trojan

[Autograf]

jak chcę ten temp usunąć to cały czas mi takie coś wyskakuje!

[wojtas]

daj do niego dokładną sciezke....

[Autograf]

stąd mam wziąć tą pełną scieżke? bo naprawde nie wiem...nic nie wychodzi


mozna jeszcze uzyc avg anti spyware?

[wojtas]

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

Autor postu otrzymał pochwałę

[Autograf]

no ok tylko nie mam takiej zakładki w viscie:/

[wojtas]

no to wykonaj co mozesz

[Autograf]

to mam nacisnac? na bank?

z optymalizacji mam wykonac wszystkie pkt?

[wojtas]

te ktore mozesz daj opcje wyłacz przywaracanie i potem włącz

[Autograf]

ok teraz wylaczylm to za ile to wlaczyc?

[Okocza]

za chwile

[Autograf]

no dobra zrobione, co bedzie dalej?...

[Okocza]

nic, już powinno być czysto dla pewności (bo teraz dopiero odpisałeś) daj log z combofixa

[Autograf]

mam viste i combofix mi nie chodzi! moge dac z dss'a

[ Dodano: Dzisiaj o 15:19 ]

Deckard's System Scanner v20071014.68
Run by Regina on 2008-05-09 16:13:46
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 1022 MiB (1024 MiB recommended).


-- HijackThis (run as Regina Kupczyk.exe) --------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:13:48, on 2008-05-09
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CacheBoost\trayicon.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Windows\system32\conime.exe
C:\Windows\notepad.exe
C:\Users\Regina Kupczyk\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\REGINA~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [CacheBoost] C:\Program Files\CacheBoost\trayicon.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [SoundMax] "E:\Audio\32bit\SM_Panel\Sys\SMax4.exe" /tray
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA')
O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-3/SmileyCentralFWBInitialSetup1.0.1.0.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game05.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zuma/sis/popcaploader_v10.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{24516228-E723-49C9-9B99-8CEA377BE53B}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{24516228-E723-49C9-9B99-8CEA377BE53B}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CacheBoost Performance Optimizer and Tuner Service (CacheBoost Service) - Systweak India - C:\Program Files\CacheBoost\cbsrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
O23 - Service: Usługa SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: SymantecAntiBotAgent - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe
O23 - Service: SymantecAntiBotWatcher - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe

--
End of file - 9168 bytes

-- Files created between 2008-04-09 and 2008-05-09 -----------------------------

2008-05-08 18:09:06 0 d-------- C:\Users\All Users\Grisoft
2008-05-07 16:05:45 21008 -----n--- C:\Windows\system32\CTL3D.DLL <Not Verified; Microsoft Corporation; 3d Windows Control>
2008-05-07 16:03:07 0 d-------- C:\Serif DrawPlus
2008-05-05 18:15:05 0 d-------- C:\!KillBox
2008-05-05 16:50:29 0 d-------- C:\Program Files\SiteAdvisor
2008-05-05 16:50:20 0 d-------- C:\Users\All Users\SiteAdvisor
2008-05-05 16:50:20 0 d-------- C:\Users\All Users\McAfee
2008-05-05 15:50:58 0 d-------- C:\Program Files\HakerzyNET AntiVirus
2008-05-04 13:31:33 0 d-------- C:\Program Files\Trend Micro
2008-05-03 19:02:41 0 d-------- C:\Program Files\SkanerOnline
2008-05-03 17:48:19 0 d-------- C:\Program Files\Symantec
2008-05-03 17:32:23 0 d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-04-30 16:21:39 0 d-------- C:\Program Files\Monte Cristo Multimedia
2008-04-30 16:03:52 0 d-------- C:\Windows\Your Memory! Część 2
2008-04-30 16:03:52 0 d-------- C:\Program Files\Your Memory! Część 2
2008-04-30 15:59:40 0 d-------- C:\Windows\Your Memory! Część 1
2008-04-30 15:59:40 0 d-------- C:\Program Files\Your Memory! Część 1
2008-04-30 14:46:23 2560 --a------ C:\Windows\_MSRSTRT.EXE
2008-04-26 15:25:58 0 d-------- C:\Program Files\Kangurek Kao Runda 2 (demo)
2008-04-24 18:10:04 0 d-------- C:\Program Files\LiveUpdate
2008-04-24 18:09:18 0 d-------- C:\Users\All Users\BVRP Software
2008-04-24 18:09:18 0 d-------- C:\Program Files\mobile PhoneTools
2008-04-21 19:31:03 0 d-------- C:\Program Files\The Adventure Company
2008-04-20 12:13:36 0 d-------- C:\Users\All Users\Flood Light Games
2008-04-20 12:09:12 0 d-------- C:\Program Files\Agatha Christie Peril at End House
2008-04-19 17:11:11 0 d-------- C:\Program Files\CacheBoost
2008-04-19 17:07:04 1264 --a------ C:\Windows\unins000.dat
2008-04-18 18:22:20 0 d-------- C:\Users\All Users\PlayfulAge
2008-04-18 18:21:49 0 d-------- C:\Windows\Pizza Chef
2008-04-18 18:21:49 0 d-------- C:\Program Files\Pizza Chef
2008-04-18 18:13:20 0 d-------- C:\Users\All Users\Totem Quest
2008-04-18 17:32:08 0 d-------- C:\Program Files\Totem Quest
2008-04-17 18:30:43 0 d-------- C:\Users\All Users\Adobe
2008-04-17 18:30:42 0 d-------- C:\Program Files\Common Files\Adobe
2008-04-17 18:29:13 0 d-------- C:\Windows\Cache
2008-04-17 17:19:57 0 d-------- C:\Program Files\Mortimer Beckett and the Secrets of Spooky Manor
2008-04-13 15:39:00 0 d-------- C:\Program Files\The Da Vinci Code
2008-04-12 15:34:20 545 --a------ C:\Windows\UC.PIF
2008-04-12 15:34:20 545 --a------ C:\Windows\RAR.PIF
2008-04-12 15:34:20 545 --a------ C:\Windows\PKZIP.PIF
2008-04-12 15:34:20 545 --a------ C:\Windows\PKUNZIP.PIF
2008-04-12 15:34:20 545 --a------ C:\Windows\NOCLOSE.PIF
2008-04-12 15:34:20 545 --a------ C:\Windows\LHA.PIF
2008-04-12 15:34:20 545 --a------ C:\Windows\ARJ.PIF
2008-04-12 15:34:20 0 d-------- C:\totalcmd
2008-04-10 16:31:08 0 d-------- C:\Windows\Moje Gimnazjum Profil Matematyczno-Przyrodniczy
2008-04-10 16:31:08 0 d-------- C:\Program Files\Moje Gimnazjum Profil Matematyczno-Przyrodniczy
2008-04-10 16:28:24 0 d-------- C:\Users\All Users\ConeXware
2008-04-10 16:28:03 0 d-------- C:\Program Files\PowerArchiver
2008-04-10 16:24:07 0 d-------- C:\Users\All Users\Downloaded Installations


-- Find3M Report ---------------------------------------------------------------

2008-05-08 18:29:15 0 d-------- C:\Users\Regina\AppData\Roaming\DNA
2008-05-08 18:09:15 0 d-------- C:\Users\Regina\AppData\Roaming\Grisoft
2008-05-07 16:07:06 0 d-------- C:\Program Files\Serif
2008-05-07 16:05:35 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-05 16:59:31 0 d-------- C:\Program Files\Ashampoo
2008-05-05 16:50:20 0 d-------- C:\Users\Regina\AppData\Roaming\SiteAdvisor
2008-05-03 17:54:52 0 d-------- C:\Users\Regina\AppData\Roaming\Symantec
2008-05-03 14:11:49 0 d-------- C:\Program Files\Winamp
2008-05-03 13:10:42 0 d-------- C:\Program Files\ActivationManager
2008-05-03 13:06:07 0 d-------- C:\Users\Regina\AppData\Roaming\BitTorrent
2008-04-29 15:02:49 0 d-------- C:\Users\Regina\AppData\Roaming\uTorrent
2008-04-20 12:13:36 0 d-------- C:\Users\Regina\AppData\Roaming\Flood Light Games
2008-04-17 18:39:31 0 d-------- C:\Users\Regina\AppData\Roaming\Adobe
2008-04-17 18:30:42 0 d-------- C:\Program Files\Common Files
2008-04-12 15:36:49 0 d-------- C:\Users\Regina\AppData\Roaming\GHISLER
2008-04-10 18:00:15 0 d-------- C:\Program Files\Windows Mail
2008-04-09 14:55:01 159017 --a------ C:\Windows\hpoins19.dat
2008-04-08 13:38:11 0 d-------- C:\Program Files\Ballance
2008-04-04 18:44:18 0 d-------- C:\Program Files\Gimnazjum klasa 1 - Fizyka
2008-04-04 18:39:45 0 d-------- C:\Program Files\uTorrent
2008-04-04 18:12:49 0 d-------- C:\Program Files\BitTorrent
2008-04-03 18:55:28 0 d-------- C:\Users\Regina\AppData\Roaming\Winamp
2008-04-02 19:09:08 0 d-------- C:\Program Files\Paragon Software
2008-04-02 18:43:57 0 d-------- C:\Program Files\Mortimer and the Enchanted Castle
2008-04-02 17:58:24 0 d-------- C:\Program Files\Gimnazjum 4 - Fizyka
2008-04-01 15:59:30 0 d-------- C:\Program Files\Avalon
2008-03-30 17:07:26 535330 --a------ C:\Windows\system32\perfh015.dat
2008-03-30 17:07:26 86210 --a------ C:\Windows\system32\perfc015.dat
2008-03-30 15:36:20 0 d-------- C:\Program Files\PITy
2008-03-30 14:06:24 0 --a------ C:\Windows\nsreg.dat
2008-03-30 14:06:11 0 d-------- C:\Users\Regina\AppData\Roaming\Mozilla
2008-03-30 14:03:54 0 d-------- C:\Users\Regina\AppData\Roaming\BESTplayer
2008-03-29 20:15:28 0 d-------- C:\Program Files\Stardock
2008-03-29 16:32:29 0 d-------- C:\Program Files\DAEMON Tools Lite
2008-03-29 16:32:19 0 d-------- C:\Users\Regina\AppData\Roaming\DAEMON Tools
2008-03-29 16:07:36 229057 --a------ C:\Windows\Alcohol_Toolbar_Uninstaller_8467.exe <Not Verified; Alcohol Soft; Alcohol Soft>
2008-03-29 16:07:36 0 d-------- C:\Program Files\Alcohol Toolbar
2008-03-29 16:07:27 0 d-------- C:\Program Files\Alcohol Soft
2008-03-29 16:00:11 0 d-------- C:\Program Files\SlySoft
2008-03-29 14:08:54 0 d-------- C:\Users\Regina\AppData\Roaming\Image Zone Express
2008-03-28 17:46:29 724992 --a------ C:\Windows\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2008-03-28 17:46:03 0 d-------- C:\Program Files\PopCap Games
2008-03-28 14:29:22 0 d-------- C:\Program Files\Common Files\SWF Studio
2008-03-28 14:29:17 0 d-------- C:\Program Files\Ballance 1LevelDemo
2008-03-19 19:22:58 0 d-------- C:\Users\Regina\AppData\Roaming\Ashampoo
2008-03-19 18:48:54 0 d-------- C:\Users\Regina\AppData\Roaming\Serif
2008-03-19 14:11:40 0 d-------- C:\Program Files\Common Files\InstallShield
2008-03-14 22:54:17 0 d-------- C:\Users\Regina\AppData\Roaming\Creative
2008-03-14 22:40:51 0 d-------- C:\Program Files\Creative
2008-03-14 22:40:46 0 d--h----- C:\Program Files\Creative Installation Information
2008-03-14 22:40:04 0 d-------- C:\Program Files\Common Files\Creative
2008-02-16 21:02:26 23580 --a------ C:\Users\Regina\AppData\Roaming\UserTile.png
2008-02-15 20:13:04 60273 --a------ C:\Windows\system32\pthreadGC2.dll <Not Verified; Open Source Software community project; >


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-12-01 04:10]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-11 23:28]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-11 23:28]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-11 23:28]
"AdslTaskBar"="stmctrl.dll" [2007-02-06 17:47 C:\Windows\System32\stmctrl.dll]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 22:52]
"hpqSRMon"="C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 17:31]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34]
"CacheBoost"="C:\Program Files\CacheBoost\trayicon.exe" [2003-06-24 20:55]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-12-04 23:03]
"MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 11:45]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 13:31]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 17:15]
"SoundMax"="E:\Audio\32bit\SM_Panel\Sys\SMax4.exe" []
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36]

C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 21:24:54]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 22:40:10]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
"C:\Users\Regina Kupczyk\Program Files\DNA\btdna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
"C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
"C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
C:\Program Files\eMule\emule.exe -AutoStart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HakerzyNET MAV]
C:\Program Files\HakerzyNET AntiVirus\HakerzyNET_MAV.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Onet.pl AutoUpdate]
C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIWatcher]
C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum 2\UIWatcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"C:\Program Files\Winamp\winampa.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum
HPZ12 Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt hpqcxs08 hpqddsvc


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16de1da1-9f2d-11dc-a518-001bfc9f5019}]
AutoRun\command- C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe pagefile.sys.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3d2c4c69-fd99-11dc-b619-f4fc3002f837}]
AutoRun\command- M:\startup.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-05-09 16:14:07 ------------

[Okocza]

wiesz co to

Kod: Zaznacz wszystko

C:\Users\All Users\Totem Quest 
C:\Program Files\Pizza Chef
C:\Users\All Users\ConeXware
C:\Users\All Users\PlayfulAge


otwórz notatnik i wklej w nim:

Kod: Zaznacz wszystko

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3d2c4c69-fd99-11dc-b619-f4fc3002f837}]


zapisujesz jako fix.reg
Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

[Autograf]

yyy jak i gdzie mam go dodac?

niewazne, zrobione

cos jeszcze robic?

[Okocza]

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

bedzie pytanie czy zgadasz sie dodac do rejestru..

[Autograf]

no to ok, cos jeszcze?

[Okocza]

jeszcze tylko pytanie:

wiesz co to Question
Kod:

C:\Users\All Users\Totem Quest
C:\Program Files\Pizza Chef
C:\Users\All Users\ConeXware
C:\Users\All Users\PlayfulAge

[Autograf]

wiem co to...usunać?

[Okocza]

sam to instalowałeś jeśli nie to usuń jeśli tak to zostaw. poza tym jest czysto i ok.