
- Kod: Zaznacz wszystko
- Logfile of HijackThis v1.99.1
 Scan saved at 21:07:47, on 2006-04-07
 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\WINDOWS\Explorer.EXE
 C:\WINDOWS\system32\spoolsv.exe
 C:\Program Files\G DATA\AntiVirenKit InternetSecurity\AVK\AVKService.exe
 C:\Program Files\G DATA\AntiVirenKit InternetSecurity\AVK\AVKWCtl.exe
 C:\Program Files\Common Files\G DATA\AVKMail\AVKPOP.EXE
 C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Firewall\kavpf.exe
 C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Webfilter\WebFilter.exe
 C:\PROGRA~1\GDATA~1\ANTIVI~1\WEBFIL~1\ADSCLE~1.EXE
 C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
 C:\Program Files\Neostrada TP\NeostradaTP.exe
 C:\Program Files\Neostrada TP\ComComp.exe
 C:\Program Files\Neostrada TP\Watch.exe
 C:\Program Files\Gadu-Gadu\gg.exe
 C:\Program Files\Internet Explorer\iexplore.exe
 C:\Program Files\WinRAR\WinRAR.exe
 C:\DOCUME~1\ania\USTAWI~1\Temp\Rar$EX00.054\HijackThis.exe
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
 R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
 O3 - Toolbar: Pasek Webfilter - {75CD0BC5-E317-449C-9FF6-4986B3D48F64} - C:\PROGRA~1\GDATA~1\ANTIVI~1\WEBFIL~1\PAKIEGUI.dll
 O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
 O4 - HKLM\..\Run: [AVK Mail Checker] "C:\Program Files\Common Files\G DATA\AVKMail\AVKPOP.EXE"
 O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
 O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
 O4 - Global Startup: Firewall.lnk = ?
 O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
 O4 - Global Startup: Webfilter.lnk = C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Webfilter\WebFilter.exe
 O8 - Extra context menu item: Add selected links to Link Container - C:\PROGRA~1\GDATA~1\ANTIVI~1\WEBFIL~1\System\Scripts\off_collector_sel.htm
 O8 - Extra context menu item: Show domain links - C:\PROGRA~1\GDATA~1\ANTIVI~1\WEBFIL~1\System\Scripts\off_domain_links.htm
 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
 O17 - HKLM\System\CCS\Services\Tcpip\..\{B288104D-4519-4665-8A3C-1445A07EAC4F}: NameServer = 194.204.152.34 217.98.63.164
 O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\G DATA\AntiVirenKit InternetSecurity\AVK\AVKService.exe
 O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C:\Program Files\G DATA\AntiVirenKit InternetSecurity\AVK\AVKWCtl.exe
- Kod: Zaznacz wszystko
- "Silent Runners.vbs", revision 44, http://www.silentrunners.org/
 Operating System: Windows XP SP2
 Output limited to non-default values, except where indicated by "{++}"
 Startup items buried in registry:
 ---------------------------------
 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
 "AVK Mail Checker" = ""C:\Program Files\Common Files\G DATA\AVKMail\AVKPOP.EXE"" ["G DATA Software AG"]
 "gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]
 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
 {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
 -> {HKLM...CLSID} = "AcroIEHlprObj Class"
 \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
 HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
 "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
 -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
 \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
 "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
 -> {HKLM...CLSID} = "WinRAR"
 \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
 "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
 -> {HKLM...CLSID} = "Shell Search Band"
 \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
 "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
 -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
 \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
 INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"
 -> {HKLM...CLSID} = "Microsoft.AntiSpyware.ShellExecuteHook.1"
 \InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]
 HKLM\System\CurrentControlSet\Control\Session Manager\
 INFECTION WARNING! "BootExecute" = "autocheck autochk *" [file not found], [MS], [file not found]
 HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
 AVK9CM\(Default) = "{CAF4C320-32F5-11D3-A222-004095200FF2}"
 -> {HKLM...CLSID} = "AVK9ContextMenue"
 \InProcServer32\(Default) = "C:\Program Files\G DATA\AntiVirenKit InternetSecurity\AVK\ShellExt.dll" [empty string]
 WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
 -> {HKLM...CLSID} = "WinRAR"
 \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
 HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
 WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
 -> {HKLM...CLSID} = "WinRAR"
 \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
 HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
 AVK9CM\(Default) = "{CAF4C320-32F5-11D3-A222-004095200FF2}"
 -> {HKLM...CLSID} = "AVK9ContextMenue"
 \InProcServer32\(Default) = "C:\Program Files\G DATA\AntiVirenKit InternetSecurity\AVK\ShellExt.dll" [empty string]
 WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
 -> {HKLM...CLSID} = "WinRAR"
 \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
 Active Desktop and Wallpaper:
 -----------------------------
 Active Desktop is disabled at this entry:
 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
 HKCU\Control Panel\Desktop\
 "Wallpaper" = "C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
 Enabled Screen Saver:
 ---------------------
 HKCU\Control Panel\Desktop\
 "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]
 Startup items in "ania" & "All Users" startup folders:
 ------------------------------------------------------
 C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
 "Firewall" -> shortcut to: "C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Firewall\kavpf.exe /silence" ["Kaspersky Labs"]
 "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]
 "Webfilter" -> shortcut to: "C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Webfilter\WebFilter.exe /POL" ["G DATA Software AG"]
 Winsock2 Service Provider DLLs:
 -------------------------------
 Namespace Service Providers
 HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
 Transport Service Providers
 HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
 %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13
 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
 Toolbars, Explorer Bars, Extensions:
 ------------------------------------
 Toolbars
 HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
 "{75CD0BC5-E317-449C-9FF6-4986B3D48F64}"
 -> {HKLM...CLSID} = "Pasek Webfilter "
 \InProcServer32\(Default) = "C:\PROGRA~1\GDATA~1\ANTIVI~1\WEBFIL~1\PAKIEGUI.dll" [null data]
 HKLM\Software\Microsoft\Internet Explorer\Toolbar\
 "{75CD0BC5-E317-449C-9FF6-4986B3D48F64}" = "Pasek Webfilter "
 -> {HKLM...CLSID} = "Pasek Webfilter "
 \InProcServer32\(Default) = "C:\PROGRA~1\GDATA~1\ANTIVI~1\WEBFIL~1\PAKIEGUI.dll" [null data]
 "{327C2873-E90D-4C37-AA9D-10AC9BABA46C}" = "Easy-WebPrint"
 -> {HKLM...CLSID} = "Easy-WebPrint"
 \InProcServer32\(Default) = "C:\Program Files\Canon\Easy-WebPrint\Toolband.dll" [null data]
 Miscellaneous IE Hijack Points
 ------------------------------
 HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
 Missing lines (compared with English-language version):
 "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided)
 -> {HKLM...CLSID} = "Search Class"
 \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string]
 Running Services (Display Name, Service Name, Path {Service DLL}):
 ------------------------------------------------------------------
 AVK Service, AVKService, "C:\Program Files\G DATA\AntiVirenKit InternetSecurity\AVK\AVKService.exe" [empty string]
 Strażnik AVK, AVKWCtl, "C:\Program Files\G DATA\AntiVirenKit InternetSecurity\AVK\AVKWCtl.exe" [empty string]
 Print Monitors:
 ---------------

 
	
 

 
	 


 
	

 wyłączony komputer = wyłączony internet i w ogóle wszystko
 wyłączony komputer = wyłączony internet i w ogóle wszystko 
 
 
 
 