proszę o sprawdzenie - wysokie pingi

[PanKrolik]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 11:48:21, on 2007-04-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\INTERIAPL\Stefan\Stefan.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ja\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O1 - Hosts: 82.146.225.105 l2authd.lineage2.com
O1 - Hosts: 82.146.225.105 l2testauthd.lineage2.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Program Files\VideoCompressionCodec\isaddon.dll (file missing)
O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\VideoCompressionCodec\iesplugin.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=042007 serial=DR12WTX-9999998-YSP lang=EN
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Stefan] C:\Program Files\INTERIAPL\Stefan\Stefan.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB9E487D-9C27-41F1-98B9-0D57FD1BE87D}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe



Kod: Zaznacz wszystko

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"ccleaner" = ""C:\Program Files\CCleaner\ccleaner.exe" /AUTO" ["CCleaner.com"]
"AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"]
"Stefan" = "C:\Program Files\INTERIAPL\Stefan\Stefan.exe" ["INTERIA.PL S.A."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"F-Secure Manager" = ""C:\Program Files\F-Secure\Common\FSM32.EXE" /splash" ["F-Secure Corporation"]
"F-Secure TNB" = ""C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW" ["F-Secure Corporation"]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"DownloadAccelerator" = ""C:\Program Files\DAP\DAP.EXE" /STARTUP" ["Speedbit Ltd."]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data]
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string]
"WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"]
"WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"]
"DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."]
"snpstd" = "C:\WINDOWS\vsnpstd.exe" [empty string]
"CorelDRAW Graphics Suite 11b" = "C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=042007 serial=DR12WTX-9999998-YSP lang=EN" ["Corel Corporation"]
"RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."]
"LanguageShortcut" = ""C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"" [null data]
"PWRISOVM.EXE" = "C:\Program Files\PowerISO\PWRISOVM.EXE" ["PowerISO Computing, Inc."]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "AcroIEHlprObj Class"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."]
{7b4d79df-9ef0-429d-a0e9-d9b138c6a53b}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\VideoCompressionCodec\isaddon.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {HKLM...CLSID} = "DesktopContext Class"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
  -> {HKLM...CLSID} = "NVIDIA CPL Extension"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
  -> {HKLM...CLSID} = "Desktop Explorer"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
  -> {HKLM...CLSID} = "nView Desktop Context Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
  -> {HKLM...CLSID} = "AlcoholShellEx"
                   \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{516EC4D3-4AD9-11D5-AA6A-00E0189008B3}" = "The Core Media Player Shell Extension"
  -> {HKLM...CLSID} = "The Core Media Player Shell Extension"
                   \InProcServer32\(Default) = "C:\PROGRA~1\CORECO~1\THECOR~1\System\CORESH~1.CLL" [null data]
"{0561EC90-CE54-4f0c-9C55-E226110A740C}" = "Haali Column Provider"
  -> {HKLM...CLSID} = "Haali Column Provider"
                   \InProcServer32\(Default) = "C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll" [null data]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
  -> {HKLM...CLSID} = "Microsoft Office Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" = "PowerISO"
  -> {HKLM...CLSID} = "PowerISO"
                   \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]
"{36A21736-36C2-4C11-8ACB-D4136F2B57BD}" = "AutoCAD Digital Signatures Icon Overlay Handler"
  -> {HKLM...CLSID} = "AcSignIcon"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\AcSignIcon.dll" ["Autodesk"]
"{AC1DB655-4F9A-4c39-8AD2-A65324A4C446}" = "Autodesk Drawing Preview"
  -> {HKLM...CLSID} = "ACTHUMBNAIL"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll" ["Autodesk"]
"{6DEA92E9-8682-4b6a-97DE-354772FE5727}" = "Autodesk DWF Preview"
  -> {HKLM...CLSID} = "ACDWFTHMBPRXY"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcDwfThmbPrxy16.dll" ["Autodesk"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
  -> {HKLM...CLSID} = "iTunes"
                   \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{0561EC90-CE54-4f0c-9C55-E226110A740C}\(Default) = "Haali Column Provider"
  -> {HKLM...CLSID} = "Haali Column Provider"
                   \InProcServer32\(Default) = "C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll" [null data]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
DAP_Menu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}"
  -> {HKLM...CLSID} = "DAPMenuShellExt Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL" ["Speedbit Ltd."]
DAP_ShredMenu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}"
  -> {HKLM...CLSID} = "DAPMenuShellExt Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL" ["Speedbit Ltd."]
PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}"
  -> {HKLM...CLSID} = "PowerArchiver Shell Extensions"
                   \InProcServer32\(Default) = "C:\Program Files\PowerArchiver\PASHLEXT.DLL" ["ConeXware, Inc."]
PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"
  -> {HKLM...CLSID} = "PowerISO"
                   \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
CoreShellAgent\(Default) = "{516EC4D3-4AD9-11D5-AA6A-00E0189008B3}"
  -> {HKLM...CLSID} = "The Core Media Player Shell Extension"
                   \InProcServer32\(Default) = "C:\PROGRA~1\CORECO~1\THECOR~1\System\CORESH~1.CLL" [null data]
DAP_ShredMenu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}"
  -> {HKLM...CLSID} = "DAPMenuShellExt Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL" ["Speedbit Ltd."]
PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"
  -> {HKLM...CLSID} = "PowerISO"
                   \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}"
  -> {HKLM...CLSID} = "PowerArchiver Shell Extensions"
                   \InProcServer32\(Default) = "C:\Program Files\PowerArchiver\PASHLEXT.DLL" ["ConeXware, Inc."]
PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"
  -> {HKLM...CLSID} = "PowerISO"
                   \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]


Default executables:
--------------------

HKCU\Software\Classes\.scr\(Default) = "AutoCADScriptFile"
<<!>> HKCU\Software\Classes\AutoCADScriptFile\shell\open\command\(Default) = ""C:\WINDOWS\notepad.exe" "%1"" [MS]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Ja\Dane aplikacji\IrfanView\IrfanView_Wallpaper.bmp"


Startup items in "Ja" & "All Users" startup folders:
----------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"AutoCAD Startup Accelerator" -> shortcut to: "C:\Program Files\Common Files\Autodesk Shared\acstart16.exe" [null data]
"F-Secure Automatic Update" -> shortcut to: "C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe -startup" ["F-Secure Automatic Update"]


Enabled Scheduled Tasks:
------------------------

"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task" ["Apple Computer, Inc."]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\Program Files\F-Secure\FSPS\program\FSLSP.DLL ["F-Secure Corporation"], 01 - 02, 08
%SystemRoot%\system32\mswsock.dll [MS], 03 - 05, 09 - 22
%SystemRoot%\system32\rsvpsp.dll [MS], 06 - 07


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{8AED5DF3-6E0B-4930-B1A5-F8AA8D757497}"
  -> {HKLM...CLSID} = "Protection Bar"
                   \InProcServer32\(Default) = "C:\Program Files\VideoCompressionCodec\iesplugin.dll" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{8AED5DF3-6E0B-4930-B1A5-F8AA8D757497}" = (no title provided)
  -> {HKLM...CLSID} = "Protection Bar"
                   \InProcServer32\(Default) = "C:\Program Files\VideoCompressionCodec\iesplugin.dll" [file not found]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{8AED5DF3-6E0B-4930-B1A5-F8AA8D757497}\(Default) = "Protection Bar"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\VideoCompressionCodec\iesplugin.dll" [file not found]

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}"
  -> {HKCU...CLSID} = "Java Plug-in 1.5.0_11"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."]
  -> {HKLM...CLSID} = "Java Plug-in 1.5.0_11"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."]

{300DB664-75B5-47C0-8B45-A44ACCF73C00}\
"ButtonText" = "IE Shield"
"MenuText" = "IE Shield..."
"CLSIDExtension" = "{0928F506-07E8-470c-979D-147C296D4879}"
  -> {HKLM...CLSID} = "F-Secure IE Shield COM button"
                   \InProcServer32\(Default) = "C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll" ["F-Secure Corporation"]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided)
  -> {HKLM...CLSID} = "Search Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string]


HOSTS file
----------

C:\WINDOWS\System32\drivers\etc\HOSTS

maps: 3 domain names to IP addresses,
      2 of the IP addresses are *not* localhost!

[wojtas]

odpal SmitfraudFix z opcji 2

http://siri.urz.free.fr/Fix/SmitfraudFix.php
opis >>

http://forum.programosy.pl/trudne-przypadki-i-metody-usuwania-vt41947.html

i przejedź nim dysk


log z silenta jest urwany potem wklej caly z HJ oraz silenta

[PanKrolik]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 12:27:53, on 2007-04-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\INTERIAPL\Stefan\Stefan.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Ja\Pulpit\hijackthis_199\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O1 - Hosts: 82.146.225.105 l2authd.lineage2.com
O1 - Hosts: 82.146.225.105 l2testauthd.lineage2.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=042007 serial=DR12WTX-9999998-YSP lang=EN
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Stefan] C:\Program Files\INTERIAPL\Stefan\Stefan.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB9E487D-9C27-41F1-98B9-0D57FD1BE87D}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"ccleaner" = ""C:\Program Files\CCleaner\ccleaner.exe" /AUTO" ["CCleaner.com"]
"AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"]
"Stefan" = "C:\Program Files\INTERIAPL\Stefan\Stefan.exe" ["INTERIA.PL S.A."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"F-Secure Manager" = ""C:\Program Files\F-Secure\Common\FSM32.EXE" /splash" ["F-Secure Corporation"]
"F-Secure TNB" = ""C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW" ["F-Secure Corporation"]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"DownloadAccelerator" = ""C:\Program Files\DAP\DAP.EXE" /STARTUP" ["Speedbit Ltd."]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data]
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string]
"WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"]
"WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"]
"DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."]
"snpstd" = "C:\WINDOWS\vsnpstd.exe" [empty string]
"CorelDRAW Graphics Suite 11b" = "C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=042007 serial=DR12WTX-9999998-YSP lang=EN" ["Corel Corporation"]
"RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."]
"LanguageShortcut" = ""C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"" [null data]
"PWRISOVM.EXE" = "C:\Program Files\PowerISO\PWRISOVM.EXE" ["PowerISO Computing, Inc."]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "AcroIEHlprObj Class"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {HKLM...CLSID} = "DesktopContext Class"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
  -> {HKLM...CLSID} = "NVIDIA CPL Extension"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
  -> {HKLM...CLSID} = "Desktop Explorer"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
  -> {HKLM...CLSID} = "nView Desktop Context Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
  -> {HKLM...CLSID} = "AlcoholShellEx"
                   \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{516EC4D3-4AD9-11D5-AA6A-00E0189008B3}" = "The Core Media Player Shell Extension"
  -> {HKLM...CLSID} = "The Core Media Player Shell Extension"
                   \InProcServer32\(Default) = "C:\PROGRA~1\CORECO~1\THECOR~1\System\CORESH~1.CLL" [null data]
"{0561EC90-CE54-4f0c-9C55-E226110A740C}" = "Haali Column Provider"
  -> {HKLM...CLSID} = "Haali Column Provider"
                   \InProcServer32\(Default) = "C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll" [null data]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
  -> {HKLM...CLSID} = "Microsoft Office Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" = "PowerISO"
  -> {HKLM...CLSID} = "PowerISO"
                   \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]
"{36A21736-36C2-4C11-8ACB-D4136F2B57BD}" = "AutoCAD Digital Signatures Icon Overlay Handler"
  -> {HKLM...CLSID} = "AcSignIcon"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\AcSignIcon.dll" ["Autodesk"]
"{AC1DB655-4F9A-4c39-8AD2-A65324A4C446}" = "Autodesk Drawing Preview"
  -> {HKLM...CLSID} = "ACTHUMBNAIL"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll" ["Autodesk"]
"{6DEA92E9-8682-4b6a-97DE-354772FE5727}" = "Autodesk DWF Preview"
  -> {HKLM...CLSID} = "ACDWFTHMBPRXY"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcDwfThmbPrxy16.dll" ["Autodesk"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
  -> {HKLM...CLSID} = "iTunes"
                   \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{0561EC90-CE54-4f0c-9C55-E226110A740C}\(Default) = "Haali Column Provider"
  -> {HKLM...CLSID} = "Haali Column Provider"
                   \InProcServer32\(Default) = "C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll" [null data]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
DAP_Menu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}"
  -> {HKLM...CLSID} = "DAPMenuShellExt Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL" ["Speedbit Ltd."]
DAP_ShredMenu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}"
  -> {HKLM...CLSID} = "DAPMenuShellExt Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL" ["Speedbit Ltd."]
PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}"
  -> {HKLM...CLSID} = "PowerArchiver Shell Extensions"
                   \InProcServer32\(Default) = "C:\Program Files\PowerArchiver\PASHLEXT.DLL" ["ConeXware, Inc."]
PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"
  -> {HKLM...CLSID} = "PowerISO"
                   \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
CoreShellAgent\(Default) = "{516EC4D3-4AD9-11D5-AA6A-00E0189008B3}"
  -> {HKLM...CLSID} = "The Core Media Player Shell Extension"
                   \InProcServer32\(Default) = "C:\PROGRA~1\CORECO~1\THECOR~1\System\CORESH~1.CLL" [null data]
DAP_ShredMenu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}"
  -> {HKLM...CLSID} = "DAPMenuShellExt Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL" ["Speedbit Ltd."]
PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"
  -> {HKLM...CLSID} = "PowerISO"
                   \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}"
  -> {HKLM...CLSID} = "PowerArchiver Shell Extensions"
                   \InProcServer32\(Default) = "C:\Program Files\PowerArchiver\PASHLEXT.DLL" ["ConeXware, Inc."]
PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"
  -> {HKLM...CLSID} = "PowerISO"
                   \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]


Default executables:
--------------------

HKCU\Software\Classes\.scr\(Default) = "AutoCADScriptFile"
<<!>> HKCU\Software\Classes\AutoCADScriptFile\shell\open\command\(Default) = ""C:\WINDOWS\notepad.exe" "%1"" [MS]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Startup items in "Ja" & "All Users" startup folders:
----------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"AutoCAD Startup Accelerator" -> shortcut to: "C:\Program Files\Common Files\Autodesk Shared\acstart16.exe" [null data]
"F-Secure Automatic Update" -> shortcut to: "C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe -startup" ["F-Secure Automatic Update"]


Enabled Scheduled Tasks:
------------------------

"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task" ["Apple Computer, Inc."]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\Program Files\F-Secure\FSPS\program\FSLSP.DLL ["F-Secure Corporation"], 01 - 02, 08
%SystemRoot%\system32\mswsock.dll [MS], 03 - 05, 09 - 22
%SystemRoot%\system32\rsvpsp.dll [MS], 06 - 07


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}"
  -> {HKCU...CLSID} = "Java Plug-in 1.5.0_11"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."]
  -> {HKLM...CLSID} = "Java Plug-in 1.5.0_11"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."]

{300DB664-75B5-47C0-8B45-A44ACCF73C00}\
"ButtonText" = "IE Shield"
"MenuText" = "IE Shield..."
"CLSIDExtension" = "{0928F506-07E8-470c-979D-147C296D4879}"
  -> {HKLM...CLSID} = "F-Secure IE Shield COM button"
                   \InProcServer32\(Default) = "C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll" ["F-Secure Corporation"]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided)
  -> {HKLM...CLSID} = "Search Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string]


HOSTS file
----------

C:\WINDOWS\System32\drivers\etc\HOSTS

maps: 3 domain names to IP addresses,
      2 of the IP addresses are *not* localhost!


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\CyberLink\Shared files\RichVideo.exe"" [empty string]
F-Secure Anti-Virus Firewall Daemon, FSDFWD, ""C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe"" ["F-Secure Corporation"]
F-Secure Automatic Update, BackWeb Plug-in - 7681197, "C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE" ["F-Secure Automatic Update"]
F-Secure Management Agent, FSMA, ""C:\Program Files\F-Secure\Common\FSMA32.EXE"" ["F-Secure Corporation"]
F-Secure Network Request Broker, F-Secure Network Request Broker, ""C:\Program Files\F-Secure\Common\FNRB32.EXE"" ["F-Secure Corporation"]
fsbwsys, fsbwsys, ""C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe"" ["F-Secure Corp."]
FSGKHS, F-Secure Gatekeeper Handler Starter, ""C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe"" ["F-Secure Corp."]
iPod Service, iPod Service, ""C:\Program Files\iPod\bin\iPodService.exe"" ["Apple Inc."]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
PnkBstrA, PnkBstrA, "C:\WINDOWS\system32\PnkBstrA.exe" [null data]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]


----------
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 67 seconds.
---------- (total run time: 114 seconds)


[wojtas]

start>urchom> wpisz msconfig> zakladka uruchamianie> wylacz progsy ktore nie chcesz zeby startowaly z systemem bedzie Ci sie komp szybciej wlaczal":

daj loga comboscana:

http://www.techsupportforum.com/sectools/Deckard/comboscan.exe

[PanKrolik]

Kod: Zaznacz wszystko

ComboScan v20070306.20 run by Ja on 2007-04-05 at 13:06:08
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created ComboScan Restore Point.


-- Last 5 Restore Point(s) --
30: 2007-04-05 11:06:26 UTC - RP168 - ComboScan Restore Point
29: 2007-04-02 07:54:10 UTC - RP167 - Installed Command & Conquer 3.
28: 2007-04-01 20:32:13 UTC - RP166 - Punkt kontrolny systemu
27: 2007-03-31 19:52:10 UTC - RP165 - Punkt kontrolny systemu
26: 2007-03-30 18:32:35 UTC - RP164 - Punkt kontrolny systemu


-- First Restore Point --
1: 2007-03-03 17:14:33 UTC - RP139 - Punkt kontrolny systemu


Performed disk cleanup.


-- HijackThis (run as Ja.exe) --------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 13:06:35, on 2007-04-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\INTERIAPL\Stefan\Stefan.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ja\Pulpit\comboscan.exe
C:\DOCUME~1\Ja\Pulpit\HIJACK~1\Ja.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O1 - Hosts: 82.146.225.105 l2authd.lineage2.com
O1 - Hosts: 82.146.225.105 l2testauthd.lineage2.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=042007 serial=DR12WTX-9999998-YSP lang=EN
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Stefan] C:\Program Files\INTERIAPL\Stefan\Stefan.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB9E487D-9C27-41F1-98B9-0D57FD1BE87D}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe


-- File Associations -----------------------------------------------------------

.bat - batfile - "%1" %*
.chm - chm.file - "C:\WINDOWS\hh.exe" %1
.cmd - cmdfile - "%1" %*
.com - comfile - "%1" %*
.exe - exefile - "%1" %*
.hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1
.inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1
.ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1
.js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %*
.lnk - lnkfile - {00021401-0000-0000-C000-000000000046}
.pif - piffile - "%1" %*
.reg - regfile - regedit.exe "%1"
[COLOR=red].scr - AutoCADScriptFile - "C:\WINDOWS\notepad.exe" "%1"[/COLOR]
.txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1
.vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

0R a347bus - C:\WINDOWS\system32\drivers\a347bus.sys
0R a347scsi - C:\WINDOWS\system32\drivers\a347scsi.sys
3R alcan5wn (SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)) - C:\WINDOWS\system32\drivers\alcan5wn.sys
3R alcaudsl (SpeedTouch ADSL Modem ATM Transport) - C:\WINDOWS\system32\drivers\alcaudsl.sys
3R ALCXWDM (Service for Realtek AC97 Audio (WDM)) - C:\WINDOWS\system32\drivers\ALCXWDM.SYS
3S CCDECODE (Dekoder napisów) - C:\WINDOWS\system32\drivers\CCDECODE.sys
0S d344prt - C:\WINDOWS\system32\Drivers\d344prt.sys (not found)
3R dtscsi - C:\WINDOWS\system32\drivers\dtscsi.sys
3S EagleNT - C:\WINDOWS\system32\drivers\EagleNT.sys (not found)
2R F-Secure Filter (F-Secure File System Filter) - C:\Program Files\F-Secure\Anti-Virus\win2k\FSfilter.sys
2R F-Secure Gatekeeper - C:\Program Files\F-Secure\Anti-Virus\win2k\fsgk.sys
2R F-Secure Recognizer (F-Secure File System Recognizer) - C:\Program Files\F-Secure\Anti-Virus\win2k\FSrec.sys
0R FSFW (F-Secure Firewall Driver) - C:\WINDOWS\system32\drivers\fsdfw.sys
3R GEARAspiWDM - C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
3S hamachi (Hamachi Network Interface) - C:\WINDOWS\system32\drivers\hamachi.sys
3R hidusb (Sterownik Microsoft klasy HID) - C:\WINDOWS\system32\drivers\hidusb.sys
1R intelppm (Sterownik procesora Intel) - C:\WINDOWS\system32\drivers\intelppm.sys
3R mouhid (Sterownik myszy HID) - C:\WINDOWS\system32\drivers\mouhid.sys
3S MSTEE (Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming) - C:\WINDOWS\system32\drivers\MSTEE.sys
3S NABTSFEC (Koder-dekoder NABTS/FEC VBI) - C:\WINDOWS\system32\drivers\NABTSFEC.sys
3S NdisIP (Połączenie TV/wideo firmy Microsoft) - C:\WINDOWS\system32\drivers\NdisIP.sys
3S npkcrypt - D:\Gry\Lineage II\system\npkcrypt.sys
3S NTProcDrv (Process creation detector for NT.) - C:\Documents and Settings\Ja\Pulpit\bot\NtProcDrv.sys (not found)
3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys
1R oreans32 - C:\WINDOWS\system32\drivers\oreans32.sys
0R PxHelp20 - C:\WINDOWS\system32\drivers\PxHelp20.sys
1R SCDEmu - C:\WINDOWS\system32\drivers\scdemu.sys
3S SLIP (BDA Slip De-Framer) - C:\WINDOWS\system32\drivers\SLIP.sys
3S snpstd (Trust 150 Spacecam Portable) - C:\WINDOWS\system32\drivers\snpstd.sys
0R sptd - C:\WINDOWS\system32\drivers\sptd.sys
3S streamip (BDA IPSink) - C:\WINDOWS\system32\drivers\StreamIP.sys
3R usbehci (Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft) - C:\WINDOWS\system32\drivers\usbehci.sys
3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS
1R WS2IFSL (Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0) - C:\WINDOWS\system32\drivers\ws2ifsl.sys
3S WSTCODEC (Kodery-dekodery teletekstu w standardzie światowym) - C:\WINDOWS\system32\drivers\WSTCODEC.SYS
3R yukonwxp (NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller) - C:\WINDOWS\system32\drivers\yk51x86.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

3S aspnet_state (ASP.NET State Service) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
3S Autodesk Licensing Service - "C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"
2R BackWeb Plug-in - 7681197 (F-Secure Automatic Update) - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
3S clr_optimization_v2.0.50727_32 (.NET Runtime Optimization Service v2.0.50727_X86) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
2R F-Secure Gatekeeper Handler Starter (FSGKHS) - "C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe"
3R F-Secure Network Request Broker - "C:\Program Files\F-Secure\Common\FNRB32.EXE"
2R fsbwsys - "C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe"
3R FSDFWD (F-Secure Anti-Virus Firewall Daemon) - "C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe"
2R FSMA (F-Secure Management Agent) - "C:\Program Files\F-Secure\Common\FSMA32.EXE"
3S IDriverT (InstallDriver Table Manager) - "C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe"
4R iPod Service - "C:\Program Files\iPod\bin\iPodService.exe"
2R NVSvc (NVIDIA Display Driver Service) - C:\WINDOWS\system32\nvsvc32.exe
4S ose (Office Source Engine) - "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
2R PnkBstrA - C:\WINDOWS\system32\PnkBstrA.exe
3S PnkBstrB - C:\WINDOWS\system32\PnkBstrB.exe
2R RichVideo (Cyberlink RichVideo Service(CRVS)) - "C:\Program Files\CyberLink\Shared files\RichVideo.exe"
2R UMWdf (Windows User Mode Driver Framework) - C:\WINDOWS\system32\wdfmgr.exe
3S usprserv (User Privilege Service) - C:\WINDOWS\System32\svchost.exe -k netsvcs


-- Scheduled Tasks -------------------------------------------------------------

2007-03-30 07:13:16       284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job<APPLES~1.JOB>


-- Files created between 2007-03-05 and 2007-04-05 -----------------------------

2007-04-05 12:19:29      4108 --a------ C:\WINDOWS\system32\tmp.reg
2007-04-04 16:52:57     26896 --a------ C:\WINDOWS\system32\hh.exe
2007-04-04 16:52:56    154624 --a------ C:\WINDOWS\system32\Glut32.dll
2007-04-04 16:52:56         0 d-------- C:\Program Files\CombatSnake<COMBAT~1>
2007-04-04 15:55:34         0 d-------- C:\Program Files\Bontago
2007-04-04 15:03:21         0 d-------- C:\Program Files\Widelands<WIDELA~1>
2007-04-03 17:02:42         0 d-------- C:\Program Files\Freeciv-2.1.0-beta3-gtk2<FREECI~1.0-B>
2007-04-02 10:02:15   3426072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-03-31 11:15:57         0 d-------- C:\Program Files\HEROES3
2007-03-31 10:58:37    122884 --a------ C:\WINDOWS\UnGins.exe
2007-03-29 12:05:39     99904 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-03-29 11:55:26         0 d-------- C:\WINDOWS\system32\LogFiles
2007-03-29 11:55:23     63040 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-03-14 16:41:52         0 d-------- C:\Program Files\iPod
2007-03-14 16:41:45         0 d-------- C:\Program Files\iTunes
2007-03-14 16:40:37         0 d-------- C:\Program Files\QuickTime<QUICKT~1>


-- Find3M Report ---------------------------------------------------------------

2007-04-05 13:02:31         0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-05 12:30:24    458022 --a------ C:\WINDOWS\system32\perfh015.dat
2007-04-05 12:30:24     79408 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-05 12:26:23         0 d-------- C:\Program Files\AutoConnect<AUTOCO~1>
2007-04-05 12:09:10         0 d-------- C:\Program Files\Neostrada TP<NEOSTR~1>
2007-04-05 08:43:20         0 d-------- C:\Documents and Settings\Ja\Dane aplikacji\teamspeak2<TEAMSP~1>
2007-04-04 22:45:25         0 d-------- C:\Documents and Settings\Ja\Dane aplikacji\Hamachi
2007-04-03 20:30:02         0 d-------- C:\Documents and Settings\Ja\Dane aplikacji\Skype
2007-04-03 11:01:41         0 d-------- C:\Documents and Settings\Ja\Dane aplikacji\Azureus
2007-04-02 16:27:14         0 d-------- C:\Documents and Settings\Ja\Dane aplikacji\Command & Conquer 3 Tiberium Wars<COMMAN~1>
2007-03-20 22:50:11         0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-16 09:12:33    108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll<CMDLIN~1.DLL>
2007-03-14 16:39:34         0 d-------- C:\Program Files\Apple Software Update<APPLES~1>
2007-03-06 21:51:32         0 d-------- C:\Program Files\Azureus
2007-03-05 09:28:17         0 d-------- C:\Program Files\Java
2007-03-01 17:57:11         0 d-------- C:\Documents and Settings\Ja\Dane aplikacji\Autodesk
2007-03-01 17:56:34         0 d---s---- C:\Documents and Settings\Ja\Dane aplikacji\Microsoft<MICROS~1>
2007-03-01 17:54:39         0 d-------- C:\Program Files\Autodesk
2007-03-01 17:54:36         0 d-------- C:\Program Files\Common Files\Autodesk Shared<AUTODE~1>
2007-03-01 17:54:16         0 d-------- C:\Program Files\AutoCAD 2005<AUTOCA~1>
2007-03-01 17:53:31         0 d-------- C:\Program Files\AnswerWorks 4.0<ANSWER~1.0>
2007-02-08 20:48:46         0 d-------- C:\Program Files\PowerISO
2007-02-06 17:23:47         0 d-------- C:\Documents and Settings\Ja\Dane aplikacji\Xfire
2007-02-05 11:39:59         0 d-------- C:\Documents and Settings\Ja\Dane aplikacji\CyberLink<CYBERL~1>
2007-02-05 11:39:21         0 d-------- C:\Program Files\CyberLink<CYBERL~1>
2007-02-03 01:37:48      1682 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-02-03 01:37:48        56 -r-hs---- C:\WINDOWS\system32\9DD41F3B57.sys<9DD41F~1.SYS>


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"ccleaner"="\"C:\\Program Files\\CCleaner\\ccleaner.exe\" /AUTO"
"AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe"
"Stefan"="C:\\Program Files\\INTERIAPL\\Stefan\\Stefan.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"F-Secure Manager"="\"C:\\Program Files\\F-Secure\\Common\\FSM32.EXE\" /splash"
"F-Secure TNB"="\"C:\\Program Files\\F-Secure\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"SoundMan"="SOUNDMAN.EXE"
"DownloadAccelerator"="\"C:\\Program Files\\DAP\\DAP.EXE\" /STARTUP"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"CorelDRAW Graphics Suite 11b"="C:\\Program Files\\Corel\\Corel Graphics 12\\Languages\\EN\\Programs\\Registration.exe /title=\"CorelDRAW Graphics Suite 12\" /date=042007 serial=DR12WTX-9999998-YSP lang=EN"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"LanguageShortcut"="\"C:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\""
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^AutoCAD Startup Accelerator.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\AutoCAD Startup Accelerator.lnk"
"backup"="C:\\WINDOWS\\pss\\AutoCAD Startup Accelerator.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\AUTODE~1\\ACSTAR~1.EXE "
"item"="AutoCAD Startup Accelerator"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="daemon"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PWRISOVM"
"hkey"="HKLM"
"command"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="vsnpstd"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\vsnpstd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CnxMon"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TaskbarIcon"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Watch"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=dword:00000003
"iPod Service"=dword:00000003
   

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter   REG_MULTI_SZ      HTTPFilter\0\0
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
DcomLaunch   REG_MULTI_SZ      DcomLaunch\0TermService\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0



-- Hosts -----------------------------------------------------------------------

82.146.225.105 l2authd.lineage2.com
82.146.225.105 l2testauthd.lineage2.com


-- End of ComboScan: finished at 2007-04-05 at 13:06:59 ------------------------



[wojtas]

skasuj ten plik w trybie awaryjnym z wylaczonym przywracaniem systemu:

C:\WINDOWS\system32\tmp.reg

a ten plik:

C:\WINDOWS\system32\9DD41F3B57.sys

przeskanuj tymi skanerami i wklej wynik

http://virusscan.jotti.org/
http://www.virustotal.com/en/indexf.html

[PanKrolik]

Plik:

Kod: Zaznacz wszystko

C:\WINDOWS\system32\tmp.reg

skasowałem, ale co do pliku:

Kod: Zaznacz wszystko

C:\WINDOWS\system32\9DD41F3B57.sys

to jest problem ponieważ go nie ma. Przeszukałem cały dysk C i go nie znalazło.

[wojtas]

on jest ukrytym plikiem wiec daj :

narzedzia>opcje folderow> widok >zaznacz opcje pokaz ukryte pliki i foldery

[PanKrolik]

Domyśliłem się... Mam zaznaczoną opcje pokazywania wszystkich plików i... nic

[wojtas]

w logu juz nic nie ma

Autor postu otrzymał pochwałę

[PanKrolik]

Hmmm a co z tym plikiem? To coś oznacza skoro go nie ma?

[ Dodano: Dzisiaj o 18:55 ]
Witam Ponownie... Zrobiłem format C:/ zainstalowałem czysty system, grę i... nadal mam pingi ponad 200... Reszta działa sprawnie. Można prosić o ponowne sprawdzenie logów:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 18:43:41, on 2007-04-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Piotr\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Accelerate] C:\Program Files\Webroot\Accelerate\accelerate.exe /S
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{E597ECB2-B897-4F0F-9864-1FEE1015FE7E}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"F-Secure Manager" = ""C:\Program Files\F-Secure\Common\FSM32.EXE" /splash" ["F-Secure Corporation"]
"F-Secure TNB" = ""C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW" ["F-Secure Corporation"]
"WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string]
"WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"]
"WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"]
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"Accelerate" = "C:\Program Files\Webroot\Accelerate\accelerate.exe /S" ["Webroot Software, Inc."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {HKLM...CLSID} = "DesktopContext Class"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
  -> {HKLM...CLSID} = "NVIDIA CPL Extension"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
  -> {HKLM...CLSID} = "Desktop Explorer"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
  -> {HKLM...CLSID} = "nView Desktop Context Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}"
  -> {HKLM...CLSID} = "PowerArchiver Shell Extensions"
                   \InProcServer32\(Default) = "C:\Program Files\PowerArchiver\PASHLEXT.DLL" ["ConeXware, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}"
  -> {HKLM...CLSID} = "PowerArchiver Shell Extensions"
                   \InProcServer32\(Default) = "C:\Program Files\PowerArchiver\PASHLEXT.DLL" ["ConeXware, Inc."]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Startup items in "Piotr" & "All Users" startup folders:
-------------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"F-Secure Automatic Update" -> shortcut to: "C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe -startup" ["F-Secure Automatic Update"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\Program Files\F-Secure\FSPS\program\FSLSP.DLL ["F-Secure Corporation"], 01 - 02, 08
%SystemRoot%\system32\mswsock.dll [MS], 03 - 05, 09 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 06 - 07


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{300DB664-75B5-47C0-8B45-A44ACCF73C00}\
"ButtonText" = "IE Shield"
"MenuText" = "IE Shield..."
"CLSIDExtension" = "{0928F506-07E8-470c-979D-147C296D4879}"
  -> {HKLM...CLSID} = "F-Secure IE Shield COM button"
                   \InProcServer32\(Default) = "C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll" ["F-Secure Corporation"]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided)
  -> {HKLM...CLSID} = "Search Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

F-Secure Anti-Virus Firewall Daemon, FSDFWD, ""C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe"" ["F-Secure Corporation"]
F-Secure Automatic Update, BackWeb Plug-in - 7681197, "C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE" ["F-Secure Automatic Update"]
F-Secure Management Agent, FSMA, ""C:\Program Files\F-Secure\Common\FSMA32.EXE"" ["F-Secure Corporation"]
F-Secure Network Request Broker, F-Secure Network Request Broker, ""C:\Program Files\F-Secure\Common\FNRB32.EXE"" ["F-Secure Corporation"]
fsbwsys, fsbwsys, ""C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe"" ["F-Secure Corp."]
FSGKHS, F-Secure Gatekeeper Handler Starter, ""C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe"" ["F-Secure Corp."]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]


----------
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 37 seconds.
---------- (total run time: 71 seconds)

[wojtas]

w logach nic nie ma

[PanKrolik]

Kurcze to ja juz nie wiem... zna ktos powód dla ktorego moze sie tak dziac?

[wojtas]

sciagnij gmera:

http://gmer.net/gmer.zip

1) Rootkit >>> zaznaczone Pokaż wszystko >>> wskazane tylko Usługi >>> Szukaj >>> Kopiuj >>> CTRL+V do posta
2) Rootkit >>> odznaczone Pokaż wszystko >>> wskazane wszystkie obiekty do skanu >>> Szukaj >>> Kopiuj >>> CTRL+V do posta

[PanKrolik]

Kod: Zaznacz wszystko

GMER 1.0.12.12086 - http://www.gmer.net
Rootkit scan 2007-04-05 19:23:28
Windows 5.1.2600 Dodatek Service Pack 2


---- Services - GMER 1.0.12 ----

Service                                                                 [DISABLED] Abiosdsk
Service                                                                 [DISABLED] abp480n5
Service  C:\WINDOWS\system32\DRIVERS\ACPI.sys                           [BOOT] ACPI
Service                                                                 [DISABLED] ACPIEC
Service                                                                 [DISABLED] adpu160m
Service  C:\WINDOWS\system32\drivers\aec.sys                            [MANUAL] aec
Service  C:\WINDOWS\System32\drivers\afd.sys                            [SYSTEM] AFD
Service                                                                 [DISABLED] Aha154x
Service                                                                 [DISABLED] aic78u2
Service                                                                 [DISABLED] aic78xx
Service  C:\WINDOWS\system32\DRIVERS\alcan5wn.sys                       [MANUAL] alcan5wn
Service  C:\WINDOWS\system32\DRIVERS\alcaudsl.sys                       [MANUAL] alcaudsl
Service  C:\WINDOWS\system32\drivers\ALCXWDM.SYS                        [MANUAL] ALCXWDM
Service  C:\WINDOWS\system32\svchost.exe                                [DISABLED] Alerter
Service  C:\WINDOWS\System32\alg.exe                                    [MANUAL] ALG
Service                                                                 [DISABLED] AliIde
Service                                                                 [DISABLED] amsint
Service  C:\WINDOWS\system32\svchost.exe                                [MANUAL] AppMgmt
Service                                                                 [DISABLED] asc
Service                                                                 [DISABLED] asc3350p
Service                                                                 [DISABLED] asc3550
Service  C:\WINDOWS\system32\DRIVERS\asyncmac.sys                       [MANUAL] AsyncMac
Service  C:\WINDOWS\system32\DRIVERS\atapi.sys                          [BOOT] atapi
Service                                                                 [DISABLED] Atdisk
Service  C:\WINDOWS\system32\DRIVERS\atmarpc.sys                        [MANUAL] Atmarpc
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] AudioSrv
Service  C:\WINDOWS\system32\DRIVERS\audstub.sys                        [MANUAL] audstub
Service  C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE      [AUTO] BackWeb Plug-in - 7681197
Service                                                                 BattC
Service                                                                 [SYSTEM] Beep
Service  C:\WINDOWS\system32\svchost.exe                                [MANUAL] BITS
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] Browser
Service                                                                 [DISABLED] cbidf2k
Service                                                                 [DISABLED] cd20xrnt
Service                                                                 [SYSTEM] Cdaudio
Service                                                                 [DISABLED] Cdfs
Service  C:\WINDOWS\system32\DRIVERS\cdrom.sys                          [SYSTEM] Cdrom
Service                                                                 [SYSTEM] Changer
Service  C:\WINDOWS\system32\cisvc.exe                                  [MANUAL] CiSvc
Service  C:\WINDOWS\system32\clipsrv.exe                                [DISABLED] ClipSrv
Service                                                                 [DISABLED] CmdIde
Service  C:\WINDOWS\system32\dllhost.exe                                [MANUAL] COMSysApp
Service                                                                 ContentFilter
Service                                                                 ContentIndex
Service                                                                 [DISABLED] Cpqarray
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] CryptSvc
Service                                                                 [DISABLED] dac2w2k
Service                                                                 [DISABLED] dac960nt
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] DcomLaunch
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] Dhcp
Service  C:\WINDOWS\system32\DRIVERS\disk.sys                           [BOOT] Disk
Service  C:\WINDOWS\System32\dmadmin.exe                                [MANUAL] dmadmin
Service  C:\WINDOWS\System32\drivers\dmboot.sys                         [DISABLED] dmboot
Service  C:\WINDOWS\System32\drivers\dmio.sys                           [BOOT] dmio
Service  C:\WINDOWS\System32\drivers\dmload.sys                         [BOOT] dmload
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] dmserver
Service  C:\WINDOWS\system32\drivers\DMusic.sys                         [MANUAL] DMusic
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] Dnscache
Service                                                                 [DISABLED] dpti2o
Service  C:\WINDOWS\system32\drivers\drmkaud.sys                        [MANUAL] drmkaud
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] ERSvc
Service  C:\WINDOWS\system32\services.exe                               [AUTO] Eventlog
Service  C:\WINDOWS\system32\svchost.exe                                [MANUAL] EventSystem
Service  C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys        [AUTO] F-Secure Filter
Service  C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys            [AUTO] F-Secure Gatekeeper
Service  C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe              [AUTO] F-Secure Gatekeeper Handler Starter
Service  C:\Program Files\F-Secure\Common\FNRB32.EXE                    [MANUAL] F-Secure Network Request Broker
Service  C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys           [AUTO] F-Secure Recognizer
Service                                                                 [DISABLED] Fastfat
Service  C:\WINDOWS\System32\svchost.exe                                [MANUAL] FastUserSwitchingCompatibility
Service  C:\WINDOWS\system32\DRIVERS\fdc.sys                            [MANUAL] Fdc
Service                                                                 [SYSTEM] Fips
Service  C:\WINDOWS\system32\DRIVERS\flpydisk.sys                       [MANUAL] Flpydisk
Service  C:\WINDOWS\system32\DRIVERS\fltMgr.sys                         [BOOT] FltMgr
Service  C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe  [AUTO] fsbwsys
Service  C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe              [MANUAL] FSDFWD
Service  C:\WINDOWS\System32\drivers\fsdfw.sys                          [BOOT] FSFW
Service  C:\Program Files\F-Secure\Common\FSMA32.EXE                    [AUTO] FSMA
Service                                                                 [SYSTEM] Fs_Rec
Service  C:\WINDOWS\system32\DRIVERS\ftdisk.sys                         [BOOT] Ftdisk
Service  C:\WINDOWS\System32\DRIVERS\gmer.sys                           [MANUAL] gmer
Service  C:\WINDOWS\system32\DRIVERS\msgpc.sys                          [MANUAL] Gpc
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] helpsvc
Service  C:\WINDOWS\System32\svchost.exe                                [DISABLED] HidServ
Service  C:\WINDOWS\system32\DRIVERS\hidusb.sys                         [MANUAL] hidusb
Service                                                                 [DISABLED] hpn
Service  C:\WINDOWS\System32\Drivers\HTTP.sys                           [MANUAL] HTTP
Service  C:\WINDOWS\System32\svchost.exe                                [MANUAL] HTTPFilter
Service                                                                 [SYSTEM] i2omgmt
Service                                                                 [DISABLED] i2omp
Service  C:\WINDOWS\system32\DRIVERS\i8042prt.sys                       [SYSTEM] i8042prt
Service  C:\WINDOWS\system32\DRIVERS\imapi.sys                          [SYSTEM] Imapi
Service  C:\WINDOWS\system32\imapi.exe                                  [MANUAL] ImapiService
Service                                                                 inetaccs
Service                                                                 [DISABLED] ini910u
Service                                                                 Inport
Service  C:\WINDOWS\system32\DRIVERS\intelide.sys                       [BOOT] IntelIde
Service  C:\WINDOWS\system32\DRIVERS\intelppm.sys                       [SYSTEM] intelppm
Service  C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys                          [MANUAL] Ip6Fw
Service  C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys                       [MANUAL] IpFilterDriver
Service  C:\WINDOWS\system32\DRIVERS\ipinip.sys                         [MANUAL] IpInIp
Service  C:\WINDOWS\system32\DRIVERS\ipnat.sys                          [MANUAL] IpNat
Service  C:\WINDOWS\system32\DRIVERS\ipsec.sys                          [SYSTEM] IPSec
Service  C:\WINDOWS\system32\DRIVERS\irenum.sys                         [MANUAL] IRENUM
Service                                                                 ISAPISearch
Service  C:\WINDOWS\system32\DRIVERS\isapnp.sys                         [BOOT] isapnp
Service  C:\WINDOWS\system32\DRIVERS\kbdclass.sys                       [SYSTEM] Kbdclass
Service  C:\WINDOWS\system32\drivers\kmixer.sys                         [MANUAL] kmixer
Service                                                                 [BOOT] KSecDD
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] lanmanserver
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] lanmanworkstation
Service                                                                 [SYSTEM] lbrtfdc
Service                                                                 ldap
Service                                                                 LicenseService
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] LmHosts
Service  C:\WINDOWS\system32\svchost.exe                                [DISABLED] Messenger
Service                                                                 [SYSTEM] mnmdd
Service  C:\WINDOWS\system32\mnmsrvc.exe                                [MANUAL] mnmsrvc
Service                                                                 [MANUAL] Modem
Service  C:\WINDOWS\system32\DRIVERS\mouclass.sys                       [SYSTEM] Mouclass
Service  C:\WINDOWS\system32\DRIVERS\mouhid.sys                         [MANUAL] mouhid
Service                                                                 [BOOT] MountMgr
Service                                                                 [DISABLED] mraid35x
Service  C:\WINDOWS\system32\DRIVERS\mrxdav.sys                         [MANUAL] MRxDAV
Service  C:\WINDOWS\system32\DRIVERS\mrxsmb.sys                         [SYSTEM] MRxSmb
Service  C:\WINDOWS\system32\msdtc.exe                                  [MANUAL] MSDTC
Service                                                                 [SYSTEM] Msfs
Service  C:\WINDOWS\system32\msiexec.exe                                [MANUAL] MSIServer
Service  C:\WINDOWS\system32\drivers\MSKSSRV.sys                        [MANUAL] MSKSSRV
Service  C:\WINDOWS\system32\drivers\MSPCLOCK.sys                       [MANUAL] MSPCLOCK
Service  C:\WINDOWS\system32\drivers\MSPQM.sys                          [MANUAL] MSPQM
Service  C:\WINDOWS\system32\DRIVERS\mssmbios.sys                       [MANUAL] mssmbios
Service                                                                 [BOOT] Mup
Service                                                                 [BOOT] NDIS
Service  C:\WINDOWS\system32\DRIVERS\ndistapi.sys                       [MANUAL] NdisTapi
Service  C:\WINDOWS\system32\DRIVERS\ndisuio.sys                        [MANUAL] Ndisuio
Service  C:\WINDOWS\system32\DRIVERS\ndiswan.sys                        [MANUAL] NdisWan
Service                                                                 [MANUAL] NDProxy
Service  C:\WINDOWS\system32\DRIVERS\netbios.sys                        [SYSTEM] NetBIOS
Service  C:\WINDOWS\system32\DRIVERS\netbt.sys                          [SYSTEM] NetBT
Service  C:\WINDOWS\system32\netdde.exe                                 [DISABLED] NetDDE
Service  C:\WINDOWS\system32\netdde.exe                                 [DISABLED] NetDDEdsdm
Service  C:\WINDOWS\system32\lsass.exe                                  [MANUAL] Netlogon
Service  C:\WINDOWS\System32\svchost.exe                                [MANUAL] Netman
Service  C:\WINDOWS\system32\svchost.exe                                [MANUAL] Nla
Service                                                                 [SYSTEM] Npfs
Service                                                                 [DISABLED] Ntfs
Service  C:\WINDOWS\system32\lsass.exe                                  [MANUAL] NtLmSsp
Service  C:\WINDOWS\system32\svchost.exe                                [MANUAL] NtmsSvc
Service                                                                 [SYSTEM] Null
Service  C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                       [MANUAL] nv
Service  C:\WINDOWS\system32\nvsvc32.exe                                [AUTO] NVSvc
Service  C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys                       [MANUAL] NwlnkFlt
Service  C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys                       [MANUAL] NwlnkFwd
Service  C:\WINDOWS\system32\DRIVERS\parport.sys                        [MANUAL] Parport
Service                                                                 [BOOT] PartMgr
Service                                                                 [AUTO] ParVdm
Service  C:\WINDOWS\system32\DRIVERS\pci.sys                            [BOOT] PCI
Service                                                                 [SYSTEM] PCIDump
Service  C:\WINDOWS\system32\DRIVERS\pciide.sys                         [BOOT] PCIIde
Service                                                                 [DISABLED] Pcmcia
Service                                                                 [MANUAL] PDCOMP
Service                                                                 [MANUAL] PDFRAME
Service                                                                 [MANUAL] PDRELI
Service                                                                 [MANUAL] PDRFRAME
Service                                                                 [DISABLED] perc2
Service                                                                 [DISABLED] perc2hib
Service                                                                 PerfDisk
Service                                                                 PerfNet
Service                                                                 PerfOS
Service                                                                 PerfProc
Service  C:\WINDOWS\system32\services.exe                               [AUTO] PlugPlay
Service  C:\WINDOWS\system32\lsass.exe                                  [AUTO] PolicyAgent
Service  C:\WINDOWS\system32\DRIVERS\raspptp.sys                        [MANUAL] PptpMiniport
Service  C:\WINDOWS\system32\lsass.exe                                  [AUTO] ProtectedStorage
Service  C:\WINDOWS\system32\DRIVERS\psched.sys                         [MANUAL] PSched
Service  C:\WINDOWS\system32\DRIVERS\ptilink.sys                        [MANUAL] Ptilink
Service  C:\WINDOWS\System32\Drivers\PxHelp20.sys                       [BOOT] PxHelp20
Service                                                                 [DISABLED] ql1080
Service                                                                 [DISABLED] Ql10wnt
Service                                                                 [DISABLED] ql12160
Service                                                                 [DISABLED] ql1240
Service                                                                 [DISABLED] ql1280
Service  C:\WINDOWS\system32\DRIVERS\rasacd.sys                         [SYSTEM] RasAcd
Service  C:\WINDOWS\system32\svchost.exe                                [MANUAL] RasAuto
Service  C:\WINDOWS\system32\DRIVERS\rasl2tp.sys                        [MANUAL] Rasl2tp
Service  C:\WINDOWS\system32\svchost.exe                                [MANUAL] RasMan
Service  C:\WINDOWS\system32\DRIVERS\raspppoe.sys                       [MANUAL] RasPppoe
Service  C:\WINDOWS\system32\DRIVERS\raspti.sys                         [MANUAL] Raspti
Service  C:\WINDOWS\system32\DRIVERS\rdbss.sys                          [SYSTEM] Rdbss
Service  C:\WINDOWS\System32\DRIVERS\RDPCDD.sys                         [SYSTEM] RDPCDD
Service                                                                 RDPDD
Service  C:\WINDOWS\system32\DRIVERS\rdpdr.sys                          [MANUAL] rdpdr
Service                                                                 RDPNP
Service                                                                 [MANUAL] RDPWD
Service  C:\WINDOWS\system32\sessmgr.exe                                [MANUAL] RDSessMgr
Service  C:\WINDOWS\system32\DRIVERS\redbook.sys                        [SYSTEM] redbook
Service  C:\WINDOWS\system32\svchost.exe                                [DISABLED] RemoteAccess
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] RemoteRegistry
Service  C:\WINDOWS\system32\locator.exe                                [MANUAL] RpcLocator
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] RpcSs
Service  C:\WINDOWS\system32\rsvp.exe                                   [MANUAL] RSVP
Service  C:\WINDOWS\system32\lsass.exe                                  [AUTO] SamSs
Service  C:\WINDOWS\System32\SCardSvr.exe                               [MANUAL] SCardSvr
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] Schedule
Service  C:\WINDOWS\system32\DRIVERS\secdrv.sys                         [MANUAL] Secdrv
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] seclogon
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] SENS
Service  C:\WINDOWS\system32\DRIVERS\serenum.sys                        [MANUAL] serenum
Service  C:\WINDOWS\system32\DRIVERS\serial.sys                         [SYSTEM] Serial
Service                                                                 [SYSTEM] Sfloppy
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] SharedAccess
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] ShellHWDetection
Service                                                                 [DISABLED] Simbad
Service                                                                 [DISABLED] Sparrow
Service  C:\WINDOWS\system32\drivers\splitter.sys                       [MANUAL] splitter
Service  C:\WINDOWS\system32\spoolsv.exe                                [AUTO] Spooler
Service  C:\WINDOWS\System32\Drivers\sptd.sys                           [BOOT] sptd
Service  C:\WINDOWS\system32\DRIVERS\sr.sys                             [BOOT] sr
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] srservice
Service  C:\WINDOWS\system32\DRIVERS\srv.sys                            [MANUAL] Srv
Service  C:\WINDOWS\system32\svchost.exe                                [MANUAL] SSDPSRV
Service  C:\WINDOWS\system32\svchost.exe                                [MANUAL] stisvc
Service  C:\WINDOWS\system32\DRIVERS\swenum.sys                         [MANUAL] swenum
Service  C:\WINDOWS\system32\drivers\swmidi.sys                         [MANUAL] swmidi
Service  C:\WINDOWS\system32\dllhost.exe                                [MANUAL] SwPrv
Service                                                                 [DISABLED] symc810
Service                                                                 [DISABLED] symc8xx
Service                                                                 [DISABLED] sym_hi
Service                                                                 [DISABLED] sym_u3
Service  C:\WINDOWS\system32\drivers\sysaudio.sys                       [MANUAL] sysaudio
Service  C:\WINDOWS\system32\smlogsvc.exe                               [MANUAL] SysmonLog
Service  C:\WINDOWS\System32\svchost.exe                                [MANUAL] TapiSrv
Service  C:\WINDOWS\system32\DRIVERS\tcpip.sys                          [SYSTEM] Tcpip
Service                                                                 [MANUAL] TDPIPE
Service                                                                 [MANUAL] TDTCP
Service  C:\WINDOWS\system32\DRIVERS\termdd.sys                         [SYSTEM] TermDD
Service  C:\WINDOWS\System32\svchost.exe                                [MANUAL] TermService
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] Themes
Service  C:\WINDOWS\system32\tlntsvr.exe                                [DISABLED] TlntSvr
Service                                                                 [DISABLED] TosIde
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] TrkWks
Service                                                                 TSDDD
Service                                                                 [DISABLED] Udfs
Service                                                                 [DISABLED] ultra
Service  C:\WINDOWS\system32\wdfmgr.exe                                 [AUTO] UMWdf
Service  C:\WINDOWS\system32\DRIVERS\update.sys                         [MANUAL] Update
Service  C:\WINDOWS\system32\svchost.exe                                [MANUAL] upnphost
Service  C:\WINDOWS\System32\ups.exe                                    [MANUAL] UPS
Service  C:\WINDOWS\system32\DRIVERS\usbehci.sys                        [MANUAL] usbehci
Service  C:\WINDOWS\system32\DRIVERS\usbhub.sys                         [MANUAL] usbhub
Service  C:\WINDOWS\system32\DRIVERS\usbuhci.sys                        [MANUAL] usbuhci
Service  C:\WINDOWS\System32\drivers\vga.sys                            [SYSTEM] VgaSave
Service                                                                 [DISABLED] ViaIde
Service                                                                 [BOOT] VolSnap
Service  C:\WINDOWS\System32\vssvc.exe                                  [MANUAL] VSS
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] W32Time
Service                                                                 W3SVC
Service  C:\WINDOWS\system32\DRIVERS\wanarp.sys                         [MANUAL] Wanarp
Service                                                                 [MANUAL] WDICA
Service  C:\WINDOWS\system32\drivers\wdmaud.sys                         [MANUAL] wdmaud
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] WebClient
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] winmgmt
Service                                                                 [MANUAL] Winsock
Service                                                                 WinSock2
Service                                                                 WinTrust
Service  C:\WINDOWS\System32\svchost.exe                                [MANUAL] WmdmPmSN
Service  C:\WINDOWS\System32\svchost.exe                                [MANUAL] Wmi
Service                                                                 WmiApRpl
Service  C:\WINDOWS\system32\wbem\wmiapsrv.exe                          [MANUAL] WmiApSrv
Service  C:\WINDOWS\System32\drivers\ws2ifsl.sys                        [SYSTEM] WS2IFSL
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] wscsvc
Service  C:\WINDOWS\system32\svchost.exe                                [AUTO] wuauserv
Service  C:\WINDOWS\System32\svchost.exe                                [AUTO] WZCSVC
Service  C:\WINDOWS\System32\svchost.exe                                [MANUAL] xmlprov
Service  C:\WINDOWS\system32\DRIVERS\yk51x86.sys                        [MANUAL] yukonwxp
Service                                                                 {E754189F-E10E-44E8-AFCA-32ED3A6097FB}

---- EOF - GMER 1.0.12 ----


[ Dodano: Dzisiaj o 19:40 ]
musisz cos napisac bo nie moge 2 czesci wstawic xD wiadomosc za długa xD

[wojtas]

tu jest ok

[PanKrolik]

GMER 1.0.12.12086 - http://www.gmer.net
Rootkit scan 2007-04-05 20:20:39
Windows 5.1.2600 Dodatek Service Pack 2
---- System - GMER 1.0.12 ----
SSDT sptd.sys ZwCreateKey
SSDT \WINDOWS\System32\drivers\fsndis5.sys ZwCreateProcess
SSDT \WINDOWS\System32\drivers\fsndis5.sys ZwCreateProcessEx
SSDT \WINDOWS\System32\drivers\fsndis5.sys ZwCreateSection
SSDT \WINDOWS\System32\drivers\fsndis5.sys ZwCreateThread
SSDT sptd.sys ZwEnumerateKey
SSDT sptd.sys ZwEnumerateValueKey
SSDT sptd.sys ZwOpenKey
SSDT sptd.sys ZwQueryKey
SSDT sptd.sys ZwQueryValueKey
SSDT sptd.sys ZwSetValueKey
SSDT \WINDOWS\System32\drivers\fsndis5.sys ZwWriteVirtualMemory

Code \WINDOWS\System32\drivers\fsndis5.sys IoCreateDevice
---- Kernel code sections - GMER 1.0.12 ----
PAGE ntkrnlpa.exe!IoCreateDevice 805699E0 5 Bytes JMP F86C4FD0 \WINDOWS\System32\drivers\fsndis5.sys
? C:\WINDOWS\system32\drivers\sptd.sys Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces.
? C:\WINDOWS\System32\Drivers\SPTD2349.SYS Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces.
PAGENPNP NDIS.SYS!NdisRegisterProtocol F82CF17D 5 Bytes JMP F86C4C49 \WINDOWS\System32\drivers\fsndis5.sys
PAGENPNP NDIS.SYS!NdisOpenAdapter F82CF397 5 Bytes JMP F86C4EB4 \WINDOWS\System32\drivers\fsndis5.sys
PAGENPNP NDIS.SYS!NdisCloseAdapter F82D961E 5 Bytes JMP F86C4EE4 \WINDOWS\System32\drivers\fsndis5.sys
PAGENPNP NDIS.SYS!NdisDeregisterProtocol F82D97FD 5 Bytes JMP F86C4CB0 \WINDOWS\System32\drivers\fsndis5.sys
PAGENDSP NDIS.SYS!NdisReturnPackets F82DC800 5 Bytes JMP F86C913A \WINDOWS\System32\drivers\fsndis5.sys
PAGENDSP NDIS.SYS!NdisRequest F82DC96B 5 Bytes JMP F86C7578 \WINDOWS\System32\drivers\fsndis5.sys
PAGENDSP NDIS.SYS!NdisSend F82DF977 5 Bytes JMP F86C93FE \WINDOWS\System32\drivers\fsndis5.sys
PAGENDSP NDIS.SYS!NdisSendPackets F82DF994 5 Bytes JMP F86C94D0 \WINDOWS\System32\drivers\fsndis5.sys
PAGENDSP NDIS.SYS!NdisTransferData F82DF9AF 5 Bytes JMP F86C925C \WINDOWS\System32\drivers\fsndis5.sys

---- Devices - GMER 1.0.12 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 82596EB0
Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 82596EB0
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CREATE 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLOSE 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_WRITE 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_INFORMATION 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_INFORMATION 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_EA 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_EA 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FLUSH_BUFFERS 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_VOLUME_INFORMATION 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_VOLUME_INFORMATION 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DIRECTORY_CONTROL 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FILE_SYSTEM_CONTROL 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DEVICE_CONTROL 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SHUTDOWN 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_LOCK_CONTROL 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLEANUP 81E340E8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_PNP 81E340E8
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_READ [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_WRITE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_POWER [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_PNP [F82FB9E8] fsdfw.sys
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 825E1808
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 825E1808
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 825E1808
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 825E1808
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 825E1808
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 825E1808
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 825E1808
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SYSTEM_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_INTERNAL_DEVICE_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SHUTDOWN 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_POWER 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SYSTEM_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_PNP 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CLOSE 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_READ 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_WRITE 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_FLUSH_BUFFERS 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_DEVICE_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_INTERNAL_DEVICE_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SHUTDOWN 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_POWER 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SYSTEM_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_PNP 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CLOSE 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_READ 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_WRITE 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_FLUSH_BUFFERS 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_DEVICE_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_INTERNAL_DEVICE_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SHUTDOWN 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_POWER 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SYSTEM_CONTROL 825E1808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_PNP 825E1808
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_READ [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_POWER [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_PNP [F82FB9E8] fsdfw.sys
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SYSTEM_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP 825E1A40
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 822C1EB0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 822C1EB0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 822C1EB0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 822C1EB0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 822C1EB0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 822C1EB0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 822C1EB0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 822C1EB0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 822C1EB0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 822C1EB0
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 822C1EB0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_NAMED_PIPE 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLOSE 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_WRITE 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_INFORMATION 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_INFORMATION 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_EA 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_EA 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FLUSH_BUFFERS 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_VOLUME_INFORMATION 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_VOLUME_INFORMATION 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DIRECTORY_CONTROL 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FILE_SYSTEM_CONTROL 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CONTROL 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_INTERNAL_DEVICE_CONTROL 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SHUTDOWN 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_LOCK_CONTROL 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLEANUP 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_MAILSLOT 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_SECURITY 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_SECURITY 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_POWER 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SYSTEM_CONTROL 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CHANGE 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_QUOTA 822698A0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_QUOTA 822698A0
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CREATE 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_READ 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_WRITE 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_FLUSH_BUFFERS 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_DEVICE_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_INTERNAL_DEVICE_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SHUTDOWN 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CLEANUP 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_POWER 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SYSTEM_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_PNP 825E1A40
Device \Driver\NetBT \Device\NetBT_Tcpip_{E754189F-E10E-44E8-AFCA-32ED3A6097FB} IRP_MJ_CREATE 82179A98
Device \Driver\NetBT \Device\NetBT_Tcpip_{E754189F-E10E-44E8-AFCA-32ED3A6097FB} IRP_MJ_CLOSE 82179A98
Device \Driver\NetBT \Device\NetBT_Tcpip_{E754189F-E10E-44E8-AFCA-32ED3A6097FB} IRP_MJ_DEVICE_CONTROL 82179A98
Device \Driver\NetBT \Device\NetBT_Tcpip_{E754189F-E10E-44E8-AFCA-32ED3A6097FB} IRP_MJ_INTERNAL_DEVICE_CONTROL 82179A98
Device \Driver\NetBT \Device\NetBT_Tcpip_{E754189F-E10E-44E8-AFCA-32ED3A6097FB} IRP_MJ_CLEANUP 82179A98
Device \Driver\NetBT \Device\NetBT_Tcpip_{E754189F-E10E-44E8-AFCA-32ED3A6097FB} IRP_MJ_PNP 82179A98
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 82179A98
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLOSE 82179A98
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL 82179A98
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL 82179A98
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLEANUP 82179A98
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_PNP 82179A98
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 82179A98
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLOSE 82179A98
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_DEVICE_CONTROL 82179A98
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_INTERNAL_DEVICE_CONTROL 82179A98
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLEANUP 82179A98
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_PNP 82179A98
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_NAMED_PIPE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_READ [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_WRITE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_EA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_EA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_FLUSH_BUFFERS [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_DIRECTORY_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_LOCK_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_SECURITY [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_SECURITY [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_POWER [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_SYSTEM_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CHANGE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_QUOTA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_QUOTA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_PNP [F82FB9E8] fsdfw.sys
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CREATE 825960E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CLOSE 825960E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_READ 825960E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_WRITE 825960E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_FLUSH_BUFFERS 825960E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_DEVICE_CONTROL 825960E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_INTERNAL_DEVICE_CONTROL 825960E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_SHUTDOWN 825960E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_POWER 825960E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_SYSTEM_CONTROL 825960E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_PNP 825960E8
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_READ [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_WRITE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_EA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_EA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_FLUSH_BUFFERS [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DIRECTORY_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_LOCK_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_SECURITY [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_SECURITY [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_POWER [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SYSTEM_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CHANGE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_QUOTA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_QUOTA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_PNP [F82FB9E8] fsdfw.sys
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSE 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP 821B1EB0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE_NAMED_PIPE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_READ [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_WRITE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_EA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_EA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_FLUSH_BUFFERS [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_VOLUME_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_VOLUME_INFORMATION [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DIRECTORY_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_FILE_SYSTEM_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SHUTDOWN [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_LOCK_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLEANUP [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE_MAILSLOT [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_SECURITY [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_SECURITY [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_POWER [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SYSTEM_CONTROL [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CHANGE [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_QUOTA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_QUOTA [F82FB9E8] fsdfw.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_PNP [F82FB9E8] fsdfw.sys
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_NAMED_PIPE 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLOSE 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_WRITE 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_INFORMATION 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_INFORMATION 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_EA 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_EA 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FLUSH_BUFFERS 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_VOLUME_INFORMATION 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_VOLUME_INFORMATION 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DIRECTORY_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FILE_SYSTEM_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_INTERNAL_DEVICE_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SHUTDOWN 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_LOCK_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLEANUP 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_MAILSLOT 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_SECURITY 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_SECURITY 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_POWER 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SYSTEM_CONTROL 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CHANGE 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_QUOTA 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_QUOTA 821B1EB0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP 821B1EB0
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE_NAMED_PIPE 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CLOSE 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_READ 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_WRITE 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_INFORMATION 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_SET_INFORMATION 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_FLUSH_BUFFERS 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_VOLUME_INFORMATION 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_DIRECTORY_CONTROL 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_FILE_SYSTEM_CONTROL 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CLEANUP 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_SECURITY 82175B10
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_SET_SECURITY 82175B10
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CREATE 825E1A40
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_READ 825E1A40
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_WRITE 825E1A40
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_FLUSH_BUFFERS 825E1A40
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_DEVICE_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_INTERNAL_DEVICE_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SHUTDOWN 825E1A40
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CLEANUP 825E1A40
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_POWER 825E1A40
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SYSTEM_CONTROL 825E1A40
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_PNP 825E1A40
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CREATE 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CLOSE 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_READ 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_WRITE 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_QUERY_INFORMATION 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_SET_INFORMATION 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_QUERY_VOLUME_INFORMATION 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_DIRECTORY_CONTROL 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_FILE_SYSTEM_CONTROL 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CLEANUP 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CREATE_MAILSLOT 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_QUERY_SECURITY 821B1B10
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_SET_SECURITY 821B1B10
Device \Driver\NetBT \Device\NetBT_Tcpip_{E597ECB2-B897-4F0F-9864-1FEE1015FE7E} IRP_MJ_CREATE 82179A98
Device \Driver\NetBT \Device\NetBT_Tcpip_{E597ECB2-B897-4F0F-9864-1FEE1015FE7E} IRP_MJ_CLOSE 82179A98
Device \Driver\NetBT \Device\NetBT_Tcpip_{E597ECB2-B897-4F0F-9864-1FEE1015FE7E} IRP_MJ_DEVICE_CONTROL 82179A98
Device \Driver\NetBT \Device\NetBT_Tcpip_{E597ECB2-B897-4F0F-9864-1FEE1015FE7E} IRP_MJ_INTERNAL_DEVICE_CONTROL 82179A98
Device \Driver\NetBT \Device\NetBT_Tcpip_{E597ECB2-B897-4F0F-9864-1FEE1015FE7E} IRP_MJ_CLEANUP 82179A98
Device \Driver\NetBT \Device\NetBT_Tcpip_{E597ECB2-B897-4F0F-9864-1FEE1015FE7E} IRP_MJ_PNP 82179A98
Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_READ 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP 81E340E8
Device \FileSystem\Fastfat \Fat IRP_MJ_PNP 81E340E8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLOSE 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_INFORMATION 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_SET_INFORMATION 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_VOLUME_INFORMATION 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_DIRECTORY_CONTROL 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_DEVICE_CONTROL 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_SHUTDOWN 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_LOCK_CONTROL 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLEANUP 823A7EB0
Device \FileSystem\Cdfs \Cdfs IRP_MJ_PNP 823A7EB0
---- Files - GMER 1.0.12 ----
ADS D:\Gregor\mp3\mp3\Korova Milky Bar\05-Za zamkni:KAVICHS
ADS D:\Gregor\mp3\mp3\Korova Milky Bar\10-Chcialbym umrzec z mi:KAVICHS
ADS D:\Gregor\mp3\mp3\Korova Milky Bar\11-Szklany cz:KAVICHS
ADS D:\Gregor\mp3\mp3\Korova Milky Bar\13-Ch:KAVICHS
ADS D:\Gregor\mp3\mp3\Korova Milky Bar\14-Nienawi:KAVICHS
ADS D:\Gregor\mp3\mp3\Korova Milky Bar\15-Gdzie:KAVICHS
ADS D:\Gregor\mp3\mp3\Korova Milky Bar\17-Mi:KAVICHS
ADS D:\Gregor\mp3\mp3\Mi:KAVICHS
ADS D:\Gregor\mp3\mp3\Mi:KAVICHS
ADS D:\Gregor\mp3\mp3\Mi:KAVICHS
ADS D:\Gregor\mp3\mp3\Mi:KAVICHS
ADS ...
---- EOF - GMER 1.0.12 ----

[wojtas]

jest ok

[PanKrolik]

No to ja już nie wiem... Dodam tylko że miałem wcześniej pingi około 80-90 i nagle wskoczyły 200+ i nie chcą spaść...

PS: Wielkie dzięki za pomoc Wojtas

[Sety]

No to ja już nie wiem... Dodam tylko że miałem wcześniej pingi około 80-90 i nagle wskoczyły 200+ i nie chcą spaść...

PS: Wielkie dzięki za pomoc Wojtas

Zmniejsz rozdzielczość w grze , detale itd, powinno pomóc.