System lekko się krzaczy - log

**Posty:** 2129 · przez **filip.ludwik** 08 Sie 2008, 14:16

Witam!
Mam mały problemik, mianowicie potrafi mi się ścinać, spowalniać muzyka... system też nie chodzi jak rakieta.
Nie wiem czy to akurat problem z wirusem, ale może... wiec zamieszczam log z HJ

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:12:14, on 2008-08-08 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16546) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\REALTEK PCI&Cardbus Wireless LAN Driver and Utility\RtWLan.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\autoclk.exe F:\Programy\Avast\ashDisp.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Gateway\EzTune\DTHtml.exe F:\Programy\AutoConnect\AutoConnect.exe F:\Programy\DAEMON Tools Pro\DTProAgent.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe F:\Programy\salling click\Salling Clicker\WinClicker.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Portrait Displays\Pivot Software\floater.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\PC Connectivity Solution\Transports\NclIVTBTSrv.exe C:\Program Files\Windows Media Player\wmpnscfg.exe F:\Programy\Gadu-Gadu\Gadu-Gadu\7.0\gg.exe C:\Program Files\uTorrent\uTorrent.exe C:\Windows\system32\wuauclt.exe F:\Programy\Foobar\foobar2000.exe F:\Programy\Last.fm\LastFM.exe C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\Explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Ahsan_Manan_Khan_Bhutta * Internet Explorer * R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programy\Acrobat Reader 7\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [avast!] F:\Programy\Avast\ashDisp.exe O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.24\AsRunHelp.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "F:\Programy\Riva Tuner\RivaTuner v2.06\RivaTuner.exe" /S O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -GWY O4 - HKLM\..\Run: [BtTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [AutoConnect] F:\Programy\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "F:\Programy\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WinClicker.exe] "F:\Programy\salling click\Salling Clicker\WinClicker.exe" -atboottime O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Programy\Acrobat Reader 7\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = F:\Programy\Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\Programy\Office\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280}: NameServer = 208.67.222.222 208.67.220.220 O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Programy\Avast\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - F:\Programy\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Programy\Avast\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - F:\Programy\Avast\ashWebSv.exe O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - F:\Programy\Nero\Nero 8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7831 bytes

**Posty:** 7956 · przez **Magik** 08 Sie 2008, 14:19

wklej log z DSS'a

te wpisy na fix w HJT w trybie awaryjnym

Kod: Zaznacz wszystko: C:\Windows\autoclk.exe O4 - HKCU\..\Run: [WinClicker.exe] "F:\Programy\salling click\Salling Clicker\WinClicker.exe" -atboottime O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA')

i przelec kompa tym
program-szukajacy-trojanow-i-malware-vt97108.html

**Posty:** 684 · przez **djarta** 08 Sie 2008, 14:26

Jeśli działa ComboFix to daj log z niego log -----> jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

**Posty:** 2129 · przez **filip.ludwik** 08 Sie 2008, 15:02

Usunąłem to przez HJ co podałeś.

Ten program usunął tylko:
!!! Files that have been deleted !!!

C:\Windows\system32\tbs.dll

A ComboFix nie odpala pod Vistą...

Jeszcze raz log z HJ:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:02:03, on 2008-08-08 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16546) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\autoclk.exe F:\Programy\Avast\ashDisp.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Gateway\EzTune\DTHtml.exe F:\Programy\AutoConnect\AutoConnect.exe F:\Programy\DAEMON Tools Pro\DTProAgent.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Portrait Displays\Pivot Software\floater.exe C:\Windows\system32\taskeng.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Program Files\REALTEK PCI&Cardbus Wireless LAN Driver and Utility\RtWLan.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\PC Connectivity Solution\Transports\NclIVTBTSrv.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe C:\Windows\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe F:\Programy\Gadu-Gadu\Gadu-Gadu\7.0\gg.exe C:\Windows\Explorer.exe F:\Programy\Office\Office10\EXCEL.EXE F:\Programy\Foobar\foobar2000.exe F:\Programy\Last.fm\LastFM.exe C:\Windows\system32\conime.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Ahsan_Manan_Khan_Bhutta * Internet Explorer * R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programy\Acrobat Reader 7\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [avast!] F:\Programy\Avast\ashDisp.exe O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.24\AsRunHelp.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "F:\Programy\Riva Tuner\RivaTuner v2.06\RivaTuner.exe" /S O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -GWY O4 - HKLM\..\Run: [BtTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [AutoConnect] F:\Programy\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "F:\Programy\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Programy\Acrobat Reader 7\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = F:\Programy\Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\Programy\Office\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280}: NameServer = 208.67.222.222 208.67.220.220 O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Programy\Avast\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - F:\Programy\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Programy\Avast\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - F:\Programy\Avast\ashWebSv.exe O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - F:\Programy\Nero\Nero 8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7620 bytes

**Posty:** 7956 · przez **Magik** 08 Sie 2008, 15:12

filip.ludwik napisał(a):A ComboFix nie odpala pod Vistą...

dlatego Ci napisalem wklej log z DSS'a :!:

**Posty:** 2129 · przez **filip.ludwik** 08 Sie 2008, 18:25

Mmm... sorry , nie zauważyłem.

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by Filip Ludwikowski on 2008-08-08 18:20:52 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- Last 3 Restore Point(s) -- 3: 2008-08-08 14:26:39 UTC - RP432 - Zaplanowany punkt kontrolny 2: 2008-08-07 23:50:53 UTC - RP431 - Zaplanowany punkt kontrolny 1: 2008-08-06 23:41:02 UTC - RP430 - Zaplanowany punkt kontrolny Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Filip Ludwikowski.exe) ----------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:22:27, on 2008-08-08 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16546) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\autoclk.exe F:\Programy\Avast\ashDisp.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Gateway\EzTune\DTHtml.exe F:\Programy\AutoConnect\AutoConnect.exe F:\Programy\DAEMON Tools Pro\DTProAgent.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Portrait Displays\Pivot Software\floater.exe C:\Windows\system32\taskeng.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Program Files\REALTEK PCI&Cardbus Wireless LAN Driver and Utility\RtWLan.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\PC Connectivity Solution\Transports\NclIVTBTSrv.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe C:\Windows\explorer.exe F:\Programy\Gadu-Gadu\Gadu-Gadu\7.0\gg.exe C:\Windows\Explorer.exe F:\Programy\Office\Office10\EXCEL.EXE F:\Programy\Foobar\foobar2000.exe F:\Programy\Last.fm\LastFM.exe C:\Windows\system32\conime.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\dowload\dss.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Filip Ludwikowski.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Ahsan_Manan_Khan_Bhutta * Internet Explorer * R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programy\Acrobat Reader 7\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [avast!] F:\Programy\Avast\ashDisp.exe O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.24\AsRunHelp.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "F:\Programy\Riva Tuner\RivaTuner v2.06\RivaTuner.exe" /S O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -GWY O4 - HKLM\..\Run: [BtTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [AutoConnect] F:\Programy\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "F:\Programy\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Programy\Acrobat Reader 7\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = F:\Programy\Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\Programy\Office\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280}: NameServer = 208.67.222.222 208.67.220.220 O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Programy\Avast\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - F:\Programy\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Programy\Avast\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - F:\Programy\Avast\ashWebSv.exe O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - F:\Programy\Nero\Nero 8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7670 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20080808-143911-274 O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') backup-20080808-143911-357 O4 - HKCU\..\Run: [WinClicker.exe] "F:\Programy\salling click\Salling Clicker\WinClicker.exe" -atboottime -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 giveio - c:\windows\system32\giveio.sys R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R2 TimerStop - \??\c:\windows\system32\timerstop.sys R3 RivaTuner32 - \??\f:\programy\riva tuner\rivatuner v2.06\rivatuner32.sys S3 BlueletAudio (Bluetooth Audio Service) - c:\windows\system32\drivers\blueletaudio.sys <Not Verified; IVT Corporation.; Bluelet Audio Driver> S3 DNE (Deterministic Network Enhancer Miniport) - c:\windows\system32\drivers\dne2000.sys <Not Verified; Deterministic Networks, Inc.; > -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Asset Management Daemon - c:\program files\common files\portrait displays\plugins\am\dtsslsrv.exe R2 BlueSoleilCS - c:\program files\ivt corporation\bluesoleil\bluesoleilcs.exe <Not Verified; ; BlueSoleilCS Module> R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour> R2 DTSRVC (Portrait Displays Display Tune Service) - c:\program files\common files\portrait displays\shared\dtsrvc.exe R2 Nero BackItUp Scheduler 3 - f:\programy\nero\nero 8\nero backitup\nbservice.exe R3 BsHelpCS - c:\program files\ivt corporation\bluesoleil\bshelpcs.exe <Not Verified; ; BsHelpCS Module> R3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0005 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0005 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0006 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0006 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0007 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0007 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0009 Manufacturer: Microsoft Name: Karta Microsoft 6to4 #6 PNP Device ID: ROOT\*6TO4MP\0009 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0011 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0011 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0015 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0015 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0017 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0017 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0021 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0021 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0024 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0024 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0027 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0027 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0030 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0030 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft 6to4 Device ID: ROOT\*6TO4MP\0034 Manufacturer: Microsoft Name: 6TO4 Adapter PNP Device ID: ROOT\*6TO4MP\0034 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft ISATAP Device ID: ROOT\*ISATAP\0000 Manufacturer: Microsoft Name: isatap.{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280} PNP Device ID: ROOT\*ISATAP\0000 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft ISATAP Device ID: ROOT\*ISATAP\0002 Manufacturer: Microsoft Name: isatap.{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280} PNP Device ID: ROOT\*ISATAP\0002 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft ISATAP Device ID: ROOT\*ISATAP\0004 Manufacturer: Microsoft Name: isatap.{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280} PNP Device ID: ROOT\*ISATAP\0004 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft ISATAP Device ID: ROOT\*ISATAP\0006 Manufacturer: Microsoft Name: isatap.{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280} PNP Device ID: ROOT\*ISATAP\0006 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft ISATAP Device ID: ROOT\*ISATAP\0009 Manufacturer: Microsoft Name: isatap.{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280} PNP Device ID: ROOT\*ISATAP\0009 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Karta Microsoft ISATAP Device ID: ROOT\*ISATAP\0024 Manufacturer: Microsoft Name: isatap.{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280} PNP Device ID: ROOT\*ISATAP\0024 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Realtek 8185 Extensible 802.11b/g Wireless Device Device ID: PCI\VEN_10EC&DEV_8185&SUBSYS_822510EC&REV_20\4&276FBEC1&0&3878 Manufacturer: Realtek Semiconductor Corp Name: Realtek 8185 Extensible 802.11b/g Wireless Device PNP Device ID: PCI\VEN_10EC&DEV_8185&SUBSYS_822510EC&REV_20\4&276FBEC1&0&3878 Service: RTL85n86 Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Kontroler sieci NVIDIA nForce Device ID: PCI\VEN_10DE&DEV_0373&SUBSYS_CB841043&REV_A2\3&2411E6FE&0&88 Manufacturer: NVIDIA Name: Kontroler sieci NVIDIA nForce PNP Device ID: PCI\VEN_10DE&DEV_0373&SUBSYS_CB841043&REV_A2\3&2411E6FE&0&88 Service: NVENETFD Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Kontroler sieci NVIDIA nForce Device ID: PCI\VEN_10DE&DEV_0373&SUBSYS_CB841043&REV_A2\3&2411E6FE&0&90 Manufacturer: NVIDIA Name: Kontroler sieci NVIDIA nForce #2 PNP Device ID: PCI\VEN_10DE&DEV_0373&SUBSYS_CB841043&REV_A2\3&2411E6FE&0&90 Service: NVENETFD -- Scheduled Tasks ------------------------------------------------------------- 2008-08-08 18:20:00 470 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{42B987FD-CBA1-4D39-96D3-AF22ADF5F379}.job 2008-08-08 14:40:44 344 --a------ C:\Windows\Tasks\RtlVistaStart.job -- Files created between 2008-07-08 and 2008-08-08 ----------------------------- 2099-01-16 10:04:23 0 d-------- C:\Windows\SoftwareDistribution 2099-01-16 10:03:11 0 d-------- C:\Windows\system32\catroot2 2099-01-16 10:03:03 0 d-------- C:\Windows\Debug 2099-01-16 10:03:03 0 d-------- C:\Windows\CSC 2099-01-16 10:01:53 0 d-------- C:\Windows\Prefetch 2099-01-16 10:01:38 0 d--hs---- C:\System Volume Information 2099-01-16 10:00:56 0 d-------- C:\Windows\Panther 2099-01-16 10:00:41 0 d--hs---- C:\Boot 2008-08-08 14:58:08 0 d-------- C:\327882R2FWJFW 2008-07-21 16:23:24 0 d-------- C:\Program Files\Trend Micro -- Find3M Report --------------------------------------------------------------- 2008-08-08 14:46:35 535330 --a------ C:\Windows\system32\perfh015.dat 2008-08-08 14:46:35 86210 --a------ C:\Windows\system32\perfc015.dat 2008-08-08 14:35:21 0 d-------- C:\Users\Filip Ludwikowski\AppData\Roaming\uTorrent 2008-08-08 14:33:09 0 d-------- C:\Users\Filip Ludwikowski\AppData\Roaming\foobar2000 2008-08-08 14:02:35 1617 --a------ C:\Windows\mozver.dat 2008-07-16 15:33:13 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-12 21:03:30 0 d-------- C:\Program Files\Prolific 2008-06-01 23:11:26 8 --a------ C:\Users\Filip Ludwikowski\AppData\Roaming\NMM-MetaData.db 2008-05-26 21:50:46 32 --a------ C:\Windows\0 2008-05-26 15:17:40 2988 --a------ C:\Windows\desctemp.dat 2008-05-26 15:12:20 0 --a------ C:\Windows\system32\0 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-02 14:32] "autoclk"="autoclk.exe" [2003-01-30 06:48 C:\Windows\autoclk.exe] "avast!"="F:\Programy\Avast\ashDisp.exe" [2008-05-16 01:19] "AsusStartupHelp"="C:\Program Files\ASUS\AASP\1.00.24\AsRunHelp.exe" [2006-12-29 03:54] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 22:34] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 04:23] "RivaTunerStartupDaemon"="F:\Programy\Riva Tuner\RivaTuner v2.06\RivaTuner.exe" [2007-10-30 21:05] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-04 18:14] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-04 18:14] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-04 18:14] "PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 13:17] "DT GWY"="C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2007-10-09 18:45] "BtTray"="C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" [2008-05-26 21:51] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2006-11-02 14:33] "AutoConnect"="F:\Programy\AutoConnect\AutoConnect.exe" [2004-08-28 21:27] "DAEMON Tools Pro Agent"="F:\Programy\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 16:08] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:34] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 12:53] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - F:\Programy\Acrobat Reader 7\Reader\reader_sl.exe [2007-11-23 16:24:38] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-10-31 18:44:41] Microsoft Office.lnk - F:\Programy\Office\Office10\OSA.EXE [2007-11-23 16:27:06] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableLUA"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] "F:\Programy\Nero\Nero 8\Nero BackItUp\NBKeyScan.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinClicker.exe] "F:\Programy\salling click\Salling Clicker\WinClicker.exe" -atboottime [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13a8197f-e055-11dc-a98f-000000000000}] Auto\command- Cn911.exe AutoRun\command- C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-08-08 18:24:19 ------------

**Posty:** 684 · przez **djarta** 08 Sie 2008, 18:46

Są tylko wpisy w rejestrze

Wklej do notatnika taki tekst:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13a8197f-e055-11dc-a98f-000000000000}]

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na: "Wszystkie pliki" >>> Zapisz jako FIX.REG>>>
plik uruchom (dwuklik i OK- zgódź się na dodanie do Rejestru).
Zrestartuj komputer.

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

i tym

FixIEDef.

**Posty:** 2129 · przez **filip.ludwik** 09 Sie 2008, 10:33

Teraz dopiero stała się dziwna rzecz, miałem bsod'a (po wyciągnięciu usb i włożeniu go z powrotem do modemu , przedtem czegos takiego nie było...) no i komputer sie właczył i zniknęła tapeta oraz pojewiły się rozszerzenai plików (to już wyłaczyłem) ale z tapetą jest nadal problem... chce ją włączyć a tu takie coś :
http://www.up.programosy.pl/view/bez_tytulu_741.jpg.html

Nijak nie idzie tapety właczyć...

djarta napisał(a):FixIEDef.

Tym już robiłem, usunął:
C:\Windows\system32\tbs.dll

Teraz skanuje kacprem, zobaczymy co z tego wyniknie.

**Posty:** 8001 · przez **Okocza** 09 Sie 2008, 10:34

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

przejedź sobie tym sysa

**Posty:** 2129 · przez **filip.ludwik** 09 Sie 2008, 10:47

okocza napisał(a):smitfraudfix z opcji 2

Kod: Zaznacz wszystko: SmitFraudFix v2.333 Scan done at 10:42:22,25, 2008-08-09 Run from E:\dowload\SmitfraudFix OS: Microsoft Windows [Wersja 6.0.6000] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost ::1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280}: NameServer=208.67.222.222 208.67.220.220 HKLM\SYSTEM\CS1\Services\Tcpip\..\{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280}: NameServer=208.67.222.222 208.67.220.220 HKLM\SYSTEM\CS3\Services\Tcpip\..\{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280}: NameServer=208.67.222.222 208.67.220.220 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

Kacper dalej skanuje, ale narazie nic nie znalazł...
Co zrobić z tą tapetą?

Dodano 09.08.2008 09:58:01:
Kacper znalazł 2 wirusy.

Raport:

Kod: Zaznacz wszystko: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT 9 sierpień 2008 10:55:09 System operacyjny: Microsoft Windows Vista Professional, (Build 6000) Kaspersky Online Scanner wersja: 5.0.98.1 Ostatnia aktualizacja Kaspersky Anti-Virus 9/08/2008 Liczba wpisów w bazie danych Kaspersky Anti-Virus1072959 ------------------------------------------------------------------------------- Ustawienia skanowania: Skanowanie przy użyciu następujących baz danych: rozszerzone Skanuj archiwa: tak Skanuj pocztowe bazy danych: nie Obszar skanowania - Obszary krytyczne: C:\Windows C:\Users\FILIPL~1\AppData\Local\Temp\ Statystyki skanowania: Liczba skanowanych obiektów: 42742 Liczba wykrytych wirusów: 2 Liczba zainfekowanych obiektów: 2 Liczba podejrzanych obiektów: 0 Czas trwania skanowania: 00:11:50 Nazwa zainfekowanego obiektu / Nazwa wirusa / Ostatnie działanie C:\Windows\CSC\v2.0.6\pq Object is locked pominięty C:\Windows\Debug\PASSWD.LOG Object is locked pominięty C:\Windows\Debug\sam.log Object is locked pominięty C:\Windows\Debug\WIA\wiatrace.log Object is locked pominięty C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat Object is locked pominięty C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat Object is locked pominięty C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WindowsUpdate.log Object is locked pominięty C:\Windows\ServiceProfiles\LocalService\ntuser.dat Object is locked pominięty C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 Object is locked pominięty C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG2 Object is locked pominięty C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{0f694465-6a70-11db-8eb3-985e31beb686}.TM.blf Object is locked pominięty C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{0f694465-6a70-11db-8eb3-985e31beb686}.TMContainer00000000000000000001.regtrans-ms Object is locked pominięty C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{0f694465-6a70-11db-8eb3-985e31beb686}.TMContainer00000000000000000002.regtrans-ms Object is locked pominięty C:\Windows\ServiceProfiles\NetworkService\ntuser.dat Object is locked pominięty C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 Object is locked pominięty C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2 Object is locked pominięty C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{0f694461-6a70-11db-8eb3-985e31beb686}.TM.blf Object is locked pominięty C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{0f694461-6a70-11db-8eb3-985e31beb686}.TMContainer00000000000000000001.regtrans-ms Object is locked pominięty C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{0f694461-6a70-11db-8eb3-985e31beb686}.TMContainer00000000000000000002.regtrans-ms Object is locked pominięty C:\Windows\SoftwareDistribution\ReportingEvents.log Object is locked pominięty C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked pominięty C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked pominięty C:\Windows\System32\catroot2\edb.log Object is locked pominięty C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked pominięty C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked pominięty C:\Windows\System32\config\components Object is locked pominięty C:\Windows\System32\config\COMPONENTS.LOG1 Object is locked pominięty C:\Windows\System32\config\COMPONENTS.LOG2 Object is locked pominięty C:\Windows\System32\config\default Object is locked pominięty C:\Windows\System32\config\DEFAULT.LOG1 Object is locked pominięty C:\Windows\System32\config\DEFAULT.LOG2 Object is locked pominięty C:\Windows\System32\config\RegBack\COMPONENTS Object is locked pominięty C:\Windows\System32\config\RegBack\DEFAULT Object is locked pominięty C:\Windows\System32\config\RegBack\SAM Object is locked pominięty C:\Windows\System32\config\RegBack\SECURITY Object is locked pominięty C:\Windows\System32\config\RegBack\SOFTWARE Object is locked pominięty C:\Windows\System32\config\RegBack\SYSTEM Object is locked pominięty C:\Windows\System32\config\sam Object is locked pominięty C:\Windows\System32\config\SAM.LOG1 Object is locked pominięty C:\Windows\System32\config\SAM.LOG2 Object is locked pominięty C:\Windows\System32\config\security Object is locked pominięty C:\Windows\System32\config\SECURITY.LOG1 Object is locked pominięty C:\Windows\System32\config\SECURITY.LOG2 Object is locked pominięty C:\Windows\System32\config\software Object is locked pominięty C:\Windows\System32\config\SOFTWARE.LOG1 Object is locked pominięty C:\Windows\System32\config\SOFTWARE.LOG2 Object is locked pominięty C:\Windows\System32\config\system Object is locked pominięty C:\Windows\System32\config\SYSTEM.LOG1 Object is locked pominięty C:\Windows\System32\config\SYSTEM.LOG2 Object is locked pominięty C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.0.regtrans-ms Object is locked pominięty C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.1.regtrans-ms Object is locked pominięty C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.2.regtrans-ms Object is locked pominięty C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.blf Object is locked pominięty C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf Object is locked pominięty C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms Object is locked pominięty C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms Object is locked pominięty C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms Object is locked pominięty C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms Object is locked pominięty C:\Windows\System32\drivers\sptd.sys Object is locked pominięty C:\Windows\System32\IEDFix.exe Zainfekowanych: Hoax.Win32.Renos.vaoz pominięty C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked pominięty C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked pominięty C:\Windows\System32\Msdtc\KtmRmTm.blf Object is locked pominięty C:\Windows\System32\Msdtc\KtmRmTmContainer00000000000000000001 Object is locked pominięty C:\Windows\System32\Msdtc\KtmRmTmContainer00000000000000000002 Object is locked pominięty C:\Windows\System32\spool\SpoolerETW.etl Object is locked pominięty C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked pominięty C:\Windows\System32\wbem\repository\INDEX.BTR Object is locked pominięty C:\Windows\System32\wbem\repository\MAPPING1.MAP Object is locked pominięty C:\Windows\System32\wbem\repository\MAPPING2.MAP Object is locked pominięty C:\Windows\System32\wbem\repository\OBJECTS.DATA Object is locked pominięty C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.003 Object is locked pominięty C:\Windows\System32\wfp\wfpdiag.etl Object is locked pominięty C:\Windows\System32\winevt\Logs\Antivirus.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Application.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Media Center.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\Security.evtx Object is locked pominięty C:\Windows\System32\winevt\Logs\System.evtx Object is locked pominięty C:\Windows\Tasks\SCHEDLGU.TXT Object is locked pominięty C:\Windows\Temp\_avast4_\Webshlock.txt Object is locked pominięty C:\Windows\WindowsUpdate.log Object is locked pominięty C:\Users\FILIPL~1\AppData\Local\Temp\etilqs_UR8Pa7DhphNNwVP Object is locked pominięty C:\Users\FILIPL~1\AppData\Local\Temp\FXSAPIDebugLogFile.txt Object is locked pominięty C:\Users\FILIPL~1\AppData\Local\Temp\ir_ext_temp_0\autorun.exe Zainfekowanych: Trojan-Spy.Win32.Banker.hgk pominięty Proces skanowania został zakończony.

C:\Users\FILIPL~1\AppData\Local\Temp\ir_ext_temp_0\autorun.exe Zainfekowanych: Trojan-Spy.Win32.Banker.hgk pominięty
oraz
C:\Windows\System32\IEDFix.exe Zainfekowanych: Hoax.Win32.Renos.vaoz pominięty

Usunąć to ręcznie, czy z killboxa?
Co z tym w ogóle zrobić?

**Posty:** 8001 · przez **Okocza** 09 Sie 2008, 11:31

filip.ludwik napisał(a):Usunąć to ręcznie, czy z killboxa?

usuń kill boxem...

potem combofix

**Posty:** 2129 · przez **filip.ludwik** 09 Sie 2008, 11:40

Usunięte...

Combo nie odpala jak mówiłem.
DDS:

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by Filip Ludwikowski on 2008-08-09 11:39:32 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Filip Ludwikowski.exe) ----------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:39:36, on 2008-08-09 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16546) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\autoclk.exe F:\Programy\Avast\ashDisp.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Windows\System32\rundll32.exe C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe C:\Windows\System32\rundll32.exe C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe C:\Program Files\Windows Sidebar\sidebar.exe F:\Programy\AutoConnect\AutoConnect.exe C:\Program Files\Portrait Displays\Pivot Software\floater.exe F:\Programy\DAEMON Tools Pro\DTProAgent.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Windows\system32\taskeng.exe C:\Program Files\REALTEK PCI&Cardbus Wireless LAN Driver and Utility\RtWLan.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\PC Connectivity Solution\Transports\NclIVTBTSrv.exe C:\Program Files\Windows Media Player\wmpnscfg.exe F:\Programy\Gadu-Gadu\Gadu-Gadu\7.0\gg.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe F:\Programy\Foobar\foobar2000.exe F:\Programy\Last.fm\LastFM.exe C:\Windows\system32\conime.exe C:\Windows\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\uTorrent\uTorrent.exe C:\Windows\Explorer.exe E:\dowload\KillBox.exe C:\Windows\system32\DllHost.exe E:\dowload\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\FILIPL~1.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Ahsan_Manan_Khan_Bhutta * Internet Explorer * R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programy\Acrobat Reader 7\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [avast!] F:\Programy\Avast\ashDisp.exe O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.24\AsRunHelp.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "F:\Programy\Riva Tuner\RivaTuner v2.06\RivaTuner.exe" /S O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -GWY O4 - HKLM\..\Run: [BtTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [AutoConnect] F:\Programy\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "F:\Programy\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Programy\Acrobat Reader 7\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = F:\Programy\Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\Programy\Office\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O13 - Gopher Prefix: O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6EB56A8A-3FFC-4009-B1D4-DAF5993D3280}: NameServer = 208.67.222.222 208.67.220.220 O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Programy\Avast\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - F:\Programy\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Programy\Avast\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - F:\Programy\Avast\ashWebSv.exe O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - F:\Programy\Nero\Nero 8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6939 bytes -- Files created between 2008-07-09 and 2008-08-09 ----------------------------- 2099-01-16 10:04:23 0 d-------- C:\Windows\SoftwareDistribution 2099-01-16 10:03:11 0 d-------- C:\Windows\system32\catroot2 2099-01-16 10:03:03 0 d-------- C:\Windows\Debug 2099-01-16 10:03:03 0 d-------- C:\Windows\CSC 2099-01-16 10:01:53 0 d-------- C:\Windows\Prefetch 2099-01-16 10:01:38 0 d--hs---- C:\System Volume Information 2099-01-16 10:00:56 0 d-------- C:\Windows\Panther 2099-01-16 10:00:41 0 d--hs---- C:\Boot 2008-08-09 11:38:18 0 d-------- C:\!KillBox 2008-08-09 10:42:30 3524 --a------ C:\Windows\system32\tmp.reg 2008-08-09 10:42:09 25600 --a------ C:\Windows\system32\WS2Fix.exe 2008-08-09 10:42:09 289144 --a------ C:\Windows\system32\VCCLSID.exe <Not Verified; S!Ri; > 2008-08-09 10:42:09 86528 --a------ C:\Windows\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix> 2008-08-09 10:42:09 51200 --a------ C:\Windows\system32\dumphive.exe 2008-08-09 10:42:09 81920 --a------ C:\Windows\system32\404Fix.exe <Not Verified; S!Ri.URZ; 404Fix> 2008-08-09 10:42:08 288417 --a------ C:\Windows\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2008-08-09 10:42:08 53248 --a------ C:\Windows\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2008-08-09 10:20:29 0 d-------- C:\Windows\system32\Kaspersky Lab 2008-08-09 10:20:29 0 d-------- C:\Users\All Users\Kaspersky Lab 2008-07-21 16:23:24 0 d-------- C:\Program Files\Trend Micro -- Find3M Report --------------------------------------------------------------- 2008-08-09 11:39:32 0 d-------- C:\Users\Filip Ludwikowski\AppData\Roaming\uTorrent 2008-08-09 10:19:25 535330 --a------ C:\Windows\system32\perfh015.dat 2008-08-09 10:19:25 86210 --a------ C:\Windows\system32\perfc015.dat 2008-08-08 18:23:51 0 d-------- C:\Users\Filip Ludwikowski\AppData\Roaming\foobar2000 2008-08-08 14:02:35 1617 --a------ C:\Windows\mozver.dat 2008-07-16 15:33:13 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-12 21:03:30 0 d-------- C:\Program Files\Prolific 2008-06-01 23:11:26 8 --a------ C:\Users\Filip Ludwikowski\AppData\Roaming\NMM-MetaData.db 2008-05-26 21:50:46 32 --a------ C:\Windows\0 2008-05-26 15:17:40 2988 --a------ C:\Windows\desctemp.dat 2008-05-26 15:12:20 0 --a------ C:\Windows\system32\0 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-02 14:32] "autoclk"="autoclk.exe" [2003-01-30 06:48 C:\Windows\autoclk.exe] "avast!"="F:\Programy\Avast\ashDisp.exe" [2008-05-16 01:19] "AsusStartupHelp"="C:\Program Files\ASUS\AASP\1.00.24\AsRunHelp.exe" [2006-12-29 03:54] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 22:34] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 04:23] "RivaTunerStartupDaemon"="F:\Programy\Riva Tuner\RivaTuner v2.06\RivaTuner.exe" [2007-10-30 21:05] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-04 18:14] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-04 18:14] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-04 18:14] "PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 13:17] "DT GWY"="C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2007-10-09 18:45] "BtTray"="C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" [2008-05-26 21:51] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2006-11-02 14:33] "AutoConnect"="F:\Programy\AutoConnect\AutoConnect.exe" [2004-08-28 21:27] "DAEMON Tools Pro Agent"="F:\Programy\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 16:08] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:34] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 12:53] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - F:\Programy\Acrobat Reader 7\Reader\reader_sl.exe [2007-11-23 16:24:38] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-10-31 18:44:41] Microsoft Office.lnk - F:\Programy\Office\Office10\OSA.EXE [2007-11-23 16:27:06] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableLUA"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] "F:\Programy\Nero\Nero 8\Nero BackItUp\NBKeyScan.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinClicker.exe] "F:\Programy\salling click\Salling Clicker\WinClicker.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-08-09 11:39:57 ------------

Dodano 09.08.2008 11:11:23:
Skończyło się na tym, że przywróciłem system z wczoraj ... i tapeta jest.

**Posty:** 18165 · przez **wojtas** 09 Sie 2008, 12:12

Ściągnij OTMoveIt W okienko po lewej Paste List of Files/Folders to be Moved wklej

C:\Windows\0
C:\Windows\system32\0

Następnie naciskamy - MoveIt!. Pliki zostały przeniesione. Wynik operacji zobaczymy w prawym oknie Results.
Po całej operacji należy zresetować komputer wykonaj jeszcze raz z wklejaniem do notatnika.. i wroc z logiem

P

**Posty:** 2129 · przez **filip.ludwik** 09 Sie 2008, 12:17

wojtas napisał(a):wykonaj jeszcze raz z wklejaniem do notatnika..

Nie bardzo skumałem?
Przetłumacz, prosze :lol:

**Posty:** 18165 · przez **wojtas** 09 Sie 2008, 14:56

Wklej do notatnika taki tekst:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13a8197f-e055-11dc-a98f-000000000000}]

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na: "Wszystkie pliki" >>> Zapisz jako FIX.REG>>>
plik uruchom (dwuklik i OK- zgódź się na dodanie do Rejestru).