proszę o sprwdzenie

**Posty:** 443 · przez **Bartek91** 16 Sie 2007, 15:17

Witam. Wczoraj przeskanowałem system AVG i znalazło mi kilka trojanów. Niby wszystko zostało usunięte, jednak dzisiaj co chwile AVG wywala mi komunikaty, że znaleziono wira. Dokładnie "Trojan horse BackDoor.Agent". Prosze więc o sprawdzenie loga i pomoc. Z góry dziękuje i pozdrawiam.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:05:33, on 2007-08-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\BearShare\BearShare.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\WINDOWS\vsnpstd3.exe C:\WINDOWS\System32\Rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Ares\Ares.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\PROGRA~1\COMMON~1\MICROS~1\Msinfo\OFFPROV.EXE C:\Program Files\Opera\Opera.exe C:\Documents and Settings\Bartek91\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll O2 - BHO: trafficninja.biz extension - {266A3562-AB67-480E-9F09-D54604FD817B} - C:\WINDOWS\system32\ninjaext.dll O2 - BHO: SmartShopper - {2BA1C226-EC1B-4471-A65F-D0688AC6EE3A} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll O2 - BHO: rightonadz.biz browser optimizer - {36A91CEC-6C71-4758-B492-397BFC8E96A2} - C:\WINDOWS\system32\gzmrotate.dll O2 - BHO: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll O2 - BHO: NavHelper Class - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} - C:\Program Files\NavExcel\NavHelper\v2.0.4a\NHelper.dll (file missing) O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll (file missing) O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll O2 - BHO: WebManager Class - {D5792AA9-D373-4039-8670-2CDAB6A71F15} - C:\Program Files\BitDownload\TorrentManager.dll (file missing) O2 - BHO: Helper Class - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll (file missing) O2 - BHO: adssite - {F31B3634-12AA-41ca-B021-0685C3B3E4CA} - C:\WINDOWS\system32\nsd2F.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll (file missing) O3 - Toolbar: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe O4 - HKLM\..\Run: [{E6-65-5D-DC-ZN}] C:\Documents and Settings\Dzidek\Ustawienia lokalne\Temp\TICHA001.exe CHA001 O4 - HKLM\..\Run: [adstart] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: TA_Start.lnk = C:\Documents and Settings\Dzidek\Ustawienia lokalne\Temp\TICHA001.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] "Komunikator" = "C:\Program Files\Tlen.pl\tlen.exe" ["o2.pl Sp. z o.o."] "ares" = ""C:\Program Files\Ares\Ares.exe" -h" ["Ares Development Group"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."] "DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "BearShare" = ""C:\Program Files\BearShare\BearShare.exe" /pause" ["Free Peers, Inc."] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"" ["Sun Microsystems, Inc."] "(Default)" = "(empty string)" [file not found] "Sony Ericsson PC Suite" = ""C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions" ["Sony Ericsson Mobile Communications AB"] "snpstd3" = "C:\WINDOWS\vsnpstd3.exe" [empty string] "webHancer Agent" = "C:\Program Files\webHancer\Programs\whagent.exe" [file not found] "{E6-65-5D-DC-ZN}" = "C:\Documents and Settings\Dzidek\Ustawienia lokalne\Temp\TICHA001.exe CHA001" [empty string] "adstart" = "C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify" [MS] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Secured_eMule toolbar" \InProcServer32\(Default) = "C:\Program Files\Secured_eMule\tbSecu.dll" ["Conduit Ltd."] {266A3562-AB67-480E-9F09-D54604FD817B}\(Default) = (no title provided) -> {HKLM...CLSID} = "trafficninja.biz extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\ninjaext.dll" [null data] {2BA1C226-EC1B-4471-A65F-D0688AC6EE3A}\(Default) = "SmartShopper" -> {HKLM...CLSID} = "SmartShopper" \InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" ["SmartShopper Networks"] {36A91CEC-6C71-4758-B492-397BFC8E96A2}\(Default) = (no title provided) -> {HKLM...CLSID} = "rightonadz.biz browser optimizer" \InProcServer32\(Default) = "C:\WINDOWS\system32\gzmrotate.dll" [empty string] {4596013b-6c31-408b-a266-deae5c086dc2}\(Default) = (no title provided) -> {HKLM...CLSID} = "Share_Accelerator_MM toolbar" \InProcServer32\(Default) = "C:\Program Files\Share_Accelerator_MM\tbSha1.dll" ["Conduit Ltd."] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {85589B5D-D53D-4237-A677-46B82EA275F3}\(Default) = "WebAssist" -> {HKLM...CLSID} = "WebAssist" \InProcServer32\(Default) = "C:\WINDOWS\WebAssist.dll" [null data] {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}\(Default) = (no title provided) -> {HKLM...CLSID} = "NavHelper Class" \InProcServer32\(Default) = "C:\Program Files\NavExcel\NavHelper\v2.0.4a\NHelper.dll" [file not found] {c900b400-cdfe-11d3-976a-00e02913a9e0}\(Default) = (no title provided) -> {HKLM...CLSID} = "WhIeHelperObj Class" \InProcServer32\(Default) = "C:\Program Files\webHancer\programs\whiehlpr.dll" [file not found] {CC59E0F9-7E43-44FA-9FAA-8377850BF205}\(Default) = (no title provided) -> {HKLM...CLSID} = "FDMIECookiesBHO Class" \InProcServer32\(Default) = "C:\Program Files\Free Download Manager\iefdmcks.dll" [null data] {D5792AA9-D373-4039-8670-2CDAB6A71F15}\(Default) = (no title provided) -> {HKLM...CLSID} = "WebManager Class" \InProcServer32\(Default) = "C:\Program Files\BitDownload\TorrentManager.dll" [file not found] {D80C4E21-C346-4E21-8E64-20746AA20AEB}\(Default) = (no title provided) -> {HKLM...CLSID} = "Helper Class" \InProcServer32\(Default) = "C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll" [file not found] {F31B3634-12AA-41ca-B021-0685C3B3E4CA}\(Default) = (no title provided) -> {HKLM...CLSID} = "adssite" \InProcServer32\(Default) = "C:\WINDOWS\system32\nsd2F.dll" [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] "{A5110426-177D-4e08-AB3F-785F10B4439C}" = "Sony Ericsson File Manager" -> {HKLM...CLSID} = "Sony Ericsson File Manager" \InProcServer32\(Default) = "C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll" ["Sony Ericsson Mobile Communications AB"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Bartek91\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\Orbitron.scr" ["Sebastian Stoff"] Startup items in "Bartek91" & "All Users" startup folders: ---------------------------------------------------------- C:\Documents and Settings\Bartek91\Menu Start\Programy\Autostart "Adobe Gamma" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "TA_Start" -> shortcut to: "C:\Documents and Settings\Dzidek\Ustawienia lokalne\Temp\TICHA001.exe CHA001" [empty string] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe" [file not found] "Adobe Reader Synchronizer" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe" [null data] "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] Enabled Scheduled Tasks: ------------------------ "At1" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At10" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At100" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At101" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At102" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At103" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At104" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At105" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At106" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At107" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At108" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At109" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At11" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At110" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At111" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At112" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At113" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At114" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At115" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At116" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At117" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At118" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At119" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At12" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At120" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At121" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At122" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At123" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At124" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At125" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At126" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At127" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At128" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At129" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At13" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At130" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At131" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At132" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At133" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At134" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At135" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At136" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At137" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At138" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At139" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At14" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At140" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At141" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At142" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At143" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At144" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At145" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At146" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At147" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At148" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At149" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At15" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At150" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At151" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At152" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At153" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At154" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At155" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At156" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At157" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At158" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At159" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At16" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At160" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At161" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At162" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At163" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At164" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At165" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At166" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At167" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At168" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At169" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At17" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At170" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At171" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At172" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At173" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At174" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At175" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At176" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At177" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At178" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At179" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At18" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At180" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At181" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At182" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At183" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At184" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At185" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At186" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At187" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At188" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At189" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At19" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At190" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At191" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At192" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At2" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At20" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At21" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At22" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At23" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At24" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At25" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At26" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At27" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At28" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At29" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At3" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At30" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At31" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At32" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At33" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At34" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At35" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At36" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At37" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At38" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At39" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At4" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At40" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At41" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At42" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At43" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At44" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At45" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At46" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At47" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At48" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At49" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At5" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At50" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At51" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At52" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At53" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At54" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At55" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At56" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At57" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At58" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At59" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At6" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At60" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At61" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At62" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At63" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At64" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At65" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At66" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At67" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At68" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At69" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At7" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At70" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At71" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At72" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At73" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At74" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At75" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At76" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At77" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At78" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At79" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At8" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At80" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At81" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At82" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At83" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At84" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At85" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At86" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At87" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At88" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At89" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At9" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At90" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At91" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At92" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At93" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At94" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At95" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At96" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At97" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At98" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At99" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] "{5AA06644-BC46-4220-A460-47A6EB47C96D}" -> {HKLM...CLSID} = "NavExcel Toolbar" \InProcServer32\(Default) = "C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] "{4596013B-6C31-408B-A266-DEAE5C086DC2}" = "Share Accelerator MM Toolbar" -> {HKLM...CLSID} = "Share_Accelerator_MM toolbar" \InProcServer32\(Default) = "C:\Program Files\Share_Accelerator_MM\tbSha1.dll" ["Conduit Ltd."] "{5AA06644-BC46-4220-A460-47A6EB47C96D}" = (no title provided) -> {HKLM...CLSID} = "NavExcel Toolbar" \InProcServer32\(Default) = "C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll" [file not found] "{1D1B60FD-B21F-4B9A-8A5F-64E8544828D7}" = "Secured eMule Toolbar" -> {HKLM...CLSID} = "Secured_eMule toolbar" \InProcServer32\(Default) = "C:\Program Files\Secured_eMule\tbSecu.dll" ["Conduit Ltd."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{137E6E5E-A205-4657-A49F-1AB865787089}\(Default) = "SmartShopper" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" ["SmartShopper Networks"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."] {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF}\ "ButtonText" = "SmartShopper - Compare product prices" "CLSIDExtension" = "{2260D608-C844-435d-90FD-DC16CFA577F2}" -> {HKLM...CLSID} = "IEButton" \InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" ["SmartShopper Networks"] {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0}\ "ButtonText" = "SmartShopper - Compare travel rates" "CLSIDExtension" = "{BCEB373D-A35A-4200-BD43-8586CD9DFAE7}" -> {HKLM...CLSID} = "IEButtonA" \InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" ["SmartShopper Networks"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."] AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."] AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."] NMIndexingService, NMIndexingService, ""C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe"" ["Nero AG"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] ---------- (launch time: 2007-08-16 15:06:04) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 21 seconds. ---------- (total run time: 89 seconds)

**Posty:** 3854 · przez **Dzi@dek** 16 Sie 2007, 16:03

Usuń wszystko z katalogu:
C:\Documents and Settings\Dzidek\Ustawienia lokalne\Temp\*.*

Wyłącz przywracanie systemu i w trybie awaryjnym usuwasz wpisy w HJ:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
O2 - BHO: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
O2 - BHO: trafficninja.biz extension - {266A3562-AB67-480E-9F09-D54604FD817B} - C:\WINDOWS\system32\ninjaext.dll
O2 - BHO: SmartShopper - {2BA1C226-EC1B-4471-A65F-D0688AC6EE3A} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O2 - BHO: rightonadz.biz browser optimizer - {36A91CEC-6C71-4758-B492-397BFC8E96A2} - C:\WINDOWS\system32\gzmrotate.dll
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll
O2 - BHO: NavHelper Class - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} - C:\Program Files\NavExcel\NavHelper\v2.0.4a\NHelper.dll (file missing)
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll (file missing)
O2 - BHO: WebManager Class - {D5792AA9-D373-4039-8670-2CDAB6A71F15} - C:\Program Files\BitDownload\TorrentManager.dll (file missing)
O2 - BHO: Helper Class - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll (file missing)
O2 - BHO: adssite - {F31B3634-12AA-41ca-B021-0685C3B3E4CA} - C:\WINDOWS\system32\nsd2F.dll
O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll (file missing)
O3 - Toolbar: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [{E6-65-5D-DC-ZN}] C:\Documents and Settings\Dzidek\Ustawienia lokalne\Temp\TICHA001.exe CHA001
O4 - HKLM\..\Run: [adstart] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify
O4 - Startup: TA_Start.lnk = C:\Documents and Settings\Dzidek\Ustawienia lokalne\Temp\TICHA001.exe
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll

Pogrubione pliki lądują w koszu.

Autor postu otrzymał pochwałę

**Posty:** 443 · przez **Bartek91** 16 Sie 2007, 16:59

Wszystko usunięte, a co do tego:

Tom@szek napisał(a):O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll

Wpis znalazłem, a pliku WebAssist.dll w folderze Windows nie było

Daje logi dla pewności :roll:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:47:58, on 2007-08-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\BearShare\BearShare.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\vsnpstd3.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Ares\Ares.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Opera\Opera.exe D:\Programy\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing) O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] "Komunikator" = "C:\Program Files\Tlen.pl\tlen.exe" ["o2.pl Sp. z o.o."] "ares" = ""C:\Program Files\Ares\Ares.exe" -h" ["Ares Development Group"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."] "DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "BearShare" = ""C:\Program Files\BearShare\BearShare.exe" /pause" ["Free Peers, Inc."] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"" ["Sun Microsystems, Inc."] "snpstd3" = "C:\WINDOWS\vsnpstd3.exe" [empty string] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {4596013b-6c31-408b-a266-deae5c086dc2}\(Default) = (no title provided) -> {HKLM...CLSID} = "Share_Accelerator_MM toolbar" \InProcServer32\(Default) = "C:\Program Files\Share_Accelerator_MM\tbSha1.dll" ["Conduit Ltd."] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {CC59E0F9-7E43-44FA-9FAA-8377850BF205}\(Default) = (no title provided) -> {HKLM...CLSID} = "FDMIECookiesBHO Class" \InProcServer32\(Default) = "C:\Program Files\Free Download Manager\iefdmcks.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Bartek91\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\Orbitron.scr" ["Sebastian Stoff"] Startup items in "Bartek91" & "All Users" startup folders: ---------------------------------------------------------- C:\Documents and Settings\Bartek91\Menu Start\Programy\Autostart "Adobe Gamma" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe" [file not found] "Adobe Reader Synchronizer" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe" [null data] "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] Enabled Scheduled Tasks: ------------------------ "At1" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At10" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At100" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At101" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At102" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At103" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At104" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At105" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At106" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At107" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At108" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At109" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At11" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At110" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At111" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At112" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At113" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At114" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At115" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At116" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At117" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At118" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At119" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At12" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At120" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At121" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At122" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At123" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At124" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At125" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At126" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At127" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At128" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At129" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At13" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At130" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At131" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At132" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At133" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At134" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At135" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At136" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At137" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At138" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At139" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At14" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At140" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At141" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At142" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At143" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At144" -> launches: "C:\WINDOWS\system32\LY58xWIV.exe" [null data] "At145" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At146" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At147" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At148" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At149" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At15" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At150" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At151" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At152" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At153" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At154" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At155" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At156" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At157" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At158" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At159" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At16" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At160" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At161" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At162" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At163" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At164" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At165" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At166" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At167" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At168" -> launches: "C:\WINDOWS\system32\MdQ5LS12.exe" [null data] "At169" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At17" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At170" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At171" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At172" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At173" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At174" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At175" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At176" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At177" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At178" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At179" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At18" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At180" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At181" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At182" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At183" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At184" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At185" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At186" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At187" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At188" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At189" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At19" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At190" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At191" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At192" -> launches: "C:\WINDOWS\system32\JunHYt16.exe" [null data] "At2" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At20" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At21" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At22" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At23" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At24" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At25" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At26" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At27" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At28" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At29" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At3" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At30" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At31" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At32" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At33" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At34" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At35" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At36" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At37" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At38" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At39" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At4" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At40" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At41" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At42" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At43" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At44" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At45" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At46" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At47" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At48" -> launches: "C:\WINDOWS\system32\i5N7jA13.exe" [file not found] "At49" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At5" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At50" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At51" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At52" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At53" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At54" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At55" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At56" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At57" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At58" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At59" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At6" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At60" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At61" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At62" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At63" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At64" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At65" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At66" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At67" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At68" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At69" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At7" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At70" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At71" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At72" -> launches: "C:\WINDOWS\system32\t5rs6Op5.exe" [file not found] "At73" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At74" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At75" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At76" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At77" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At78" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At79" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At8" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At80" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At81" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At82" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At83" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At84" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At85" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At86" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At87" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At88" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At89" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At9" -> launches: "C:\WINDOWS\system32\HwAC3tCH.exe" [file not found] "At90" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At91" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At92" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At93" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At94" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At95" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At96" -> launches: "C:\WINDOWS\system32\82Q22J0o.exe" [file not found] "At97" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At98" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] "At99" -> launches: "C:\WINDOWS\system32\XyRYp7H2.exe" [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] "{5AA06644-BC46-4220-A460-47A6EB47C96D}" -> {HKLM...CLSID} = "NavExcel Toolbar" \InProcServer32\(Default) = "C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] "{4596013B-6C31-408B-A266-DEAE5C086DC2}" = "Share Accelerator MM Toolbar" -> {HKLM...CLSID} = "Share_Accelerator_MM toolbar" \InProcServer32\(Default) = "C:\Program Files\Share_Accelerator_MM\tbSha1.dll" ["Conduit Ltd."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{137E6E5E-A205-4657-A49F-1AB865787089}\(Default) = "SmartShopper" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" [file not found] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."] {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF}\ "ButtonText" = "SmartShopper - Compare product prices" "CLSIDExtension" = "{2260D608-C844-435d-90FD-DC16CFA577F2}" -> {HKLM...CLSID} = "IEButton" \InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" [file not found] {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0}\ "ButtonText" = "SmartShopper - Compare travel rates" "CLSIDExtension" = "{BCEB373D-A35A-4200-BD43-8586CD9DFAE7}" -> {HKLM...CLSID} = "IEButtonA" \InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" [file not found] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."] AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."] AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."] NMIndexingService, NMIndexingService, ""C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe"" ["Nero AG"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] ---------- (launch time: 2007-08-16 16:48:30) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 173 seconds. ---------- (total run time: 245 seconds)

**Posty:** 18165 · przez **wojtas** 16 Sie 2007, 17:45

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz te skanery po kilka razy

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

potem nowy log z hijacka, silenta oraz z combofixa

jak sie nie zmieszcza umiesc na rapida

**Posty:** 443 · przez **Bartek91** 17 Sie 2007, 12:59

Witam. Zrobiłem to co kazałeś. Wszystkie te 3 skanery poszły po 3 razy i nic nie znalazły, lecz dzisiaj rano AVG wywaliło 3 powiadomienia o tym samaym trojanie, o którym pisałem w pierwszym poście

. Logi

**Posty:** 18165 · przez **wojtas** 17 Sie 2007, 16:59

wszystko robisz w awaryjnym z wylaczonym przywracaniem systemu:

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

C:\WINDOWS\B6D5E63DEFF546169DB706D08F10B0C0.TMP
C:\WINDOWS\system32\MdQ5LS12.exe
C:\WINDOWS\system32\JunHYt16.exe
C:\WINDOWS\system32\LY58xWIV.exe
C:\Temp\cenzura!.exe
C:\WINDOWS\system32\adssite-remove.exe
C:\DOCUME~1\Dzidek\DANEAP~1\SmartShopper
O2 - BHO: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
O3 - Toolbar: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)

najpierw skasuj wpisy potem pogrubione do kosza;

w panelu sterowania znajdz zaplanowane zadania i skasuj wszystkie zadania

potem te pliki (beda raczej ukryte)

C:\WINDOWS\system32\40C1F8C331.dll
C:\WINDOWS\system32\flvDX.dll
C:\WINDOWS\system32\msfDX.dll

skanujesz tu:

http://virusscan.jotti.org/
http://www.virustotal.com/

dajesz wszystkie nowe logi i raporty ze skanerow

**Posty:** 443 · przez **Bartek91** 17 Sie 2007, 22:21

Witam. Wszytko zrobione, tak jak kazałeś lecz jest jedno ale

wojtas19162 napisał(a):C:\WINDOWS\system32\MdQ5LS12.exe
C:\WINDOWS\system32\JunHYt16.exe
C:\WINDOWS\system32\LY58xWIV.exe
C:\WINDOWS\system32\adssite-remove.exe

Tych plikow nie znalazłem :roll:

Logi i raporty

**Posty:** 18165 · przez **wojtas** 18 Sie 2007, 14:38

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\system32\adssite-remove.exe

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

potem skasuj wpisy + pogrubiony jesli bedzie

O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)

**Posty:** 443 · przez **Bartek91** 18 Sie 2007, 15:11

Logi Wszystko zrobione.

**Posty:** 3854 · przez **Dzi@dek** 18 Sie 2007, 15:42

wojtas19162 napisał(a):potem skasuj wpisy + pogrubiony jesli bedzie
Cytat:

O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)

Siedza dalej te wpisy.

**Posty:** 443 · przez **Bartek91** 18 Sie 2007, 15:51

Tom@szek Ja o tym wiem tylko one za nic nie chcą się skasować. Włączam Fix checked jak zawsze a tu nic (oczywiście mam je zaznaczone)... :roll:

**Posty:** 3854 · przez **Dzi@dek** 18 Sie 2007, 15:55

C:\!KillBox
Usuń ten folder jeszcze i poczekaj na wojtas19162.

[ Dodano: Dzisiaj o 16:08 ]
Otwórz notatnik i wklej:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\ {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF}] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\ {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru

**Posty:** 443 · przez **Bartek91** 18 Sie 2007, 16:44

Kod: Zaznacz wszystko: ComboFix 07-08-14.4 - "Bartek91" 2007-08-18 16:28:47.4 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.315 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 ))))))))))))))))))))))))))))))) 2007-08-17 20:55 <DIR> d--hs---- C:\WINDOWS\CSC 2007-08-17 08:21 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-16 21:47 <DIR> d-------- C:\VundoFix Backups 2007-08-16 21:42 1,872 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-16 21:37 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-16 21:37 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-16 21:37 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-14 15:58 87,824 -ra------ C:\WINDOWS\system32\drivers\k310mgmt.sys 2007-08-14 15:58 85,696 -ra------ C:\WINDOWS\system32\drivers\k310obex.sys 2007-08-14 13:23 96,352 -ra------ C:\WINDOWS\system32\drivers\k310mdm.sys 2007-08-14 13:23 9,264 -ra------ C:\WINDOWS\system32\drivers\k310mdfl.sys 2007-08-14 13:23 60,800 -ra------ C:\WINDOWS\system32\drivers\k310bus.sys 2007-08-14 13:23 6,208 -ra------ C:\WINDOWS\system32\drivers\k310cmnt.sys 2007-08-14 13:23 6,208 -ra------ C:\WINDOWS\system32\drivers\k310cm.sys 2007-08-14 13:23 5,840 -ra------ C:\WINDOWS\system32\drivers\k310whnt.sys 2007-08-14 13:23 5,840 -ra------ C:\WINDOWS\system32\drivers\k310wh.sys 2007-08-13 07:06 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Trymedia 2007-08-12 22:16 59,904 --a------ C:\WINDOWS\system32\Mscc2fr.dll 2007-08-12 22:16 21,504 --a------ C:\WINDOWS\system32\TABCTFR.DLL 2007-08-12 22:16 15,360 --a------ C:\WINDOWS\system32\inetfr.DLL 2007-08-12 22:16 141,312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL 2007-08-12 22:16 119,568 --a------ C:\WINDOWS\system32\VB6FR.DLL 2007-08-12 22:15 32,768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL 2007-08-12 12:48 <DIR> d-------- C:\Program Files\Microids 2007-08-12 12:11 <DIR> d-------- C:\DOCUME~1\Dzidek\DANEAP~1\GetRightToGo 2007-08-11 19:53 <DIR> d-------- C:\Virtual 2007-08-11 19:50 <DIR> d-------- C:\Program Files\Secured eMule 2007-08-11 19:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\BufferZone 2007-08-11 18:58 <DIR> d-------- C:\DOCUME~1\Dzidek\DANEAP~1\Gadu-Gadu 2007-08-10 18:56 <DIR> d-------- C:\Program Files\BitTorrent Fastest Tool 2007-08-10 18:56 <DIR> d-------- C:\Program Files\BitDownload 2007-08-10 17:40 <DIR> d-------- C:\DOCUME~1\Dzidek\Gadu-Gadu 2007-08-10 15:00 <DIR> d-------- C:\Program Files\GameFlood 2007-08-08 10:14 110,080 --a------ C:\WINDOWS\system32\Orbitron.scr 2007-08-08 10:14 <DIR> d-------- C:\Program Files\Orbitron 2007-07-25 12:49 <DIR> d-------- C:\direct (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-17 23:18 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\foobar2000 2007-08-17 13:55 --------- d-------- C:\Program Files\Mozilla Thunderbird 2007-08-17 13:05 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\Tlen.pl 2007-08-16 16:36 --------- d-------- C:\Program Files\NavExcel 2007-08-16 15:32 --------- d-------- C:\Program Files\Sony Ericsson 2007-08-15 08:42 --------- d-------- C:\Program Files\Gadu-Gadu1 2007-08-13 19:04 --------- d-------- C:\Program Files\Winamp 2007-08-11 17:47 --------- d-------- C:\Program Files\JoWood 2007-08-11 12:45 --------- d-------- C:\Program Files\LIVEUPDATE 2007-08-09 00:48 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\Free Download Manager 2007-07-25 19:39 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\ATI 2007-07-11 00:19 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\uk.co.planetside 2007-07-10 23:58 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\Planetside Software 2007-06-29 15:58 --------- d-------- C:\Program Files\Opera 2007-06-29 15:58 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\Opera 2007-06-25 15:42 --------- d-------- C:\Program Files\Ligos 2007-06-25 08:35 --------- d-------- C:\Program Files\Heavyweight Thunder 2007-06-24 22:54 --------- d-------- C:\Program Files\Kurka Wodna 2007-06-21 19:28 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-06-18 17:03 --------- d-------- C:\Program Files\Apophysis 2.0 2007-06-18 16:19 --------- d-------- C:\Program Files\Ultra Fractal 4 2007-06-06 21:54 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-02-04 16:44:05 80 --sh--r C:\WINDOWS\system32\40C1F8C331.dll 2006-05-03 09:06:54 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 10:47:16 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{5AA06644-BC46-4220-A460-47A6EB47C96D}"= C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll [ ] [HKEY_CLASSES_ROOT\CLSID\{5AA06644-BC46-4220-A460-47A6EB47C96D}] [HKEY_CLASSES_ROOT\NavExcelBar.NavExcelBarObj.1] [HKEY_CLASSES_ROOT\TypeLib\{5297E905-1DFB-4A9C-9871-A4F95FD58945}] [HKEY_CLASSES_ROOT\NavExcelBar.NavExcelBarObj] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-08-16 10:40] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-11-09 00:00] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [2006-08-01 18:04] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "snpstd3"="C:\WINDOWS\vsnpstd3.exe" [2005-09-05 09:55] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 17:14] "Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [2007-02-12 12:01] "ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 02:32] C:\Documents and Settings\Bartek91\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-01-29 10:46:10] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Notification Packages"= scecli scecli R0 ndisrd;ndisrd;C:\WINDOWS\system32\drivers\ndisrd.sys R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS S3 k310bus;Sony Ericsson K310 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k310bus.sys S3 k310mdfl;Sony Ericsson K310 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k310mdfl.sys S3 k310mdm;Sony Ericsson K310 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k310mdm.sys S3 k310mgmt;Sony Ericsson K310 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k310mgmt.sys S3 k310obex;Sony Ericsson K310 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k310obex.sys S3 nsysaudm;nsysaudm;\??\C:\DOCUME~1\Kacper\USTAWI~1\Temp\nsysaudm.sys S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-18 16:29:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-18 16:30:06 C:\ComboFix-quarantined-files.txt ... 2007-08-18 16:29 C:\ComboFix2.txt ... 2007-08-18 15:02 C:\ComboFix3.txt ... 2007-08-17 22:10 --- E O F ---

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] "Komunikator" = "C:\Program Files\Tlen.pl\tlen.exe" ["o2.pl Sp. z o.o."] "ares" = ""C:\Program Files\Ares\Ares.exe" -h" ["Ares Development Group"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."] "DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "BearShare" = ""C:\Program Files\BearShare\BearShare.exe" /pause" ["Free Peers, Inc."] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"" ["Sun Microsystems, Inc."] "snpstd3" = "C:\WINDOWS\vsnpstd3.exe" [empty string] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {CC59E0F9-7E43-44FA-9FAA-8377850BF205}\(Default) = (no title provided) -> {HKLM...CLSID} = "FDMIECookiesBHO Class" \InProcServer32\(Default) = "C:\Program Files\Free Download Manager\iefdmcks.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Bartek91" & "All Users" startup folders: ---------------------------------------------------------- C:\Documents and Settings\Bartek91\Menu Start\Programy\Autostart "Adobe Gamma" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe" [file not found] "Adobe Reader Synchronizer" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe" [null data] "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] "{5AA06644-BC46-4220-A460-47A6EB47C96D}" -> {HKLM...CLSID} = "NavExcel Toolbar" \InProcServer32\(Default) = "C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{137E6E5E-A205-4657-A49F-1AB865787089}\(Default) = "SmartShopper" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" [file not found] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."] {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF}\ "ButtonText" = "SmartShopper - Compare product prices" "CLSIDExtension" = "{2260D608-C844-435d-90FD-DC16CFA577F2}" -> {HKLM...CLSID} = "IEButton" \InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" [file not found] {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0}\ "ButtonText" = "SmartShopper - Compare travel rates" "CLSIDExtension" = "{BCEB373D-A35A-4200-BD43-8586CD9DFAE7}" -> {HKLM...CLSID} = "IEButtonA" \InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" [file not found] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] All Non-Disabled Services (Display Name, Service Name, Path {Service DLL}): --------------------------------------------------------------------------- Adobe LM Service, Adobe LM Service, ""C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"" ["Adobe Systems"] Ares Chatroom server, AresChatServer, "C:\Program Files\Ares\chatServer.exe" ["Ares Development Group"] ASP.NET State Service, aspnet_state, "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe" [MS] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] ATI Smart, ATI Smart, "C:\WINDOWS\system32\ati2sgag.exe" [empty string] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."] AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."] AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."] Karta wydajności WMI, WmiApSrv, "C:\WINDOWS\System32\wbem\wmiapsrv.exe" [MS] NBService, NBService, "C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe" ["Nero AG"] NMIndexingService, NMIndexingService, ""C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe"" ["Nero AG"] Usługa administracyjna Menedżera dysków logicznych, dmadmin, "C:\WINDOWS\System32\dmadmin.exe /com" ["Microsoft Corp., Veritas Software"] Usługa dostarczania sieci, xmlprov, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\xmlprov.dll" [MS]} Usługa numeru seryjnego multimediów przenośnych, WmdmPmSN, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\MsPMSNSv.dll" [MS]} Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] ---------- (launch time: 2007-08-18 16:35:31) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 17 seconds. ---------- (total run time: 70 seconds)

Kod: Zaznacz wszystko

Kod: Zaznacz wszystko: [size=75][ [i][b][color=#B50158]Dodano:[/b] Dzisiaj o 16:44[/i] ][/size] [/color] [code]ComboFix 07-08-14.4 - "Bartek91" 2007-08-18 16:28:47.4 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.315 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 ))))))))))))))))))))))))))))))) 2007-08-17 20:55 <DIR> d--hs---- C:\WINDOWS\CSC 2007-08-17 08:21 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-16 21:47 <DIR> d-------- C:\VundoFix Backups 2007-08-16 21:42 1,872 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-16 21:37 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-16 21:37 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-16 21:37 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-14 15:58 87,824 -ra------ C:\WINDOWS\system32\drivers\k310mgmt.sys 2007-08-14 15:58 85,696 -ra------ C:\WINDOWS\system32\drivers\k310obex.sys 2007-08-14 13:23 96,352 -ra------ C:\WINDOWS\system32\drivers\k310mdm.sys 2007-08-14 13:23 9,264 -ra------ C:\WINDOWS\system32\drivers\k310mdfl.sys 2007-08-14 13:23 60,800 -ra------ C:\WINDOWS\system32\drivers\k310bus.sys 2007-08-14 13:23 6,208 -ra------ C:\WINDOWS\system32\drivers\k310cmnt.sys 2007-08-14 13:23 6,208 -ra------ C:\WINDOWS\system32\drivers\k310cm.sys 2007-08-14 13:23 5,840 -ra------ C:\WINDOWS\system32\drivers\k310whnt.sys 2007-08-14 13:23 5,840 -ra------ C:\WINDOWS\system32\drivers\k310wh.sys 2007-08-13 07:06 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Trymedia 2007-08-12 22:16 59,904 --a------ C:\WINDOWS\system32\Mscc2fr.dll 2007-08-12 22:16 21,504 --a------ C:\WINDOWS\system32\TABCTFR.DLL 2007-08-12 22:16 15,360 --a------ C:\WINDOWS\system32\inetfr.DLL 2007-08-12 22:16 141,312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL 2007-08-12 22:16 119,568 --a------ C:\WINDOWS\system32\VB6FR.DLL 2007-08-12 22:15 32,768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL 2007-08-12 12:48 <DIR> d-------- C:\Program Files\Microids 2007-08-12 12:11 <DIR> d-------- C:\DOCUME~1\Dzidek\DANEAP~1\GetRightToGo 2007-08-11 19:53 <DIR> d-------- C:\Virtual 2007-08-11 19:50 <DIR> d-------- C:\Program Files\Secured eMule 2007-08-11 19:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\BufferZone 2007-08-11 18:58 <DIR> d-------- C:\DOCUME~1\Dzidek\DANEAP~1\Gadu-Gadu 2007-08-10 18:56 <DIR> d-------- C:\Program Files\BitTorrent Fastest Tool 2007-08-10 18:56 <DIR> d-------- C:\Program Files\BitDownload 2007-08-10 17:40 <DIR> d-------- C:\DOCUME~1\Dzidek\Gadu-Gadu 2007-08-10 15:00 <DIR> d-------- C:\Program Files\GameFlood 2007-08-08 10:14 110,080 --a------ C:\WINDOWS\system32\Orbitron.scr 2007-08-08 10:14 <DIR> d-------- C:\Program Files\Orbitron 2007-07-25 12:49 <DIR> d-------- C:\direct (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-17 23:18 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\foobar2000 2007-08-17 13:55 --------- d-------- C:\Program Files\Mozilla Thunderbird 2007-08-17 13:05 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\Tlen.pl 2007-08-16 16:36 --------- d-------- C:\Program Files\NavExcel 2007-08-16 15:32 --------- d-------- C:\Program Files\Sony Ericsson 2007-08-15 08:42 --------- d-------- C:\Program Files\Gadu-Gadu1 2007-08-13 19:04 --------- d-------- C:\Program Files\Winamp 2007-08-11 17:47 --------- d-------- C:\Program Files\JoWood 2007-08-11 12:45 --------- d-------- C:\Program Files\LIVEUPDATE 2007-08-09 00:48 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\Free Download Manager 2007-07-25 19:39 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\ATI 2007-07-11 00:19 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\uk.co.planetside 2007-07-10 23:58 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\Planetside Software 2007-06-29 15:58 --------- d-------- C:\Program Files\Opera 2007-06-29 15:58 --------- d-------- C:\DOCUME~1\Bartek91\DANEAP~1\Opera 2007-06-25 15:42 --------- d-------- C:\Program Files\Ligos 2007-06-25 08:35 --------- d-------- C:\Program Files\Heavyweight Thunder 2007-06-24 22:54 --------- d-------- C:\Program Files\Kurka Wodna 2007-06-21 19:28 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-06-18 17:03 --------- d-------- C:\Program Files\Apophysis 2.0 2007-06-18 16:19 --------- d-------- C:\Program Files\Ultra Fractal 4 2007-06-06 21:54 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-02-04 16:44:05 80 --sh--r C:\WINDOWS\system32\40C1F8C331.dll 2006-05-03 09:06:54 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 10:47:16 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{5AA06644-BC46-4220-A460-47A6EB47C96D}"= C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll [ ] [HKEY_CLASSES_ROOT\CLSID\{5AA06644-BC46-4220-A460-47A6EB47C96D}] [HKEY_CLASSES_ROOT\NavExcelBar.NavExcelBarObj.1] [HKEY_CLASSES_ROOT\TypeLib\{5297E905-1DFB-4A9C-9871-A4F95FD58945}] [HKEY_CLASSES_ROOT\NavExcelBar.NavExcelBarObj] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-08-16 10:40] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-11-09 00:00] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [2006-08-01 18:04] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "snpstd3"="C:\WINDOWS\vsnpstd3.exe" [2005-09-05 09:55] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 17:14] "Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [2007-02-12 12:01] "ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 02:32] C:\Documents and Settings\Bartek91\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-01-29 10:46:10] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Notification Packages"= scecli scecli R0 ndisrd;ndisrd;C:\WINDOWS\system32\drivers\ndisrd.sys R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS S3 k310bus;Sony Ericsson K310 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k310bus.sys S3 k310mdfl;Sony Ericsson K310 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k310mdfl.sys S3 k310mdm;Sony Ericsson K310 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k310mdm.sys S3 k310mgmt;Sony Ericsson K310 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k310mgmt.sys S3 k310obex;Sony Ericsson K310 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k310obex.sys S3 nsysaudm;nsysaudm;\??\C:\DOCUME~1\Kacper\USTAWI~1\Temp\nsysaudm.sys S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-18 16:29:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-18 16:30:06 C:\ComboFix-quarantined-files.txt ... 2007-08-18 16:29 C:\ComboFix2.txt ... 2007-08-18 15:02 C:\ComboFix3.txt ... 2007-08-17 22:10 --- E O F ---[/code] [code]"Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] "Komunikator" = "C:\Program Files\Tlen.pl\tlen.exe" ["o2.pl Sp. z o.o."] "ares" = ""C:\Program Files\Ares\Ares.exe" -h" ["Ares Development Group"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."] "DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "BearShare" = ""C:\Program Files\BearShare\BearShare.exe" /pause" ["Free Peers, Inc."] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"" ["Sun Microsystems, Inc."] "snpstd3" = "C:\WINDOWS\vsnpstd3.exe" [empty string] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {CC59E0F9-7E43-44FA-9FAA-8377850BF205}\(Default) = (no title provided) -> {HKLM...CLSID} = "FDMIECookiesBHO Class" \InProcServer32\(Default) = "C:\Program Files\Free Download Manager\iefdmcks.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Bartek91" & "All Users" startup folders: ---------------------------------------------------------- C:\Documents and Settings\Bartek91\Menu Start\Programy\Autostart "Adobe Gamma" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe" [file not found] "Adobe Reader Synchronizer" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe" [null data] "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] "{5AA06644-BC46-4220-A460-47A6EB47C96D}" -> {HKLM...CLSID} = "NavExcel Toolbar" \InProcServer32\(Default) = "C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{137E6E5E-A205-4657-A49F-1AB865787089}\(Default) = "SmartShopper" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" [file not found] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."] {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF}\ "ButtonText" = "SmartShopper - Compare product prices" "CLSIDExtension" = "{2260D608-C844-435d-90FD-DC16CFA577F2}" -> {HKLM...CLSID} = "IEButton" \InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" [file not found] {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0}\ "ButtonText" = "SmartShopper - Compare travel rates" "CLSIDExtension" = "{BCEB373D-A35A-4200-BD43-8586CD9DFAE7}" -> {HKLM...CLSID} = "IEButtonA" \InProcServer32\(Default) = "C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll" [file not found] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] All Non-Disabled Services (Display Name, Service Name, Path {Service DLL}): --------------------------------------------------------------------------- Adobe LM Service, Adobe LM Service, ""C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"" ["Adobe Systems"] Ares Chatroom server, AresChatServer, "C:\Program Files\Ares\chatServer.exe" ["Ares Development Group"] ASP.NET State Service, aspnet_state, "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe" [MS] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] ATI Smart, ATI Smart, "C:\WINDOWS\system32\ati2sgag.exe" [empty string] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."] AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."] AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."] Karta wydajności WMI, WmiApSrv, "C:\WINDOWS\System32\wbem\wmiapsrv.exe" [MS] NBService, NBService, "C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe" ["Nero AG"] NMIndexingService, NMIndexingService, ""C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe"" ["Nero AG"] Usługa administracyjna Menedżera dysków logicznych, dmadmin, "C:\WINDOWS\System32\dmadmin.exe /com" ["Microsoft Corp., Veritas Software"] Usługa dostarczania sieci, xmlprov, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\xmlprov.dll" [MS]} Usługa numeru seryjnego multimediów przenośnych, WmdmPmSN, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\MsPMSNSv.dll" [MS]} Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] ---------- (launch time: 2007-08-18 16:35:31) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 17 seconds. ---------- (total run time: 70 seconds)[/code] [code]

[code]

**Posty:** 3854 · przez **Dzi@dek** 18 Sie 2007, 16:55

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{137E6E5E-A205-4657-A49F-1AB865787089}]=- [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\ {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF}]=- [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\ {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0}]=-

plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru

wojtas19162 napisał(a):O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)

I te wpisy w HJ jesli będą.

**Posty:** 443 · przez **Bartek91** 18 Sie 2007, 17:13

Tom@szek napisał(a):O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)

To nadal siedzi i nie zamierza wyjść :1:

**Posty:** 3854 · przez **Dzi@dek** 18 Sie 2007, 17:16

Restartowałeś system :?:

jeśli nie zrestartuj.
Czy były jakieś informacje przy zastosowaniu FIX.REG :?:

**Posty:** 443 · przez **Bartek91** 18 Sie 2007, 17:32

Tom@szek napisał(a):Restartowałeś system

Tak

Tom@szek napisał(a):Czy były jakieś informacje przy zastosowaniu FIX.REG

Najpierw pyało czy dodać, a później, potwierdzenie dodania.

**Posty:** 18165 · przez **wojtas** 18 Sie 2007, 19:32

a spruboj skasowac wpisy w trybie awaryjnym z wylaczonym przywracaniem

**Posty:** 443 · przez **Bartek91** 19 Sie 2007, 10:04

wojtas19162 napisał(a):a spruboj skasowac wpisy w trybie awaryjnym z wylaczonym przywracaniem

Od razu robiłem to w awaryjnym i bez przywracania i nic, spróbowałem też normalnie i to samo :roll:

**Posty:** 18165 · przez **wojtas** 19 Sie 2007, 10:29

start >uruchom >regedit przejdz do klucza:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions

i usun:

{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF}
{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0}

oraz do klucza i usun pogrubiony:

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{137E6E5E-A205-4657-A49F-1AB865787089}]

proszę o sprwdzenie

Proszę o sprwdzenie

Kto jest na forum