bardzo proszę o sprawdzenie loga - reklamy

[gmaster]

Witam! Kiedy jestem na necie co chwila wyskakują mi rekalmy i przenoszą najczeciej na adres www.xxxxxxxxxxxxx.Jest tak kiedy używam Opery.



Jak odpale stronę w IExplorerze to pojawia się biała strona a w wyszukiwarce jest napis "auto.blank" . Co robic?

Mój log z Hijackthis:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 21:38:23, on 2006-02-24
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Documents and Settings\Administrator\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [KAVPersonal50] "d:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.0 RC 15.8\RivaTuner.exe" /S
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZN
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137324697496
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4B5C108E-96F9-47D3-BA9F-72332D715E7B}: NameServer = 194.204.152.34 217.98.63.164
O20 - Winlogon Notify: htproc - htproc32.dll (file missing)
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\o8pqli7518.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: kavsvc - Kaspersky Lab - d:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe

Bardzo proszę o pomoc!

[Haczyk]

Ale bajzel pod maską. Nie jestem specem w Hijacku, ale wg mnie powinieneś przyjrzeć się bliżej tym wpisom:

R0 - xxxxxxxxxxxxxxxx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - xxxxxxxxxxxxxxxxxxxxxx
R0 - xxxxxxxxxxxxxxxxxxx
R3 - xxxxxxxxxxxxxxxxxxxxxxxx
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O3 - xxxxxxxxxxxxxxxxxxxx
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O4 - HKLM\..\Run: xxxxxxxxxxxxxxxxxx
O4 - HKLM\..\Run: xxxxxxxxxxxxxxxxxxxxxxxxx
O4 - HKLM\..\Run: xxxxxxxxxxxxxxxxxxxxxxxxxx
O4 - HKLM\..\Run: xxxxxxxxxxxxxxxxxx
O4 - HKLM\..\Run: xxxxxxxxxxxxx
O4 - HKLM\..\Run: xxxxxxxxxxxxxxx
O4 - HKLM\..\Run: xxxxxxxxxxxxxxxxxxxx
O4 - HKLM\..\Run: xxxxxxxxxxxxxxxxxxxx
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run:xxxxxxxxxxxxxxx
O4 - HKLM\..\Run:xxxxxxxxxxxxxxxxxxx
O4 - HKLM\..\Run: xxxxxxxxxxxxxxx
O4 - HKLM\..\Run: xxxxxxxxxxxxxxx
O4 - HKLM\..\Run: xxxxxxxxxxxxxxxxx
O4 - HKCU\..\Run: xxxxxxxxxxxxxxxx
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O4 - xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZN
O9 - xxxxxxxxxxxxxxxxxxxxx
O9 - xxxxxxxxxxxxxxxxxxxxxx
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 -xxxxxxxxxxxxxxxxxxxx
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O17 - HKLMxxxxxxxxxxxxxxxxxxxxxxx
O20 - Winlogon Notify: htproc - htproc32.dll (file missing)
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\o8pqli7518.dll
O23 -xxxxxxxxxxxxxxxxxxxxxx
O23 - xxxxxxxxxxxxxxxxxxx
O23 - xxxxxxxxxxxxxxxxx
O23 -xxxxxxxxxxxxxxxxxxxxxxx
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe

Ale z podjęciem stanowczych działań (usuwanie wpisów) poczekaj aż któryś z Adminów sprawdzi twój log. Zapomniałbym: coś jest na pewno nie tak z wpisem C:\Program Files\Network Monitor\netmon.exe

Autor postu otrzymał pochwałę

[Red]

Haczyk twoj post to bzdet i głupoty

[gmaster]

Red , móglbyś mnie poinstruowac co zrobic, żeby sie pozbyc tego świnstwa?? Zapomniałem dodac, ze od czasu do czasu wyskakuje mi to:

[Tom@szek]

Zaznacz - Nie pokazuj więcej tego komunikatu.
To jest prawidłowe działanie firewalla.

[Haczyk]

Nie będę się spierał czy ostrzeżenie dla mnie jest sprawiedliwe, ale na końcu wyraźnie napisałem:
"Ale z podjęciem stanowczych działań (usuwanie wpisów) poczekaj aż któryś z Adminów sprawdzi twój log."

Próbowałem tylko pomóc. Lepsza jakaś pomoc niż żadna

p.s. Tom@szek mógłbyś rzucić okiem na mój post w dziale Bezpieczeństwo->Skaner otwartych portów [temat przyklejony]. Nikt mi nie odpowiada, a w końcu ty jesteś autorem tematu

[Tom@szek]

Próbowałem pomóc

Jak widać - w tym dziale nie robimy czegos na "odwal się"
Więc jesli nie wiesz co usuwać - po prostu nic nie pisz.

[gmaster]

eee to wie ktoś co z tym fantem zrobic? bo log raczej nie jest czysty...
pozdro

[Tom@szek]

Wklej jeszcze raz tego log-a - może być juz nieaktualny.
Przed wklejeniem przeczyść kompa:

Spybot
Kaspersky
CWShredder
AdAware
Pestpatrol

[gmaster]

Sprwadzałem kompa Kaspersky'im AV Personal, SpySweeper, Ad-Aware SE Personal (wszystkie programy aktualizowałem przed skanowaniem). Kaspersky nie wykrył nic, SpySweeper to co wykrył to usunął Ad-Aware wykrył też trochę "spy" i usunął wszystko oprócz jedego wpisu:

Kod: Zaznacz wszystko

C:\\WINDOWS\system32\irlsl5371.dll

Czy mogę go usunąć w trybie awaryjnym bez żadnych konsekfencji?

Dam log z Ad-Aware:

Kod: Zaznacz wszystko

Ad-Aware SE Build 1.06r1
Logfile Created on:3 marca 2006 18:55:30
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R94 28.02.2006
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
CoolWebSearch(TAC index:10):5 total references
Malware.Psguard(TAC index:7):1 total references
MRU List(TAC index:0):13 total references
VX2(TAC index:10):11 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


2006-03-03 18:55:30 - Scan started. (Full System Scan)

MRU List Object Recognized!
    Location:          : C:\Documents and Settings\Administrator\recent
    Description        :


MRU List Object Recognized!
    Location:          : S-1-5-21-854245398-823518204-725345543-500\software\microsoft\direct3d\mostrecentapplication
    Description        :


MRU List Object Recognized!
    Location:          : software\microsoft\direct3d\mostrecentapplication
    Description        :


MRU List Object Recognized!
    Location:          : S-1-5-21-854245398-823518204-725345543-500\software\microsoft\direct3d\mostrecentapplication
    Description        :


MRU List Object Recognized!
    Location:          : software\microsoft\direct3d\mostrecentapplication
    Description        :


MRU List Object Recognized!
    Location:          : software\microsoft\directdraw\mostrecentapplication
    Description        :


MRU List Object Recognized!
    Location:          : S-1-5-21-854245398-823518204-725345543-500\software\microsoft\directinput\mostrecentapplication
    Description        :


MRU List Object Recognized!
    Location:          : S-1-5-21-854245398-823518204-725345543-500\software\microsoft\directinput\mostrecentapplication
    Description        :


MRU List Object Recognized!
    Location:          : S-1-5-21-854245398-823518204-725345543-500\software\microsoft\windows\currentversion\applets\wordpad\recent file list
    Description        :


MRU List Object Recognized!
    Location:          : S-1-5-21-854245398-823518204-725345543-500\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
    Description        :


MRU List Object Recognized!
    Location:          : S-1-5-21-854245398-823518204-725345543-500\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
    Description        :


MRU List Object Recognized!
    Location:          : S-1-5-21-854245398-823518204-725345543-500\software\microsoft\windows\currentversion\explorer\recentdocs
    Description        :


MRU List Object Recognized!
    Location:          : S-1-5-21-854245398-823518204-725345543-500\software\microsoft\windows media\wmsdk\general
    Description        :


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
    FilePath           : \SystemRoot\System32\
    ProcessID          : 652
    ThreadCreationTime : 2006-03-03 17:54:26
    BasePriority       : Normal


#:2 [winlogon.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 760
    ThreadCreationTime : 2006-03-03 17:54:35
    BasePriority       : High


CoolWebSearch Object Recognized!
    Type               : Process
    Data               : irlsl5371.dll
    TAC Rating         : 10
    Category           : Malware
    Comment            : (CSI MATCH)
    Object             : C:\WINDOWS\system32\


Warning! CoolWebSearch Object found in memory(C:\WINDOWS\system32\irlsl5371.dll)


#:3 [services.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 804
    ThreadCreationTime : 2006-03-03 17:54:36
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : System operacyjny Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Usługi i aplikacja Kontroler
    InternalName       : services.exe
    LegalCopyright     : © Microsoft Corporation. Wszelkie prawa zastrzeżone.
    OriginalFilename   : services.exe

#:4 [lsass.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 816
    ThreadCreationTime : 2006-03-03 17:54:36
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : LSA Shell (Export Version)
    InternalName       : lsass.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : lsass.exe

#:5 [ati2evxx.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 964
    ThreadCreationTime : 2006-03-03 17:54:36
    BasePriority       : Normal
    FileVersion        : 6.14.10.4129
    ProductVersion     : 6.14.10.4129
    ProductName        : ATI External Event Utility for WindowsNT and Windows9X
    CompanyName        : ATI Technologies Inc.
    FileDescription    : ATI External Event Utility EXE Module
    InternalName       : ATI2EVXX.EXE
    LegalCopyright     : Copyright © 1999-2004 ATI Technologies Inc.
    OriginalFilename   : ATI2EVXX.EXE

#:6 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 996
    ThreadCreationTime : 2006-03-03 17:54:36
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:7 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1024
    ThreadCreationTime : 2006-03-03 17:54:36
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:8 [spoolsv.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1316
    ThreadCreationTime : 2006-03-03 17:54:38
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (XPClient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Spooler SubSystem App
    InternalName       : spoolsv.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : spoolsv.exe

#:9 [rundll32.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1944
    ThreadCreationTime : 2006-03-03 17:54:46
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : System operacyjny Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Uruchamia plik DLL jako aplikację
    InternalName       : rundll
    LegalCopyright     : © Microsoft Corporation. Wszelkie prawa zastrzeżone.
    OriginalFilename   : RUNDLL.EXE

CoolWebSearch Object Recognized!
    Type               : Process
    Data               : ufeg.dll
    TAC Rating         : 10
    Category           : Malware
    Comment            : (CSI MATCH)
    Object             : C:\WINDOWS\system32\


Warning! CoolWebSearch Object found in memory(C:\WINDOWS\system32\ufeg.dll)


#:10 [ati2evxx.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 296
    ThreadCreationTime : 2006-03-03 17:54:49
    BasePriority       : Normal
    FileVersion        : 6.14.10.4129
    ProductVersion     : 6.14.10.4129
    ProductName        : ATI External Event Utility for WindowsNT and Windows9X
    CompanyName        : ATI Technologies Inc.
    FileDescription    : ATI External Event Utility EXE Module
    InternalName       : ATI2EVXX.EXE
    LegalCopyright     : Copyright © 1999-2004 ATI Technologies Inc.
    OriginalFilename   : ATI2EVXX.EXE

#:11 [explorer.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 400
    ThreadCreationTime : 2006-03-03 17:54:49
    BasePriority       : Normal
    FileVersion        : 6.00.2600.0000 (xpclient.010817-1148)
    ProductVersion     : 6.00.2600.0000
    ProductName        : System operacyjny Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Eksplorator Windows
    InternalName       : explorer
    LegalCopyright     : © Microsoft Corporation. Wszelkie prawa zastrzeżone.
    OriginalFilename   : EXPLORER.EXE

CoolWebSearch Object Recognized!
    Type               : Process
    Data               : ufeg.dll
    TAC Rating         : 10
    Category           : Malware
    Comment            : (CSI MATCH)
    Object             : C:\WINDOWS\system32\


Warning! CoolWebSearch Object found in memory(C:\WINDOWS\system32\ufeg.dll)


#:12 [rundll32.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 608
    ThreadCreationTime : 2006-03-03 17:54:50
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : System operacyjny Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Uruchamia plik DLL jako aplikację
    InternalName       : rundll
    LegalCopyright     : © Microsoft Corporation. Wszelkie prawa zastrzeżone.
    OriginalFilename   : RUNDLL.EXE

#:13 [cnxmon.exe]
    FilePath           : C:\PROGRA~1\NEOSTR~1\
    ProcessID          : 620
    ThreadCreationTime : 2006-03-03 17:54:50
    BasePriority       : Normal
    FileVersion        : 1, 0, 0, 1
    ProductVersion     : 1, 0, 0, 1
    ProductName        : Application CnxMon
    FileDescription    : Application MFC CnxMon
    InternalName       : CnxMon
    LegalCopyright     : Copyright (C) 2001
    OriginalFilename   : CnxMon.EXE

#:14 [dragdiag.exe]
    FilePath           : C:\Program Files\Thomson\SpeedTouch USB\
    ProcessID          : 628
    ThreadCreationTime : 2006-03-03 17:54:50
    BasePriority       : Normal
    FileVersion        : 301.0.0.12
    ProductVersion     : 301.0.0.12
    ProductName        : SpeedTouch USB
    CompanyName        : THOMSON Telecom Belgium
    FileDescription    : SpeedTouch Statistics
    LegalCopyright     : Copyright© THOMSON Telecom Belgium 1999-2004
    LegalTrademarks    : SpeedTouch

#:15 [jusched.exe]
    FilePath           : C:\Program Files\Java\jre1.5.0_06\bin\
    ProcessID          : 644
    ThreadCreationTime : 2006-03-03 17:54:50
    BasePriority       : Normal


#:16 [ctfmon.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 720
    ThreadCreationTime : 2006-03-03 17:54:51
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : CTF Loader
    InternalName       : CTFMON
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : CTFMON.EXE

#:17 [ad-aware.exe]
    FilePath           : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
    ProcessID          : 1896
    ThreadCreationTime : 2006-03-03 17:55:04
    BasePriority       : Normal
    FileVersion        : 6.2.0.236
    ProductVersion     : SE 106
    ProductName        : Lavasoft Ad-Aware SE
    CompanyName        : Lavasoft Sweden
    FileDescription    : Ad-Aware SE Core application
    InternalName       : Ad-Aware.exe
    LegalCopyright     : Copyright © Lavasoft AB Sweden
    OriginalFilename   : Ad-Aware.exe
    Comments           : All Rights Reserved

#:18 [wuauclt.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 780
    ThreadCreationTime : 2006-03-03 17:55:27
    BasePriority       : Normal
    FileVersion        : 5.8.0.2469 built by: lab01_n(wmbla)
    ProductVersion     : 5.8.0.2469
    ProductName        : System operacyjny Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Aktualizacje automatyczne
    InternalName       : wuauclt.exe
    LegalCopyright     : © Microsoft Corporation. Wszelkie prawa zastrzeżone.
    OriginalFilename   : wuauclt.exe

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 16


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Malware.Psguard Object Recognized!
    Type               : Regkey
    Data               :
    TAC Rating         : 7
    Category           : Malware
    Comment            :
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\winhound.com

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 17


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

VX2 Object Recognized!
    Type               : Regkey
    Data               :
    TAC Rating         : 10
    Category           : Malware
    Comment            : C:\WINDOWS\system32\sfndcmsg.dll
    Rootkey            : HKEY_CLASSES_ROOT
    Object             : CLSID\{8E2ADA44-1544-4274-9064-E99B0CD851F3}

VX2 Object Recognized!
    Type               : File
    Data               : sfndcmsg.dll
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Object             : c:\windows\system32\



VX2 Object Recognized!
    Type               : Regkey
    Data               :
    TAC Rating         : 10
    Category           : Malware
    Comment            : C:\WINDOWS\system32\udrsvpia.dll
    Rootkey            : HKEY_CLASSES_ROOT
    Object             : CLSID\{D75A7C78-ABF9-448E-8E1E-45A57772A093}

VX2 Object Recognized!
    Type               : File
    Data               : udrsvpia.dll
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Object             : c:\windows\system32\



Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 2
Objects found so far: 21


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 21



Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

VX2 Object Recognized!
    Type               : File
    Data               : A0086201.dll
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Object             : C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP107\



VX2 Object Recognized!
    Type               : File
    Data               : A0086202.dll
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Object             : C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP107\



VX2 Object Recognized!
    Type               : File
    Data               : A0086246.dll
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Object             : C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP107\



VX2 Object Recognized!
    Type               : File
    Data               : A0086264.dll
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Object             : C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP107\



Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 25


Deep scanning and examining files (D:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for D:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 25


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
142 entries scanned.
New critical objects:0
Objects found so far: 25




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

CoolWebSearch Object Recognized!
    Type               : RegValue
    Data               :
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\microsoft\internet explorer\main
    Value              : Search Bar

CoolWebSearch Object Recognized!
    Type               : File
    Data               : wbemess.log
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Object             : C:\WINDOWS\System32\wbem\logs\



VX2 Object Recognized!
    Type               : RegValue
    Data               :
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : system\lastknowngoodrecovery\lastgood
    Value              : INF/oem14.PNF

VX2 Object Recognized!
    Type               : RegValue
    Data               :
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : system\lastknowngoodrecovery\lastgood
    Value              : INF/oem11.PNF

VX2 Object Recognized!
    Type               : RegValue
    Data               :
    TAC Rating         : 10
    Category           : Malware
    Comment            :
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : system\lastknowngoodrecovery\lastgood
    Value              : INF/oem12.PNF

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 5
Objects found so far: 30

19:02:16 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:06:45.579
Objects scanned:179305
Objects identified:14
Objects ignored:0
New critical objects:14



Daje jeszcze aktualny log z Hijacktjis... :

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 19:26:57, on 2006-03-03
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\RunDll32.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Administrator\Pulpit\l2mfix.exe
C:\Documents and Settings\Administrator\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KAVPersonal50] "d:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.0 RC 15.8\RivaTuner.exe" /S
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZN
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137324697496
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\irlsl5371.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: kavsvc - Kaspersky Lab - d:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)



Ktoś ma jakieś sugestie? Może dać jeszcze log z innego programu? Będe wdzięczny za wszelką pomoc

[Red]

gmaster chcesz powalczyc ????To prosze o dwa logi:

1. ewido:
http://www.ewido.net/en/download/
2.
1. Sciagnij i uruchom (wypakuj) programik
http://www.atribune.org/downloads/l2mfix.exe
2. Odpal go przez l2mfix.bat z jego folderu
3. Uruchom w nim opcje 1 (Run Find Log)
4. Czekaj cierpliwie na zakonczenie
5. Pokaz log ktory dostaniesz po zakonczeniu

[gmaster]

Red, będe walczył do końca

Log z ewido:

Kod: Zaznacz wszystko

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on:         20:41:37, 2006-03-03
+ Report-Checksum:      7FE4BC0

+ Scan result:

   HKLM\SOFTWARE\WinHound.com -> Adware.WinHound : Error during cleaning
   HKLM\SOFTWARE\WinHound.com\WinHound -> Adware.WinHound : Error during cleaning
   HKLM\SOFTWARE\WinHound.com\WinHound\WinHound -> Adware.WinHound : Error during cleaning
   HKLM\SOFTWARE\WinHound.com\WinHound\WinHound\License -> Adware.WinHound : Cleaned with backup
   [820] C:\WINDOWS\system32\guard.tmp -> Adware.Look2Me : Error during cleaning
   C:\Program Files\Tlen.pl\plugins\DozaKultury.tpl -> Adware.Doza : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP85\A0074915.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP85\A0074959.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP85\A0074985.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP87\A0075000.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP87\A0075006.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP87\A0075022.exe -> Adware.AdURL : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP87\A0076012.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP87\A0076018.exe -> Adware.AdURL : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP87\A0076056.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP90\A0076515.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP91\A0076838.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP91\A0076855.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP91\A0076862.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP91\A0077874.DLL -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP91\A0078873.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP93\A0079123.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP93\A0080074.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP93\A0080602.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP94\A0080622.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP94\A0080644.exe -> Adware.AdURL : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP94\A0081635.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP94\A0081650.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP94\A0081763.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP97\A0081872.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP98\A0082110.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP98\A0082177.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP98\A0082209.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP100\A0082321.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP101\A0084332.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP101\A0084349.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP101\A0084365.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP101\A0084393.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP101\A0084407.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP101\A0084437.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP101\A0084458.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP104\A0085776.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP105\A0085825.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP106\A0086001.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP106\A0086125.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP106\A0086135.exe -> Adware.AdURL : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP106\A0086138.exe -> Dialer.Plsex : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP106\A0086140.EXE -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP106\A0086141.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP107\A0086210.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP107\A0086255.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP107\A0086290.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP107\A0086295.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP107\A0086305.dll -> Adware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{EDAF9B0F-66F8-4F22-A88F-4F9522E2913C}\RP107\A0086306.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\svsinv.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dbdlgs.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\parfproc.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dpmclien.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\djrgres.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\slnsapi.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\ksdpl1.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\wuecedit.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\szimgvw.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mjpmsp.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\kldgae.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\hptplug.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\nurszhc.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\nwvdmd.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\sbardssp.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\gctuname.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\uteg.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\cwrsrv.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mjvcrt20.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mjiqtz32.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\nbevtmsg.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\gqtuname.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\cwl3d32.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\sqclient.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dkintf.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\apstream.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dinmpntw.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dv32gt.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\nrptools.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dwdiagn.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\rkhx32.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mvrepl40.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\cVpesnpn.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\impromon.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dlwave.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\hzsetup.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\l44qleh51h4.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\kt0ml7d11.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\jtn4075qe.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\insmsnap.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\izlogmsg.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\qssname.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\jtns0757e.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\lv2s09f7e.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\k4440ehqeh4e0.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\o8ns0i57e8.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dnl0013me.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\ndcodins.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mjlbui.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mKpi32.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\wF2time.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\wosapi32.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\jt0607dse.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\cpiconfg.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mvnsl9571.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\coyptnet.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\vkhelper.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\ceyptext.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\doound.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mwvidctl.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\ksdhela2.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mrpmspsv.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\rypcfgex.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\wrdmlog.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dtserial.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\oabc32gt.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\cLbview.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\phisdecd.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\jk0607dse.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\tnpmonui.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mrls31.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\ujdmxfrm.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\enr0l19m1.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\nimccs.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\ir4ul5h91.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\ncinstnt.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\ma3216.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\ovengl32.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\j62q0gf5e62.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\h6n00g5me6.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\rfched20.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mudart.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\kzdit142.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\k4js0e17eh.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\kruser.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mxcorier.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\wyhcon.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\kldlt.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\ienathlp.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dnl6013se.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\nxprint.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dAdx9_26.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\nsshrui.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mvlogmgr.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\u4rule991h.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\kzdca.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\kmdmac.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\nprsptb.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\dZdx9_26.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\o4ro0e93eh.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\vvrsion.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\snell.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\oyesvr.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\MLRDO20.DLL -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\pxisdecd.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\jt6807jue.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\mkutil.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\n8p4li7q18.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\k6080gdue6080.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\oHns0i57e8.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\p2n8lc5u1f.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\f8l0li3m18.dll -> Adware.Look2Me : Cleaned with backup
   C:\WINDOWS\system32\p08q0al5edq.dll -> Adware.Look2Me : Cleaned with backup
   C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\temp.fr9647 -> Adware.Look2Me : Cleaned with backup
   C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\temp.frBF71 -> Adware.Look2Me : Cleaned with backup
   C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
   C:\Documents and Settings\Administrator\Cookies\administrator@gde.adocean[2].txt -> TrackingCookie.Adocean : Cleaned with backup
   C:\Documents and Settings\Administrator\Cookies\administrator@my.adocean[1].txt -> TrackingCookie.Adocean : Cleaned with backup
   C:\Documents and Settings\Administrator\Cookies\administrator@paypopup[2].txt -> TrackingCookie.Paypopup : Cleaned with backup
   C:\Documents and Settings\Administrator\Cookies\administrator@ad.adocean[2].txt -> TrackingCookie.Adocean : Cleaned with backup
   :mozilla.24:D:\Documents and Settings\Przemysław Chabowski\Dane aplikacji\Mozilla\Firefox\Profiles\xylfmb9c.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
   :mozilla.48:D:\Documents and Settings\Przemysław Chabowski\Dane aplikacji\Mozilla\Firefox\Profiles\xylfmb9c.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup
   :mozilla.49:D:\Documents and Settings\Przemysław Chabowski\Dane aplikacji\Mozilla\Firefox\Profiles\xylfmb9c.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup
   :mozilla.53:D:\Documents and Settings\Przemysław Chabowski\Dane aplikacji\Mozilla\Firefox\Profiles\xylfmb9c.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup
   :mozilla.54:D:\Documents and Settings\Przemysław Chabowski\Dane aplikacji\Mozilla\Firefox\Profiles\xylfmb9c.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup
   :mozilla.55:D:\Documents and Settings\Przemysław Chabowski\Dane aplikacji\Mozilla\Firefox\Profiles\xylfmb9c.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
   :mozilla.56:D:\Documents and Settings\Przemysław Chabowski\Dane aplikacji\Mozilla\Firefox\Profiles\xylfmb9c.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
   :mozilla.57:D:\Documents and Settings\Przemysław Chabowski\Dane aplikacji\Mozilla\Firefox\Profiles\xylfmb9c.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
   :mozilla.58:D:\Documents and Settings\Przemysław Chabowski\Dane aplikacji\Mozilla\Firefox\Profiles\xylfmb9c.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
   :mozilla.67:D:\Documents and Settings\Przemysław Chabowski\Dane aplikacji\Mozilla\Firefox\Profiles\xylfmb9c.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup
   D:\Program Files\NewDotNet\newdotnet3_88.dll -> Adware.NewDotNet : Cleaned with backup
   D:\Przemek\programy\craagle191.rar/Craagle.exe -> Adware.Craagle : Cleaned with backup


::Report End


A log z L2MFIX jest taki długi ze nie chce sie cały zmiescic! Jak odpalam ten program i biore 1 to pisze parę razy "nie można odnaleźć pliku..." potem pisze "please wait..." i po 2 sekundach wywala mi loga. O co tu chodzi?

[mafia435]

A log z L2MFIX jest taki długi ze nie chce sie cały zmiescic

Bo on ma być długi umieść go jakoś na forum jak nie dasz rady w jednym poscie to ewentualnie podziel go na 2 części. Mysle że nie ma ograniczenia wielkości więc powinno się udac umieścić cały.

[gmaster]

Log z L2MFIX cz.1:

Kod: Zaznacz wszystko

L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Applets]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\irlsl5371.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{676D346F-E67A-4F50-40E3-1B6A557B19F5}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Karta wˆa˜ciwo˜ci pliku multimedialnego"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ZarzĄdzanie skanerem ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Strona zabezpieczeä NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Strona wˆa˜ciwo˜ci OLE Docfile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Rozszerzenia powˆoki dla udost©pniania zasob˘w"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL karty graficznej"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL monitora wy˜wietlania"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL kadrowania wy˜wietlania"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Strona zabezpieczeä usˆugi DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Strona zgodno˜ci"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Program obsˆugi danych wycinkowych powˆoki"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Rozszerzenie Disc Copy"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Rozszerzenia powˆoki dla obiekt˘w Microsoft Windows Network"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ZarzĄdzanie monitorem ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ZarzĄdzanie drukarkĄ ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Rozszerzenia powˆoki dla kompresji plik˘w"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Rozszerzenie powˆoki drukarek sieci Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu kontekstowe szyfrowania"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Akt˘wka"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Rozszerzenie ikony HyperTerminalu"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Strona zabezpieczeä drukarek"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Rozszerzenia powˆoki dla udost©pniania zasob˘w"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Rozszerzenie Crypto PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Rozszerzenie Crypto Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="PoˆĄczenia sieciowe"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="PoˆĄczenia sieciowe"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Skanery i aparaty fotograficzne"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Skanery i aparaty fotograficzne"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Skanery i aparaty fotograficzne"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Skanery i aparaty fotograficzne"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Skanery i aparaty fotograficzne"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Rozszerzenia powˆoki dla hosta skrypt˘w systemu Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Zaplanowane zadania"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Pasek zadaä i menu Start"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Wyszukaj"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Pomoc i obsˆuga techniczna"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Pomoc i obsˆuga techniczna"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Uruchom..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Czcionki"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Narz©dzia administracyjne"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Pasek narz©dzi programu Microsoft Internet"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Stan pobierania"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Folder powˆoki zwi©kszonej"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Folder powˆoki zwi©kszonej 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Pasek przeglĄdarki Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Pasek wyszukiwania"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Pasek multimedi˘w"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Wyszukiwanie w okienku"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Wyszukiwanie w sieci Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Narz©dzie opcji drzewa rejestru"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adres"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Pole edycji adresu"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Autouzupeˆnianie Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="Wyodr©bnianie obraz˘w Trident"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Lista autouzupeˆniania MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Niestandardowa lista autouzupeˆniania MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Dost©pny"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Pasek podr©czny ˜ledzenia"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analizator paska adresu"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lista autouzupeˆniania historii Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Lista autouzupeˆniania folderu powˆoki Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Kontener wielu list autouzupeˆniania Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu witryny paska powˆoki"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Pasek pulpitu powˆoki"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Pomoc dla uľytkownika"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Globalne ustawienia folder˘w"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historia"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Tymczasowe pliki internetowe"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Tymczasowe pliki internetowe"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Ekran powitalny pakietu IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Pasek eksploratora"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Folder pami©ci podr©cznej ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Folder subskrypcji"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Menedľer aplikacji powˆoki"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Wyliczanie zainstalowanych aplikacji"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publikator aplikacji Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+program wyodr©bniajĄcy miniatury plik˘w"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Informacje podsumowujĄce obsˆugi miniatur (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Wyodr©bnianie miniatur HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Kreator publikacji w sieci Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Zamawianie odbitek w sieci Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Obiekt powˆoki kreatora publikacji"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Kreator uzyskiwania profilu usˆugi Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Konta uľytkownik˘w"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Plik kanaˆu"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Skr˘t kanaˆu"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Obiekt obsˆugi kanaˆu"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Folder plik˘w trybu offline"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Do os˘b..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
"{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device"
"{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device ContextMenuHandler"
"{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}"="Siemens SX1 PropertySheetHandler"
"{B8323370-FF27-11D2-97B6-204C4F4F5020}"="SmartFTP Shell Extension DLL"
"{B327765E-D724-4347-8B16-78AE18552FC3}"="NeroDigitalIconHandler"
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}"="NeroDigitalPropSheetHandler"
"{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6 Context Menu Shell Extension"
"{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6 DragDrop Shell Extension"
"{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6 Context Menu Shell Extension"
"{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6 Property Sheet Shell Extension"
"{7C56A142-8AA5-46F4-BC14-2BF1B99D98DF}"=""
"{0226B34C-79AA-4373-B841-096193846BD2}"=""
"{C91E1D46-919E-44C5-A7E5-61A9034C1255}"=""
"{7EC56637-CF3D-4175-B1C3-88EE2FC6CE7C}"=""
"{4D97E152-766A-4883-898F-3828E81F6455}"=""
"{DBDA4B75-F8D0-4D60-871E-C98AF697DECF}"=""
"{BC7CE28D-120C-49AF-A734-F81577A71690}"=""
"{6252A406-C428-4BFB-B505-B1C8F3660CA5}"=""
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{25EF9F80-FC41-49E4-9A30-6EA7B62F49D4}"=""
"{75FE0647-DDF3-40B2-9796-DA8AE353E9E4}"=""
"{E2892A35-5746-470D-A778-49B1542FF0B7}"=""
"{0786CF45-7037-4869-80E5-62D40453E25A}"=""
"{36626FFC-B84E-4BE7-933A-31517D612441}"=""
"{FD7F64DC-4B14-48C4-9C9E-C3F7019D404F}"=""
"{671751B9-A6E9-46E2-84C7-46C6280F2D18}"=""
"{86C6C145-4999-4732-92F0-B2DE2F90A805}"=""
"{64CEBA9D-BCB7-4D95-B4E2-78959E482B68}"=""
"{F652DD12-C78E-4C6A-A849-C7A320C1D1EF}"=""
"{7CEF2AE6-7C1A-4B3C-AD74-20E8BAAEED50}"=""
"{B1B37486-7BBC-451F-A008-F15CC2AD8B2F}"=""
"{6B2DD4B4-C85B-44DB-B342-F9368A4027D5}"=""
"{F27075C8-7215-4D29-9F8F-75CBC953D9CF}"=""
"{2C603354-BC26-454F-AD21-5C6B2A2BC7EB}"=""
"{D4E87739-2BF8-4025-A563-0653F749F699}"=""
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{78E4A8C7-CDA7-4616-ACC6-5483AC0F6DB7}"=""
"{57F08465-E555-4A94-8F84-FA8580C652D2}"=""
"{7E7E2B5A-C3C6-4BA0-A95F-80C5DC907D61}"=""
"{EA23D663-6581-4456-9B98-5C821B801E8E}"=""
"{83362BF7-3090-4114-88D5-AAA1783DE1F5}"=""
"{53976799-BED7-4926-A150-E63798DDC994}"=""
"{84CA1198-F034-4D94-AFCF-5A9E35FB90C8}"=""
"{93A287CC-B498-496B-BBE0-D6E063742F37}"=""
"{23489FD1-025E-494C-8943-ECC4303BF73E}"=""
"{5D6DD442-89F4-4066-AE36-CB58B6F2FB2E}"=""
"{BB979E3E-FEAD-4C0A-9426-03A9D0A99F6D}"=""
"{48B0AE34-DC34-410B-ABAD-E7982B4753A2}"=""
"{CACAAA47-1E61-4892-85DC-08DD6B5C8036}"=""
"{669B500E-5234-4C3E-9DAC-D638D9A996FB}"=""
"{B108DA5F-1939-458C-8A6A-165E8B473DD0}"=""
"{6BB4C545-B1A1-48B7-A550-0EFB3FAFDB78}"=""
"{F1928CDA-04A1-4D6D-8DAA-B607921E2D9D}"=""
"{1859B30C-E8B2-4B86-9F8C-01E06731FC2F}"=""
"{45BCC95C-404D-4BA5-9EDE-742C4359A06A}"=""
"{46B8855B-7241-4675-9DD5-5D69266B2CAA}"=""
"{03F4BEB3-2899-446C-9F6E-5B23FAE3BE8C}"=""
"{05B10EE2-4FF0-4F00-B5CF-F36AFC327D52}"=""
"{43E3E8C6-7A02-4146-9411-2A6265BD6A80}"=""
"{9D2CC552-F7C6-495D-89D3-6A6AF19A5BC2}"=""
"{8ECB5E34-323D-43A1-8E8F-6314C55C9E1C}"=""
"{F351A251-F468-4C84-A0F3-A296F09A5C84}"=""
"{2AEE1EE8-D840-47D6-9E18-F03D79FD1A34}"=""
"{2E2ADAA1-7751-40AB-9775-D6C5454516C8}"=""
"{F1B73DF0-3CF4-4C2A-9527-FCF697FEB9C6}"=""
"{3A7A7D29-0C6A-4EF1-AA6C-F08E99059364}"=""
"{5301EEA5-A671-445A-8D66-B9F46E730545}"=""
"{8AB70588-67C8-4B6C-8010-C08305518459}"=""
"{0EE4390F-2788-4E11-8511-932AE6082E87}"=""
"{11B41141-ADBD-41A7-A6F1-003C74E61B73}"=""
"{60AD89F5-BC46-44FE-A823-A5C66EFEC899}"=""
"{FC69A678-3871-4E2A-A9F9-EC62DAED38BF}"=""
"{4F96544C-7DAE-484D-8CB7-529D680FC312}"=""
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{C60D1F81-7291-4FCF-BCD1-925A0ACD33D0}"=""
"{EA62789B-C8F3-4669-90EA-CAEA32338E4B}"=""
"{62C742F0-10E9-4ABB-9AB4-40E5BBF3100E}"=""
"{99517C40-3169-4D64-8023-FA81533AB22B}"=""
"{4C662981-14E9-4E73-A8F5-3DBB2EBD6BC1}"=""
"{C131832F-AE9A-4DF6-A3CC-C02BF3F9ECA5}"=""
"{6A162FF5-5202-4CAB-AE2A-584C6A5F3C03}"=""
"{880C6DAA-4087-4A79-908B-19829406AEE3}"=""
"{554A6108-2BEE-48CD-ACFE-184F0FEC590B}"=""
"{1DFD3152-8A9B-40A0-A8A8-04874C6C5A7C}"=""
"{9648FA79-C1D4-4480-BAA9-83F0F3A0CAA4}"=""
"{1ADF09D4-10F2-4206-AF88-44D2CE848104}"=""
"{C403F69A-AE5C-45C8-ADD8-F8E51B14B84A}"=""
"{9938E88D-952A-4EC4-8EE5-60CFCFD3686E}"=""
"{9593D963-3DDC-4FB1-B580-B7DC46F1DCC4}"=""
"{E5863767-8A28-42A4-962A-D8B1216C2FDB}"=""
"{4E3EAA1C-6BB1-4805-B7BC-A33878A01556}"=""
"{28752D67-C32D-4150-B308-286751C2D38E}"=""
"{9D7BDDFF-AE4B-40AA-97AA-FC42B12904DA}"=""
"{BE9D6B43-CE81-45A8-89E9-AE414ED14DA2}"=""
"{EC62367D-CA10-4541-9C3E-508DA1B83FD1}"=""
"{60263383-FC27-48A3-95AB-EBB9BB5EBA1E}"=""
"{1F51DBE7-FE48-4ACB-AC2C-C17F55F6B261}"=""
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"
"{0A978C23-B24B-4B52-AAA7-DF884597CB93};"=""
"{D75A7C78-ABF9-448E-8E1E-45A57772A093}"=""
"{D9C9D0F6-DAF6-4239-9D96-AB495D31019A}"=""
"{8E2ADA44-1544-4274-9064-E99B0CD851F3}"=""
"{5DDB7771-7C45-46B0-95CE-EC817D91654C}"=""
"{73219337-2625-43F2-8E62-13DF44CDFCA2}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{7C56A142-8AA5-46F4-BC14-2BF1B99D98DF}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7C56A142-8AA5-46F4-BC14-2BF1B99D98DF}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7C56A142-8AA5-46F4-BC14-2BF1B99D98DF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7C56A142-8AA5-46F4-BC14-2BF1B99D98DF}\InprocServer32]
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{0226B34C-79AA-4373-B841-096193846BD2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0226B34C-79AA-4373-B841-096193846BD2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0226B34C-79AA-4373-B841-096193846BD2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0226B34C-79AA-4373-B841-096193846BD2}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C91E1D46-919E-44C5-A7E5-61A9034C1255}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C91E1D46-919E-44C5-A7E5-61A9034C1255}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C91E1D46-919E-44C5-A7E5-61A9034C1255}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C91E1D46-919E-44C5-A7E5-61A9034C1255}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{7EC56637-CF3D-4175-B1C3-88EE2FC6CE7C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7EC56637-CF3D-4175-B1C3-88EE2FC6CE7C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7EC56637-CF3D-4175-B1C3-88EE2FC6CE7C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7EC56637-CF3D-4175-B1C3-88EE2FC6CE7C}\InprocServer32]
@="C:\\WINDOWS\\system32\\svsinv.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4D97E152-766A-4883-898F-3828E81F6455}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4D97E152-766A-4883-898F-3828E81F6455}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4D97E152-766A-4883-898F-3828E81F6455}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4D97E152-766A-4883-898F-3828E81F6455}\InprocServer32]
@="C:\\WINDOWS\\system32\\dpmclien.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DBDA4B75-F8D0-4D60-871E-C98AF697DECF}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DBDA4B75-F8D0-4D60-871E-C98AF697DECF}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DBDA4B75-F8D0-4D60-871E-C98AF697DECF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DBDA4B75-F8D0-4D60-871E-C98AF697DECF}\InprocServer32]
@="C:\\WINDOWS\\system32\\djrgres.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BC7CE28D-120C-49AF-A734-F81577A71690}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BC7CE28D-120C-49AF-A734-F81577A71690}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BC7CE28D-120C-49AF-A734-F81577A71690}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BC7CE28D-120C-49AF-A734-F81577A71690}\InprocServer32]
@="C:\\WINDOWS\\system32\\slnsapi.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6252A406-C428-4BFB-B505-B1C8F3660CA5}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6252A406-C428-4BFB-B505-B1C8F3660CA5}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6252A406-C428-4BFB-B505-B1C8F3660CA5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6252A406-C428-4BFB-B505-B1C8F3660CA5}\InprocServer32]
@="C:\\WINDOWS\\system32\\mjpmsp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{25EF9F80-FC41-49E4-9A30-6EA7B62F49D4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{25EF9F80-FC41-49E4-9A30-6EA7B62F49D4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{25EF9F80-FC41-49E4-9A30-6EA7B62F49D4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{25EF9F80-FC41-49E4-9A30-6EA7B62F49D4}\InprocServer32]
@="C:\\WINDOWS\\system32\\hptplug.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{75FE0647-DDF3-40B2-9796-DA8AE353E9E4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{75FE0647-DDF3-40B2-9796-DA8AE353E9E4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{75FE0647-DDF3-40B2-9796-DA8AE353E9E4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{75FE0647-DDF3-40B2-9796-DA8AE353E9E4}\InprocServer32]
@="C:\\WINDOWS\\system32\\dkintf.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E2892A35-5746-470D-A778-49B1542FF0B7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E2892A35-5746-470D-A778-49B1542FF0B7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E2892A35-5746-470D-A778-49B1542FF0B7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E2892A35-5746-470D-A778-49B1542FF0B7}\InprocServer32]
@="C:\\WINDOWS\\system32\\dwdiagn.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{0786CF45-7037-4869-80E5-62D40453E25A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0786CF45-7037-4869-80E5-62D40453E25A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0786CF45-7037-4869-80E5-62D40453E25A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0786CF45-7037-4869-80E5-62D40453E25A}\InprocServer32]
@="C:\\WINDOWS\\system32\\rkhx32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{36626FFC-B84E-4BE7-933A-31517D612441}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{36626FFC-B84E-4BE7-933A-31517D612441}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{36626FFC-B84E-4BE7-933A-31517D612441}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{36626FFC-B84E-4BE7-933A-31517D612441}\InprocServer32]
@="C:\\WINDOWS\\system32\\impromon.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FD7F64DC-4B14-48C4-9C9E-C3F7019D404F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FD7F64DC-4B14-48C4-9C9E-C3F7019D404F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FD7F64DC-4B14-48C4-9C9E-C3F7019D404F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FD7F64DC-4B14-48C4-9C9E-C3F7019D404F}\InprocServer32]
@="C:\\WINDOWS\\system32\\dlwave.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{671751B9-A6E9-46E2-84C7-46C6280F2D18}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{671751B9-A6E9-46E2-84C7-46C6280F2D18}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{671751B9-A6E9-46E2-84C7-46C6280F2D18}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{671751B9-A6E9-46E2-84C7-46C6280F2D18}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{86C6C145-4999-4732-92F0-B2DE2F90A805}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{86C6C145-4999-4732-92F0-B2DE2F90A805}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{86C6C145-4999-4732-92F0-B2DE2F90A805}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{86C6C145-4999-4732-92F0-B2DE2F90A805}\InprocServer32]
@="C:\\WINDOWS\\system32\\insmsnap.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{64CEBA9D-BCB7-4D95-B4E2-78959E482B68}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{64CEBA9D-BCB7-4D95-B4E2-78959E482B68}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{64CEBA9D-BCB7-4D95-B4E2-78959E482B68}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{64CEBA9D-BCB7-4D95-B4E2-78959E482B68}\InprocServer32]
@="C:\\WINDOWS\\system32\\hzsetup.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F652DD12-C78E-4C6A-A849-C7A320C1D1EF}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F652DD12-C78E-4C6A-A849-C7A320C1D1EF}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F652DD12-C78E-4C6A-A849-C7A320C1D1EF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F652DD12-C78E-4C6A-A849-C7A320C1D1EF}\InprocServer32]
@="C:\\WINDOWS\\system32\\izlogmsg.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{7CEF2AE6-7C1A-4B3C-AD74-20E8BAAEED50}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7CEF2AE6-7C1A-4B3C-AD74-20E8BAAEED50}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7CEF2AE6-7C1A-4B3C-AD74-20E8BAAEED50}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7CEF2AE6-7C1A-4B3C-AD74-20E8BAAEED50}\InprocServer32]
@="C:\\WINDOWS\\system32\\qssname.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B1B37486-7BBC-451F-A008-F15CC2AD8B2F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B1B37486-7BBC-451F-A008-F15CC2AD8B2F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B1B37486-7BBC-451F-A008-F15CC2AD8B2F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B1B37486-7BBC-451F-A008-F15CC2AD8B2F}\InprocServer32]
@="C:\\WINDOWS\\system32\\ndcodins.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6B2DD4B4-C85B-44DB-B342-F9368A4027D5}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B2DD4B4-C85B-44DB-B342-F9368A4027D5}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B2DD4B4-C85B-44DB-B342-F9368A4027D5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B2DD4B4-C85B-44DB-B342-F9368A4027D5}\InprocServer32]
@="C:\\WINDOWS\\system32\\mjlbui.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F27075C8-7215-4D29-9F8F-75CBC953D9CF}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F27075C8-7215-4D29-9F8F-75CBC953D9CF}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F27075C8-7215-4D29-9F8F-75CBC953D9CF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F27075C8-7215-4D29-9F8F-75CBC953D9CF}\InprocServer32]
@="C:\\WINDOWS\\system32\\wosapi32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2C603354-BC26-454F-AD21-5C6B2A2BC7EB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2C603354-BC26-454F-AD21-5C6B2A2BC7EB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2C603354-BC26-454F-AD21-5C6B2A2BC7EB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2C603354-BC26-454F-AD21-5C6B2A2BC7EB}\InprocServer32]
@="C:\\WINDOWS\\system32\\cpiconfg.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D4E87739-2BF8-4025-A563-0653F749F699}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D4E87739-2BF8-4025-A563-0653F749F699}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D4E87739-2BF8-4025-A563-0653F749F699}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D4E87739-2BF8-4025-A563-0653F749F699}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{78E4A8C7-CDA7-4616-ACC6-5483AC0F6DB7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{78E4A8C7-CDA7-4616-ACC6-5483AC0F6DB7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{78E4A8C7-CDA7-4616-ACC6-5483AC0F6DB7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{78E4A8C7-CDA7-4616-ACC6-5483AC0F6DB7}\InprocServer32]
@="C:\\WINDOWS\\system32\\nurszhc.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{57F08465-E555-4A94-8F84-FA8580C652D2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{57F08465-E555-4A94-8F84-FA8580C652D2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{57F08465-E555-4A94-8F84-FA8580C652D2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{57F08465-E555-4A94-8F84-FA8580C652D2}\InprocServer32]
@="C:\\WINDOWS\\system32\\wF2time.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{7E7E2B5A-C3C6-4BA0-A95F-80C5DC907D61}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7E7E2B5A-C3C6-4BA0-A95F-80C5DC907D61}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7E7E2B5A-C3C6-4BA0-A95F-80C5DC907D61}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7E7E2B5A-C3C6-4BA0-A95F-80C5DC907D61}\InprocServer32]
@="C:\\WINDOWS\\system32\\coyptnet.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EA23D663-6581-4456-9B98-5C821B801E8E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EA23D663-6581-4456-9B98-5C821B801E8E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EA23D663-6581-4456-9B98-5C821B801E8E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EA23D663-6581-4456-9B98-5C821B801E8E}\InprocServer32]
@="C:\\WINDOWS\\system32\\vkhelper.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{83362BF7-3090-4114-88D5-AAA1783DE1F5}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{83362BF7-3090-4114-88D5-AAA1783DE1F5}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{83362BF7-3090-4114-88D5-AAA1783DE1F5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{83362BF7-3090-4114-88D5-AAA1783DE1F5}\InprocServer32]
@="C:\\WINDOWS\\system32\\ceyptext.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{53976799-BED7-4926-A150-E63798DDC994}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{53976799-BED7-4926-A150-E63798DDC994}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{53976799-BED7-4926-A150-E63798DDC994}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{53976799-BED7-4926-A150-E63798DDC994}\InprocServer32]
@="C:\\WINDOWS\\system32\\ksdhela2.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{84CA1198-F034-4D94-AFCF-5A9E35FB90C8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{84CA1198-F034-4D94-AFCF-5A9E35FB90C8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{84CA1198-F034-4D94-AFCF-5A9E35FB90C8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{84CA1198-F034-4D94-AFCF-5A9E35FB90C8}\InprocServer32]
@="C:\\WINDOWS\\system32\\mrpmspsv.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{93A287CC-B498-496B-BBE0-D6E063742F37}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{93A287CC-B498-496B-BBE0-D6E063742F37}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{93A287CC-B498-496B-BBE0-D6E063742F37}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{93A287CC-B498-496B-BBE0-D6E063742F37}\InprocServer32]
@="C:\\WINDOWS\\system32\\rypcfgex.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{23489FD1-025E-494C-8943-ECC4303BF73E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{23489FD1-025E-494C-8943-ECC4303BF73E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{23489FD1-025E-494C-8943-ECC4303BF73E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{23489FD1-025E-494C-8943-ECC4303BF73E}\InprocServer32]
@="C:\\WINDOWS\\system32\\sbardssp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5D6DD442-89F4-4066-AE36-CB58B6F2FB2E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5D6DD442-89F4-4066-AE36-CB58B6F2FB2E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5D6DD442-89F4-4066-AE36-CB58B6F2FB2E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5D6DD442-89F4-4066-AE36-CB58B6F2FB2E}\InprocServer32]
@="C:\\WINDOWS\\system32\\mvrepl40.dll"
"ThreadingModel"="Apartment"

[ Dodano: Dzisiaj o 22:07 ]
Niech ktos go sprawdzi jak moze i powie czy ta część jest czysta to wkleje następną cześć.

[Red]

prosze sciagnac:
http://www.atribune.org/ccount/click.php?id=7

odlacz kabel od internetu i uruchom to narzedzie.Po wykonaniu zadania podlaczysz sobie net i dasz do kontroli log z L2MFIX raz jeszcze z opcji 1 do sprawdzenia ...

[gmaster]

Sciagąm, odłączam kabel od neta, wyłączam nawet Kaspersky'iego i wszystkie zbedne procesy i:



A jak chce włączyc kompa to po dojsciu do okna logowania i wpisaniu hasła czekająmnie 2-3 restarty samoczynne i dopiero windows ładuje sie jak należy.

[Red]

smieci masz troszke ,wiec sie nie dziw...hehe,zrobimy inaczej:

sciagnij :
http://www.bleepingcomputer.com/files/killbox.php

Raz jeszcze odlaczasz sie od netu

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę :
C:\WINDOWS\system32\guard.tmp i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

Nastepnie uruchomisz program L2MFIX,ale tym razem z opcji 2 i czekasz na wykonanie zadania .Po zakonczeniu dajesz log z opcji 1 do kontroli

[gmaster]

Red tym razem Windows sie uruchomił za 1-szym razem...

Oto log z L2MFIX:

Kod: Zaznacz wszystko

L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Extensions]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\d80m0id1e80.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Karta wˆa˜ciwo˜ci pliku multimedialnego"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ZarzĄdzanie skanerem ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Strona zabezpieczeä NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Strona wˆa˜ciwo˜ci OLE Docfile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Rozszerzenia powˆoki dla udost©pniania zasob˘w"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL karty graficznej"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL monitora wy˜wietlania"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL kadrowania wy˜wietlania"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Strona zabezpieczeä usˆugi DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Strona zgodno˜ci"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Program obsˆugi danych wycinkowych powˆoki"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Rozszerzenie Disc Copy"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Rozszerzenia powˆoki dla obiekt˘w Microsoft Windows Network"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ZarzĄdzanie monitorem ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ZarzĄdzanie drukarkĄ ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Rozszerzenia powˆoki dla kompresji plik˘w"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Rozszerzenie powˆoki drukarek sieci Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu kontekstowe szyfrowania"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Akt˘wka"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Rozszerzenie ikony HyperTerminalu"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Strona zabezpieczeä drukarek"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Rozszerzenia powˆoki dla udost©pniania zasob˘w"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Rozszerzenie Crypto PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Rozszerzenie Crypto Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="PoˆĄczenia sieciowe"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="PoˆĄczenia sieciowe"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Skanery i aparaty fotograficzne"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Skanery i aparaty fotograficzne"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Skanery i aparaty fotograficzne"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Skanery i aparaty fotograficzne"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Skanery i aparaty fotograficzne"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Rozszerzenia powˆoki dla hosta skrypt˘w systemu Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Zaplanowane zadania"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Pasek zadaä i menu Start"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Wyszukaj"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Pomoc i obsˆuga techniczna"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Pomoc i obsˆuga techniczna"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Uruchom..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Czcionki"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Narz©dzia administracyjne"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Pasek narz©dzi programu Microsoft Internet"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Stan pobierania"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Folder powˆoki zwi©kszonej"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Folder powˆoki zwi©kszonej 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Pasek przeglĄdarki Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Pasek wyszukiwania"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Pasek multimedi˘w"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Wyszukiwanie w okienku"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Wyszukiwanie w sieci Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Narz©dzie opcji drzewa rejestru"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adres"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Pole edycji adresu"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Autouzupeˆnianie Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="Wyodr©bnianie obraz˘w Trident"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Lista autouzupeˆniania MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Niestandardowa lista autouzupeˆniania MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Dost©pny"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Pasek podr©czny ˜ledzenia"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analizator paska adresu"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lista autouzupeˆniania historii Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Lista autouzupeˆniania folderu powˆoki Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Kontener wielu list autouzupeˆniania Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu witryny paska powˆoki"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Pasek pulpitu powˆoki"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Pomoc dla uľytkownika"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Globalne ustawienia folder˘w"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historia"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Tymczasowe pliki internetowe"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Tymczasowe pliki internetowe"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Ekran powitalny pakietu IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Pasek eksploratora"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Folder pami©ci podr©cznej ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Folder subskrypcji"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Menedľer aplikacji powˆoki"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Wyliczanie zainstalowanych aplikacji"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publikator aplikacji Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+program wyodr©bniajĄcy miniatury plik˘w"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Informacje podsumowujĄce obsˆugi miniatur (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Wyodr©bnianie miniatur HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Kreator publikacji w sieci Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Zamawianie odbitek w sieci Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Obiekt powˆoki kreatora publikacji"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Kreator uzyskiwania profilu usˆugi Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Konta uľytkownik˘w"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Plik kanaˆu"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Skr˘t kanaˆu"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Obiekt obsˆugi kanaˆu"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Folder plik˘w trybu offline"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Do os˘b..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
"{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device"
"{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device ContextMenuHandler"
"{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}"="Siemens SX1 PropertySheetHandler"
"{B8323370-FF27-11D2-97B6-204C4F4F5020}"="SmartFTP Shell Extension DLL"
"{B327765E-D724-4347-8B16-78AE18552FC3}"="NeroDigitalIconHandler"
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}"="NeroDigitalPropSheetHandler"
"{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6 Context Menu Shell Extension"
"{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6 DragDrop Shell Extension"
"{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6 Context Menu Shell Extension"
"{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6 Property Sheet Shell Extension"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
   atidemgr.dll   Wed  2006-01-25   3:29:40   A....        282 624   276,00 K
   atiiiexx.dll   Wed  2006-01-25   4:28:12   A....        307 200   300,00 K
   atitvo32.dll   Wed  2006-01-25   4:16:08   A....         17 408    17,00 K
   ati2dvag.dll   Wed  2006-01-25   4:52:48   A....        255 488   249,50 K
   atioglxx.dll   Wed  2006-01-25   4:13:54   A....      5 115 904     4,88 M
   atioglx1.dll   Wed  2006-01-25   4:30:28   A....      6 684 672     6,38 M
   ati2cqag.dll   Wed  2006-01-25   4:10:38   A....        258 048   252,00 K
   ati3duag.dll   Wed  2006-01-25   4:36:50   A....      2 604 128     2,48 M
   ativvaxx.dll   Wed  2006-01-25   4:30:18   A....        860 192   840,03 K
   cmdlin~1.dll   Sat  2006-02-25  17:38:32   A....         98 304    96,00 K
   atikvmag.dll   Wed  2006-01-25   4:16:50   A....        151 552   148,00 K
   atiddc.dll     Wed  2006-01-25   4:44:58   A....         53 248    52,00 K
   ati2evxx.dll   Wed  2006-01-25   4:46:38   A....         61 440    60,00 K
   ati2edxx.dll   Wed  2006-01-25   4:46:50   A....         41 472    40,50 K
   atipdlxx.dll   Wed  2006-01-25   4:47:18   A....        114 688   112,00 K
   oemdspif.dll   Wed  2006-01-25   4:47:04   A....         77 824    76,00 K

16 items found:  16 files, 0 directories.
   Total of file sizes:  16 984 192 bytes     16,20 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Wolumin w stacji C nie ma etykiety.
Numer seryjny woluminu: 1A3C-17F0

Katalog: C:\WINDOWS\System32

2005-12-26  18:47    <DIR>          Microsoft
2005-12-19  19:24    <DIR>          dllcache
               0 plik(˘w)               0 bajt˘w
               2 katalog(˘w)   3˙023˙372˙288 bajt˘w wolnych


[Red]

Pozostała jeszcze kosmetyka

otworz notatnik windowsa i wklej w nim to co ponizej:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Extensions]

nastepnie w notatniku>>Plik >> Zapisz jako, zapisz jako typ: wszystkie pliki, nazwa pliku: Fix.reg
Klikasz dwa razy na powstały plik i potwierdzasz.

Strony juz nie bedą cie atakowały

Autor postu otrzymał pochwałę

[gmaster]

Red - WIELKIE dzięki, naprawde, nareszcie moge normalnie przeglądac neta...