straszny zamuł komputeraz

**Posty:** 8001 · przez **Okocza** 21 Paź 2007, 18:28

witam, kiedy wlaczam winampa i chce wlaczyc np moj komputer to wtedy otwiera sie on kilka minut, strasznie muli mi komputer.. zamieszczam loga

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:26:46, on 2007-10-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\D-Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Sygate\SHN\sgserv.exe C:\WINDOWS\System32\svchost.exe F:\BearShare Pro\Bearshare.exe C:\Documents and Settings\Administrator\Pulpit\minET.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Progsy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SyGateManager] C:\Program Files\Sygate\SHN\Sygate.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{11BCA017-53DD-41DF-8ABB-E6934B8BEDB4}: NameServer = 208.67.222.222,208.67.220.220 O17 - HKLM\System\CCS\Services\Tcpip\..\{E2724D53-DEE4-46DE-A6FC-4D794F162FB6}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SyGateService (SaService) - Sygate technologies Inc. - C:\Program Files\Sygate\SHN\sgserv.exe

**Posty:** 7838 · przez **Lukesh** 21 Paź 2007, 18:33

Dysk pracuje w trybie DMA?
Menedżer urządzeń >> Kontrolery IDE ATA/ATAPI >> sprawdz we właściwościach w Ustawianiach zaawansowanych czy w którymś - pomocniczym lub podstawowym kanale nie występuje tryb PIO, jeśli tak, to odinstaluj ten kontroler >> restart kompa

**Posty:** 8001 · przez **Okocza** 21 Paź 2007, 18:36

nie występuje

**Posty:** 237 · przez **Kuba1** 21 Paź 2007, 18:36

W logu czysto.

Dołącz logi z ComboFix i Silentrunners.

Instalowałeś coś ostatnio?

**Posty:** 8001 · przez **Okocza** 21 Paź 2007, 19:14

Kod: Zaznacz wszystko: ComboFix 07-09-21.2 - "Administrator" 2005-10-21 18:39:35.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.58 [GMT 2:00] . ((((((((((((((((((((((((( Files Created from 2007-08-21 to 2007-09-21 ))))))))))))))))))))))))))))))) . 2007-09-30 15:15 297,472 --a------ C:\WINDOWS\uninst.exe 2007-09-30 15:15 <DIR> d-------- C:\Program Files\PPU Geobid Katowice 2007-09-30 15:15 <DIR> d-------- C:\DOCUME~1\ADMINI~1\WINDOWS 2007-09-30 11:45 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Bluetooth 2007-09-30 11:42 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys 2007-09-30 11:42 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys 2007-09-30 11:42 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys 2007-09-30 11:42 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys 2007-09-30 11:40 <DIR> d-------- C:\Program Files\IVT Corporation 2007-09-30 00:26 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\vlc 2007-09-30 00:21 <DIR> d-------- C:\Program Files\VideoLAN 2007-09-29 21:45 <DIR> d-------- C:\Program Files\eMule 2007-09-29 15:56 307,200 --a------ C:\WINDOWS\IsUn0415.exe 2007-09-29 15:53 <DIR> d-------- C:\Program Files\UltraISO 2007-09-29 15:53 <DIR> d-------- C:\Program Files\Common Files\EZB Systems 2007-09-29 10:46 379,909 --a------ C:\WINDOWS\hgraphic.exe 2007-09-28 21:20 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Help 2007-09-28 15:11 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-09-28 15:11 298,104 --a------ C:\WINDOWS\system32\imon.dll 2007-09-28 15:11 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-09-28 13:38 <DIR> d-------- C:\Program Files\MarBit 2007-09-28 13:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Media Player Classic 2007-09-28 13:12 577,536 --a------ C:\WINDOWS\soundman.exe 2007-09-28 13:12 49,152 --a------ C:\WINDOWS\system32\ChCfg.exe 2007-09-28 13:12 4,027,456 -ra------ C:\WINDOWS\system32\drivers\alcxwdm.sys 2007-09-28 13:12 315,392 --a------ C:\WINDOWS\alcupd.exe 2007-09-28 13:12 217,088 --a------ C:\WINDOWS\Alcrmv.exe 2007-09-28 13:12 147,456 --a------ C:\WINDOWS\system32\RtlCPAPI.dll 2007-09-28 13:12 10,528,768 --a------ C:\WINDOWS\system32\RTLCPL.exe 2007-09-28 13:12 <DIR> d-------- C:\Program Files\Realtek AC97 2007-09-28 12:54 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-28 12:49 <DIR> d-------- C:\Program Files\Lavalys 2007-09-28 12:36 <DIR> d-------- C:\Program Files\Winamp 2007-09-28 12:11 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2007-09-28 11:42 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Menu Start 2007-09-28 11:37 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2007-09-28 11:37 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-09-28 11:37 42,240 --a------ C:\WINDOWS\system32\drivers\viaagp.sys 2007-09-28 11:37 20,992 --a------ C:\WINDOWS\system32\drivers\rtl8139.sys 2007-09-28 11:37 2,944 --a------ C:\WINDOWS\system32\drivers\msmpu401.sys 2007-09-28 11:37 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys 2007-09-28 11:36 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne 2007-09-28 11:36 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Dane aplikacji 2007-09-28 11:36 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji 2007-09-28 11:36 <DIR> dr------- C:\DOCUME~1\DEFAUL~1\Menu Start 2007-09-28 11:36 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start 2007-09-28 11:36 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty 2007-09-28 11:36 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony 2007-09-28 11:36 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony 2007-09-28 11:36 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione 2007-09-28 11:36 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit 2007-09-28 11:36 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty 2007-09-28 11:36 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione 2007-09-28 11:36 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit 2007-09-28 11:28 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2007-09-28 11:25 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-09-28 11:24 <DIR> d-------- C:\WINDOWS\EHome 2007-09-28 11:19 84,480 --a--c--- C:\WINDOWS\system32\dllcache\ac97via.sys 2007-09-28 11:19 84,480 --a------ C:\WINDOWS\system32\drivers\ac97via.sys 2007-09-28 11:15 192,000 --a------ C:\WINDOWS\system32\iuengine.dll 2007-09-28 11:11 1,277 --a------ C:\WINDOWS\mozver.dat 2007-09-28 11:10 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Talkback 2007-09-28 11:09 0 --a------ C:\WINDOWS\nsreg.dat 2007-09-28 11:08 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-09-28 11:07 <DIR> d-------- C:\Program Files\AutoConnect 2007-09-28 11:03 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll 2007-09-28 11:02 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2007-09-28 11:02 <DIR> d-------- C:\Program Files\SAGEM 2007-09-28 11:02 <DIR> d-------- C:\Program Files\Java Web Start 2007-09-28 11:01 <DIR> d-------- C:\Program Files\Neostrada TP 2007-09-28 11:00 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-09-21 21:21 <DIR> d-------- C:\Program Files\foobar2000 2007-09-21 21:21 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\foobar2000 2007-09-21 21:20 22,528 --a------ C:\WINDOWS\system32\WNASPI32.DLL 2007-09-21 21:20 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS 2007-09-21 15:59 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Gadu-Gadu . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-21 13:13 --------- d-------- C:\Program Files\Sygate 2007-10-20 12:47 --------- d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Hamachi 2007-10-19 23:49 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-10-18 18:41 10578 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-10-15 13:26 --------- d-------- C:\Program Files\FlashGet 2007-10-15 13:18 --------- d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Real 2007-10-15 13:17 --------- d-------- C:\Program Files\Real Alternative 2007-10-15 13:17 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-10-15 10:49 --------- d-------- C:\Program Files\CDBurnerXP Pro 3 2007-10-15 09:58 --------- d-------- C:\Program Files\buddyPhone 2007-10-14 21:59 --------- d-------- C:\Program Files\Shortcut 2007-10-14 19:04 --------- d-------- C:\Program Files\SiGSOFT 2007-10-14 15:04 --------- d-------- C:\Program Files\Sony Ericsson 2007-10-14 15:04 --------- d-------- C:\Program Files\Common Files\Teleca Shared 2007-10-14 15:01 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-10-14 14:28 --------- d-------- C:\Program Files\Traffic Shaper XP Server 2007-10-14 11:45 --------- d-------- C:\Program Files\D-Tools 2007-10-11 17:40 --------- d-------- C:\Program Files\WIBUKEY 2007-10-11 17:40 --------- d-------- C:\Program Files\WIBU-SYSTEMS 2007-10-11 17:40 --------- d-------- C:\Program Files\Motorola 2007-10-07 20:03 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype 2007-10-06 21:36 --------- d--h----- C:\Program Files\Zero G Registry 2007-10-06 21:36 --------- d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Sports Interactive 2007-10-06 19:13 --------- d-------- C:\Program Files\Teamspeak2_RC2 2007-10-06 19:10 --------- d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\teamspeak2 2007-10-06 16:48 --------- d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Joost 2007-10-01 19:47 --------- d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Locktime 2007-10-01 19:44 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Locktime 2007-10-01 19:26 --------- d-------- C:\Program Files\PopCap Games 2007-10-01 19:24 --------- d-------- C:\Program Files\TryMedia 2007-10-01 18:23 --------- d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\AdobeUM 2007-09-28 11:02 23 --a------ C:\WINDOWS\system32\drivers\adidsl.cfg 2007-09-28 10:53 --------- d-------- C:\Program Files\microsoft frontpage --------- C:\Program Files\Usługi online . ((((((((((((((((((((((((((((( snapshot_2007-09-28_125648.47 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 69,120 2004-08-22 15:04:56 C:\WINDOWS\daemon.dll ----a-w 13,224 2007-09-21 16:42:10 C:\WINDOWS\DhcpClient.dat ----a-w 306,688 1998-10-29 13:45:06 C:\WINDOWS\IsUninst.exe -c----w 2,804,224 2004-08-03 22:44:06 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msi.dll -c----w 77,312 2004-08-03 22:44:24 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msiexec.exe -c----w 331,264 2004-08-03 22:44:06 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msihnd.dll -c----w 884,736 2004-08-03 22:43:08 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msimsg.dll -c----w 44,032 2004-08-03 22:44:06 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msisip.dll -c----w 212,704 2005-05-03 10:58:30 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe -c----w 387,296 2005-05-03 10:58:30 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll ----a-r 135,168 2007-10-15 08:49:21 C:\WINDOWS\Installer\{896D642C-7125-44F0-AC49-A23ABF82209C}\ARPPRODUCTICON.exe ----a-r 135,168 2007-10-15 08:49:21 C:\WINDOWS\Installer\{896D642C-7125-44F0-AC49-A23ABF82209C}\cdbxp.exe1_A2B8C891E8B94C26975E193A62033974.exe ----a-r 135,168 2007-10-15 08:49:21 C:\WINDOWS\Installer\{896D642C-7125-44F0-AC49-A23ABF82209C}\cdbxp.exe_A2B8C891E8B94C26975E193A62033974.exe ----a-r 69,632 2007-10-15 08:49:21 C:\WINDOWS\Installer\{896D642C-7125-44F0-AC49-A23ABF82209C}\Uninstall_CDBurnerXP_A2B8C891E8B94C26975E193A62033974.exe ----a-r 593,920 2007-10-16 14:42:21 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\accicons.exe ----a-r 12,288 2007-10-16 14:42:21 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\cagicon.exe ----a-r 86,016 2007-10-16 14:42:21 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\inficon.exe ----a-r 135,168 2007-10-16 14:42:21 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\misc.exe ----a-r 11,264 2007-10-16 14:42:21 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\mspicons.exe ----a-r 27,136 2007-10-16 14:42:21 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\oisicon.exe ----a-r 4,096 2007-10-16 14:42:21 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\opwicon.exe ----a-r 794,624 2007-10-16 14:42:22 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\outicon.exe ----a-r 249,856 2007-10-16 14:42:21 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pptico.exe ----a-r 61,440 2007-10-16 14:42:21 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pubs.exe ----a-r 23,040 2007-10-16 14:42:22 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\unbndico.exe ----a-r 286,720 2007-10-16 14:42:20 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\wordicon.exe ----a-r 409,600 2007-10-16 14:42:20 C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\xlicons.exe ----a-r 3,638 2007-09-30 09:43:46 C:\WINDOWS\Installer\{996D8BB8-9B47-46C7-92DC-DCCE64467AB8}\ARPPRODUCTICON.exe ----a-r 45,056 2007-09-30 09:43:46 C:\WINDOWS\Installer\{996D8BB8-9B47-46C7-92DC-DCCE64467AB8}\NewShortcut2_B0C8A90F65894FC68EA581831D92A6B4.exe ----a-r 45,056 2007-09-30 09:43:46 C:\WINDOWS\Installer\{996D8BB8-9B47-46C7-92DC-DCCE64467AB8}\NewShortcut2_B9F499B8D1F042FC84BECC552123CCCB.exe ----a-r 45,056 2007-09-30 09:43:46 C:\WINDOWS\Installer\{996D8BB8-9B47-46C7-92DC-DCCE64467AB8}\NewShortcut2_D52FB7FCBA0548A399F27778E184CAF7.exe ----a-r 8,854 2007-09-30 09:43:46 C:\WINDOWS\Installer\{996D8BB8-9B47-46C7-92DC-DCCE64467AB8}\Uninstall_BlueSoleil_DA0C16B5026041ACAA4BA0D7EA548378.exe ----a-r 25,214 2007-10-01 16:22:24 C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A70800000002}\SC_Reader.exe ----a-w 52,736 2001-12-27 08:59:44 C:\WINDOWS\system\WkWin.dll ----a-r 89,088 2003-03-18 19:05:50 C:\WINDOWS\system32\atl71.dll ----a-w 34,308 2007-10-01 17:46:22 C:\WINDOWS\system32\BASSMOD.dll ----a-w 129,536 2006-06-13 16:18:00 C:\WINDOWS\system32\btfunc.dll ----a-w 7,680 2004-09-21 16:18:40 C:\WINDOWS\system32\btinstall.dll ----a-w 107,888 2007-10-06 19:36:21 C:\WINDOWS\system32\CmdLineExt.dll ----a-r 27,200 2001-07-21 23:15:50 C:\WINDOWS\system32\ctl3dv2.dll ----a-w 622,592 2004-06-02 00:24:40 C:\WINDOWS\system32\DVDProX2.dll ----a-w 1,146,184 2003-08-03 16:56:16 C:\WINDOWS\system32\FM20.DLL ----a-w 32,584 2003-07-15 04:57:04 C:\WINDOWS\system32\FM20ENU.DLL ----a-w 126,912 2007-09-21 16:43:01 C:\WINDOWS\system32\FNTCACHE.DAT ----a-w 48,640 2000-05-09 12:10:12 C:\WINDOWS\system32\inetwh32.dll ----a-w 17,920 2003-06-18 23:31:48 C:\WINDOWS\system32\mdimon.dll ----a-w 53,248 1999-04-08 09:23:34 C:\WINDOWS\system32\MFC42PLK.DLL ----a-w 2,890,240 2005-05-03 10:58:36 C:\WINDOWS\system32\msi.dll ----a-w 78,848 2005-05-03 10:58:36 C:\WINDOWS\system32\msiexec.exe ----a-w 271,360 2005-05-03 10:58:36 C:\WINDOWS\system32\msihnd.dll ----a-w 884,736 2005-05-03 10:58:36 C:\WINDOWS\system32\msimsg.dll ----a-w 15,360 2005-05-03 10:58:36 C:\WINDOWS\system32\msisip.dll ----a-w 7,680 1999-06-04 13:22:38 C:\WINDOWS\system32\MSPRPPL.DLL ----a-w 397,312 2000-05-11 11:06:20 C:\WINDOWS\system32\MSRDO20.DLL ----a-w 118,784 2000-04-03 18:05:58 C:\WINDOWS\system32\msstdfmt.dll ----a-w 94,208 2000-04-03 15:52:52 C:\WINDOWS\system32\msstkprp.dll ----a-r 499,712 2003-03-18 20:14:52 C:\WINDOWS\system32\msvcp71.dll ----a-w 40,128 2007-10-19 23:29:47 C:\WINDOWS\system32\perfc009.dat ----a-w 49,712 2007-10-19 23:29:47 C:\WINDOWS\system32\perfc015.dat ----a-w 311,740 2007-10-19 23:29:47 C:\WINDOWS\system32\perfh009.dat ----a-w 355,830 2007-10-19 23:29:47 C:\WINDOWS\system32\perfh015.dat ----a-w 278,528 2001-06-22 23:31:20 C:\WINDOWS\system32\pncrt.dll ----a-w 6,656 1998-03-26 02:57:34 C:\WINDOWS\system32\pndx5016.dll ----a-w 5,632 1998-05-12 18:36:44 C:\WINDOWS\system32\pndx5032.dll ----a-w 66,872 2007-10-06 17:44:36 C:\WINDOWS\system32\PnkBstrA.exe ----a-w 103,736 2007-10-19 21:48:59 C:\WINDOWS\system32\PnkBstrB.exe ----a-w 151,552 2000-04-03 15:52:54 C:\WINDOWS\system32\RDOCURS.DLL ----a-w 185,952 2006-10-07 03:18:32 C:\WINDOWS\system32\rmoc3260.dll ----a-w 317,952 2000-05-09 12:10:10 C:\WINDOWS\system32\roboex32.dll ----a-w 15,872 1998-03-24 19:54:08 C:\WINDOWS\system32\SCP32.DLL ------w 15,584 2005-05-03 10:58:30 C:\WINDOWS\system32\spmsg.dll ----a-w 8,192 2001-10-26 15:29:46 C:\WINDOWS\system32\tsbyuv.dll ----a-w 77,895 2004-03-08 08:18:18 C:\WINDOWS\system32\unibus_tcutil.dll ----a-w 89,360 1998-06-17 22:00:00 C:\WINDOWS\system32\VB5DB.DLL ----a-w 40,960 1999-11-24 16:40:50 C:\WINDOWS\system32\VBAME.DLL ----a-w 299,008 2003-10-19 13:51:16 C:\WINDOWS\system32\vbwFunctionsVB6.dll ----a-w 57,552 2001-12-27 08:59:40 C:\WINDOWS\system32\WKDOS.EXE ----a-w 139,264 2001-12-27 08:59:44 C:\WINDOWS\system32\WkWin32.dll -c--a-w 126,976 2004-08-03 22:43:54 C:\WINDOWS\system32\dllcache\apphelp.dll -c--a-w 17,024 2004-08-03 21:10:18 C:\WINDOWS\system32\dllcache\ccdecode.sys -c--a-w 60,288 2004-08-03 21:08:00 C:\WINDOWS\system32\dllcache\drmk.sys -c--a-w 47,616 2004-08-03 22:44:02 C:\WINDOWS\system32\dllcache\iyuv_32.dll -c--a-w 140,928 2004-08-03 21:15:22 C:\WINDOWS\system32\dllcache\ks.sys -c--a-w 4,096 2004-08-03 22:44:02 C:\WINDOWS\system32\dllcache\ksuser.dll -c--a-w 17,408 2004-08-03 22:44:06 C:\WINDOWS\system32\dllcache\msyuv.dll -c--a-w 85,376 2004-08-03 21:10:30 C:\WINDOWS\system32\dllcache\nabtsfec.sys -c--a-w 145,792 2004-08-03 21:15:50 C:\WINDOWS\system32\dllcache\portcls.sys -c--a-w 11,136 2004-08-03 21:10:18 C:\WINDOWS\system32\dllcache\slip.sys -c--a-w 48,640 2004-08-03 21:08:04 C:\WINDOWS\system32\dllcache\stream.sys -c--a-w 15,360 2004-08-03 21:10:14 C:\WINDOWS\system32\dllcache\streamip.sys -c--a-w 8,192 2001-10-26 15:29:46 C:\WINDOWS\system32\dllcache\tsbyuv.dll -c--a-w 31,616 2004-08-03 21:08:48 C:\WINDOWS\system32\dllcache\usbccgp.sys -c--a-w 25,600 2004-08-03 21:08:44 C:\WINDOWS\system32\dllcache\usbser.sys -c--a-w 26,496 2004-08-03 21:08:48 C:\WINDOWS\system32\dllcache\usbstor.sys -c--a-w 19,328 2004-08-03 21:10:22 C:\WINDOWS\system32\dllcache\wstcodec.sys ----a-w 148,830 2004-09-21 16:18:36 C:\WINDOWS\system32\drivers\bcbthub.sys ----a-w 31,488 2006-06-23 14:00:26 C:\WINDOWS\system32\drivers\blueletaudio.sys ----a-w 20,480 2005-08-31 08:34:52 C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys ----a-w 23,040 2006-07-16 14:06:16 C:\WINDOWS\system32\drivers\btcusb.sys ----a-w 28,271 2005-05-01 03:50:10 C:\WINDOWS\system32\drivers\BTHidMgr.sys ----a-w 10,068 2006-01-19 11:31:34 C:\WINDOWS\system32\drivers\BtNetDrv.sys ----a-w 14,312 2006-04-14 07:14:12 C:\WINDOWS\system32\drivers\BTNetFilter.sys ----a-w 17,024 2004-08-03 21:10:18 C:\WINDOWS\system32\drivers\CCDECODE.sys ----a-w 155,136 2004-08-22 14:31:10 C:\WINDOWS\system32\drivers\d347bus.sys ----a-w 5,248 2004-08-22 14:31:48 C:\WINDOWS\system32\drivers\d347prt.sys ----a-w 116,021 2004-09-21 16:18:36 C:\WINDOWS\system32\drivers\fw203x.sys ----a-w 85,376 2004-08-03 21:10:30 C:\WINDOWS\system32\drivers\NABTSFEC.sys ----a-w 51,169 2003-04-28 23:31:18 C:\WINDOWS\system32\drivers\OXSER.SYS ----a-w 37,760 2004-03-01 16:53:12 C:\WINDOWS\system32\drivers\P2k.sys ----a-w 40,960 2002-09-23 05:30:48 C:\WINDOWS\system32\drivers\SCTray.exe ----a-w 48,076 2004-02-11 11:29:34 C:\WINDOWS\system32\drivers\Sio9502k.sys ----a-w 77,824 2002-09-18 05:11:02 C:\WINDOWS\system32\drivers\SioUi2k.dll ----a-w 48,556 2004-03-23 08:26:22 C:\WINDOWS\system32\drivers\SktBt2k.sys ----a-w 11,136 2004-08-03 21:10:18 C:\WINDOWS\system32\drivers\SLIP.sys ----a-w 15,360 2004-08-03 21:10:14 C:\WINDOWS\system32\drivers\StreamIP.sys ----a-w 31,616 2004-08-03 21:08:48 C:\WINDOWS\system32\drivers\usbccgp.sys ----a-w 25,600 2004-08-03 21:08:44 C:\WINDOWS\system32\drivers\usbser.sys ----a-w 26,496 2004-08-03 21:08:48 C:\WINDOWS\system32\drivers\USBSTOR.SYS ----a-w 11,988 2005-07-30 05:21:32 C:\WINDOWS\system32\drivers\vbtenum.sys ----a-w 61,312 2004-10-19 11:37:38 C:\WINDOWS\system32\drivers\VComm.sys ----a-w 84,836 2006-02-28 14:57:22 C:\WINDOWS\system32\drivers\VcommMgr.sys ----a-w 54,784 2004-08-03 22:44:14 C:\WINDOWS\system32\drivers\vfwwdm32.dll ----a-w 11,736 2005-07-29 14:21:48 C:\WINDOWS\system32\drivers\VHIDMini.sys ----a-w 8,023 2002-01-07 11:29:40 C:\WINDOWS\system32\drivers\WG1N.sys ----a-w 8,023 2002-01-07 11:29:40 C:\WINDOWS\system32\drivers\WG2N.sys ----a-w 8,023 2002-01-07 11:29:40 C:\WINDOWS\system32\drivers\wg4n.sys ----a-w 8,023 2002-01-07 11:29:40 C:\WINDOWS\system32\drivers\wg5n.sys ----a-w 8,023 2002-01-07 11:29:40 C:\WINDOWS\system32\drivers\wg6n.sys ----a-w 67,072 2001-12-27 08:59:34 C:\WINDOWS\system32\drivers\Wibukey.sys ----a-w 29,696 2001-12-27 08:59:38 C:\WINDOWS\system32\drivers\Wibukey2.sys ----a-w 529,394 2001-06-25 07:03:34 C:\WINDOWS\system32\drivers\Wsdrv.sys ----a-w 63,488 2003-07-04 00:58:34 C:\WINDOWS\system32\drivers\wssbtr1f.sys ----a-w 19,328 2004-08-03 21:10:22 C:\WINDOWS\system32\drivers\WSTCODEC.SYS ----a-r 190,696 2007-06-11 11:04:38 C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe ----a-w 758,784 2003-06-18 23:31:44 C:\WINDOWS\system32\spool\drivers\w32x86\mdigraph.dll ----a-w 35,328 2003-06-18 23:31:46 C:\WINDOWS\system32\spool\drivers\w32x86\mdiui.dll ----a-w 61,440 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMCP66.DLL ----a-w 153,600 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMD566.DLL ----a-w 397,824 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMDR66.DLL ----a-w 19,456 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMFU66.DLL ----a-w 19,456 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMOP66.DLL ----a-w 23,280 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP066.DAT ----a-w 27,140 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP166.DAT ----a-w 30,320 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP266.DAT ----a-w 6,656 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPI66.DLL ----a-w 80,896 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV66.EXE ----a-w 819,200 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSB66.DLL ----a-w 8,704 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD66.EXE ----a-w 130,048 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM66.EXE ----a-w 6,656 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ66.EXE ----a-w 110,592 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSR66.DLL ----a-w 296,448 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUB66.DLL ----a-w 1,571,840 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUI66.DLL ----a-w 219,648 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUR66.DLL ----a-w 6,656 2004-05-21 06:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMW366.DLL ----a-w 758,784 2003-06-18 23:31:44 C:\WINDOWS\system32\spool\drivers\w32x86\3\mdigraph.dll ----a-w 35,328 2003-06-18 23:31:46 C:\WINDOWS\system32\spool\drivers\w32x86\3\mdiui.dll ----a-w 18,944 2003-06-18 23:31:48 C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll . ----a-w 27,200 2001-07-21 23:15:50 C:\WINDOWS\system32\ctl3dv2.dll ----a-w 95,072 2007-09-28 09:40:26 C:\WINDOWS\system32\FNTCACHE.DAT ----a-w 2,804,224 2004-08-03 22:44:06 C:\WINDOWS\system32\msi.dll ----a-w 77,312 2004-08-03 22:44:24 C:\WINDOWS\system32\msiexec.exe ----a-w 331,264 2004-08-03 22:44:06 C:\WINDOWS\system32\msihnd.dll ----a-w 884,736 2004-08-03 22:43:08 C:\WINDOWS\system32\msimsg.dll ----a-w 44,032 2004-08-03 22:44:06 C:\WINDOWS\system32\msisip.dll ----a-w 40,128 2007-09-28 09:55:55 C:\WINDOWS\system32\perfc009.dat ----a-w 49,712 2007-09-28 09:55:55 C:\WINDOWS\system32\perfc015.dat ----a-w 311,740 2007-09-28 09:55:55 C:\WINDOWS\system32\perfh009.dat ----a-w 355,830 2007-09-28 09:55:55 C:\WINDOWS\system32\perfh015.dat ------w 9,216 2004-07-17 20:57:02 C:\WINDOWS\system32\spmsg.dll ----a-w 8,192 2001-10-26 19:03:24 C:\WINDOWS\system32\tsbyuv.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 12:22] "nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-10-22 12:22] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07] "Cmaudio"="cmicnfg.cpl" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-10-25 07:37] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 05:42 C:\WINDOWS\soundman.exe] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-28 15:11] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "SyGateManager"="C:\Program Files\Sygate\SHN\Sygate.exe" [2003-02-08 14:17] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 11:12] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-09-29 15:58:46] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-07-16 17:33:36] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-09-28 11:02:32] R2 WG1N;SyGate for NT, WG1N;C:\WINDOWS\system32\Drivers\WG1N.sys R2 WG2N;SyGate for NT, WG2N;C:\WINDOWS\system32\Drivers\WG2N.sys R2 WIBUKEY;WIBU-KEY Kernel Driver;C:\WINDOWS\system32\DRIVERS\Wibukey.sys S3 ASPI;Advanced SCSI Programming Interface Driver;\??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys S3 BTNetFilter;Bluetooth Network Filter;\??\C:\Program Files\IVT Corporation\BlueSoleil\Device\Win2k\BTNetFilter.sys *Newly Created Service* - WG1N *Newly Created Service* - WG2N *Newly Created Service* - WG4N *Newly Created Service* - WG5N *Newly Created Service* - WG6N . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-21 18:43:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Tcpip6] "ImagePath"="system32\DRIVERS\tcpip6.sys" . Completion time: 2007-09-21 18:44:35 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-09-21 18:44 C:\ComboFix2.txt ... 2007-09-21 15:46 . --- E O F ---

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS] "WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string] "WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"" ["Sun Microsystems, Inc."] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "SyGateManager" = "C:\Program Files\Sygate\SHN\Sygate.exe" ["Sygate Technologies, Inc."] HKLM\Software\Microsoft\Active Setup\Installed Components\ >{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer" \StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["Amaze Soft"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{00020000-0000-1011-8004-0000C06B5161}" = "WIBU-SYSTEMS Shell Extension" -> {HKLM...CLSID} = "WIBU-SYSTEMS Shell Extension" \InProcServer32\(Default) = "C:\Program Files\WIBU-SYSTEMS\System\WibuShellExt.dll" ["WIBU-SYSTEMS AG"] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Uniwersalne urządzenia Plug and Play" -> {HKLM...CLSID} = "Uniwersalne urządzenia Plug and Play" \InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {00020000-0000-1011-8004-0000C06B5161}\(Default) = (no title provided) -> {HKLM...CLSID} = "WIBU-SYSTEMS Shell Extension" \InProcServer32\(Default) = "C:\Program Files\WIBU-SYSTEMS\System\WibuShellExt.dll" ["WIBU-SYSTEMS AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Administrator" & "All Users" startup folders: --------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "BlueSoleil" -> shortcut to: "C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe" ["IVT Corporation"] "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 11 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar" -> {HKLM...CLSID} = "FlashGet Bar" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\fgiebar.dll" ["Amaze Soft"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_13" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_13" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_13\bin\npjpi150_13.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "C:\PROGRA~1\FlashGet\flashget.exe" ["Amaze Soft"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ BlueSoleil Hid Service, BlueSoleil Hid Service, "C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe" [null data] NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] PnkBstrA, PnkBstrA, "C:\WINDOWS\system32\PnkBstrA.exe" [null data] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 412 seconds. ---------- (total run time: 587 seconds)

**Posty:** 18165 · przez **wojtas** 21 Paź 2007, 21:00

czysto zrob defragmentacje dysku. sprawdz w menadzeze zadan czy cos uzywa duzo mocy procka

straszny zamuł komputeraz

straszny zamuł komputeraz

Kto jest na forum