gdy wchodzę u was na dział (lub inne forum) "System Windows" wyłącza mi sie przeglądarka - czy to Opera czy to IE po prostu sie zamyka
Czym to jest spowodowane?
Aktualizacje na programosy.pl:
Maxthon Cloud Browser • Far Manager • reaConverter Lite • Alternate Pic View • WashAndGo • YT Downloader • SmartFTP • ChrisPC YTD Downloader MP3 Converter • Syncovery
-
- Ogłoszenie:
przeglądarki sie zamykają
26 posty(ów) • Strona 1 z 2 • 1, 2
przeglądarki sie zamykają
przez serenity15 25 Cze 2007, 22:35
gdy wchodzę u was na dział (lub inne forum) "System Windows" wyłącza mi sie przeglądarka - czy to Opera czy to IE po prostu sie zamyka
Czym to jest spowodowane?
-
serenity15 - ~user
- Posty: 596
- Dołączenie: 16 Cze 2005, 21:04
- Pochwały: 13
przez serenity15 26 Cze 2007, 12:46
nie nie znam sie na logach
wrzucic je tu czy do działu bezpieczenstwo?
wrzucic je tu czy do działu bezpieczenstwo?
-
serenity15 - ~user
- Posty: 596
- Dołączenie: 16 Cze 2005, 21:04
- Pochwały: 13
-
przez serenity15 26 Cze 2007, 14:58
Niesety Hijack This mi sie nie chce odpalic 
poprostu nic sie nie dzieje
Daje wiec loga z Silent Runners
poprostu nic sie nie dzieje
Daje wiec loga z Silent Runners
- Kod: Zaznacz wszystko
"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"AdslTaskBar" = "rundll32.exe stmctrl.dll,TaskBar" [MS]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"(Default)" = "(empty string)" [file not found]
"htocusa" = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
"bhbsdrx" = "C:\Program Files\Common Files\System\tnmgncd.exe" [null data]
"AVPSrv" = "C:\WINDOWS\AVPSrv.exe" [null data]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture"
-> {HKLM...CLSID} = "BitComet Helper"
\InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO.dll" [null data]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Groove GFS Browser Helper"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]
{AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Conversion Toolbar Helper"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AxShlex.dll" ["Alcohol Soft Development Team"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"
-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"
-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper"
-> {HKLM...CLSID} = "Groove GFS Browser Helper"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar"
-> {HKLM...CLSID} = "Groove Folder Synchronization"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler"
-> {HKLM...CLSID} = "Groove GFS Stub Icon Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
-> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler"
-> {HKLM...CLSID} = "Groove XML Icon Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {HKLM...CLSID} = "Microsoft Office Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS]
"{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
-> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"
-> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
-> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
<<!>> "{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}" = (no title provided)
-> {HKLM...CLSID} = "Microsoft Data Tools Query Designe"
\InProcServer32\(Default) = "C:\WINDOWS\system32\scandisk.dll" [null data]
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
<<!>> "System" = "kdidg.exe" [null data]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
<<!>> 360rpt.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> 360Safe.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> 360tray.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> adam.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> AgentSvr.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> AppSvc32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> ArSwp.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> AST.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> autoruns.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> avconsol.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> avgrssvc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> AvMonitor.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> avp.com\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> avp.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> CCenter.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> ccSvcHst.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> EGHOST.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> FileDsty.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> FTCleanerShell.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> FYFireWall.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> HijackThis.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> IceSword.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> iparmo.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Iparmor.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> isPwdSvc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> kabaload.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KaScrScn.SCR\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KASMain.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KASTask.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAV32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAVDX.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAVPF.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAVPFW.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAVSetup.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAVStart.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KISLnchr.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KMailMon.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KMFilter.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KPFW32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KPFW32X.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KPfwSvc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KRegEx.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KRepair.com\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KsLoader.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVCenter.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KvDetect.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KvfwMcl.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVMonXP.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVMonXP_1.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> kvol.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> kvolself.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KvReport.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVScan.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVSrvXP.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVStub.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> kvupload.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> kvwsc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KvXP.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KvXP_1.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KWatch.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KWatch9x.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KWatchX.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> loaddll.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> MagicSet.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> mcconsol.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> mmqczj.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> mmsk.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Navapsvc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Navapw32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> nod32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> nod32krn.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> nod32kui.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> NPFMntor.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> PFW.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> PFWLiveUpdate.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> QHSET.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> QQDoctor.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> QQKav.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Ras.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Rav.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RavMon.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RavMonD.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RavStub.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RavTask.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RegClean.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> rfwcfg.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> rfwmain.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> rfwsrv.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RsAgent.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Rsaupd.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> rstrui.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> runiep.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> safelive.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> scan32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> shcfg32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> SmartUp.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> SREng.EXE\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> symlcsvc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> SysSafe.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> TrojanDetector.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Trojanwall.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> TrojDie.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UIHost.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UmxAgent.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UmxAttachment.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UmxCfg.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UmxFwHlp.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UmxPol.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> upiea.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UpLive.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> USBCleaner.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> vsstat.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> webscanx.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> WoptiClean.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]
HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
-> {HKLM...CLSID} = "NeroCoverEdContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------
Note: detected settings may not have any effect.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Sailor Moon Stars.SERENITY\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{0D704FAD-66E9-4F0A-BFED-4F665770DDB3}" = (no title provided)
-> {HKLM...CLSID} = "&Tłumaczenie"
\InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
Explorer Bars
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
HKLM\Software\Classes\CLSID\{175556B1-4D91-4E9A-9C4B-D6888D5DEE6C}\(Default) = "&Ramka Tłumaczenia"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]
HKLM\Software\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
HKLM\Software\Classes\CLSID\{D553F157-2AB0-4B46-98D2-7BA7CA418491}\(Default) = "&Słownik Podręczny"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]
HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_01"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_01"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."]
{2670000A-7350-4F3C-8081-5663EE0C6C49}\
"ButtonText" = "Wyślij do programu OneNote"
"MenuText" = "Wyślij &do programu OneNote"
"CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}"
-> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll" [MS]
{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"
{B46B0919-62BA-4D99-A5C4-916B57A6805C}\
"MenuText" = "@C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103"
"CLSIDExtension" = "{B46B0919-62BA-4D99-A5C4-916B57A6805C}"
-> {HKLM...CLSID} = "InternetTranslatorProperties Class"
\InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\CyberLink\Shared files\RichVideo.exe"" [empty string]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NMIndexingService, NMIndexingService, ""C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe"" ["Nero AG"]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Print Monitors:
---------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
5200 Series Port\Driver = "lxbtlmpm.DLL" ["Lexmark International, Inc."]
Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" ["Adobe Systems Incorporated."]
Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS]
----------
<<!>>: Suspicious data at a malware launch point.
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 115 seconds.
---------- (total run time: 163 seconds)
-
serenity15 - ~user
- Posty: 596
- Dołączenie: 16 Cze 2005, 21:04
- Pochwały: 13
-
przez wojtas 26 Cze 2007, 15:19
daj loga z:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
oraz z tego hijacka:
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/tools/hijackthis.com
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
oraz z tego hijacka:
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/tools/hijackthis.com
-
wojtas - *mod
- Posty: 18165
- Dołączenie: 13 Sty 2006, 16:00
- Miejscowość: Krzeszyce
- Pochwały: 1656
przez serenity15 26 Cze 2007, 16:27
- Kod: Zaznacz wszystko
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\SAILOR~1.SER\DANEAP~1.\addon.dat
C:\Program Files\meex.exe
C:\WINDOWS\avpsrv.exe
C:\WINDOWS\kb726255.log
C:\WINDOWS\system32\avpsrv.dll
C:\WINDOWS\system32\checkfile.dll
C:\WINDOWS\system32\dllhost32.exe
C:\WINDOWS\system32\kdidg.exe
C:\WINDOWS\system32\lyloader.exe
C:\WINDOWS\system32\mydata.exe
C:\WINDOWS\system32\scandisk.dll
((((((((((((((((((((((((( Files Created from 2007-05-26 to 2007-06-26 )))))))))))))))))))))))))))))))
2007-06-26 15:55 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-26 01:05 9,548 --a------ C:\Program Files\pro4.exe
2007-06-26 01:05 18,636 --a------ C:\Program Files\pro3.exe
2007-06-26 01:05 17,600 --a------ C:\Program Files\pro7.exe
2007-06-26 01:05 13,600 --a------ C:\Program Files\pro9.exe
2007-06-26 01:05 12,564 --a------ C:\Program Files\pro5.exe
2007-06-26 01:05 12,204 --a------ C:\Program Files\pro2.exe
2007-06-26 01:04 23,090 --a------ C:\WINDOWS\system32\Lysvr.exe
2007-06-26 01:04 19,892 --a------ C:\Program Files\pro1.exe
2007-06-22 20:54 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-06-22 20:54 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-06-18 19:35 42,496 --a------ C:\WINDOWS\system32\cenzura-spam.dat
2007-06-18 18:44 10,696 --a------ C:\WINDOWS\system32\nwizqjsj.exe
2007-06-18 18:43 25,824 ---hs---- C:\Program Files\meex.exe
2007-06-17 13:12 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-06-17 13:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1\FLEXnet
2007-06-15 22:12 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-06-13 23:32 <DIR> d-------- C:\Downloads
2007-05-26 13:17 <DIR> d-------- C:\Program Files\Real
2007-05-26 13:17 <DIR> d-------- C:\Program Files\Common Files\Real
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-26 13:58:21 -------- d-----w C:\Program Files\AutoConnect
2007-06-24 21:11:25 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-24 16:39:03 -------- d-----w C:\Program Files\NAPI-PROJEKT
2007-06-22 08:28:03 -------- d-----w C:\Program Files\eMule
2007-06-20 09:18:00 -------- d-----w C:\Program Files\Opera
2007-06-17 01:11:54 -------- d-----w C:\Program Files\BitComet
2007-06-15 20:15:19 -------- d-----w C:\DOCUME~1\SAILOR~1.SER\DANEAP~1\Real
2007-06-12 22:43:58 -------- d-----w C:\Program Files\Gadu-Gadu
2007-05-23 15:08:20 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-05-22 17:30:55 -------- d-----w C:\Program Files\Common Files\Ahead
2007-05-19 16:53:29 -------- d-----w C:\DOCUME~1\SAILOR~1.SER\DANEAP~1\Opera
2007-05-18 08:56:21 -------- d-----w C:\Program Files\SpeedSim
2007-05-16 17:46:57 -------- d-----w C:\Program Files\Winamp
2007-05-16 16:12:14 133,168 ----a-w C:\WINDOWS\system32\drivers\imagesrv.sys
2007-05-16 16:12:12 11,568 ----a-w C:\WINDOWS\system32\drivers\imagedrv.sys
2007-05-16 07:42:22 972,336 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-05-15 07:45:14 972,336 ----a-w C:\WINDOWS\UNNeroVision.exe
2007-05-06 10:06:20 -------- d-----w C:\Program Files\Alcohol Soft
2007-05-02 11:27:28 -------- d-----w C:\DOCUME~1\SAILOR~1.SER\DANEAP~1\CyberLink
2007-05-01 08:04:31 -------- d-----w C:\DOCUME~1\SAILOR~1.SER\DANEAP~1\BSplayer Pro
2007-05-01 08:04:12 -------- d-----w C:\Program Files\Webteh
2007-04-29 20:07:01 639,224 -c--a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-04-25 21:13:18 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-04-23 14:42:50 972,336 ----a-w C:\WINDOWS\UNRecode.exe
2007-04-18 17:41:53 1,230 ----a-w C:\WINDOWS\system32\tmp.reg
2007-04-16 20:47:36 33,624 -c--a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-04 21:16:07 80,444 ----a-w C:\WINDOWS\system32\perfc015.dat
2007-04-04 21:16:07 461,026 ----a-w C:\WINDOWS\system32\perfh015.dat
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO.dll [2007-01-11 17:05]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 01:48]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdslTaskBar"="stmctrl.dll" [2006-06-02 11:01 C:\WINDOWS\system32\stmctrl.dll]
"nwiz"="nwiz.exe" [2005-07-20 15:07 C:\WINDOWS\system32\nwiz.exe]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-15 22:12]
"@"="" []
"htocusa"="C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [2007-06-18 18:42]
"bhbsdrx"="C:\Program Files\Common Files\System\tnmgncd.exe" [2007-06-18 18:42]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 09:27]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 01:48]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360rpt.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360Safe.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360tray.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\adam.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AgentSvr.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AppSvc32.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ArSwp.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AST.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\autoruns.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avconsol.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avgrssvc.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AvMonitor.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avp.com]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avp.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\CCenter.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ccSvcHst.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\EGHOST.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FileDsty.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FTCleanerShell.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FYFireWall.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\HijackThis.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IceSword.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iparmo.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Iparmor.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\isPwdSvc.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kabaload.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KaScrScn.SCR]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KASMain.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KASTask.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAV32.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVDX.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVPF.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVPFW.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVSetup.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVStart.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KISLnchr.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KMailMon.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KMFilter.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KPFW32.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KPFW32X.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KPfwSvc.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KRegEx.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KRepair.com]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KsLoader.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVCenter.kxp]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvDetect.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvfwMcl.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVMonXP.kxp]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVMonXP_1.kxp]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvol.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvolself.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvReport.kxp]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVScan.kxp]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVSrvXP.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVStub.kxp]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvupload.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvwsc.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvXP.kxp]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvXP_1.kxp]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KWatch.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KWatch9x.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KWatchX.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\loaddll.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\MagicSet.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mcconsol.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mmqczj.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mmsk.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Navapsvc.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Navapw32.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\nod32.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\nod32krn.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\nod32kui.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NPFMntor.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\PFW.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\PFWLiveUpdate.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QHSET.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QQDoctor.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QQKav.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Ras.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Rav.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavMon.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavMonD.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavStub.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavTask.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RegClean.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwcfg.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwmain.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwsrv.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RsAgent.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Rsaupd.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\runiep.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\safelive.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\scan32.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\shcfg32.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SmartUp.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SREng.EXE]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\symlcsvc.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SysSafe.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\TrojanDetector.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Trojanwall.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\TrojDie.kxp]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UIHost.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxAgent.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxAttachment.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxCfg.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxFwHlp.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxPol.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\upiea.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UpLive.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\USBCleaner.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\vsstat.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\webscanx.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\WoptiClean.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[color=red]SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.[/color]
~~\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
"C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65f2b0a8-dfbb-11db-9de6-f59302cf68fe}]
AutoRun\command- M:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9beb2838-a801-11db-9df4-ecf2fff51904}]
AutoRun\command- M:\htocusa.exe
explore\Command- M:\htocusa.exe
open\Command- M:\htocusa.exe
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
**************************************************************************
catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-26 15:58:15
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
- Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1
Scan saved at 16:05:48, on 2007-06-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
C:\Program Files\Common Files\System\tnmgncd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Opera\Opera.exe
G:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [htocusa] C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
O4 - HKLM\..\Run: [bhbsdrx] C:\Program Files\Common Files\System\tnmgncd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Dołącz do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Konwertuj do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konwertuj wybrane łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Konwertuj wybrane łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Konwertuj zaznaczenie do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konwertuj zaznaczenie do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1182538453125
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.trafficredlight.net/11679-23.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63FA959C-6BC9-48C9-97CD-99093DA4459E}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Network Provisioning Stop (xmlpro) - Unknown owner - C:\WINDOWS\system32\\Lysvr.exe
-
serenity15 - ~user
- Posty: 596
- Dołączenie: 16 Cze 2005, 21:04
- Pochwały: 13
-
przez serenity15 26 Cze 2007, 17:02
dodam ze nie tylko przeglądarke zamyka
ale np. jak mam folder o nazwie "System" to tez wywala na pulpit
ale np. jak mam folder o nazwie "System" to tez wywala na pulpit
-
serenity15 - ~user
- Posty: 596
- Dołączenie: 16 Cze 2005, 21:04
- Pochwały: 13
-
przez wojtas 26 Cze 2007, 22:00
Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg
sciagnij: ATF_Cleaner
http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED
Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:
Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y
otwierasz notatnik i wklejasz"
w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG
Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....
potem nowe logi
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg
sciagnij: ATF_Cleaner
http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED
Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:
Drivers to unload:
xmlpro
Files to delete:
C:\Program Files\pro4.exe
C:\Program Files\pro3.exe
C:\Program Files\pro7.exe
C:\Program Files\pro9.exe
C:\Program Files\pro5.exe
C:\Program Files\pro2.exe
C:\Program Files\pro1.exe
C:\WINDOWS\system32\cenzura-spam.dat
C:\WINDOWS\system32\nwizqjsj.exe
C:\Program Files\meex.exe
C:\Program Files\Common Files\System\tnmgncd.exe
C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
C:\WINDOWS\system32\\Lysvr.exe
Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.trafficredlight.net/11679-23.exe
otwierasz notatnik i wklejasz"
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"htocusa"=-
"bhbsdrx"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360rpt.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360Safe.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360tray.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\adam.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AgentSvr.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AppSvc32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ArSwp.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AST.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\autoruns.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avconsol.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avgrssvc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AvMonitor.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avp.com]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avp.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\CCenter.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ccSvcHst.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\EGHOST.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FileDsty.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FTCleanerShell.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FYFireWall.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\HijackThis.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IceSword.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iparmo.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Iparmor.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\isPwdSvc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kabaload.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KaScrScn.SCR]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KASMain.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KASTask.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAV32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVDX.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVPF.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVPFW.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVSetup.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVStart.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KISLnchr.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KMailMon.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KMFilter.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KPFW32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KPFW32X.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KPfwSvc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KRegEx.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KRepair.com]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KsLoader.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVCenter.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvDetect.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvfwMcl.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVMonXP.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVMonXP_1.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvol.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvolself.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvReport.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVScan.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVSrvXP.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVStub.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvupload.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvwsc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvXP.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvXP_1.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KWatch.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KWatch9x.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KWatchX.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\loaddll.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\MagicSet.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mcconsol.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mmqczj.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mmsk.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Navapsvc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Navapw32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\nod32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\nod32krn.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\nod32kui.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NPFMntor.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\PFW.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\PFWLiveUpdate.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QHSET.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QQDoctor.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QQKav.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Ras.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Rav.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavMon.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavMonD.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavStub.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavTask.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RegClean.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwcfg.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwmain.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwsrv.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RsAgent.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Rsaupd.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\runiep.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\safelive.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\scan32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\shcfg32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SmartUp.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SREng.EXE]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\symlcsvc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SysSafe.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\TrojanDetector.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Trojanwall.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\TrojDie.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UIHost.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxAgent.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxAttachment.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxCfg.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxFwHlp.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxPol.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\upiea.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UpLive.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\USBCleaner.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\vsstat.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\webscanx.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\WoptiClean.exe]
w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG
Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....
potem nowe logi
-
wojtas - *mod
- Posty: 18165
- Dołączenie: 13 Sty 2006, 16:00
- Miejscowość: Krzeszyce
- Pochwały: 1656
-
przez serenity15 27 Cze 2007, 11:10
wojtas19162 napisał(a):Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg
to wczesniej miałem zrobione
wojtas19162 napisał(a):Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
nie moge uruchomic Hijack This wiec usunąłem je w Jv16 power tools
wojtas19162 napisał(a):potem nowe logi
nie uruchamia mi sie hijack this
sciagałem 10 razy na nowo i nie chce
-
serenity15 - ~user
- Posty: 596
- Dołączenie: 16 Cze 2005, 21:04
- Pochwały: 13
-
przez wojtas 27 Cze 2007, 11:39
to podaj loga z combofixa, z silenta oraz 2 gmera z opcji
sciagnij gmera:
http://gmer.net/gmer.zip
1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
wrzuc logi na rapida lub cos bo nie wejda tutaj
sciagnij gmera:
http://gmer.net/gmer.zip
1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
wrzuc logi na rapida lub cos bo nie wejda tutaj
-
wojtas - *mod
- Posty: 18165
- Dołączenie: 13 Sty 2006, 16:00
- Miejscowość: Krzeszyce
- Pochwały: 1656
-
przez serenity15 27 Cze 2007, 12:42
wojtas19162 napisał(a):z silenta
- Kod: Zaznacz wszystko
"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"AdslTaskBar" = "rundll32.exe stmctrl.dll,TaskBar" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"(Default)" = "(empty string)" [file not found]
"htocusa" = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
"bhbsdrx" = "C:\Program Files\Common Files\System\tnmgncd.exe" [null data]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture"
-> {HKLM...CLSID} = "BitComet Helper"
\InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO.dll" [null data]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Groove GFS Browser Helper"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]
{AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Conversion Toolbar Helper"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AxShlex.dll" ["Alcohol Soft Development Team"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"
-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"
-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper"
-> {HKLM...CLSID} = "Groove GFS Browser Helper"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar"
-> {HKLM...CLSID} = "Groove Folder Synchronization"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler"
-> {HKLM...CLSID} = "Groove GFS Stub Icon Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
-> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler"
-> {HKLM...CLSID} = "Groove XML Icon Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {HKLM...CLSID} = "Microsoft Office Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS]
"{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
-> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"
-> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
-> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
<<!>> 360rpt.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> 360Safe.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> 360tray.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> adam.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> AgentSvr.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> AppSvc32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> ArSwp.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> AST.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> autoruns.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> avconsol.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> avgrssvc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> AvMonitor.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> avp.com\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> avp.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> CCenter.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> ccSvcHst.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> EGHOST.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> FileDsty.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> FTCleanerShell.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> FYFireWall.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> HijackThis.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> IceSword.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> iparmo.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Iparmor.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> isPwdSvc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> kabaload.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KaScrScn.SCR\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KASMain.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KASTask.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAV32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAVDX.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAVPF.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAVPFW.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAVSetup.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KAVStart.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KISLnchr.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KMailMon.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KMFilter.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KPFW32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KPFW32X.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KPfwSvc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KRegEx.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KRepair.com\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KsLoader.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVCenter.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KvDetect.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KvfwMcl.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVMonXP.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVMonXP_1.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> kvol.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> kvolself.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KvReport.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVScan.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVSrvXP.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KVStub.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> kvupload.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> kvwsc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KvXP.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KvXP_1.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KWatch.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KWatch9x.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> KWatchX.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> loaddll.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> MagicSet.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> mcconsol.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> mmqczj.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> mmsk.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Navapsvc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Navapw32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> nod32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> nod32krn.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> nod32kui.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> NPFMntor.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> PFW.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> PFWLiveUpdate.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> QHSET.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> QQDoctor.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> QQKav.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Ras.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Rav.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RavMon.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RavMonD.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RavStub.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RavTask.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RegClean.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> rfwcfg.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> rfwmain.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> rfwsrv.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> RsAgent.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Rsaupd.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> rstrui.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> runiep.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> safelive.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> scan32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> shcfg32.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> SmartUp.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> SREng.EXE\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> symlcsvc.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> SysSafe.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> TrojanDetector.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> Trojanwall.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> TrojDie.kxp\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UIHost.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UmxAgent.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UmxAttachment.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UmxCfg.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UmxFwHlp.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UmxPol.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> upiea.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> UpLive.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> USBCleaner.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> vsstat.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> webscanx.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
<<!>> WoptiClean.exe\Debugger = "C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [null data]
HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]
HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
-> {HKLM...CLSID} = "NeroCoverEdContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------
Note: detected settings may not have any effect.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Sailor Moon Stars.SERENITY\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{0D704FAD-66E9-4F0A-BFED-4F665770DDB3}" = (no title provided)
-> {HKLM...CLSID} = "&Tłumaczenie"
\InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
Explorer Bars
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
HKLM\Software\Classes\CLSID\{175556B1-4D91-4E9A-9C4B-D6888D5DEE6C}\(Default) = "&Ramka Tłumaczenia"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]
HKLM\Software\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
HKLM\Software\Classes\CLSID\{D553F157-2AB0-4B46-98D2-7BA7CA418491}\(Default) = "&Słownik Podręczny"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]
HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_01"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_01"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."]
{2670000A-7350-4F3C-8081-5663EE0C6C49}\
"ButtonText" = "Wyślij do programu OneNote"
"MenuText" = "Wyślij &do programu OneNote"
"CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}"
-> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll" [MS]
{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"
{B46B0919-62BA-4D99-A5C4-916B57A6805C}\
"MenuText" = "@C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103"
"CLSIDExtension" = "{B46B0919-62BA-4D99-A5C4-916B57A6805C}"
-> {HKLM...CLSID} = "InternetTranslatorProperties Class"
\InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\CyberLink\Shared files\RichVideo.exe"" [empty string]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NMIndexingService, NMIndexingService, ""C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe"" ["Nero AG"]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Print Monitors:
---------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
5200 Series Port\Driver = "lxbtlmpm.DLL" ["Lexmark International, Inc."]
Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" ["Adobe Systems Incorporated."]
----------
<<!>>: Suspicious data at a malware launch point.
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 87 seconds.
---------- (total run time: 125 seconds)
wojtas19162 napisał(a):combofixa
- Kod: Zaznacz wszystko
"Sailor Moon Stars" - 2007-06-27 12:03:28 - ComboFix 07-06-27.7 - Dodatek Service Pack 2 NTFS
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Program Files\meex.exe
((((((((((((((((((((((((( Files Created from 2007-05-27 to 2007-06-27 )))))))))))))))))))))))))))))))
2007-06-27 09:52 <DIR> d-------- C:\DOCUME~1\SAILOR~1.SER\DANEAP~1\Atari
2007-06-26 15:55 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-26 01:05 9,548 --a------ C:\Program Files\pro4.exe
2007-06-26 01:05 18,636 --a------ C:\Program Files\pro3.exe
2007-06-26 01:05 17,600 --a------ C:\Program Files\pro7.exe
2007-06-26 01:05 13,600 --a------ C:\Program Files\pro9.exe
2007-06-26 01:05 12,564 --a------ C:\Program Files\pro5.exe
2007-06-26 01:05 12,204 --a------ C:\Program Files\pro2.exe
2007-06-26 01:04 23,090 --a------ C:\WINDOWS\system32\Lysvr.exe
2007-06-26 01:04 19,892 --a------ C:\Program Files\pro1.exe
2007-06-22 20:54 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-06-22 20:54 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-06-18 19:35 42,496 --a------ C:\WINDOWS\system32\cenzura-spam.dat
2007-06-18 18:44 10,696 --a------ C:\WINDOWS\system32\nwizqjsj.exe
2007-06-18 18:43 25,824 ---hs---- C:\Program Files\meex.exe
2007-06-17 13:12 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-06-17 13:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1\FLEXnet
2007-06-15 22:12 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-06-13 23:32 <DIR> d-------- C:\Downloads
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-27 08:58:36 -------- d-----w C:\Program Files\AutoConnect
2007-06-27 07:47:40 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-24 16:39:03 -------- d-----w C:\Program Files\NAPI-PROJEKT
2007-06-22 08:28:03 -------- d-----w C:\Program Files\eMule
2007-06-20 09:18:00 -------- d-----w C:\Program Files\Opera
2007-06-17 01:11:54 -------- d-----w C:\Program Files\BitComet
2007-06-15 20:15:19 -------- d-----w C:\DOCUME~1\SAILOR~1.SER\DANEAP~1\Real
2007-06-15 20:12:51 -------- d-----w C:\Program Files\Common Files\Real
2007-06-12 22:43:58 -------- d-----w C:\Program Files\Gadu-Gadu
2007-05-26 11:17:07 -------- d-----w C:\Program Files\Real
2007-05-23 15:08:20 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-05-22 17:30:55 -------- d-----w C:\Program Files\Common Files\Ahead
2007-05-19 16:53:29 -------- d-----w C:\DOCUME~1\SAILOR~1.SER\DANEAP~1\Opera
2007-05-18 08:56:21 -------- d-----w C:\Program Files\SpeedSim
2007-05-16 17:46:57 -------- d-----w C:\Program Files\Winamp
2007-05-16 16:12:14 133,168 ----a-w C:\WINDOWS\system32\drivers\imagesrv.sys
2007-05-16 16:12:12 11,568 ----a-w C:\WINDOWS\system32\drivers\imagedrv.sys
2007-05-16 07:42:22 972,336 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-05-15 07:45:14 972,336 ----a-w C:\WINDOWS\UNNeroVision.exe
2007-05-06 10:06:20 -------- d-----w C:\Program Files\Alcohol Soft
2007-05-02 11:27:28 -------- d-----w C:\DOCUME~1\SAILOR~1.SER\DANEAP~1\CyberLink
2007-05-01 08:04:31 -------- d-----w C:\DOCUME~1\SAILOR~1.SER\DANEAP~1\BSplayer Pro
2007-05-01 08:04:12 -------- d-----w C:\Program Files\Webteh
2007-04-29 20:07:01 639,224 -c--a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-04-25 21:13:18 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-04-23 14:42:50 972,336 ----a-w C:\WINDOWS\UNRecode.exe
2007-04-18 17:41:53 1,230 ----a-w C:\WINDOWS\system32\tmp.reg
2007-04-16 20:47:36 33,624 -c--a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-04 21:16:07 80,444 ----a-w C:\WINDOWS\system32\perfc015.dat
2007-04-04 21:16:07 461,026 ----a-w C:\WINDOWS\system32\perfh015.dat
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO.dll [2007-01-11 17:05]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 01:48]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdslTaskBar"="stmctrl.dll" [2006-06-02 11:01 C:\WINDOWS\system32\stmctrl.dll]
"nwiz"="nwiz.exe" [2005-07-20 15:07 C:\WINDOWS\system32\nwiz.exe]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-15 22:12]
"@"="" []
"htocusa"="C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe" [2007-06-18 18:42]
"bhbsdrx"="C:\Program Files\Common Files\System\tnmgncd.exe" [2007-06-18 18:42]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 09:27]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 01:48]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe]
Debugger=C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
[color=red]SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.[/color]
~~\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
"C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65f2b0a8-dfbb-11db-9de6-f59302cf68fe}]
AutoRun\command- M:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9beb2838-a801-11db-9df4-ecf2fff51904}]
AutoRun\command- M:\htocusa.exe
explore\Command- M:\htocusa.exe
open\Command- M:\htocusa.exe
**************************************************************************
catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-27 12:04:14
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-06-27 12:04:33
C:\ComboFix-quarantined-files.txt ... 2007-06-27 12:04
--- E O F ---
wojtas19162 napisał(a):1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
http://rapidshare.com/files/39615053/Log_1.log.html
wojtas19162 napisał(a):2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
http://rapidshare.com/files/39615243/Log_2.log.html
-
serenity15 - ~user
- Posty: 596
- Dołączenie: 16 Cze 2005, 21:04
- Pochwały: 13
-
przez serenity15 27 Cze 2007, 15:29
wojtas19162 napisał(a):wykonales to co kazalem z avengerem i wklejeniem do notatnika??
tak
wszystko zrobiłem
-
serenity15 - ~user
- Posty: 596
- Dołączenie: 16 Cze 2005, 21:04
- Pochwały: 13
-
przez wojtas 27 Cze 2007, 15:33
to pokaz teraz wszystkie nowo wygnerowane logi i wrzucone na rapidzie. najlepiej jak bedzie jedna paczka (combofix, silent, gmer, oraz raport a avengera)
C:\avenger.txt
-
wojtas - *mod
- Posty: 18165
- Dołączenie: 13 Sty 2006, 16:00
- Miejscowość: Krzeszyce
- Pochwały: 1656
-
przez wojtas 27 Cze 2007, 16:07
Wklej do notatnika
wklej do notatnika
Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT
Uruchamiasz Gmera, w zakładce Procesy wybierasz opcje Gmer Awaryjny. Komputer się zresetuje i uruchomi się Gmer. Wybierasz znów zakładke Procesy i na dole w poleceniu przez trzy kropki wskaz plik FIX.BAT i go uruchom.
Otwierasz Gmera i przechodzisz do zakładki CMD zaznaczając tam REGEDIT. Do okna wklejasz
Klik na Uruchom.
potem nowe wszystkie logi
wklej do notatnika
gmer -del service hrc^qqwp
gmer -del file C:\WINDOWS\system32\drivers\ahcdsybx.sys
gmer -del file C:\Program Files\pro4.exe
gmer -del file C:\Program Files\pro3.exe
gmer -del file C:\Program Files\pro2.exe
gmer -del file C:\Program Files\pro9.exe
gmer -del file C:\Program Files\pro7.exe
gmer -del file C:\WINDOWS\system32\Lysvr.exe
gmer -del file C:\Program Files\pro1.exe
gmer -del file C:\WINDOWS\system32\cenzura-spam.dat
gmer -del file C:\WINDOWS\system32\nwizqjsj.exe
gmer -del file C:\Program Files\Common Files\Microsoft Shared\pxpfern.exe
gmer -del file C:\Program Files\Common Files\System\tnmgncd.exe
gmer -del file C:\Program Files\meex.exe
gmer –reboot
Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT
Uruchamiasz Gmera, w zakładce Procesy wybierasz opcje Gmer Awaryjny. Komputer się zresetuje i uruchomi się Gmer. Wybierasz znów zakładke Procesy i na dole w poleceniu przez trzy kropki wskaz plik FIX.BAT i go uruchom.
Otwierasz Gmera i przechodzisz do zakładki CMD zaznaczając tam REGEDIT. Do okna wklejasz
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"htocusa"=-
"bhbsdrx"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360rpt.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360Safe.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360tray.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\adam.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AgentSvr.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AppSvc32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ArSwp.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AST.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\autoruns.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avconsol.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avgrssvc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AvMonitor.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avp.com]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avp.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\CCenter.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ccSvcHst.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\EGHOST.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FileDsty.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FTCleanerShell.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FYFireWall.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\HijackThis.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IceSword.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iparmo.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Iparmor.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\isPwdSvc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kabaload.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KaScrScn.SCR]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KASMain.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KASTask.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAV32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVDX.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVPF.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVPFW.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVSetup.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVStart.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KISLnchr.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KMailMon.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KMFilter.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KPFW32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KPFW32X.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KPfwSvc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KRegEx.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KRepair.com]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KsLoader.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVCenter.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvDetect.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvfwMcl.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVMonXP.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVMonXP_1.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvol.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvolself.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvReport.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVScan.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVSrvXP.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVStub.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvupload.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kvwsc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvXP.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KvXP_1.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KWatch.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KWatch9x.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KWatchX.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\loaddll.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\MagicSet.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mcconsol.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mmqczj.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mmsk.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Navapsvc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Navapw32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\nod32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\nod32krn.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\nod32kui.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NPFMntor.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\PFW.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\PFWLiveUpdate.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QHSET.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QQDoctor.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QQKav.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Ras.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Rav.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavMon.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavMonD.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavStub.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavTask.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RegClean.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwcfg.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwmain.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwsrv.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RsAgent.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Rsaupd.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\runiep.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\safelive.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\scan32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\shcfg32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SmartUp.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SREng.EXE]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\symlcsvc.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SysSafe.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\TrojanDetector.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Trojanwall.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\TrojDie.kxp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UIHost.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxAgent.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxAttachment.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxCfg.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxFwHlp.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UmxPol.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\upiea.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UpLive.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\USBCleaner.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\vsstat.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\webscanx.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\WoptiClean.exe]
Klik na Uruchom.
potem nowe wszystkie logi
-
wojtas - *mod
- Posty: 18165
- Dołączenie: 13 Sty 2006, 16:00
- Miejscowość: Krzeszyce
- Pochwały: 1656
-
26 posty(ów) • Strona 1 z 2 • 1, 2
Kto jest na forum
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 4 gości