prosze o sprawdzenie loga!

**Posty:** 8079 · przez **kajtekjr** 09 Lip 2006, 13:41

Witam Was! Mam problem z kompem.. Mainowicie wyskakujace okienka w przegladarce.. Nawet na stronie forum, co nigdy sie nie działo

Daje loga z HJ I Silent Runners:

==========================
Log z HJ:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:31:25, on 2006-07-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SYSTEM32\rundll32.exe C:\WINDOWS\RmlsaXBpYWs\command.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\SYSTEM32\rundll32.exe C:\WINDOWS\SYSTEM32\rundll32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\htpatch.exe C:\Program Files\D-Tools\daemon.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\WINDOWS\LOGI_MWX.EXE C:\WINDOWS\system32\RunDll32.exe C:\dfndrd_5.exe C:\WINDOWS\nbilvdns.exe C:\Program Files\Internet Optimizer\optimize.exe C:\WINDOWS\mgtdl.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\COMMON~1\ooor\ooorm.exe C:\PROGRA~1\COMMON~1\ooor\ooora.exe C:\Program Files\SpeedFan\speedfan.exe C:\WINDOWS\system32\nvsvc32.exe D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\ISTsvc\istsvc.exe C:\Program Files\SurfAccuracy\SAcc.exe C:\Program Files\Tlen.pl\tlen.exe E:\eMule2\emule.exe C:\Program Files\mozilla.org\Mozilla\mozilla.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe c:\Program.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [I downloaded pirated Software from P2P ] C:\WINDOWS\system32\0106.exe O4 - HKLM\..\Run: [012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678912345678] C:\Program Files\user32.exe O4 - HKLM\..\Run: [defender] C:\\dfndrd_5.exe O4 - HKLM\..\Run: [keyboard] C:\\kybrdd_5.exe O4 - HKLM\..\Run: [newname] C:\\nwnmd_5.exe O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [OdDf3] C:\WINDOWS\nbilvdns.exe O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [ReJf5vH] C:\WINDOWS\mgtdl.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ooor] C:\PROGRA~1\COMMON~1\ooor\ooorm.exe O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O16 - DPF: {4539348E-01D7-11D5-9A39-0080C8D85044} (GameDesire Slots 90th) - http://67.15.101.3/g_bin/pl/slots90_2_0_0_29.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\zhpfldr.dll O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\boackbox.dll O20 - Winlogon Notify: Unimodem - C:\WINDOWS\system32\boackbox.dll O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

==========================
Log z Silent Runners:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "(Default)" = (empty string) "MsnMsgr" = ""C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background" [MS] "ooor" = "C:\PROGRA~1\COMMON~1\ooor\ooorm.exe" [empty string] "sys_up1" = "C:\Program Files\Common Files\svchostsys\svchostsys.exe" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "HTpatch" = "C:\WINDOWS\htpatch.exe" [null data] "SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."] "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data] "HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"] "DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"] "DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"] "Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "I downloaded pirated Software from P2P " = "C:\WINDOWS\system32\0106.exe" [file not found] "012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678912345678" = "C:\Program Files\user32.exe" [null data] "defender" = "C:\\dfndrd_5.exe" ["DJWK JWBND HWBDH BWHDB HWHD H"] "keyboard" = "C:\\kybrdd_5.exe" [file not found] "newname" = "C:\\nwnmd_5.exe" [file not found] "IST Service" = "C:\Program Files\ISTsvc\istsvc.exe" [null data] "OdDf3" = "C:\WINDOWS\nbilvdns.exe" [null data] "SurfAccuracy" = "C:\Program Files\SurfAccuracy\SAcc.exe" [empty string] "Internet Optimizer" = ""C:\Program Files\Internet Optimizer\optimize.exe"" [null data] "ReJf5vH" = "C:\WINDOWS\mgtdl.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {HKLM...CLSID} = "Shell Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] "{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web" -> {HKLM...CLSID} = "Folder przesyłania Share-to-Web" \InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"] "{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler" -> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler" -> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder" -> {HKLM...CLSID} = "Corel Media Folder" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder" -> {HKLM...CLSID} = "Corel Media Folder" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder" -> {HKLM...CLSID} = "Corel Media Find Folder" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler" -> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"] "{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"] "{B63FCD5A-2396-11D1-B762-00A0C90646A4}" = "*n" (unwritable string) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFnd80.dll" ["Corel Corporation"] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"] "{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View" -> {HKLM...CLSID} = "Contact View" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"] "{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View" -> {HKLM...CLSID} = "Message View" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Moje foldery udostępniania" \InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS] "{4F395BC9-0891-4BEB-8673-D52D4E25F80D}" = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\guard.tmp" [null data] "{3C7F7C90-77FF-4054-8B13-FD6B3D7C0744}" = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\secbase.dll" [null data] HKLM\System\CurrentControlSet\Control\Session Manager\ INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! ShellCompatibility\DLLName = "C:\WINDOWS\system32\zhpfldr.dll" [null data] INFECTION WARNING! Themes\DLLName = "C:\WINDOWS\system32\boackbox.dll" [null data] INFECTION WARNING! Unimodem\DLLName = "C:\WINDOWS\system32\boackbox.dll" [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" -> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Administrator" & "All Users" startup folders: --------------------------------------------------------------- C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart "SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{86227D9C-0EFE-4F8A-AA55-30386A3F5686}" -> {HKLM...CLSID} = "YourSiteBar" \InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [empty string] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar" -> {HKLM...CLSID} = "FlashGet Bar" \InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"] "{86227D9C-0EFE-4F8A-AA55-30386A3F5686}" = (no title provided) -> {HKLM...CLSID} = "YourSiteBar" \InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [empty string] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Command Service, cmdService, "C:\WINDOWS\RmlsaXBpYWs\command.exe" [null data] Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt08\Driver = "hpzsnt08.dll" ["HP"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 109 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 85 seconds. ---------- (total run time: 284 seconds)

**Posty:** 8694 · przez **Red** 09 Lip 2006, 13:55

usuwasz z wylaczonym przywracaniem systemu w xp i w trybie awaryjnym f8

poczatek:

Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop cmdService
sc delete cmdService

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll
O4 - HKLM\..\Run: [I downloaded pirated Software from P2P ] C:\WINDOWS\system32\0106.exe
O4 - HKLM\..\Run: [012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678912345678] C:\Program Files\user32.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrd_5.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdd_5.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmd_5.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [OdDf3] C:\WINDOWS\nbilvdns.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [ReJf5vH] C:\WINDOWS\mgtdl.exe
O4 - HKCU\..\Run: [ooor] C:\PROGRA~1\COMMON~1\ooor\ooorm.exe
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe
O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\zhpfldr.dll
O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\boackbox.dll
O20 - Winlogon Notify: Unimodem - C:\WINDOWS\system32\boackbox.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

pogrubione musisz usunac recznie ,wpisysy zaznacz w hijacku i fixujesz

zastosowac obowiazkowo do czyszzcenia:

http://securityresponse.symantec.com/avcenter/FxIstbar.exe
http://www.ewido.net/en/download/
http://siri.urz.free.fr/Fix/SmitfraudFix.php z opcji 2

po dzialaniu restart i logi do kontroli raz jeszcze

Autor postu otrzymał pochwałę

**Posty:** 8079 · przez **kajtekjr** 09 Lip 2006, 16:06

Zrobiłem to co kazałes

=================================
Log z programu SmitFraudFix po wykonaniu opcji 2:

Kod: Zaznacz wszystko: SmitFraudFix v2.68b Scan done at 14:44:06,50, 2006-07-09 Run from C:\Documents and Settings\Administrator\Pulpit\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\drsmartload2.dat Deleted C:\WINDOWS\keyboard1.dat Deleted C:\WINDOWS\newname.dat Deleted C:\WINDOWS\teller2.chk Deleted C:\Program Files\secure32.html Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

=================================

Log z FxIstbar:

Kod: Zaznacz wszystko: Symantec Adware.Istbar / Trojan.ISTsvc Removal Tool 1.1.0 registry: HKEY_USERS\S-1-5-21-1960408961-448539723-725345543-500\Software\Avenue Media (key deleted) registry: HKEY_USERS\S-1-5-21-1960408961-448539723-725345543-500\Software\IST (key deleted) registry: HKEY_USERS\S-1-5-21-1960408961-448539723-725345543-500\Software\Policies\Avenue Media (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Avenue Media (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000010-6F7D-442C-93E3-4A4827C2E4C8} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DyFuCA_BH.BHObj (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DyFuCA_BH.BHObj.1 (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C01D150-91A4-4DE0-9BF8-A35D1BDF1001} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{40B1D454-9CA4-43CC-86AA-CB175EAC52FB} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\ISTsvc (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DyFuCA (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISTsvc (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Optimizer (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Avenue Media (key deleted) registry: HKEY_USERS\S-1-5-21-1960408961-448539723-725345543-500\Software\Microsoft\Internet Explorer\Main: BandRest (value deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main: BandRest (value deleted) C:\WINDOWS\nem220.dll: (deleted) E:\System Volume Information: (not scanned) registry: HKEY_USERS\S-1-5-21-1960408961-448539723-725345543-500\Software\Microsoft\Internet Explorer\Main: Start Page (value set to "about:blank") Adware.Istbar has been successfully removed from your computer! Here is the report: The total number of the scanned files: 82467 The number of deleted files: 1 The number of threat processes terminated: 0 The number of other processes terminated: 0 The number of registry entries fixed: 17

=================================

Log z Ewido anti-spyware:

Kod: Zaznacz wszystko: --------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 15:35:39 2006-07-09 + Scan result: C:\WINDOWS\RmlsaXBpYWs\__delete_on_reboot__a_s_a_p_p_s_r_v_._d_l_l_ -> Adware.CommAd : No action taken. C:\WINDOWS\RmlsaXBpYWs\command.exe -> Adware.CommAd : No action taken. [1248] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [1456] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [1620] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [164] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [1900] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2052] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2068] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2108] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2136] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2160] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [216] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2216] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2256] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2304] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2424] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2512] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2640] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [2696] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. [3816] C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kapabout -> Adware.InternetOptimizer : No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\AMeOpt -> Adware.InternetOptimizer : No action taken. HKU\S-1-5-21-1960408961-448539723-725345543-500\Software\Microsoft\Windows\CurrentVersion\Policies\AMeOpt -> Adware.InternetOptimizer : No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YourSiteBar -> Adware.ISTBar : No action taken. HKLM\SOFTWARE\YourSiteBar -> Adware.ISTBar : No action taken. HKLM\SOFTWARE\YourSiteBar\Historyfiles -> Adware.ISTBar : No action taken. HKLM\SOFTWARE\YourSiteBar\Historystring -> Adware.ISTBar : No action taken. C:\WINDOWS\system32\__delete_on_reboot__c_c_y_p_t_s_v_c_._d_l_l_ -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\c800lidm180a.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\dn4o01h3e.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\fp0o03d3e.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\i6nmlg5116.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\njobjapi.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\nmrsel.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\o8pqli7518.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\q8860ilse8q60.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\sks.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\tzflog.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\whigest.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\wkdmtp.dll -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\xCctsrv.dll -> Adware.Look2Me : No action taken. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\H323TSP -> Adware.Look2Me : No action taken. C:\Program Files\Common Files\ooor\ooord\ooorc.dll -> Adware.TargetServer : No action taken. HKLM\SOFTWARE\Classes\Ysb.YsbObj -> Adware.YourSiteBar : No action taken. HKLM\SOFTWARE\Classes\Ysb.YsbObj.1 -> Adware.YourSiteBar : No action taken. HKLM\SOFTWARE\Classes\Ysb.YsbObj\CLSID -> Adware.YourSiteBar : No action taken. HKLM\SOFTWARE\Classes\Ysb.YsbObj\CurVer -> Adware.YourSiteBar : No action taken. C:\Program Files\user32.exe -> Downloader.Harnig.bh : No action taken. C:\Program Files\Common Files\svchostsys\svchostupdate.exe -> Downloader.Small : No action taken. C:\WINDOWS\MTE3NDI6ODoxNg.exe -> Downloader.Small.buy : No action taken. C:\Program Files\Common Files\ooor\ooorp.exe -> Downloader.TSUpdate.f : No action taken. C:\Program Files\Common Files\ooor\ooora.exe -> Downloader.TSUpdate.l : No action taken. C:\Program Files\Common Files\ooor\ooorl.exe -> Downloader.TSUpdate.p : No action taken. C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Temporary Internet Files\Content.IE5\8EFBOV8C\send_ocx_sof[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : No action taken. :mozilla.497:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.498:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.499:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.500:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.501:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.502:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.503:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.504:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt -> TrackingCookie.2o7 : No action taken. :mozilla.512:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.513:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.514:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.519:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.557:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.91:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.92:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.220:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adition : No action taken. :mozilla.221:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adition : No action taken. :mozilla.133:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.134:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.208:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.210:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.361:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.362:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.620:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.621:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@ad.adocean[1].txt -> TrackingCookie.Adocean : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@gde.adocean[2].txt -> TrackingCookie.Adocean : No action taken. :mozilla.812:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adtech : No action taken. :mozilla.813:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adtech : No action taken. :mozilla.651:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.652:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.653:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.654:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.655:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.656:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.796:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Atdmt : No action taken. :mozilla.931:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Bluestreak : No action taken. :mozilla.614:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Burstnet : No action taken. :mozilla.615:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Burstnet : No action taken. :mozilla.238:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.239:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.240:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.241:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.507:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Clickhype : No action taken. :mozilla.599:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Com : No action taken. :mozilla.601:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Com : No action taken. :mozilla.171:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Doubleclick : No action taken. :mozilla.537:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Epilot : No action taken. :mozilla.406:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Etracker : No action taken. :mozilla.605:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.401:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.120:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.123:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.124:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.125:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.126:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@media.fastclick[2].txt -> TrackingCookie.Fastclick : No action taken. :mozilla.215:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.216:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.217:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.218:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.437:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.438:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.776:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.777:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.778:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.780:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.781:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.782:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.783:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.784:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.785:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.786:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.787:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.835:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.836:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.837:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.838:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.841:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.736:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitslink : No action taken. :mozilla.737:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitslink : No action taken. :mozilla.738:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitslink : No action taken. :mozilla.739:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitslink : No action taken. :mozilla.150:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hotlog : No action taken. :mozilla.744:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hypertracker : No action taken. :mozilla.405:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Ivwbox : No action taken. :mozilla.377:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Mediaplex : No action taken. :mozilla.378:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Mediaplex : No action taken. :mozilla.184:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Onestat : No action taken. :mozilla.185:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Onestat : No action taken. :mozilla.186:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Onestat : No action taken. :mozilla.187:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Onestat : No action taken. :mozilla.225:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Overture : No action taken. :mozilla.226:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Overture : No action taken. :mozilla.650:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Overture : No action taken. :mozilla.146:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Paypopup : No action taken. :mozilla.147:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Paypopup : No action taken. :mozilla.148:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Paypopup : No action taken. :mozilla.940:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.941:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.942:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.943:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.769:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Popularix : No action taken. :mozilla.510:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Revenue : No action taken. :mozilla.563:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Ru4 : No action taken. :mozilla.564:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Ru4 : No action taken. :mozilla.884:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.cenzura-spam : No action taken. :mozilla.885:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.cenzura-spam : No action taken. :mozilla.169:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Sitestat : No action taken. :mozilla.170:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Sitestat : No action taken. :mozilla.149:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Spylog : No action taken. :mozilla.172:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.173:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.174:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.175:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.176:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.177:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.178:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.179:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.180:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@statcounter[1].txt -> TrackingCookie.Statcounter : No action taken. :mozilla.457:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.458:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.38:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.39:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.40:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.41:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.42:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.43:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.44:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.45:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.46:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.722:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Trafic : No action taken. :mozilla.287:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.811:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Valueclick : No action taken. :mozilla.460:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Webtrendslive : No action taken. :mozilla.137:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yadro : No action taken. :mozilla.10:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.11:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.12:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.13:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.6:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.7:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.8:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.9:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@ysbweb[1].txt -> TrackingCookie.Ysbweb : No action taken. :mozilla.760:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. :mozilla.761:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. :mozilla.762:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. ::Report end

=================================

Log z HJ:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:56:15, on 2006-07-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SYSTEM32\rundll32.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\htpatch.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\LOGI_MWX.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SpeedFan\speedfan.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\Program Files\Microsoft Office\Office\WINWORD.EXE C:\WINDOWS\msagent\AgentSvr.exe C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: DIFx - C:\WINDOWS\system32\gp6ql3j51.dll O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\boackbox.dll (file missing) O20 - Winlogon Notify: Unimodem - C:\WINDOWS\system32\boackbox.dll (file missing) O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe (file missing) O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing) O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

=================================

Log z Silent Runners:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"(Default)" = (empty string)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]
"Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web"
-> {HKLM...CLSID} = "Folder przesyłania Share-to-Web"
\InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder"
-> {HKLM...CLSID} = "Corel Media Find Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler"
-> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{B63FCD5A-2396-11D1-B762-00A0C90646A4}" = "*g" (unwritable string)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFnd80.dll" ["Corel Corporation"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]
"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"
-> {HKLM...CLSID} = "Message View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Moje foldery udostępniania"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]
"{4F395BC9-0891-4BEB-8673-D52D4E25F80D}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\kddmaori.dll" [null data]
"{3C7F7C90-77FF-4054-8B13-FD6B3D7C0744}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\dncompos.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! DIFx\DLLName = "C:\WINDOWS\system32\gp6ql3j51.dll" [null data]
INFECTION WARNING! Setup\DLLName = "C:\WINDOWS\system32\boackbox.dll" [file not found]
INFECTION WARNING! Unimodem\DLLName = "C:\WINDOWS\system32\boackbox.dll" [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart
"SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686}"
-> {HKLM...CLSID} = "YourSiteBar"
\InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
-> {HKLM...CLSID} = "FlashGet Bar"
\InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"]
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686}" = (no title provided)
-> {HKLM...CLSID} = "YourSiteBar"
\InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [file not found]

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 34 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 27 seconds.
---------- (total run time: 91 seconds)

**Posty:** 8694 · przez **Red** 09 Lip 2006, 16:14

w hijacku zafixuj:

O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll (file missing)
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\boackbox.dll (file missing)
O20 - Winlogon Notify: Unimodem - C:\WINDOWS\system32\boackbox.dll (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe (file missing)

jest juz bardzo dobrze ,ale musimy usunac to to :

O20 - Winlogon Notify: DIFx - C:\WINDOWS\system32\gp6ql3j51.dll

zaczniemy od zastosowania automatu:
http://www.atribune.org/content/view/28/
uruchom,przelec system,restart i logi do kontroli

Autor postu otrzymał pochwałę

**Posty:** 8079 · przez **kajtekjr** 09 Lip 2006, 16:55

okienka wyskakuja nadal

=======================

Red napisał(a):w hijacku zafixuj:

Cytat:
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll (file missing)
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\boackbox.dll (file missing)
O20 - Winlogon Notify: Unimodem - C:\WINDOWS\system32\boackbox.dll (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe (file missing)

to na awaryjnym ?

**Posty:** 18165 · przez **wojtas** 09 Lip 2006, 16:57

kajtekjr napisał(a):to na awaryjnym ?

tak.
zrob to co kazal Red i podaj nowe logi

**Posty:** 8079 · przez **kajtekjr** 09 Lip 2006, 16:58

wojtas19162 ten automat tez w awaryjnym :?:

**Posty:** 18165 · przez **wojtas** 09 Lip 2006, 17:00

wszystko w awaryjnym

**Posty:** 8079 · przez **kajtekjr** 09 Lip 2006, 17:36

Red napisał(a):w hijacku zafixuj:

Cytat:
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll (file missing)
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\boackbox.dll (file missing)
O20 - Winlogon Notify: Unimodem - C:\WINDOWS\system32\boackbox.dll (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe (file missing)

Zafixowane

========================

Log z Look2Me-Destroyer

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 2006-07-09 17:24:05

Infected! C:\WINDOWS\system32\p66s0gj7e6o.dll
Infected! C:\WINDOWS\system32\wjecedit.dll
Infected! C:\WINDOWS\system32\IGIresize.dll
Infected! C:\WINDOWS\system32\sucurity.dll
Infected! C:\WINDOWS\system32\r4r6le9s1h.dll
Infected! C:\WINDOWS\system32\f2l0lc3m1f.dll
Infected! C:\WINDOWS\system32\dqprpres.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\p66s0gj7e6o.dll
C:\WINDOWS\system32\p66s0gj7e6o.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\wjecedit.dll
C:\WINDOWS\system32\wjecedit.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\IGIresize.dll
C:\WINDOWS\system32\IGIresize.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\sucurity.dll
C:\WINDOWS\system32\sucurity.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\r4r6le9s1h.dll
C:\WINDOWS\system32\r4r6le9s1h.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\f2l0lc3m1f.dll
C:\WINDOWS\system32\f2l0lc3m1f.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\dqprpres.dll
C:\WINDOWS\system32\dqprpres.dll Deleted successfully!

Making registry repairs.

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{B63FCD5A-2396-11D1-B762-00A0C90646A4}"
HKCR\Clsid\{B63FCD5A-2396-11D1-B762-00A0C90646A4}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{4F395BC9-0891-4BEB-8673-D52D4E25F80D}"
HKCR\Clsid\{4F395BC9-0891-4BEB-8673-D52D4E25F80D}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{3C7F7C90-77FF-4054-8B13-FD6B3D7C0744}"
HKCR\Clsid\{3C7F7C90-77FF-4054-8B13-FD6B3D7C0744}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file

Restoring SeDebugPrivilege for Administratorzy - Succeeded

========================

Log z HJ:

Logfile of HijackThis v1.99.1
Scan saved at 17:30:52, on 2006-07-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NetCache - C:\WINDOWS\system32\r4r6le9s1h.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe (file missing)
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

========================

Log z Silent Runners:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"(Default)" = (empty string)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]
"Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web"
-> {HKLM...CLSID} = "Folder przesyłania Share-to-Web"
\InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder"
-> {HKLM...CLSID} = "Corel Media Find Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler"
-> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]
"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"
-> {HKLM...CLSID} = "Message View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Moje foldery udostępniania"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! NetCache\DLLName = "C:\WINDOWS\system32\r4r6le9s1h.dll" [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart
"SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686}"
-> {HKLM...CLSID} = "YourSiteBar"
\InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
-> {HKLM...CLSID} = "FlashGet Bar"
\InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"]

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 47 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 23 seconds.
---------- (total run time: 99 seconds)

**Posty:** 8694 · przez **Red** 09 Lip 2006, 17:46

kosmetycznie usuniesz z hijacka:

O20 - Winlogon Notify: NetCache - C:\WINDOWS\system32\r4r6le9s1h.dll (file missing)

i jeszcze widze dalej to:
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe (file missing)

Usun recznie C:\WINDOWS\RmlsaXBpYWs

**Posty:** 8079 · przez **kajtekjr** 09 Lip 2006, 17:50

Red napisał(a):Usun recznie C:\WINDOWS\RmlsaXBpYWs

Nie ma tego w folderze WINDOWS.. :roll:

**Posty:** 1665 · przez **SER** 09 Lip 2006, 17:52

Być może to folder ukryty - włącz pokazywanie ukrytych plików/folderów i poszukaj, bądź wpisz nazwę w Start -> Wyszukaj

**Posty:** 8694 · przez **Red** 09 Lip 2006, 17:55

czy wykonałes:

Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop cmdService
sc delete cmdService

jesli tak to raz jeszcze sprobuj wywalic w pis 023 hijackiem

**Posty:** 8079 · przez **kajtekjr** 09 Lip 2006, 18:07

SER napisał(a):Być może to folder ukryty - włącz pokazywanie ukrytych plików/folderów i poszukaj, bądź wpisz nazwę w Start -> Wyszukaj Wink

Juz wczesniej wpadłem na ten pomysł i tez nic

=================================

Red napisał(a):czy wykonałes:

Cytat:
Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop cmdService
sc delete cmdService

Wykonałem wtedy i teraz jeszcze raz i w obu przypadkach pokazało sie cos takiego:
:arrow:

=================================

Jeszcze jeden log z HJ:

Logfile of HijackThis v1.99.1
Scan saved at 18:04:07, on 2006-07-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe