prosze o sprwdzenie loga

**Posty:** 7 · przez **blady1989** 21 Wrz 2007, 19:14

Ostatnio sytem dziala mi bardzo wolno ( bardzo czesto sie wiesza) pozatym nie dziala skrot ALT + CTRL+ DELETE w zakladce z system zniklo mi przywracanie sytemu brakuje tez kilku opcji w uslugach lokalnych

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:59:09, on 2007-09-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Eset\nod32kui.exe
E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
E:\Program Files\Winamp\winampa.exe
E:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HHVcdV6Sys\VC6SecS.exe
C:\Program Files\Sferia\EasyWirelessNet\EasyWirelessNet.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
E:\Program Files\TuneUp Utilities 2007\RegistryCleaner.exe
E:\Program Files\Opera\Opera.exe
C:\Documents and Settings\TXP\Pulpit\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.pl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: IE7pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7pro\IE7pro.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Vistadrv] C:\Program Files\VistaDrives\vsdrv.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [Ashampoo FireWall] "E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [WinampAgent] E:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7pro\IE7pro.dll
O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7pro\IE7pro.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{298F8F36-64CE-4A0F-8EE4-FB126BDA7A49}: NameServer = 193.41.112.18 193.41.112.14
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Virtual CD v6 Management Service (VC6SecS) - H+H Software GmbH - C:\Program Files\HHVcdV6Sys\VC6SecS.exe

--
End of file - 6207 bytes

z gory dzieki

**Posty:** 18165 · przez **wojtas** 21 Wrz 2007, 19:41

skasuj:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

daj loga z combofixa

**Posty:** 7 · przez **blady1989** 23 Wrz 2007, 20:09

uswalem hijack ten wpis ale po restarcie znow sie pojawia

nie moge sie go pozbyc

Kod: Zaznacz wszystko: ComboFix 07-09-21.2 - "TXP" 2007-09-21 20:00:38.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.698 [GMT 2:00] . ((((((((((((((((((((((((( Files Created from 2007-08-21 to 2007-09-21 ))))))))))))))))))))))))))))))) . 2007-09-21 19:52 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-21 16:05 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-09-21 15:38 <DIR> d-------- C:\DOCUME~1\TXP\DANEAP~1\Command & Conquer 3 Tiberium Wars 2007-09-21 12:03 <DIR> d-------- C:\Program Files\Activision 2007-09-21 11:58 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-09-20 23:40 <DIR> d--h----- C:\DOCUME~1\ADMINI~1.32D\Ustawienia lokalne 2007-09-20 23:40 <DIR> d--h----- C:\DOCUME~1\ADMINI~1.32D\Szablony 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\Ulubione 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\Pulpit 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\Moje dokumenty 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\Menu Start 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\Dane aplikacji 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\AI4BA.tmp 2007-09-20 23:38 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-09-20 23:38 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\AI4BA.tmp 2007-09-19 14:59 378 --a------ C:\DOCUME~1\TXP\wpis.reg 2007-09-18 17:29 <DIR> d-------- C:\DOCUME~1\TXP\DANEAP~1\Thunderbird 2007-09-17 20:05 <DIR> dr-h----- C:\DOCUME~1\TXP\DANEAP~1\SecuROM 2007-09-16 17:23 <DIR> d---s---- C:\DOCUME~1\TXP\DANEAP~1\Brother 2007-09-16 12:58 <DIR> d-------- C:\DOCUME~1\TXP\DANEAP~1\ScanSoft 2007-09-16 12:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP 2007-09-16 12:40 50 --a------ C:\WINDOWS\system32\bridf05a.dat 2007-09-16 12:39 81,920 --------- C:\WINDOWS\system32\BrWebIns.dll 2007-09-16 12:39 65,536 --------- C:\WINDOWS\system32\BRWEBUP.EXE 2007-09-16 12:39 52,224 --------- C:\WINDOWS\system32\brinsstr.dll 2007-09-16 12:39 188,416 --------- C:\WINDOWS\system32\PDRVINST.DLL 2007-09-16 12:39 147,456 --------- C:\WINDOWS\brunin03.dll 2007-09-16 12:39 <DIR> d-------- C:\Program Files\Brother 2007-09-16 12:39 <DIR> d-------- C:\Brother 2007-09-15 07:30 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-14 22:32 101 --a------ C:\WINDOWS\favorites.dat 2007-09-14 22:21 <DIR> d-------- C:\WINDOWS\Windows 2007-09-14 22:17 0 --a------ C:\WINDOWS\undo.dat 2007-09-14 21:58 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-09-14 21:58 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-09-14 21:56 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2007-09-14 21:56 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-09-14 21:56 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-09-14 21:56 4,027,456 --a------ C:\WINDOWS\system32\drivers\ALCXWDM.SYS 2007-09-14 21:56 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-09-14 21:56 208,896 --a------ C:\WINDOWS\system32\nvugart.exe 2007-09-14 21:56 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-09-14 21:53 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne 2007-09-14 21:53 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start 2007-09-14 21:53 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty 2007-09-14 21:53 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony 2007-09-14 21:53 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony 2007-09-14 21:53 <DIR> d-------- C:\Program Files\ScanSoft 2007-09-14 21:53 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Menu Start 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ScanSoft 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\InstallShield 2007-09-14 21:52 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji 2007-09-14 21:52 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2007-09-14 21:52 <DIR> d-------- C:\WINDOWS\system32\CatRoot 2007-09-14 21:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Dane aplikacji 2007-09-14 21:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Brother 2007-09-14 21:51 55,808 --a------ C:\devcon.exe 2007-09-14 21:51 211,050 --a------ C:\DSPdsblr.exe 2007-09-14 21:51 21,760 --a------ C:\WINDOWS\system32\drivers\point32.sys 2007-09-14 21:51 202,238 --a------ C:\pmtimer.exe 2007-09-14 21:51 20,992 --a------ C:\makePNF.exe 2007-09-14 21:51 13,568 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys 2007-09-14 21:50 964 --a------ C:\WINDOWS\system32\drivers\RADIO11.bin 2007-09-14 21:50 964 --a------ C:\WINDOWS\system\RADIO11.bin 2007-09-14 21:50 936 --a------ C:\WINDOWS\system32\drivers\RADIO0d.bin 2007-09-14 21:50 936 --a------ C:\WINDOWS\system\RADIO0d.bin 2007-09-14 21:50 912 --a------ C:\WINDOWS\system32\drivers\RADIO15.bin 2007-09-14 21:50 912 --a------ C:\WINDOWS\system\RADIO15.bin 2007-09-14 21:50 40,636 --a------ C:\WINDOWS\system32\drivers\WLANGEN.bin 2007-09-14 21:50 40,636 --a------ C:\WINDOWS\system\WLANGEN.bin 2007-09-14 21:50 255,360 --a------ C:\WINDOWS\system32\drivers\AIRPLUS.sys 2007-09-14 21:49 89,856 --a------ C:\WINDOWS\system32\drivers\nvatabus.sys 2007-09-14 21:49 577,536 --a------ C:\WINDOWS\SOUNDMAN.EXE 2007-09-14 21:49 295,424 --a------ C:\WINDOWS\system32\idecoi.dll 2007-09-14 21:49 217,088 --a------ C:\WINDOWS\Alcrmv.exe 2007-09-14 21:49 16,640 --a------ C:\WINDOWS\system32\drivers\nvcchflt.sys 2007-09-14 21:49 147,456 --a------ C:\WINDOWS\system32\RTLCPAPI.dll 2007-09-14 21:49 10,528,768 --a------ C:\WINDOWS\system32\RTLCPL.EXE 2007-09-14 21:48 93,764 --a------ C:\WINDOWS\system32\drivers\NVENET.sys 2007-09-14 21:48 31,744 --a------ C:\WINDOWS\system32\NVCOE.DLL 2007-09-14 21:46 <DIR> d-------- C:\D 2007-09-14 21:45 529,792 --a------ C:\WINDOWS\system32\autoruns.exe 2007-09-14 21:45 447,872 --a------ C:\WINDOWS\system32\autorunsc.exe 2007-09-14 21:45 263,680 --a------ C:\WINDOWS\system32\ActivePorts_1.4.exe 2007-09-14 21:45 <DIR> d-------- C:\WINDOWS\system32\Data 2007-09-14 21:45 <DIR> d-------- C:\DOCUME~1\TXP\Gadu-Gadu 2007-09-14 21:28 64,896 -ra------ C:\WINDOWS\system32\drivers\adusbser65.sys 2007-09-14 21:24 64,896 -ra------ C:\WINDOWS\system32\drivers\adusbmdm65.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-21 12:07 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-19 15:07 --------- d-------- C:\Program Files\DaemonTools_WhenUSave_Installer 2007-09-17 20:42 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-09-17 20:42 298104 --a------ C:\WINDOWS\system32\imon.dll 2007-09-17 20:42 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-09-15 08:06 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-09-14 21:53 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-09-14 21:03 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Microsoft Help 2007-09-14 20:59 --------- d-------- C:\Program Files\Microsoft Visual Studio 8 2007-09-14 20:54 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Ashampoo 2007-09-14 20:54 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ashampoo 2007-09-14 20:51 --------- d-------- C:\Program Files\HHVcdV6Sys 2007-09-14 20:41 25992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe 2007-09-14 20:27 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\TuneUp Software 2007-09-14 20:26 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Simply Super Software 2007-09-14 20:22 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Opera 2007-09-14 20:20 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Lavasoft 2007-09-14 20:18 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Talkback 2007-09-14 20:17 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\IE7pro 2007-09-14 20:07 --------- d-------- C:\Program Files\VistaDrives 2007-09-14 20:07 --------- d-------- C:\Program Files\Real Alternative 2007-09-14 20:07 --------- d-------- C:\Program Files\Paint.NET 2007-09-14 20:07 --------- d-------- C:\Program Files\iColorFolder 2007-09-14 20:07 --------- d-------- C:\Program Files\Combined Community Codec Pack 2007-09-14 20:07 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Real 2007-09-14 20:07 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-09-14 20:05 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\IDMComp 2007-09-14 20:04 --------- d-------- C:\Program Files\IE7pro 2007-09-14 20:04 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Symantec 2007-09-14 20:03 --------- d-------- C:\Program Files\UPHClean 2007-09-14 20:03 --------- d-------- C:\Program Files\HighMAT CD Writing Wizard 2007-01-03 17:29 1179 --a------ C:\DOCUME~1\TXP\Licence.reg . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22] "nwiz"="nwiz.exe" [2006-10-22 13:22 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 13:22] "Vistadrv"="C:\Program Files\VistaDrives\vsdrv.exe" [2006-07-30 03:37] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-17 20:42] "GrooveMonitor"="E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22] "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 14:25] "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 14:45] "Ashampoo FireWall"="E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2006-08-23 17:21] "SetDefPrt"="C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 18:02] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 17:42] "WinampAgent"="E:\Program Files\Winamp\winampa.exe" [2006-06-09 02:17] "!AVG Anti-Spyware"="E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools"="E:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-09-16 12:40:09] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"=1 (0x1) "SynchronousMachineGroupPolicy"=0 (0x0) "SynchronousUserGroupPolicy"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoDesktopCleanupWizard"=1 (0x1) "NoSMHelp"=1 (0x1) "NoWelcomeScreen"=1 (0x1) "ForceClassicControlPanel"=1 (0x1) "NoSharedDocuments"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"=1 (0x1) "NoSMBalloonTip"=0 (0x0) "NoUserNameInStartMenu"=1 (0x1) "NoSMConfigurePrograms"=1 (0x1) "NoExpandedNewMenu"=1 (0x1) "NoResolveTrack"=1 (0x1) "NoResolveSearch"=1 (0x1) "NoSharedDocuments"=1 (0x1) "NoThumbnailCache"=1 (0x1) "NoTaskGrouping"=1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"=1 (0x1) "NoSMBalloonTip"=0 (0x0) "StartMenuLogoff"=0 (0x0) "NoUserNameInStartMenu"=1 (0x1) "NoSMConfigurePrograms"=1 (0x1) "NoExpandedNewMenu"=1 (0x1) "NoResolveTrack"=1 (0x1) "NoResolveSearch"=1 (0x1) "NoSharedDocuments"=1 (0x1) "NoThumbnailCache"=1 (0x1) "NoTaskGrouping"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Gadu-Gadu"="E:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Licence"=Licence.exe "RegDoctor"=E:\Program Files\RegDoctor\RegDoctor.exe -Quick "TrojanScanner"=E:\Program Files\Trojan Remover\Trjscan.exe "VC6Player"=C:\Program Files\HHVcdV6Sys\VC6Play.exe R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys R1 obvious;obvious;C:\WINDOWS\system32\DRIVERS\obvious.sys R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs R2 VC6SecS;Virtual CD v6 Management Service;C:\Program Files\HHVcdV6Sys\VC6SecS.exe R3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501);C:\WINDOWS\system32\DRIVERS\adusbmdm65.sys R3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501);C:\WINDOWS\system32\DRIVERS\adusbser65.sys R3 AIRPLUS;D-Link AirPlus Wireless Adapter;C:\WINDOWS\system32\DRIVERS\airplus.sys R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys R3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS S3 RivaTuner32;RivaTuner32;\??\E:\Program Files\RivaTuner v2.02\RivaTuner32.sys [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService SSDPSRV HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- G:\startcd.exe *Newly Created Service* - AVG_ANTI-SPYWARE_DRIVER *Newly Created Service* - AVG_ANTI-SPYWARE_GUARD *Newly Created Service* - CATCHME *Newly Created Service* - SPEEDFAN . Contents of the 'Scheduled Tasks' folder "2007-09-21 15:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job" - E:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe "2007-09-21 16:44:52 C:\WINDOWS\Tasks\XoftSpySE 2.job" - E:\Program Files\XoftSpySE\XoftSpy.exe "2007-09-18 16:33:54 C:\WINDOWS\Tasks\XoftSpySE.job" - E:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-21 20:01:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-21 20:02:11 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 23 Wrz 2007, 20:12

skasuj pogrubiony:

C:\Program Files\DaemonTools_WhenUSave_Installer

**Posty:** 7 · przez **blady1989** 23 Wrz 2007, 21:01

usunolem nadal nie dziala mi alt ctrl delete nadal brakuje przywracania systemu co mam robic ??
jeszcze raz dac loga ??

**Posty:** 18165 · przez **wojtas** 23 Wrz 2007, 21:05

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje
Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt

wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
"**del.DisableTaskMgr"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableTaskMgr"=dword:00000000

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> Uruchom plik FIX.REG

blady1989 napisał(a):nadal brakuje przywracania systemu co mam robic ??

daj screena + raport+ log z combofixa

**Posty:** 7 · przez **blady1989** 23 Wrz 2007, 21:31

SDFix: Version 1.107

Run by Administrator on 2007-09-23 at 21:16

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service

Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

Files with Hidden Attributes:

Fri 14 Sep 2007 135,168 A..H. --- "C:\Documents and Settings\NetworkService\NTUSER.bak"
Fri 14 Sep 2007 786,432 A..H. --- "C:\Documents and Settings\TXP\NTUSER.bak"
Fri 14 Sep 2007 262,144 A..H. --- "C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.bak"
Fri 14 Sep 2007 262,144 A..H. --- "C:\Documents and Settings\TXP\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.bak"

Finished!

Kod: Zaznacz wszystko: ComboFix 07-09-21.2 - "TXP" 2007-09-23 21:23:50.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.689 [GMT 2:00] . ((((((((((((((((((((((((( Files Created from 2007-08-23 to 2007-09-23 ))))))))))))))))))))))))))))))) . 2007-09-23 21:15 <DIR> d-------- C:\WINDOWS\ERUNT 2007-09-23 21:02 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2007-09-23 19:57 <DIR> d--h----- C:\DOCUME~1\ADMINI~1.001\Ustawienia lokalne 2007-09-23 19:57 <DIR> d--h----- C:\DOCUME~1\ADMINI~1.001\Szablony 2007-09-23 19:57 <DIR> d-------- C:\DOCUME~1\ADMINI~1.001\Ulubione 2007-09-23 19:57 <DIR> d-------- C:\DOCUME~1\ADMINI~1.001\Pulpit 2007-09-23 19:57 <DIR> d-------- C:\DOCUME~1\ADMINI~1.001\Moje dokumenty 2007-09-23 19:57 <DIR> d-------- C:\DOCUME~1\ADMINI~1.001\Menu Start 2007-09-23 19:57 <DIR> d-------- C:\DOCUME~1\ADMINI~1.001\Dane aplikacji 2007-09-23 19:57 <DIR> d-------- C:\DOCUME~1\ADMINI~1.001\AI4BA.tmp 2007-09-23 19:46 <DIR> d--h----- C:\DOCUME~1\ADMINI~1.000\Ustawienia lokalne 2007-09-23 19:46 <DIR> d--h----- C:\DOCUME~1\ADMINI~1.000\Szablony 2007-09-23 19:46 <DIR> d-------- C:\DOCUME~1\ADMINI~1.000\Ulubione 2007-09-23 19:46 <DIR> d-------- C:\DOCUME~1\ADMINI~1.000\Pulpit 2007-09-23 19:46 <DIR> d-------- C:\DOCUME~1\ADMINI~1.000\Moje dokumenty 2007-09-23 19:46 <DIR> d-------- C:\DOCUME~1\ADMINI~1.000\Menu Start 2007-09-23 19:46 <DIR> d-------- C:\DOCUME~1\ADMINI~1.000\Dane aplikacji 2007-09-23 19:46 <DIR> d-------- C:\DOCUME~1\ADMINI~1.000\AI4BA.tmp 2007-09-22 06:46 <DIR> d--h----- C:\DOCUME~1\LOCALS~1\Ustawienia lokalne 2007-09-22 06:46 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Dane aplikacji 2007-09-21 20:37 <DIR> d-------- C:\Program Files\Skype 2007-09-21 20:37 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-09-21 20:37 <DIR> d-------- C:\DOCUME~1\TXP\DANEAP~1\Skype 2007-09-21 20:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype 2007-09-21 19:52 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-21 16:05 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-09-21 15:38 <DIR> d-------- C:\DOCUME~1\TXP\DANEAP~1\Command & Conquer 3 Tiberium Wars 2007-09-21 12:03 <DIR> d-------- C:\Program Files\Activision 2007-09-21 11:58 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-09-20 23:40 <DIR> d--h----- C:\DOCUME~1\ADMINI~1.32D\Ustawienia lokalne 2007-09-20 23:40 <DIR> d--h----- C:\DOCUME~1\ADMINI~1.32D\Szablony 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\Ulubione 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\Pulpit 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\Moje dokumenty 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\Menu Start 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\Dane aplikacji 2007-09-20 23:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.32D\AI4BA.tmp 2007-09-20 23:38 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-09-20 23:38 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-09-20 23:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\AI4BA.tmp 2007-09-19 14:59 378 --a------ C:\DOCUME~1\TXP\wpis.reg 2007-09-18 17:29 <DIR> d-------- C:\DOCUME~1\TXP\DANEAP~1\Thunderbird 2007-09-17 20:05 <DIR> dr-h----- C:\DOCUME~1\TXP\DANEAP~1\SecuROM 2007-09-16 17:23 <DIR> d---s---- C:\DOCUME~1\TXP\DANEAP~1\Brother 2007-09-16 12:58 <DIR> d-------- C:\DOCUME~1\TXP\DANEAP~1\ScanSoft 2007-09-16 12:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP 2007-09-16 12:40 50 --a------ C:\WINDOWS\system32\bridf05a.dat 2007-09-16 12:39 81,920 --------- C:\WINDOWS\system32\BrWebIns.dll 2007-09-16 12:39 65,536 --------- C:\WINDOWS\system32\BRWEBUP.EXE 2007-09-16 12:39 52,224 --------- C:\WINDOWS\system32\brinsstr.dll 2007-09-16 12:39 188,416 --------- C:\WINDOWS\system32\PDRVINST.DLL 2007-09-16 12:39 147,456 --------- C:\WINDOWS\brunin03.dll 2007-09-16 12:39 <DIR> d-------- C:\Program Files\Brother 2007-09-16 12:39 <DIR> d-------- C:\Brother 2007-09-15 07:30 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-14 22:32 101 --a------ C:\WINDOWS\favorites.dat 2007-09-14 22:21 <DIR> d-------- C:\WINDOWS\Windows 2007-09-14 22:17 0 --a------ C:\WINDOWS\undo.dat 2007-09-14 21:58 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-09-14 21:58 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-09-14 21:56 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2007-09-14 21:56 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-09-14 21:56 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-09-14 21:56 4,027,456 --a------ C:\WINDOWS\system32\drivers\ALCXWDM.SYS 2007-09-14 21:56 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-09-14 21:56 208,896 --a------ C:\WINDOWS\system32\nvugart.exe 2007-09-14 21:56 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-09-14 21:53 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne 2007-09-14 21:53 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start 2007-09-14 21:53 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty 2007-09-14 21:53 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony 2007-09-14 21:53 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony 2007-09-14 21:53 <DIR> d-------- C:\Program Files\ScanSoft 2007-09-14 21:53 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Menu Start 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ScanSoft 2007-09-14 21:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\InstallShield 2007-09-14 21:52 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji 2007-09-14 21:52 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2007-09-14 21:52 <DIR> d-------- C:\WINDOWS\system32\CatRoot 2007-09-14 21:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Dane aplikacji 2007-09-14 21:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Brother 2007-09-14 21:51 55,808 --a------ C:\devcon.exe 2007-09-14 21:51 211,050 --a------ C:\DSPdsblr.exe 2007-09-14 21:51 21,760 --a------ C:\WINDOWS\system32\drivers\point32.sys 2007-09-14 21:51 202,238 --a------ C:\pmtimer.exe 2007-09-14 21:51 20,992 --a------ C:\makePNF.exe 2007-09-14 21:51 13,568 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys 2007-09-14 21:50 964 --a------ C:\WINDOWS\system32\drivers\RADIO11.bin 2007-09-14 21:50 964 --a------ C:\WINDOWS\system\RADIO11.bin . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-23 12:35 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-21 20:50 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-09-17 20:42 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-09-17 20:42 298104 --a------ C:\WINDOWS\system32\imon.dll 2007-09-17 20:42 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-09-15 08:06 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-09-14 21:53 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-09-14 21:03 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Microsoft Help 2007-09-14 20:59 --------- d-------- C:\Program Files\Microsoft Visual Studio 8 2007-09-14 20:54 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Ashampoo 2007-09-14 20:54 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ashampoo 2007-09-14 20:51 --------- d-------- C:\Program Files\HHVcdV6Sys 2007-09-14 20:41 25992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe 2007-09-14 20:27 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\TuneUp Software 2007-09-14 20:26 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Simply Super Software 2007-09-14 20:22 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Opera 2007-09-14 20:20 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Lavasoft 2007-09-14 20:18 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Talkback 2007-09-14 20:17 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\IE7pro 2007-09-14 20:07 --------- d-------- C:\Program Files\VistaDrives 2007-09-14 20:07 --------- d-------- C:\Program Files\Real Alternative 2007-09-14 20:07 --------- d-------- C:\Program Files\Paint.NET 2007-09-14 20:07 --------- d-------- C:\Program Files\iColorFolder 2007-09-14 20:07 --------- d-------- C:\Program Files\Combined Community Codec Pack 2007-09-14 20:07 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\Real 2007-09-14 20:07 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-09-14 20:05 --------- d-------- C:\DOCUME~1\TXP\DANEAP~1\IDMComp 2007-09-14 20:04 --------- d-------- C:\Program Files\IE7pro 2007-09-14 20:04 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Symantec 2007-09-14 20:03 --------- d-------- C:\Program Files\UPHClean 2007-09-14 20:03 --------- d-------- C:\Program Files\HighMAT CD Writing Wizard 2007-01-03 17:29 1179 --a------ C:\DOCUME~1\TXP\Licence.reg . ((((((((((((((((((((((((((((( snapshot_2007-09-21_200153.73 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 163,328 2007-09-23 06:52:19 C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE ----a-w 299,008 2007-09-23 19:15:45 C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT ----a-w 8,192 2007-09-23 19:15:45 C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat ----a-w 163,328 2007-09-23 06:52:19 C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE ----a-w 299,008 2007-09-23 19:15:44 C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT ----a-w 8,192 2007-09-23 19:15:44 C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat ----a-w 54,824 2007-09-22 04:50:14 C:\WINDOWS\system32\perfc009.dat ----a-w 69,740 2007-09-22 04:50:14 C:\WINDOWS\system32\perfc015.dat ----a-w 380,386 2007-09-22 04:50:14 C:\WINDOWS\system32\perfh009.dat ----a-w 435,380 2007-09-22 04:50:14 C:\WINDOWS\system32\perfh015.dat . ----a-w 54,824 2007-09-14 19:26:01 C:\WINDOWS\system32\perfc009.dat ----a-w 69,740 2007-09-14 19:26:01 C:\WINDOWS\system32\perfc015.dat ----a-w 380,386 2007-09-14 19:26:01 C:\WINDOWS\system32\perfh009.dat ----a-w 435,380 2007-09-14 19:26:01 C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22] "nwiz"="nwiz.exe" [2006-10-22 13:22 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 13:22] "Vistadrv"="C:\Program Files\VistaDrives\vsdrv.exe" [2006-07-30 03:37] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-17 20:42] "GrooveMonitor"="E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22] "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 14:25] "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 14:45] "Ashampoo FireWall"="E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2006-08-23 17:21] "SetDefPrt"="C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 18:02] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 17:42] "WinampAgent"="E:\Program Files\Winamp\winampa.exe" [2006-06-09 02:17] "!AVG Anti-Spyware"="E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25] "DaemonTools_WhenUSave_Installer"="C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools"="E:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:37] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-09-16 12:40:09] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"=1 (0x1) "SynchronousMachineGroupPolicy"=0 (0x0) "SynchronousUserGroupPolicy"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoDesktopCleanupWizard"=1 (0x1) "NoSMHelp"=1 (0x1) "NoWelcomeScreen"=1 (0x1) "ForceClassicControlPanel"=1 (0x1) "NoSharedDocuments"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"=1 (0x1) "NoSMBalloonTip"=0 (0x0) "NoUserNameInStartMenu"=1 (0x1) "NoSMConfigurePrograms"=1 (0x1) "NoExpandedNewMenu"=1 (0x1) "NoResolveTrack"=1 (0x1) "NoResolveSearch"=1 (0x1) "NoSharedDocuments"=1 (0x1) "NoThumbnailCache"=1 (0x1) "NoTaskGrouping"=1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"=1 (0x1) "NoSMBalloonTip"=0 (0x0) "StartMenuLogoff"=0 (0x0) "NoUserNameInStartMenu"=1 (0x1) "NoSMConfigurePrograms"=1 (0x1) "NoExpandedNewMenu"=1 (0x1) "NoResolveTrack"=1 (0x1) "NoResolveSearch"=1 (0x1) "NoSharedDocuments"=1 (0x1) "NoThumbnailCache"=1 (0x1) "NoTaskGrouping"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Gadu-Gadu"="E:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Licence"=Licence.exe "RegDoctor"=E:\Program Files\RegDoctor\RegDoctor.exe -Quick "TrojanScanner"=E:\Program Files\Trojan Remover\Trjscan.exe "VC6Player"=C:\Program Files\HHVcdV6Sys\VC6Play.exe R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys R1 obvious;obvious;C:\WINDOWS\system32\DRIVERS\obvious.sys R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs R2 VC6SecS;Virtual CD v6 Management Service;C:\Program Files\HHVcdV6Sys\VC6SecS.exe R3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501);C:\WINDOWS\system32\DRIVERS\adusbmdm65.sys R3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501);C:\WINDOWS\system32\DRIVERS\adusbser65.sys R3 AIRPLUS;D-Link AirPlus Wireless Adapter;C:\WINDOWS\system32\DRIVERS\airplus.sys R3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys S3 RivaTuner32;RivaTuner32;\??\E:\Program Files\RivaTuner v2.02\RivaTuner32.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService SSDPSRV HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- G:\startcd.exe *Newly Created Service* - SPEEDFAN . Contents of the 'Scheduled Tasks' folder "2007-09-22 04:45:57 C:\WINDOWS\Tasks\1-Click Maintenance.job" - E:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-23 21:24:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... C:\WINDOWS\system32\cmd.exe [2588] 0x8453C440 scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-23 21:25:22 C:\ComboFix-quarantined-files.txt ... 2007-09-23 21:25 C:\ComboFix2.txt ... 2007-09-21 20:02 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 23 Wrz 2007, 21:36

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DaemonTools_WhenUSave_Installer"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 7 · przez **blady1989** 23 Wrz 2007, 22:10

nie moge odnalesc
Szukasz:

Usługa odnajdywania SSDP + Host Uniwersalnego urządzenia plug and play i/lub Posłaniec -> prawoklik -> Zatrzymaj -> Właściwości -> Typ uruchomienia ustaw : Wyłączona -> uruchom ponownie komputer.

szukalem kilka razy
moze ty dostrzezesz
http://images27.fotosik.pl/87/d4638e4ab39c4bf0med.jpg
http://images24.fotosik.pl/87/687b03b319bdbe9cmed.jpg
pozatym nadal nie dziala alt ctrl delete
chyba jednym wyjsciem jest format

**Posty:** 18165 · przez **wojtas** 23 Wrz 2007, 22:12

na tych screenach nic nie widac

Usługa odnajdywania SSDP + Host Uniwersalnego urządzenia plug and play i/lub Posłaniec -> prawoklik -> Zatrzymaj -> Właściwości -> Typ uruchomienia ustaw : Wyłączona -> uruchom ponownie komputer.

gdzie zes to wyczytal?

daj loga z hijacka oraz silent runners

**Posty:** 7 · przez **blady1989** 23 Wrz 2007, 22:15

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:15:32, on 2007-09-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Eset\nod32kui.exe
E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
E:\Program Files\Winamp\winampa.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\DAEMON Tools\daemon.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HHVcdV6Sys\VC6SecS.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Sferia\EasyWirelessNet\EasyWirelessNet.exe
E:\Program Files\Opera\Opera.exe
C:\Documents and Settings\TXP\Pulpit\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.pl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: IE7pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7pro\IE7pro.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Vistadrv] C:\Program Files\VistaDrives\vsdrv.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [Ashampoo FireWall] "E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [WinampAgent] E:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7pro\IE7pro.dll
O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7pro\IE7pro.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{298F8F36-64CE-4A0F-8EE4-FB126BDA7A49}: NameServer = 193.41.112.18 193.41.112.14
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Virtual CD v6 Management Service (VC6SecS) - H+H Software

**Posty:** 18165 · przez **wojtas** 23 Wrz 2007, 22:16

log nie jest w tagach i daj loga z silent runners

**Posty:** 7 · przez **blady1989** 23 Wrz 2007, 22:27

"Silent Runners.vbs", revision 52, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"DAEMON Tools" = ""E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."]
"Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"Vistadrv" = "C:\Program Files\VistaDrives\vsdrv.exe" [null data]
"nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "]
"GrooveMonitor" = ""E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"" [MS]
"SSBkgdUpdate" = ""C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot" ["Scansoft, Inc."]
"PaperPort PTD" = "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" ["ScanSoft, Inc."]
"IndexSearch" = "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" ["ScanSoft, Inc."]
"Ashampoo FireWall" = ""E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY" [null data]
"SetDefPrt" = "C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe" ["Brother Industories, Ltd."]
"ControlCenter2.0" = "C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun" ["Brother Industries, Ltd."]
"WinampAgent" = "E:\Program Files\Winamp\winampa.exe" [null data]
"!AVG Anti-Spyware" = ""E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["GRISOFT s.r.o."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{00011268-E188-40DF-A514-835FCD78B1BF}\(Default) = "IE7pro"
-> {HKLM...CLSID} = "IE7pro BHO"
\InProcServer32\(Default) = "C:\Program Files\IE7pro\IE7pro.dll" ["IE7pro.com"]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{22BF413B-C6D2-4d91-82A9-A0F997BA588C}\(Default) = "Skype add-on (mastermind)"
-> {HKLM...CLSID} = "Skype add-on (mastermind)"
\InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Groove GFS Browser Helper"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "*g" (unwritable string) [file not found]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band"
-> {HKLM...CLSID} = "History Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]
"{19F500E0-9964-11cf-B63D-08002B317C03}" = "Desktop Icon Layout"
-> {HKLM...CLSID} = "Desktop Icon Layout"
\InProcServer32\(Default) = "Layout.dll" ["Microsoft"]
"{48EAD1E1-ECF2-4a85-AA09-1C44FBEED451}" = "OODefrag"
-> {HKLM...CLSID} = "OODShellExtObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\oodsh.dll" ["O&O Software GmbH"]
"{ABC70703-32AF-11d4-90C4-D483A70F4825}" = "CMenuExtender"
-> {HKLM...CLSID} = "CMenuExtender"
\InProcServer32\(Default) = "C:\Program Files\iColorFolder\CMExt.dll" ["Revenger inc."]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
"{52B87208-9CCF-42C9-B88E-069281105805}" = "Trojan Remover Shell Extension"
-> {HKLM...CLSID} = "Trojan Remover Shell Extension"
\InProcServer32\(Default) = "E:\PROGRA~1\TROJAN~1\Trshlex.dll" ["Simply Super Software"]
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper"
-> {HKLM...CLSID} = "Groove GFS Browser Helper"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar"
-> {HKLM...CLSID} = "Groove Folder Synchronization"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler"
-> {HKLM...CLSID} = "Groove GFS Stub Icon Handler"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
-> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler"
-> {HKLM...CLSID} = "Groove XML Icon Handler"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\OLKFSTUB.DLL" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {HKLM...CLSID} = "Microsoft Office Outlook"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\MLSHEXT.DLL" [MS]
"{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
-> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\ONFILTER.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "E:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" = "TuneUp Shredder Shell Extension"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"
\InProcServer32\(Default) = "E:\Program Files\TuneUp Utilities 2007\SDShelEx-win32.dll" ["TuneUp Software GmbH"]
"{44440D00-FF19-4AFC-B765-9A0970567D97}" = "TuneUp Theme Extension"
-> {HKLM...CLSID} = "TuneUp Theme Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\uxtuneup.dll" ["TuneUp Software GmbH"]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
-> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]
<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["GRISOFT s.r.o."]

HKLM\System\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "autocheck autochk *"|"OODBS" ["O&O Software GmbH"]| [file not found]| [file not found]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "E:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."]
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
OODefrag\(Default) = "{48EAD1E1-ECF2-4a85-AA09-1C44FBEED451}"
-> {HKLM...CLSID} = "OODShellExtObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\oodsh.dll" ["O&O Software GmbH"]
Trojan Remover\(Default) = "{52B87208-9CCF-42C9-B88E-069281105805}"
-> {HKLM...CLSID} = "Trojan Remover Shell Extension"
\InProcServer32\(Default) = "E:\PROGRA~1\TROJAN~1\Trshlex.dll" ["Simply Super Software"]
TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"
\InProcServer32\(Default) = "E:\Program Files\TuneUp Utilities 2007\SDShelEx-win32.dll" ["TuneUp Software GmbH"]
UltraEdit-32\(Default) = "{b5eedee0-c06e-11cf-8c56-444553540000}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "ue32ctmn.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."]
CMenuExtender\(Default) = "{ABC70703-32AF-11d4-90C4-D483A70F4825}"
-> {HKLM...CLSID} = "CMenuExtender"
\InProcServer32\(Default) = "C:\Program Files\iColorFolder\CMExt.dll" ["Revenger inc."]
TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"
\InProcServer32\(Default) = "E:\Program Files\TuneUp Utilities 2007\SDShelEx-win32.dll" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
IconLayout\(Default) = "{19F500E0-9964-11cf-B63D-08002B317C03}"
-> {HKLM...CLSID} = "Desktop Icon Layout"
\InProcServer32\(Default) = "Layout.dll" ["Microsoft"]
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
OODefrag\(Default) = "{48EAD1E1-ECF2-4a85-AA09-1C44FBEED451}"
-> {HKLM...CLSID} = "OODShellExtObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\oodsh.dll" ["O&O Software GmbH"]
Trojan Remover\(Default) = "{52B87208-9CCF-42C9-B88E-069281105805}"
-> {HKLM...CLSID} = "Trojan Remover Shell Extension"
\InProcServer32\(Default) = "E:\PROGRA~1\TROJAN~1\Trshlex.dll" ["Simply Super Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]

HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]

Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoSMHelp" = (REG_DWORD) hex:0x00000001
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Remove Help menu from Start Menu}

"NoSMBalloonTip" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoUserNameInStartMenu" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoSMConfigurePrograms" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoExpandedNewMenu" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoResolveTrack" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoResolveSearch" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoLowDiskSpaceChecks" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoSharedDocuments" = (REG_DWORD) hex:0x00000001
{User Configuration|Administrative Templates|Windows Components|Windows Explorer|
Remove Shared Documents from My Computer}

"NoThumbnailCache" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoTaskGrouping" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoDesktopCleanupWizard" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoSMHelp" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoRemoteRecursiveEvents" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoWelcomeScreen" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"ForceClassicControlPanel" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoSharedDocuments" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|System|
Prevent access to registry editing tools}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

"NoInternetOpenWith" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"DisableStatusMessages" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"SynchronousMachineGroupPolicy" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"SynchronousUserGroupPolicy" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\Web\Wallpaper\TXP.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\Web\Wallpaper\TXP.bmp"

Startup items in "TXP" & "All Users" startup folders:
-----------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Adobe Reader Speed Launch" -> shortcut to: "E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"Status Monitor" -> shortcut to: "C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe Brother DCP-115C /STARTUP" ["Brother Industries, Ltd."]

Enabled Scheduled Tasks:
------------------------

"1-Click Maintenance" -> launches: "E:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 11
E:\Program Files\Ashampoo\Ashampoo FireWall\spi.dll [null data], 06 - 10, 24
%SystemRoot%\system32\mswsock.dll [MS], 12 - 23, 25 - 27
%SystemRoot%\system32\rsvpsp.dll [MS], 28 - 29

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [MS]

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{0026439F-A980-4F18-8C95-4F1CBBF9C1D8}\
"ButtonText" = "IE7pro Preferences"
"MenuText" = "IE7pro Preferences"
"CLSIDExtension" = "{B119EB0C-C021-46CF-85B0-34A760E0D5FE}"
-> {HKLM...CLSID} = "IE7pro ToolsExt"
\InProcServer32\(Default) = "C:\Program Files\IE7pro\IE7pro.dll" ["IE7pro.com"]

{2670000A-7350-4F3C-8081-5663EE0C6C49}\
"ButtonText" = "Wyślij do programu OneNote"
"MenuText" = "Wyślij &do programu OneNote"
"CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}"
-> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button"
\InProcServer32\(Default) = "E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll" [MS]

{77BF5300-1474-4EC7-9980-D32B190E9B07}\
"ButtonText" = "Skype"
"CLSIDExtension" = "{77BF5300-1474-4EC7-9980-D32B190E9B07}"
-> {HKLM...CLSID} = "Skype add-on (button)"
\InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"

Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\AboutURLs\
<<H>> "TuneUp" = "file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css" [file not found]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["GRISOFT s.r.o."]
BrSplService, Brother XP spl Service, "C:\WINDOWS\system32\brsvc01a.exe" ["brother Industries Ltd"]
NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "]
O&O Defrag, O&O Defrag, "C:\WINDOWS\system32\oodag.exe" ["O&O Software GmbH"]
TuneUp Design Expansion, UxTuneUp, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\uxtuneup.dll" ["TuneUp Software GmbH"]}
Virtual CD v6 Management Service, VC6SecS, "C:\Program Files\HHVcdV6Sys\VC6SecS.exe" ["H+H Software GmbH"]

---------- (launch time: 2007-09-23 22:27:00)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 42 seconds, including 5 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 23 Wrz 2007, 22:38

hijack czysty silent nie jest pelny

prosze o sprwdzenie loga

prosze o sprwdzenie loga

Kto jest na forum