przez siata 15 Lip 2008, 18:19
przez Magik 15 Lip 2008, 18:20
przez siata 15 Lip 2008, 18:29
emo Magik napisał(a):masz amvo infekcje
przez Magik 15 Lip 2008, 18:32
co to jest? o co chodzi z tymi logami? sorry za niewiedzę ale jestem troszkę zielony w tych sprawach
nastepnie wklej je na forum tam ejst krok po kroku, z obrazkami 
przez siata 15 Lip 2008, 18:40
ComboFix 08-07-14.2 - aaa 2008-07-15 18:38:16.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.646 [GMT 2:00]
Running from: E:\różne\instalki\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\autorun.inf
C:\copy.exe
E:\Autorun.inf
E:\copy.exe
.
((((((((((((((((((((((((( Files Created from 2008-06-15 to 2008-07-15 )))))))))))))))))))))))))))))))
.
2099-01-15 14:16 . 2099-01-15 14:16 <DIR> d-------- C:\Program Files\Thomson
2099-01-15 14:09 . 2099-01-15 14:09 <DIR> d----c--- C:\Documents and Settings\aaa\Dane aplikacji\ATI
2099-01-15 14:06 . 2099-01-15 14:06 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2099-01-15 14:05 . 2099-01-15 14:07 <DIR> d-------- C:\Program Files\ATI Technologies
2099-01-15 14:05 . 2004-11-24 22:10 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2099-01-15 14:05 . 2004-11-24 19:01 294,912 -ra------ C:\WINDOWS\system32\atiiiexx.dll
2099-01-15 14:05 . 2004-11-16 11:33 9,054 -ra------ C:\WINDOWS\system32\atifglpf.xml
2099-01-15 14:02 . 2099-01-15 14:02 <DIR> d-------- C:\Program Files\Attansic
2099-01-15 14:01 . 2099-01-15 14:01 <DIR> d-------- C:\Program Files\Realtek
2099-01-15 14:01 . 2005-04-16 16:20 487,424 -r------- C:\WINDOWS\RtlExUpd.dll
2099-01-15 14:01 . 2006-07-22 01:40 143,360 -r------- C:\WINDOWS\system32\RtlCPAPI.dll
2099-01-15 14:01 . 2006-08-01 09:02 49,152 -r------- C:\WINDOWS\system32\ChCfg.exe
2099-01-15 14:00 . 2099-01-15 14:00 <DIR> d-------- C:\Program Files\VIA
2099-01-15 13:59 . 2099-01-15 13:59 <DIR> d-------- C:\Program Files\AMD
2099-01-15 13:59 . 2005-03-09 16:53 43,008 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2099-01-15 13:59 . 2099-01-15 13:59 19,633 --a------ C:\WINDOWS\Ascd_tmp.ini
2099-01-15 13:59 . 2004-04-27 09:26 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2099-01-15 13:32 . 2003-10-16 19:07 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2099-01-15 13:30 . 2008-03-14 19:35 <DIR> d-------- C:\Program Files\Java
2099-01-15 13:30 . 2008-07-14 17:10 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2099-01-15 13:30 . 2099-01-15 13:59 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2099-01-15 13:30 . 2003-12-08 12:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
2099-01-15 13:30 . 2003-12-08 12:53 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
2099-01-15 13:30 . 2002-11-01 21:15 45,175 --------- C:\WINDOWS\system32\plugincpl140_03.cpl
2099-01-15 13:30 . 2002-11-01 21:15 41,068 --------- C:\WINDOWS\system32\ActPanel.dll
2099-01-15 13:30 . 2003-12-08 12:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2099-01-15 13:30 . 2003-12-08 12:53 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys
2099-01-15 13:30 . 2003-12-08 12:53 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys
2099-01-15 13:25 . 2099-01-15 13:25 <DIR> d-------- C:\WINDOWS\system32\Adobe
2099-01-15 13:25 . 2099-01-15 13:25 <DIR> d-------- C:\WINDOWS\Profiles
2099-01-15 13:25 . 2099-01-15 13:25 <DIR> d-------- C:\Program Files\Common Files\Adobe
2099-01-15 13:25 . 2099-01-15 13:25 <DIR> d----c--- C:\Documents and Settings\aaa\Dane aplikacji\InterTrust
2099-01-15 13:25 . 2008-07-07 20:51 30 --a------ C:\WINDOWS\TextSpy.ini
2099-01-15 13:24 . 1998-10-07 14:54 327,168 --a------ C:\WINDOWS\IsUn0415.exe
2099-01-15 13:20 . 2008-07-15 18:36 <DIR> d-------- C:\Program Files\Neostrada TP
2099-01-15 13:19 . 2099-01-15 13:19 <DIR> d--hs---- C:\WINDOWS\ftpcache
2099-01-13 19:39 . 2001-10-26 17:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2099-01-13 19:38 . 2001-08-17 23:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2099-01-13 14:59 . 2099-01-13 14:59 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-07-09 12:40 . 2007-10-09 01:57 100,352 --------- C:\WINDOWS\system32\dllcache\6to4svc.dll
2008-07-09 04:29 . 2008-07-09 04:29 <DIR> d-------- C:\Program Files\Common Files\DirectX
2008-07-09 04:28 . 2008-07-09 04:28 <DIR> d----c--- C:\Documents and Settings\aaa\Dane aplikacji\THQ
2008-07-02 19:28 . 2008-07-09 00:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-07-02 19:27 . 2008-07-09 00:56 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-07-01 01:01 . 2008-07-01 01:01 <DIR> d-------- C:\Program Files\Hamachi
2008-07-01 01:01 . 2008-07-09 00:56 <DIR> d----c--- C:\Documents and Settings\aaa\Dane aplikacji\Hamachi
2008-07-01 01:01 . 2008-07-01 01:01 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-06-30 16:50 . 2008-06-30 16:50 <DIR> d-------- C:\Program Files\DOSBox-0.63
2008-06-23 20:27 . 2008-06-24 13:34 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-06-20 19:37 . 2008-06-20 19:37 246,784 --------- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 12:44 . 2008-06-20 12:44 138,368 --------- C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 11:32 . 2008-06-20 11:32 225,920 --------- C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-15 12:00 . 2008-06-15 12:00 <DIR> d----c--- C:\Documents and Settings\aaa\Dane aplikacji\Nokia Multimedia Player
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2099-01-13 13:01 --------- d-----w C:\Program Files\Usługi online
2008-07-15 14:13 --------- d-----w C:\Program Files\Lineage II
2008-07-12 16:06 --------- d-----w C:\Program Files\Valve
2008-07-02 01:50 --------- d-----w C:\Program Files\Gadu-Gadu
2008-06-30 21:22 --------- d-----w C:\Program Files\Nokia
2008-06-24 11:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-23 18:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-06-20 17:37 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:37 147,968 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:44 360,960 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 360,960 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:32 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-12 07:59 --------- d-----w C:\Program Files\eMule
2008-06-11 16:59 --------- d-----w C:\Program Files\Electronic Arts
2008-05-30 20:17 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-30 16:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-05-28 21:16 --------- dc----w C:\Documents and Settings\aaa\Dane aplikacji\mIRC
2008-05-28 21:16 --------- d-----w C:\Program Files\mIRC
2008-05-27 21:41 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-05-27 21:41 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-05-08 12:14 203,008 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:03 1,291,776 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:03 1,291,776 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-22 08:02 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 08:02 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 08:02 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
.
------- Sigcheck -------
2007-07-10 15:06 642560 ce594e18fe0d0af804f1f3694921ce62 C:\WINDOWS\system32\user32.dll
2007-10-19 00:19 2145280 6c264e21d3bd7082b43fc016d760c1d1 C:\WINDOWS\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:44 15360]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-03-20 18:39 216520]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 12:53 1079808]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 22:10 344064]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-25 01:27 32768]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 12:38 866816]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07 53248]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-06 05:44 16262656 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:44 15360]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-25 01:27 32768]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\startupfolder\C:^Documents and Settings^aaa^Menu Start^Programy^Autostart^hamachi.lnk]
path=C:\Documents and Settings\aaa\Menu Start\Programy\Autostart\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST System Tray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST System Tray.lnk
backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2008-03-25 04:59 507904 C:\Program Files\Winamp Remote\bin\OrbTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2008-04-16 12:53 1079808 C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-03-17 20:56 36352 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"E:\\Gry\\Call of Duty 4\\CoD 4\\iw3mp.exe"=
"C:\\Program Files\\Valve\\hl.exe"=
R0 mv61xx;mv61xx;C:\WINDOWS\system32\DRIVERS\mv61xx.sys [2007-10-17 20:23]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2007-10-17 20:23]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-08-22 07:36]
S0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [2007-10-17 20:23]
S0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2007-10-17 20:23]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 15:17]
S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 15:17]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
*Newly Created Service* - CATCHME
.
- - - - ORPHANS REMOVED - - - -
Notify-WgaLogon - (no file)
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 18:38:47
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-15 18:39:16
ComboFix-quarantined-files.txt 2008-07-15 16:39:10
Pre-Run: 2,540,937,216 bajtów wolnych
Post-Run: 2,535,456,768 bajtów wolnych
213 --- E O F --- 2008-07-10 01:00:35
przez Magik 15 Lip 2008, 18:42
przez siata 15 Lip 2008, 18:56
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:54:35, on 2008-07-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
E:\różne\instalki\HiJack\hijackthis.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{697CB2E8-2A17-4C7C-817B-24A77DB4BBFF}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
--
End of file - 7169 bytes
przez Magik 15 Lip 2008, 19:03
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
przez siata 15 Lip 2008, 19:14
emo Magik napisał(a):i dla pewnosci
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 8 gości