zamieniona strona startowa

**Posty:** 3874 · przez **Wojtasgls** 19 Lis 2007, 17:18

Wiam
Prosze o sprawdzenie loga jakies badziewie przez przypadek zainstalowalem z neta i zmienila mi sie strona startowa ie.. Po zmianie np. na wp. jest okej ale jak juz zrobie restart to lipa. Na poczatek HJT:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:16:07, on 2007-11-19 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\LClock\LClock.exe C:\Program Files\VisualTooltip\VisualToolTip.exe C:\Program Files\Styler\Styler.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\DOCUME~1\Wojtas\LOCALS~1\Temp\{8DFF633F-2CCF-41C8-B3FE-BC8563C3502C}\Blaero Start Orb.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\WinRAR\WinRAR.exe C:\Program Files\BitComet\BitComet.exe C:\Documents and Settings\Wojtas\Desktop\Wojtas.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start-digital-media.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada Plus wita Cie w Internecie O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O4 - HKLM\..\Run: [PathNvidiaTV] C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [Videos] "C:\Program Files\laughnetwork\update.exe" /background O4 - Startup: Joost.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{E7FAC2A2-7766-41FF-B349-60DDCDEAC170}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**Posty:** 7838 · przez **Lukesh** 19 Lis 2007, 17:24

Zastosuj sie do wskazowek z tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
:arrow:

Zrob skan on-line www.ewido.com
:arrow:

Pokaz log z ComboFix: http://www.programosy.pl/program,combofix.html - juz on powinien sie z tym uporac.
:arrow:

na sam koniec wstaw CALE logi wg opisu: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 3874 · przez **Wojtasgls** 19 Lis 2007, 17:57

1. zrobione
2. ewido nic nie wykrylo

combofix z tego linka mi nie dziala

wyskakuje:

a pozniej unnistal

ale znalazlem na dysku comboscan:

Kod: Zaznacz wszystko: mboScan v20070306.20 run by Wojtas on 2007-11-19 at 16:52:10 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Wojtas.exe) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 16:52:11, on 2007-11-19 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\LClock\LClock.exe C:\Program Files\VisualTooltip\VisualToolTip.exe C:\Program Files\Styler\Styler.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\DOCUME~1\Wojtas\LOCALS~1\Temp\{8DFF633F-2CCF-41C8-B3FE-BC8563C3502C}\Blaero Start Orb.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\mspaint.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Wojtas\Desktop\comboscan.exe C:\DOCUME~1\Wojtas\Desktop\Wojtas.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start-digital-media.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O4 - HKLM\..\Run: [PathNvidiaTV] C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [Videos] "C:\Program Files\laughnetwork\update.exe" /background O4 - Startup: Joost.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{E7FAC2A2-7766-41FF-B349-60DDCDEAC170}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- Files created between 2007-10-19 and 2007-11-19 ----------------------------- 2007-11-19 16:48:11 51200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-18 21:57:34 0 d-------- C:\Program Files\laughnetwork<LAUGHN~1> 2007-11-14 23:00:25 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\DAEMON Tools Pro<DAEMON~1> 2007-11-14 22:58:24 0 d-------- C:\Program Files\DAEMON Tools Pro<DAEMON~2> 2007-11-14 22:51:39 0 d-------- C:\Documents and Settings\Wojtas\Application Data\DAEMON Tools Pro<DAEMON~1> 2007-11-14 17:53:54 267112 --a------ C:\WINDOWS\system32\xactengine2_9.dll<XA3C66~1.DLL> 2007-11-14 17:53:54 3727720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2007-11-14 17:53:54 444776 --a------ C:\WINDOWS\system32\d3dx10_35.dll<D3DX10~3.DLL> 2007-11-14 17:53:54 1358192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll<D3DCOM~3.DLL> 2007-11-14 15:59:20 266088 --a------ C:\WINDOWS\system32\xactengine2_8.dll<XA3866~1.DLL> 2007-11-14 15:59:20 261480 --a------ C:\WINDOWS\system32\xactengine2_7.dll<XA3466~1.DLL> 2007-11-14 15:59:20 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll<X3DAUD~3.DLL> 2007-11-14 15:59:20 3497832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-11-14 15:59:20 443752 --a------ C:\WINDOWS\system32\d3dx10_34.dll<D3DX10~2.DLL> 2007-11-14 15:59:20 1124720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll<D3DCOM~2.DLL> 2007-11-14 15:59:19 443752 --a------ C:\WINDOWS\system32\d3dx10_33.dll<D3DX10~1.DLL> 2007-11-14 15:59:19 1123696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll<D3DCOM~1.DLL> 2007-11-14 15:59:18 255848 --a------ C:\WINDOWS\system32\xactengine2_6.dll<XA3066~1.DLL> 2007-11-14 15:59:18 251672 --a------ C:\WINDOWS\system32\xactengine2_5.dll<XA3C56~1.DLL> 2007-11-14 15:59:17 3426072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-11-11 11:25:06 1156 --a------ C:\WINDOWS\mozver.dat 2007-11-10 18:18:06 0 d-------- C:\Fraps 2007-11-10 15:39:36 0 d-------- C:\Program Files\MadOnion.com 2007-11-10 13:09:23 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-10-26 16:32:55 0 d-------- C:\Program Files\Common Files\Enterbrain<ENTERB~1> 2007-10-19 18:27:40 1060864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-10-19 18:27:40 3495784 --a------ C:\WINDOWS\system32\d3dx9_33.dll -- Find3M Report --------------------------------------------------------------- 2007-11-19 16:36:30 0 d-------- C:\Program Files\ewido anti-spyware 4.0<EWIDOA~1.0> 2007-11-19 16:06:30 0 d-------- C:\Program Files\AutoConnect<AUTOCO~1> 2007-11-14 20:25:11 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-11-11 11:25:37 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1> 2007-11-10 13:16:39 0 d-------- C:\Program Files\eMule 2007-10-19 18:33:56 107888 --a------ C:\WINDOWS\system32\CmdLineExt.dll<CMDLIN~1.DLL> 2007-10-04 18:16:48 356352 --a------ C:\WINDOWS\system32\nvusmb.exe 2007-10-04 18:16:48 356352 --a------ C:\WINDOWS\system32\nvunrm.exe 2007-10-04 18:16:48 356352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2007-10-04 18:16:48 356352 --a------ C:\WINDOWS\system32\nvuide.exe 2007-10-04 18:16:48 356352 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-10-04 17:14:00 1626112 --a------ C:\WINDOWS\system32\nwiz.exe 2007-10-04 17:14:00 2441216 --a------ C:\WINDOWS\system32\nvwssr.dll 2007-10-04 17:14:00 2371584 --a------ C:\WINDOWS\system32\nvwss.dll 2007-10-04 17:14:00 167936 --a------ C:\WINDOWS\system32\nvwrszht.dll 2007-10-04 17:14:00 163840 --a------ C:\WINDOWS\system32\nvwrszhc.dll 2007-10-04 17:14:00 303104 --a------ C:\WINDOWS\system32\nvwrstr.dll 2007-10-04 17:14:00 290816 --a------ C:\WINDOWS\system32\nvwrsth.dll 2007-10-04 17:14:00 294912 --a------ C:\WINDOWS\system32\nvwrssv.dll 2007-10-04 17:14:00 303104 --a------ C:\WINDOWS\system32\nvwrssl.dll 2007-10-04 17:14:00 299008 --a------ C:\WINDOWS\system32\nvwrssk.dll 2007-10-04 17:14:00 315392 --a------ C:\WINDOWS\system32\nvwrsru.dll 2007-10-04 17:14:00 319488 --a------ C:\WINDOWS\system32\nvwrsptb.dll 2007-10-04 17:14:00 323584 --a------ C:\WINDOWS\system32\nvwrspt.dll 2007-10-04 17:14:00 294912 --a------ C:\WINDOWS\system32\nvwrspl.dll 2007-10-04 17:14:00 299008 --a------ C:\WINDOWS\system32\nvwrsno.dll 2007-10-04 17:14:00 319488 --a------ C:\WINDOWS\system32\nvwrsnl.dll 2007-10-04 17:14:00 196608 --a------ C:\WINDOWS\system32\nvwrsko.dll 2007-10-04 17:14:00 212992 --a------ C:\WINDOWS\system32\nvwrsja.dll 2007-10-04 17:14:00 323584 --a------ C:\WINDOWS\system32\nvwrsit.dll 2007-10-04 17:14:00 315392 --a------ C:\WINDOWS\system32\nvwrshu.dll 2007-10-04 17:14:00 278528 --a------ C:\WINDOWS\system32\nvwrshe.dll 2007-10-04 17:14:00 327680 --a------ C:\WINDOWS\system32\nvwrsfr.dll 2007-10-04 17:14:00 303104 --a------ C:\WINDOWS\system32\nvwrsfi.dll 2007-10-04 17:14:00 327680 --a------ C:\WINDOWS\system32\nvwrsesm.dll 2007-10-04 17:14:00 335872 --a------ C:\WINDOWS\system32\nvwrses.dll 2007-10-04 17:14:00 286720 --a------ C:\WINDOWS\system32\nvwrseng.dll 2007-10-04 17:14:00 335872 --a------ C:\WINDOWS\system32\nvwrsel.dll 2007-10-04 17:14:00 311296 --a------ C:\WINDOWS\system32\nvwrsde.dll 2007-10-04 17:14:00 294912 --a------ C:\WINDOWS\system32\nvwrsda.dll 2007-10-04 17:14:00 286720 --a------ C:\WINDOWS\system32\nvwrscs.dll 2007-10-04 17:14:00 282624 --a------ C:\WINDOWS\system32\nvwrsar.dll 2007-10-04 17:14:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll 2007-10-04 17:14:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2007-10-04 17:14:00 81920 --a------ C:\WINDOWS\system32\nvwddi.dll 2007-10-04 17:14:00 3629056 --a------ C:\WINDOWS\system32\nvvitvsr.dll 2007-10-04 17:14:00 3551232 --a------ C:\WINDOWS\system32\nvvitvs.dll 2007-10-04 17:14:00 155716 --a------ C:\WINDOWS\system32\nvsvc32.exe 2007-10-04 17:14:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll 2007-10-04 17:14:00 126976 --a------ C:\WINDOWS\system32\nvrszht.dll 2007-10-04 17:14:00 225280 --a------ C:\WINDOWS\system32\nvrszhc.dll 2007-10-04 17:14:00 258048 --a------ C:\WINDOWS\system32\nvrstr.dll 2007-10-04 17:14:00 253952 --a------ C:\WINDOWS\system32\nvrsth.dll 2007-10-04 17:14:00 253952 --a------ C:\WINDOWS\system32\nvrssv.dll 2007-10-04 17:14:00 258048 --a------ C:\WINDOWS\system32\nvrssl.dll 2007-10-04 17:14:00 258048 --a------ C:\WINDOWS\system32\nvrssk.dll 2007-10-04 17:14:00 270336 --a------ C:\WINDOWS\system32\nvrsru.dll 2007-10-04 17:14:00 266240 --a------ C:\WINDOWS\system32\nvrsptb.dll 2007-10-04 17:14:00 274432 --a------ C:\WINDOWS\system32\nvrspt.dll 2007-10-04 17:14:00 253952 --a------ C:\WINDOWS\system32\nvrspl.dll 2007-10-04 17:14:00 253952 --a------ C:\WINDOWS\system32\nvrsno.dll 2007-10-04 17:14:00 274432 --a------ C:\WINDOWS\system32\nvrsnl.dll 2007-10-04 17:14:00 258048 --a------ C:\WINDOWS\system32\nvrsko.dll 2007-10-04 17:14:00 266240 --a------ C:\WINDOWS\system32\nvrsja.dll 2007-10-04 17:14:00 278528 --a------ C:\WINDOWS\system32\nvrsit.dll 2007-10-04 17:14:00 258048 --a------ C:\WINDOWS\system32\nvrshu.dll 2007-10-04 17:14:00 327680 --a------ C:\WINDOWS\system32\nvrshe.dll 2007-10-04 17:14:00 282624 --a------ C:\WINDOWS\system32\nvrsfr.dll 2007-10-04 17:14:00 249856 --a------ C:\WINDOWS\system32\nvrsfi.dll 2007-10-04 17:14:00 274432 --a------ C:\WINDOWS\system32\nvrsesm.dll 2007-10-04 17:14:00 282624 --a------ C:\WINDOWS\system32\nvrses.dll 2007-10-04 17:14:00 245760 --a------ C:\WINDOWS\system32\nvrseng.dll 2007-10-04 17:14:00 282624 --a------ C:\WINDOWS\system32\nvrsel.dll 2007-10-04 17:14:00 278528 --a------ C:\WINDOWS\system32\nvrsde.dll 2007-10-04 17:14:00 253952 --a------ C:\WINDOWS\system32\nvrsda.dll 2007-10-04 17:14:00 249856 --a------ C:\WINDOWS\system32\nvrscs.dll 2007-10-04 17:14:00 327680 --a------ C:\WINDOWS\system32\nvrsar.dll 2007-10-04 17:14:00 6750208 --a------ C:\WINDOWS\system32\nvoglnt.dll 2007-10-04 17:14:00 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2007-10-04 17:14:00 2854912 --a------ C:\WINDOWS\system32\nvmoblsr.dll 2007-10-04 17:14:00 1150976 --a------ C:\WINDOWS\system32\nvmobls.dll 2007-10-04 17:14:00 81920 --a------ C:\WINDOWS\system32\nvmctray.dll 2007-10-04 17:14:00 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll 2007-10-04 17:14:00 188416 --a------ C:\WINDOWS\system32\nvmccss.dll 2007-10-04 17:14:00 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll 2007-10-04 17:14:00 229376 --a------ C:\WINDOWS\system32\nvmccs.dll 2007-10-04 17:14:00 1478656 --a------ C:\WINDOWS\system32\nview.dll 2007-10-04 17:14:00 3166208 --a------ C:\WINDOWS\system32\nvgamesr.dll 2007-10-04 17:14:00 3334144 --a------ C:\WINDOWS\system32\nvgames.dll 2007-10-04 17:14:00 307200 --a------ C:\WINDOWS\system32\nvexpbar.dll 2007-10-04 17:14:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe 2007-10-04 17:14:00 5509120 --a------ C:\WINDOWS\system32\nvdispsr.dll 2007-10-04 17:14:00 6344704 --a------ C:\WINDOWS\system32\nvdisps.dll 2007-10-04 17:14:00 1073152 --a------ C:\WINDOWS\system32\nvcpluir.dll 2007-10-04 17:14:00 753664 --a------ C:\WINDOWS\system32\nvcplui.exe 2007-10-04 17:14:00 8491008 --a------ C:\WINDOWS\system32\nvcpl.dll 2007-10-04 17:14:00 147456 --a------ C:\WINDOWS\system32\nvcolor.exe 2007-10-04 17:14:00 36864 --a------ C:\WINDOWS\system32\nvcodins.dll 2007-10-04 17:14:00 36864 --a------ C:\WINDOWS\system32\nvcod.dll 2007-10-04 17:14:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe 2007-10-04 17:14:00 364544 --a------ C:\WINDOWS\system32\nvapi.dll 2007-10-04 17:14:00 5783424 --a------ C:\WINDOWS\system32\nv4_disp.dll 2007-10-04 17:14:00 425984 --a------ C:\WINDOWS\system32\keystone.exe 2007-10-03 18:47:00 0 d-------- C:\Program Files\Joost 2007-10-03 18:46:58 0 d-------- C:\Documents and Settings\Wojtas\Application Data\Joost 2007-09-14 07:21:04 81768 --a------ C:\WINDOWS\system32\xinput1_3.dll<XINPUT~4.DLL> 2007-09-11 12:02:40 81920 --a------ C:\WINDOWS\system32\frapsvid.dll -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "DAEMON Tools Pro Agent"="\"C:\\Program Files\\DAEMON Tools Pro\\DTProAgent.exe\"" "Videos"="\"C:\\Program Files\\laughnetwork\\update.exe\" /background" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "PathNvidiaTV"="C:\\Program Files\\Gigabyte\\Nvidia\\patchnvidiaTVout.exe" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "SoundMan"="SOUNDMAN.EXE" "LClock"="C:\\Program Files\\LClock\\LClock.exe" "Vista Sidebar"="C:\\Program Files\\Vista Sidebar\\sidebar.exe" "VisualTooltip"="C:\\Program Files\\VisualTooltip\\VisualToolTip.exe" "Blaero Start Orb"="C:\\Program Files\\Blaero Start Orb\\Blaero Start Orb.exe" "Styler"="C:\\Program Files\\Styler\\Styler.exe" "nwiz"="nwiz.exe /install" "NVRTCLK"="C:\\WINDOWS\\system32\\NVRTCLK\\NVRTClk.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~2.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk] "path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk" "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.EXE -b -l" "item"="Microsoft Office" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoclk] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="autoclk" "hkey"="HKLM" "command"="autoclk.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ctfmon" "hkey"="HKCU" "command"="C:\\WINDOWS\\system32\\ctfmon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="daemon" "hkey"="HKLM" "command"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="isuspm" "hkey"="HKLM" "command"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\isuspm.exe -startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="issch" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MMTray" "hkey"="HKLM" "command"="MMTray.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRTCLK] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NVRTClk" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NVRTCLK\\NVRTClk.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="nwiz" "hkey"="HKLM" "command"="nwiz.exe /install" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PDVDServ" "hkey"="HKLM" "command"="\"C:\\Program Files\\CyberLink DVD Solution\\PowerDVD\\PDVDServ.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="winampa" "hkey"="HKLM" "command"="C:\\Program Files\\Winamp\\winampa.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TaskbarIcon" "hkey"="HKLM" "command"="C:\\PROGRA~1\\Wanadoo\\TaskbarIcon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Watch" "hkey"="HKLM" "command"="C:\\PROGRA~1\\Wanadoo\\Watch.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wuauserv"=dword:00000002 "wscsvc"=dword:00000002 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{94b00071-92fb-11dc-be89-4d6564696130}] Shell\AutoRun\command I:\Autorun.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{94b00072-92fb-11dc-be89-4d6564696130}] Shell\AutoRun\command K:\Autorun.exe -- End of ComboScan: finished at 2007-11-19 at 16:52:28 ------------------------

silent:

Kod: Zaznacz wszystko: Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "DAEMON Tools Pro Agent" = ""C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"" ["DT Soft Ltd."] "Videos" = ""C:\Program Files\laughnetwork\update.exe" /background" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "PathNvidiaTV" = "C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe" [file not found] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "LClock" = "C:\Program Files\LClock\LClock.exe" [null data] "Vista Sidebar" = "C:\Program Files\Vista Sidebar\sidebar.exe" [null data] "VisualTooltip" = "C:\Program Files\VisualTooltip\VisualToolTip.exe" ["Christian Salmon"] "Blaero Start Orb" = "C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe" [null data] "Styler" = "C:\Program Files\Styler\Styler.exe" ["ta2027"] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NVRTCLK" = "C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe" [empty string] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension" -> {HKLM...CLSID} = "Display Panning CPL Extension" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\audiodev.dll" [MS] "{3028902F-6374-48b2-8DC6-9725E775B926}" = "IE Microsoft AutoComplete" -> {HKLM...CLSID} = "IE Microsoft AutoComplete" \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] "{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band" -> {HKLM...CLSID} = "History Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{8e9d6600-f84a-11ce-8daa-00aa004a5691}" = "Shell extensions for NetWare" -> {HKLM...CLSID} = "NetWare Objects" \InProcServer32\(Default) = "nwprovau.dll" [MS] "{e3f2bac0-099f-11cf-8daa-00aa004a5691}" = "Shell extensions for NetWare" -> {HKLM...CLSID} = "NetWare UNC Folder Menu" \InProcServer32\(Default) = "nwprovau.dll" [MS] "{52c68510-09a0-11cf-8daa-00aa004a5691}" = "Shell extensions for NetWare" -> {HKLM...CLSID} = "NetWare Hood Verbs" \InProcServer32\(Default) = "nwprovau.dll" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NetWareUNCMenu\(Default) = "{e3f2bac0-099f-11cf-8daa-00aa004a5691}" -> {HKLM...CLSID} = "NetWare UNC Folder Menu" \InProcServer32\(Default) = "nwprovau.dll" [MS] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Wojtas\Local Settings\Application Data\Microsoft\Wallpaper1.bmp" Startup items in "Wojtas" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\Wojtas\Start Menu\Programs\Startup "Joost" -> shortcut to: "C:\Program Files\Joost\xulrunner\tvprunner.exe ..\application.ini -standby" ["Joost Technologies B.V."] C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 25 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" [file not found] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Client Service for NetWare, NWCWorkstation, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\nwwks.dll" [MS]} NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] ---------- (launch time: 2007-11-19 16:55:33) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 17 seconds. ---------- (total run time: 60 seconds)

**Posty:** 7838 · przez **Lukesh** 19 Lis 2007, 17:59

combofix z tego linka mi nie dziala :-/

wyskakuje:

Dzisiaj bawilem sie z tym w szkole i mialem identyczny problem - zmien date systemowa, np rok do tylu i powinno ruszyc :wink:

Autor postu otrzymał pochwałę

**Posty:** 3874 · przez **Wojtasgls** 19 Lis 2007, 18:07

i poszlo

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - Wojtas 2006-11-19 17:04:49.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.672 [GMT 1:00] Running from: C:\Documents and Settings\Wojtas\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Admini\Dane aplikacji\install.dat C:\Documents and Settings\Wojtas\Desktop\internet.lnk C:\uniq . ((((((((((((((((((((((((( Files Created from 2007-10-08 to 2007-11-08 ))))))))))))))))))))))))))))))) . 2007-11-19 16:48 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-18 21:57 <DIR> d-------- C:\Program Files\laughnetwork 2007-11-14 23:00 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\DAEMON Tools Pro 2007-11-14 22:58 <DIR> d-------- C:\Program Files\DAEMON Tools Pro 2007-11-14 22:51 <DIR> d-------- C:\Documents and Settings\Wojtas\Application Data\DAEMON Tools Pro 2007-11-14 17:53 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2007-11-14 17:53 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll 2007-11-14 17:53 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll 2007-11-14 17:53 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2007-11-11 11:25 1,156 --a------ C:\WINDOWS\mozver.dat 2007-11-10 18:18 <DIR> d-------- C:\Fraps 2007-11-10 15:39 <DIR> d-------- C:\Program Files\MadOnion.com 2007-11-10 13:09 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-10-26 16:32 <DIR> d-------- C:\Program Files\Common Files\Enterbrain 2007-10-19 18:27 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-10-19 18:27 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-19 15:36 --------- d-----w C:\Program Files\ewido anti-spyware 4.0 2007-11-19 15:06 --------- d-----w C:\Program Files\AutoConnect 2007-11-14 21:48 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-11-14 19:25 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-14 16:54 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys 2007-11-14 15:29 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP 2007-11-10 12:16 --------- d-----w C:\Program Files\eMule 2007-10-19 17:33 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-10-04 17:16 356,352 ----a-w C:\WINDOWS\system32\nvusmb.exe 2007-10-04 17:16 356,352 ----a-w C:\WINDOWS\system32\nvunrm.exe 2007-10-04 17:16 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE 2007-10-04 17:16 356,352 ----a-w C:\WINDOWS\system32\nvuide.exe 2007-10-04 17:16 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe 2007-10-04 16:14 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll 2007-10-04 16:14 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll 2007-10-04 16:14 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll 2007-10-04 16:14 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe 2007-10-04 16:14 6,854,464 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-10-04 16:14 6,750,208 ----a-w C:\WINDOWS\system32\nvoglnt.dll 2007-10-04 16:14 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll 2007-10-04 16:14 5,783,424 ----a-w C:\WINDOWS\system32\nv4_disp.dll 2007-10-04 16:14 5,509,120 ----a-w C:\WINDOWS\system32\nvdispsr.dll 2007-10-04 16:14 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll 2007-10-04 16:14 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll 2007-10-04 16:14 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll 2007-10-04 16:14 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe 2007-10-04 16:14 425,984 ----a-w C:\WINDOWS\system32\keystone.exe 2007-10-04 16:14 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll 2007-10-04 16:14 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll 2007-10-04 16:14 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll 2007-10-04 16:14 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll 2007-10-04 16:14 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll 2007-10-04 16:14 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll 2007-10-04 16:14 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll 2007-10-04 16:14 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll 2007-10-04 16:14 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll 2007-10-04 16:14 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll 2007-10-04 16:14 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll 2007-10-04 16:14 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll 2007-10-04 16:14 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll 2007-10-04 16:14 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll 2007-10-04 16:14 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll 2007-10-04 16:14 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll 2007-10-04 16:14 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll 2007-10-04 16:14 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll 2007-10-04 16:14 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll 2007-10-04 16:14 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll 2007-10-04 16:14 3,629,056 ----a-w C:\WINDOWS\system32\nvvitvsr.dll 2007-10-04 16:14 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll 2007-10-04 16:14 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll 2007-10-04 16:14 3,166,208 ----a-w C:\WINDOWS\system32\nvgamesr.dll 2007-10-04 16:14 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll 2007-10-04 16:14 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll 2007-10-04 16:14 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll 2007-10-04 16:14 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll 2007-10-04 16:14 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll 2007-10-04 16:14 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll 2007-10-04 16:14 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll 2007-10-04 16:14 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll 2007-10-04 16:14 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll 2007-10-04 16:14 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll 2007-10-04 16:14 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll 2007-10-04 16:14 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll 2007-10-04 16:14 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll 2007-10-04 16:14 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll 2007-10-04 16:14 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll 2007-10-04 16:14 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll 2007-10-04 16:14 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll 2007-10-04 16:14 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll 2007-10-04 16:14 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll 2007-10-04 16:14 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll 2007-10-04 16:14 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll 2007-10-04 16:14 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll 2007-10-04 16:14 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll 2007-10-04 16:14 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll 2007-10-04 16:14 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll 2007-10-04 16:14 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll 2007-10-04 16:14 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll 2007-10-04 16:14 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll 2007-10-04 16:14 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll 2007-10-04 16:14 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll 2007-10-04 16:14 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll 2007-10-04 16:14 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll 2007-10-04 16:14 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll 2007-10-04 16:14 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll 2007-10-04 16:14 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll 2007-10-04 16:14 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll 2007-10-04 16:14 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll 2007-10-04 16:14 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll 2007-10-04 16:14 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll 2007-10-04 16:14 2,441,216 ----a-w C:\WINDOWS\system32\nvwssr.dll 2007-10-04 16:14 2,371,584 ----a-w C:\WINDOWS\system32\nvwss.dll 2007-10-04 16:14 196,608 ----a-w C:\WINDOWS\system32\nvwrsko.dll 2007-10-04 16:14 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll 2007-10-04 16:14 167,936 ----a-w C:\WINDOWS\system32\nvwrszht.dll 2007-10-04 16:14 163,840 ----a-w C:\WINDOWS\system32\nvwrszhc.dll 2007-10-04 16:14 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe 2007-10-04 16:14 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe 2007-10-04 16:14 126,976 ----a-w C:\WINDOWS\system32\nvrszht.dll 2007-10-04 16:14 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll 2007-01-24 20:34:34 56 --sh--r C:\WINDOWS\system32\77004CCD45.sys 2007-01-24 20:34:34 11,270 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PathNvidiaTV"="C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe" [] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14] "SoundMan"="SOUNDMAN.EXE" [2004-11-15 11:20 C:\WINDOWS\SOUNDMAN.EXE] "LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 00:27] "Vista Sidebar"="C:\Program Files\Vista Sidebar\sidebar.exe" [2006-12-25 07:14] "VisualTooltip"="C:\Program Files\VisualTooltip\VisualToolTip.exe" [2006-10-06 08:21] "Blaero Start Orb"="C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe" [2006-07-30 18:32] "Styler"="C:\Program Files\Styler\Styler.exe" [2006-05-03 09:48] "nwiz"="nwiz.exe" [2007-10-04 17:14 C:\WINDOWS\system32\nwiz.exe] "NVRTCLK"="C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe" [2003-12-30 10:44] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 10:12] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2006-10-15 17:41] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08] "Videos"="C:\Program Files\laughnetwork\update.exe" [2007-11-08 19:42] C:\Documents and Settings\Wojtas\Start Menu\Programs\Startup\ Joost.lnk - C:\Program Files\Joost\xulrunner\tvprunner.exe [2007-09-27 19:49:34] C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-03-11 08:49:27] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"=hex(2):76,69,73,74,61,75,69,2e,65,78,65,00 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoclk] autoclk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] MMTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wuauserv"=2 (0x2) "wscsvc"=2 (0x2) R3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-08 17:05:40 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run PathNvidiaTV = C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe??wLU??E??|N??|?????????????????D>????????|????????????x????D?|p??|???|?D?|?E?|?C?|?????????????????????????{??<??????????|?{??????Q??|????m??|???????????????|???????????|????????`???&s?|???|?s?|???Z@?? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-08 17:06:09 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 19 Lis 2007, 18:20

znasz to:

C:\Program Files\MadOnion.com

??

ktora strona startowa CI nie pasuje:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start-digital-media.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net

jesli ktoras z nich skasuj ja w hijacku

Autor postu otrzymał pochwałę

**Posty:** 3874 · przez **Wojtasgls** 19 Lis 2007, 19:08

C:\Program Files\MadOnion.com

pozostalosci po 3dmark2001 juz usunelem

Juz strone zmienilem dzieki

. Rozumiem, ze syfu zadnego nie widac?

**Posty:** 18165 · przez **wojtas** 19 Lis 2007, 19:10

nic nie widac

zamieniona strona startowa

zamieniona strona startowa

Kto jest na forum