Awast wykrył trojana

margoo2 · 15 Styczeń 2007 15:17

Witam’:-D’ Proszę o pomoc. Awast wykrył u mnie jakiegos trojana ‘:o’

. Probowalam go usunac, ale zaraz jak to zrobie to pojawia sie nasepny. Przesyłam logi. Prosze o ich sprawdzenie i pomoc w usunieciu tego co nie potrzebne. Z gory dziekuje.

Logfile of HijackThis v1.99.1 Scan saved at 16:01:12, on 2007-01-15 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\keyhook.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Documents and Settings\sss\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O4 - HKLM…\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [siS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe O4 - HKLM…\Run: [QuickTime Task] “C:\WINDOWS\system32\qttask.exe” -atboottime O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S O4 - HKLM…\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKLM…\Run: [364tvb384] C:\WINDOWS\System32\z1591.exe asycf74 O4 - HKCU…\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi … xdm119YYPL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach … 0.0.15.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://80.51.123.131/activex/AxisCamControl.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\Plugin Manager\Skype4COM.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “MyWebSearch Email Plugin” = “C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe” [“MyWebSearch.com”] “swg” = “C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe” [“Google Inc.”] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu Sp. z o.o.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SiSUSBRG” = “C:\WINDOWS\SiSUSBrg.exe” [“Silicon Integrated Systems Corp.”] “Cmaudio” = “RunDll32 cmicnfg.cpl,CMICtrlWnd” [MS] “SiS Windows KeyHook” = “C:\WINDOWS\System32\keyhook.exe” [“Silicon Integrated Systems Corporation”] “QuickTime Task” = ““C:\WINDOWS\system32\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “My Web Search Bar” = “rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S” [MS] “MyWebSearch Email Plugin” = “C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe” [“MyWebSearch.com”] “364tvb384” = “C:\WINDOWS\System32\z1591.exe asycf74” [null data] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINDOWS\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {00A6FAF1-072E-44cf-8957-5838F569A31D}(Default) = “MyWebSearch Search Assistant BHO” -> {HKLM…CLSID} = “MyWebSearch Search Assistant BHO” \InProcServer32(Default) = “C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL” [“MyWebSearch.com”] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {07B18EA1-A523-4961-B6BB-170DE4475CCA}(Default) = “mwsBar BHO” -> {HKLM…CLSID} = “mwsBar BHO” \InProcServer32(Default) = “C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL” [“MyWebSearch.com”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar2.dll” [“Google Inc.”] {F97DA966-F09D-4cab-BF29-75A0026986EA}(Default) = “XBTP02634” -> {HKLM…CLSID} = “XBTP02634 Class” \InProcServer32(Default) = “C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll” [“IE Toolbar”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\rpshell.dll” [“RealNetworks, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] HKLM\System\CurrentControlSet\Control\Session Manager\ <> “BootExecute” = “autocheck autochk *”|“aswBoot.exe /M:382075a4” [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\sss\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\sss\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “sss” & “All Users” startup folders: ----------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{07B18EA9-A523-4961-B6BB-170DE4475CCA}” -> {HKLM…CLSID} = “My &Web Search” \InProcServer32(Default) = “C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL” [“MyWebSearch.com”] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar2.dll” [“Google Inc.”] “{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}” -> {HKLM…CLSID} = “BearShare MediaBar” \InProcServer32(Default) = “C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll” [“IE Toolbar”] “{07B18EA9-A523-4961-B6BB-170DE4475CCA}” -> {HKLM…CLSID} = “My &Web Search” \InProcServer32(Default) = “C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL” [“MyWebSearch.com”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{07B18EA9-A523-4961-B6BB-170DE4475CCA}” = (no title provided) -> {HKLM…CLSID} = “My &Web Search” \InProcServer32(Default) = “C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL” [“MyWebSearch.com”] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar2.dll” [“Google Inc.”] “{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}” = (no title provided) -> {HKLM…CLSID} = “BearShare MediaBar” \InProcServer32(Default) = “C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll” [“IE Toolbar”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}(Default) = “My Web Search Quick View” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\WINDOWS\System32\shdocvw.dll” [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{00A6FAF6-072E-44cf-8957-5838F569A31D}” = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL” [“MyWebSearch.com”] <> “{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}” = (no title provided) -> {HKLM…CLSID} = “BearShare MediaBar” \InProcServer32(Default) = “C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll” [“IE Toolbar”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] BlueSoleil Hid Service, BlueSoleil Hid Service, “C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe” [null data] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 194 seconds. ---------- (total run time: 471 seconds)

__________________________________________________ ewido anti-spyware online scanner http://www.ewido.net __________________________________________________ Name: TrackingCookie.247realmedia Path: C:\Documents and Settings\sss\Cookies\sss@247realmedia[1].txt Risk: Medium Name: TrackingCookie.2o7 Path: C:\Documents and Settings\sss\Cookies\sss@2o7[2].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\sss\Cookies\sss@ad.adocean[1].txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: C:\Documents and Settings\sss\Cookies\sss@ad.yieldmanager[2].txt Risk: Medium Name: TrackingCookie.Adbrite Path: C:\Documents and Settings\sss\Cookies\sss@adbrite[2].txt Risk: Medium Name: TrackingCookie.Euroclick Path: C:\Documents and Settings\sss\Cookies\sss@adopt.euroclick[2].txt Risk: Medium Name: TrackingCookie.Specificclick Path: C:\Documents and Settings\sss\Cookies\sss@adopt.specificclick[2].txt Risk: Medium Name: TrackingCookie.Adrevolver Path: C:\Documents and Settings\sss\Cookies\sss@adrevolver[2].txt Risk: Medium Name: TrackingCookie.Addynamix Path: C:\Documents and Settings\sss\Cookies\sss@ads.addynamix[1].txt Risk: Medium Name: TrackingCookie.Pointroll Path: C:\Documents and Settings\sss\Cookies\sss@ads.pointroll[2].txt Risk: Medium Name: TrackingCookie.Adtech Path: C:\Documents and Settings\sss\Cookies\sss@adtech[2].txt Risk: Medium Name: TrackingCookie.Advertising Path: C:\Documents and Settings\sss\Cookies\sss@advertising[2].txt Risk: Medium Name: TrackingCookie.Falkag Path: C:\Documents and Settings\sss\Cookies\sss@as-us.falkag[1].txt Risk: Medium Name: TrackingCookie.Falkag Path: C:\Documents and Settings\sss\Cookies\sss@as1.falkag[1].txt Risk: Medium Name: TrackingCookie.Atdmt Path: C:\Documents and Settings\sss\Cookies\sss@atdmt[1].txt Risk: Medium Name: TrackingCookie.Casalemedia Path: C:\Documents and Settings\sss\Cookies\sss@b.casalemedia[1].txt Risk: Medium Name: TrackingCookie.Bfast Path: C:\Documents and Settings\sss\Cookies\sss@bfast[2].txt Risk: Medium Name: TrackingCookie.Bluestreak Path: C:\Documents and Settings\sss\Cookies\sss@bluestreak[1].txt Risk: Medium Name: TrackingCookie.Burstnet Path: C:\Documents and Settings\sss\Cookies\sss@burstnet[2].txt Risk: Medium Name: TrackingCookie.Casalemedia Path: C:\Documents and Settings\sss\Cookies\sss@casalemedia[2].txt Risk: Medium Name: TrackingCookie.Bridgetrack Path: C:\Documents and Settings\sss\Cookies\sss@cc.bridgetrack[1].txt Risk: Medium Name: TrackingCookie.Com Path: C:\Documents and Settings\sss\Cookies\sss@com[1].txt Risk: Medium Name: TrackingCookie.Sextracker Path: C:\Documents and Settings\sss\Cookies\sss@counter11.sextracker[1].txt Risk: Medium Name: TrackingCookie.Sextracker Path: C:\Documents and Settings\sss\Cookies\sss@counter12.sextracker[1].txt Risk: Medium Name: TrackingCookie.Sextracker Path: C:\Documents and Settings\sss\Cookies\sss@counter16.sextracker[1].txt Risk: Medium Name: TrackingCookie.Sextracker Path: C:\Documents and Settings\sss\Cookies\sss@counter2.sextracker[1].txt Risk: Medium Name: TrackingCookie.Sextracker Path: C:\Documents and Settings\sss\Cookies\sss@counter4.sextracker[1].txt Risk: Medium Name: TrackingCookie.Sextracker Path: C:\Documents and Settings\sss\Cookies\sss@counter6.sextracker[1].txt Risk: Medium Name: TrackingCookie.Sextracker Path: C:\Documents and Settings\sss\Cookies\sss@counter8.sextracker[1].txt Risk: Medium Name: TrackingCookie.Sextracker Path: C:\Documents and Settings\sss\Cookies\sss@counter9.sextracker[1].txt Risk: Medium Name: TrackingCookie.Sexcounter Path: C:\Documents and Settings\sss\Cookies\sss@cs.sexcounter[2].txt Risk: Medium Name: TrackingCookie.Clickzs Path: C:\Documents and Settings\sss\Cookies\sss@cz3.clickzs[2].txt Risk: Medium Name: TrackingCookie.Clickzs Path: C:\Documents and Settings\sss\Cookies\sss@cz7.clickzs[2].txt Risk: Medium Name: TrackingCookie.Overture Path: C:\Documents and Settings\sss\Cookies\sss@data2.perf.overture[1].txt Risk: Medium Name: TrackingCookie.2o7 Path: C:\Documents and Settings\sss\Cookies\sss@divx.112.2o7[1].txt Risk: Medium Name: TrackingCookie.Doubleclick Path: C:\Documents and Settings\sss\Cookies\sss@doubleclick[1].txt Risk: Medium Name: TrackingCookie.Hitbox Path: C:\Documents and Settings\sss\Cookies\sss@ehg-dig.hitbox[2].txt Risk: Medium Name: TrackingCookie.Hitbox Path: C:\Documents and Settings\sss\Cookies\sss@ehg-digg.hitbox[2].txt Risk: Medium Name: TrackingCookie.Hitbox Path: C:\Documents and Settings\sss\Cookies\sss@ehg-globalgamingleague.hitbox[2].txt Risk: Medium Name: TrackingCookie.Hitbox Path: C:\Documents and Settings\sss\Cookies\sss@ehg-youtube.hitbox[1].txt Risk: Medium Name: TrackingCookie.Enhance Path: C:\Documents and Settings\sss\Cookies\sss@enhance[2].txt Risk: Medium Name: TrackingCookie.Fastclick Path: C:\Documents and Settings\sss\Cookies\sss@fastclick[1].txt Risk: Medium Name: TrackingCookie.Comclick Path: C:\Documents and Settings\sss\Cookies\sss@fl01.ct2.comclick[1].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\sss\Cookies\sss@gde.adocean[2].txt Risk: Medium Name: TrackingCookie.Goclick Path: C:\Documents and Settings\sss\Cookies\sss@goclick[2].txt Risk: Medium Name: TrackingCookie.Hitbox Path: C:\Documents and Settings\sss\Cookies\sss@hitbox[1].txt Risk: Medium Name: TrackingCookie.Hotlog Path: C:\Documents and Settings\sss\Cookies\sss@hotlog[2].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\sss\Cookies\sss@idg.adocean[2].txt Risk: Medium Name: TrackingCookie.Itrack Path: C:\Documents and Settings\sss\Cookies\sss@ilead.itrack[2].txt Risk: Medium Name: TrackingCookie.Masterstats Path: C:\Documents and Settings\sss\Cookies\sss@image.masterstats[1].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\sss\Cookies\sss@int.adocean[2].txt Risk: Medium Name: TrackingCookie.Ivwbox Path: C:\Documents and Settings\sss\Cookies\sss@ivwbox[1].txt Risk: Medium Name: TrackingCookie.Mediaplex Path: C:\Documents and Settings\sss\Cookies\sss@mediaplex[1].txt Risk: Medium Name: TrackingCookie.2o7 Path: C:\Documents and Settings\sss\Cookies\sss@metacafe.122.2o7[1].txt Risk: Medium Name: TrackingCookie.2o7 Path: C:\Documents and Settings\sss\Cookies\sss@msnportal.112.2o7[1].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\sss\Cookies\sss@my.adocean[1].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\sss\Cookies\sss@myao.adocean[2].txt Risk: Medium Name: TrackingCookie.Overture Path: C:\Documents and Settings\sss\Cookies\sss@overture[1].txt Risk: Medium Name: TrackingCookie.Overture Path: C:\Documents and Settings\sss\Cookies\sss@perf.overture[1].txt Risk: Medium Name: TrackingCookie.Hitbox Path: C:\Documents and Settings\sss\Cookies\sss@phg.hitbox[1].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\sss\Cookies\sss@pracuj.adocean[2].txt Risk: Medium Name: TrackingCookie.Qksrv Path: C:\Documents and Settings\sss\Cookies\sss@qksrv[2].txt Risk: Medium Name: TrackingCookie.Questionmarket Path: C:\Documents and Settings\sss\Cookies\sss@questionmarket[2].txt Risk: Medium Name: TrackingCookie.Valuead Path: C:\Documents and Settings\sss\Cookies\sss@reduxads.valuead[2].txt Risk: Medium Name: TrackingCookie.Revenue Path: C:\Documents and Settings\sss\Cookies\sss@revenue[2].txt Risk: Medium Name: TrackingCookie.Adjuggler Path: C:\Documents and Settings\sss\Cookies\sss@rotator.adjuggler[2].txt Risk: Medium Name: TrackingCookie.Information Path: C:\Documents and Settings\sss\Cookies\sss@searchportal.information[2].txt Risk: Medium Name: TrackingCookie.Liveperson Path: C:\Documents and Settings\sss\Cookies\sss@server.iad.liveperson[2].txt Risk: Medium Name: TrackingCookie.Serving-sys Path: C:\Documents and Settings\sss\Cookies\sss@serving-sys[2].txt Risk: Medium Name: TrackingCookie.Sexlist Path: C:\Documents and Settings\sss\Cookies\sss@sexlist[1].txt Risk: Medium Name: TrackingCookie.Sextracker Path: C:\Documents and Settings\sss\Cookies\sss@sextracker[1].txt Risk: Medium Name: TrackingCookie.Spylog Path: C:\Documents and Settings\sss\Cookies\sss@spylog[2].txt Risk: Medium Name: TrackingCookie.Onestat Path: C:\Documents and Settings\sss\Cookies\sss@stat.onestat[2].txt Risk: Medium Name: TrackingCookie.Statcounter Path: C:\Documents and Settings\sss\Cookies\sss@statcounter[1].txt Risk: Medium Name: TrackingCookie.Webtrendslive Path: C:\Documents and Settings\sss\Cookies\sss@statse.webtrendslive[2].txt Risk: Medium Name: TrackingCookie.Tacoda Path: C:\Documents and Settings\sss\Cookies\sss@tacoda[1].txt Risk: Medium Name: TrackingCookie.Targetnet Path: C:\Documents and Settings\sss\Cookies\sss@targetnet[1].txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: C:\Documents and Settings\sss\Cookies\sss@tradedoubler[1].txt Risk: Medium Name: TrackingCookie.Trafficmp Path: C:\Documents and Settings\sss\Cookies\sss@trafficmp[1].txt Risk: Medium Name: TrackingCookie.Trafic Path: C:\Documents and Settings\sss\Cookies\sss@trafic[1].txt Risk: Medium Name: TrackingCookie.Tribalfusion Path: C:\Documents and Settings\sss\Cookies\sss@tribalfusion[1].txt Risk: Medium Name: TrackingCookie.Valueclick Path: C:\Documents and Settings\sss\Cookies\sss@valueclick[1].txt Risk: Medium Name: TrackingCookie.2o7 Path: C:\Documents and Settings\sss\Cookies\sss@viamtvcom.112.2o7[1].txt Risk: Medium Name: TrackingCookie.2o7 Path: C:\Documents and Settings\sss\Cookies\sss@wrigley.122.2o7[1].txt Risk: Medium Name: TrackingCookie.Burstnet Path: C:\Documents and Settings\sss\Cookies\sss@www.burstnet[1].txt Risk: Medium Name: TrackingCookie.Smartadserver Path: C:\Documents and Settings\sss\Cookies\sss@www.smartadserver[1].txt Risk: Medium Name: TrackingCookie.Xxxcounter Path: C:\Documents and Settings\sss\Cookies\sss@xxxcounter[1].txt Risk: Medium Name: TrackingCookie.Yadro Path: C:\Documents and Settings\sss\Cookies\sss@yadro[1].txt Risk: Medium Name: TrackingCookie.2o7 Path: C:\Documents and Settings\sss\Cookies\sss@youtube.112.2o7[1].txt Risk: Medium Name: TrackingCookie.Adserver Path: C:\Documents and Settings\sss\Cookies\sss@z1.adserver[2].txt Risk: Medium Name: TrackingCookie.Zedo Path: C:\Documents and Settings\sss\Cookies\sss@zedo[2].txt Risk: Medium Name: Adware.Generic Path: HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions{c95fe080-8f5d-11d2-a20b-00aa003c157a} Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.49:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.50:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.51:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.52:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.53:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.64:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.65:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.66:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.67:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.68:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Tribalfusion Path: :mozilla.69:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Falkag Path: :mozilla.78:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Falkag Path: :mozilla.79:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Falkag Path: :mozilla.80:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Advertising Path: :mozilla.81:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Falkag Path: :mozilla.82:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Advertising Path: :mozilla.83:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Advertising Path: :mozilla.84:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Advertising Path: :mozilla.85:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Falkag Path: :mozilla.86:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Atdmt Path: :mozilla.87:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Doubleclick Path: :mozilla.90:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.91:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.92:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.93:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.94:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.95:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.96:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.97:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.98:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.123:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.124:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.125:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.146:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.147:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.148:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.149:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.150:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.151:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.152:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.153:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Revenue Path: :mozilla.174:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.175:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.176:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.177:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.178:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Information Path: :mozilla.179:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.180:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.181:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.182:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.183:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.184:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.185:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.195:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.196:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Ru4 Path: :mozilla.255:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Ru4 Path: :mozilla.256:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Pointroll Path: :mozilla.257:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Pointroll Path: :mozilla.258:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Ru4 Path: :mozilla.259:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Pointroll Path: :mozilla.260:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Pointroll Path: :mozilla.261:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Ru4 Path: :mozilla.262:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.263:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.264:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.292:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.293:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Itrack Path: :mozilla.318:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.326:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.327:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.328:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.329:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adbrite Path: :mozilla.331:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adbrite Path: :mozilla.332:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Googleadservices Path: :mozilla.344:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Googleadservices Path: :mozilla.347:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Webtrendslive Path: :mozilla.372:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.407:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Overture Path: :mozilla.432:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Overture Path: :mozilla.433:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Overture Path: :mozilla.434:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Overture Path: :mozilla.435:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Qksrv Path: :mozilla.451:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Qksrv Path: :mozilla.452:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.492:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.498:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.499:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Targetnet Path: :mozilla.534:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Targetnet Path: :mozilla.535:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.559:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.560:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.587:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Mediaplex Path: :mozilla.592:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Valueclick Path: :mozilla.626:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Hotlog Path: :mozilla.654:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Yadro Path: :mozilla.655:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Zedo Path: :mozilla.679:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Zedo Path: :mozilla.680:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Smartadserver Path: :mozilla.685:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Trafic Path: :mozilla.697:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.700:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.731:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.732:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Questionmarket Path: :mozilla.735:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Questionmarket Path: :mozilla.740:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.747:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adjuggler Path: :mozilla.762:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adjuggler Path: :mozilla.763:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Adjuggler Path: :mozilla.764:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Ivwbox Path: :mozilla.766:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Spylog Path: :mozilla.769:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Masterstats Path: :mozilla.791:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.792:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.793:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.794:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.795:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.796:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Bfast Path: :mozilla.812:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.814:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.815:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.818:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.849:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Com Path: :mozilla.889:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.Com Path: :mozilla.890:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: TrackingCookie.247realmedia Path: :mozilla.891:C:\Documents and Settings\sss\Dane aplikacji\Mozilla\Firefox\Profiles\kqe8q0ry.default\cookies.txt Risk: Medium Name: Adware.Solution Path: C:\System Volume Information_restore{F663D37F-5FF1-4C2D-A40F-70D572AFB352}\RP78\A0091683.dll Risk: Medium Name: Adware.Agent Path: C:\System Volume Information_restore{F663D37F-5FF1-4C2D-A40F-70D572AFB352}\RP79\A0098071.dll Risk: Medium Name: Downloader.Small.nqe Path: C:\System Volume Information_restore{F663D37F-5FF1-4C2D-A40F-70D572AFB352}\RP86\A0109706.dll Risk: High Name: Downloader.Small.nqe Path: C:\WINDOWS\system32\z1591.exe Risk: High Name: Downloader.Small.nqe Path: C:\WINDOWS\Temp_avast4_\unp77198344.tmp Risk: High

W ostatnim logu z ewido anti-spyware online scanner najbardziej niepokoja mnie 3 ostatnie wpisy.

adam9870 · 15 Styczeń 2007 15:29

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O4 - HKLM…\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S O4 - HKCU…\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKLM…\Run: [364tvb384] C:\WINDOWS\System32\z1591.exe asycf74 O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi … xdm119YYPL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach … alFWBIniti alSetup1.0.0.15.cab

Foldery i pliki usuń ręcznie w trybie awaryjnym, a wpisy w HJT.

Otwórz Notatnik i wklej w nim to:

Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] “MyWebSearch Email Plugin”=- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] “My Web Search Bar”=- “MyWebSearch Email Plugin”=- “364tvb384”=- [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{00A6FAF1-072E-44cf-8957-5838F569A31D}] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{07B18EA1-A523-4961-B6BB-170DE4475CCA}] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{F97DA966-F09D-4cab-BF29-75A0026986EA} [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager] “BootExecute”=hex(7):61,00,75,00,74,00,6f,00,63,00,68,00,65,00,63,00,6b,00,20,\ 00,61,00,75,00,74,00,6f,00,63,00,68,00,6b,00,20,00,2a,00,00,00,00,00 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser] “{07B18EA9-A523-4961-B6BB-170DE4475CCA}”=- [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] “{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}”=- “{07B18EA9-A523-4961-B6BB-170DE4475CCA}”=- [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar] “{07B18EA9-A523-4961-B6BB-170DE4475CCA}”=- “{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}”=- [-HKEY_LOCAL_MACHINE\Software\Classes\CLSID{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] “{00A6FAF6-072E-44cf-8957-5838F569A31D}”=- “{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}”=-

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG i uruchom go w trybie awaryjnym.

Po wykonaniu wklej nowe logi.

Usuwanie szkodników z folderu System Volume Information 1. Najpierw wyłączamy przywracanie systemu ponieważ w folderze System Volume Information są przechowywane punkty przywracania. W tym celu klikamy prawym klawiszem myszki na ikonę Mój komputer => wybieramy Właściwości => przechodzimy na zakładkę Przywracanie systemu => zaznaczamy opcję Wyłącz Przywracanie systemu na wszystkich dyskach => teraz tylko potwierdzamy klikając na Zastosuj i OK. 2. Włączamy pokazywanie ukrytych plików i folderów ponieważ folder System Volume Information jest ukryty. W tym celu otwieramy Mój komputer = u góry wybieramy Narzędzia = Opcje folderów… = w okienku, które się otworzy przechodzimy na zakładkę Widok = w części Ukryte pliki i foldery zaznaczamy opcję Pokaż ukryte pliki i foldery = dalej wystarczy tylko potwierdzić klikając na Zastosuj i OK. 3. Uruchamiamy system w trybie awaryjnym. W tym celu gdy komputer będzie wyłączony wciskamy klawisz F5 bądź F8 = włączamy komputer = gdy pojawi się ekran wyboru systemu puszczamy klawisz i za pomocą strzałek na klawiaturze wybieramy pozycję Tryb awaryjny i potwierdzamy wciskając klawisz Enter. Będąc w trybie awaryjnym wchodzimy do lokalizacji gdzie jest zainfekowany obiekt = klikamy na niego prawym klawiszem myszki = wybieramy Usuń i potwierdzamy. Czyli np. w tym przypadku: wchodzimy do lokalizacji: C:\System Volume Information_restore{833884EB-BC7B-42B3-8E66-1EA709E558E6}\RP7 i kasujemy znajdujący się tam plik A0005350.exe. UWAGI: Jeśli podczas wchodzenia do folderu System Volume Information naszym oczom okaże się komunikat Odmowa dostępu, to musimy poczytać na temat przejmowania na własność pliku lub folderu. W przypadku system Windows XP opis jest dostępny tutaj: http://support.microsoft.com/default.aspx?scid=kb;pl;308421 Ewentualnie możemy wykonać tylko punkt pierwszy z tego opisu, a następnie przeskanować jakimś skanerem i jeśli zostaną wykryte zainfekowane pliki, to opcja w stylu Usuń w nim powinna sobie w zupełności poradzić. Oczywiście po usuwaniu szkodników możemy włączyć przywracanie systemu jeśli korzystamy z tej funkcji.

margoo2 · 15 Styczeń 2007 16:32

Prawie wszystko udalo mi sie zrobic. Nie moglam tylko tego znalezc

‘:-(’

Oto logi:

Logfile of HijackThis v1.99.1 Scan saved at 17:13:54, on 2007-01-15 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\keyhook.exe C:\WINDOWS\system32\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\sss\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM…\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [siS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe O4 - HKLM…\Run: [QuickTime Task] “C:\WINDOWS\system32\qttask.exe” -atboottime O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi … xdm119YYPL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach … 0.0.15.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://80.51.123.131/activex/AxisCamControl.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\Plugin Manager\Skype4COM.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “swg” = “C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe” [“Google Inc.”] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu Sp. z o.o.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SiSUSBRG” = “C:\WINDOWS\SiSUSBrg.exe” [“Silicon Integrated Systems Corp.”] “Cmaudio” = “RunDll32 cmicnfg.cpl,CMICtrlWnd” [MS] “SiS Windows KeyHook” = “C:\WINDOWS\System32\keyhook.exe” [“Silicon Integrated Systems Corporation”] “QuickTime Task” = ““C:\WINDOWS\system32\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINDOWS\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar2.dll” [“Google Inc.”] {F97DA966-F09D-4cab-BF29-75A0026986EA}(Default) = “XBTP02634” -> {HKLM…CLSID} = “XBTP02634 Class” \InProcServer32(Default) = “C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\rpshell.dll” [“RealNetworks, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\sss\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\sss\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “sss” & “All Users” startup folders: ----------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar2.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar2.dll” [“Google Inc.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] BlueSoleil Hid Service, BlueSoleil Hid Service, “C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe” [null data] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 177 seconds. ---------- (total run time: 357 seconds)

Prosze o dalsze instrukcje.

Joan · 15 Styczeń 2007 16:55

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R3 - Default URLSearchHook is missing O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll (file missing) O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi … xdm119YYPL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach … 0.0.15.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://80.51.123.131/activex/AxisCamControl.cab

Zafixuj w HJT.

Otwórz notatnik i wklej w nim to:

Plik -> zapisz jako -> zmień rozszerzenie na wszystkie pliki -> zapisz pod nazwą FIX.REG

Odpal plik FIX.REG i potwierdź dodanie do rejestru i reset kompa

Daj nowe logi

margoo2 · 15 Styczeń 2007 17:03

Sory ze sie pytam ale co to znaczy???

Cytat: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R3 - Default URLSearchHook is missing O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll (file missing) O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi … xdm119YYPL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach … 0.0.15.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://80.51.123.131/activex/AxisCamControl.cab Zafixuj w HJT.

Mama to usunac w HJTczy co??? Nie chcialabym namieszac… :oops:

adam9870 · 15 Styczeń 2007 17:15

Tak, w hijacku zaznaczasz wszystkie wpisy, które podała Joan poza tym:

bo to prawidłowa kontrolka => klikasz Fix checked i potwierdzasz usunięcie.

Następnie zastosuj FIX.REG który podała i pokaż nowe logi.

margoo2 · 15 Styczeń 2007 17:55

Zrobione!

A oto logi:

Logfile of HijackThis v1.99.1 Scan saved at 18:47:08, on 2007-01-15 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\keyhook.exe C:\WINDOWS\system32\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Documents and Settings\sss\Pulpit\apteczka dla kompa\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM…\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [siS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe O4 - HKLM…\Run: [QuickTime Task] “C:\WINDOWS\system32\qttask.exe” -atboottime O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\Plugin Manager\Skype4COM.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “swg” = “C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe” [“Google Inc.”] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu Sp. z o.o.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SiSUSBRG” = “C:\WINDOWS\SiSUSBrg.exe” [“Silicon Integrated Systems Corp.”] “Cmaudio” = “RunDll32 cmicnfg.cpl,CMICtrlWnd” [MS] “SiS Windows KeyHook” = “C:\WINDOWS\System32\keyhook.exe” [“Silicon Integrated Systems Corporation”] “QuickTime Task” = ““C:\WINDOWS\system32\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINDOWS\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) - {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) - {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar2.dll” [“Google Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” - {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” - {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” - {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” - {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\rpshell.dll” [“RealNetworks, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” - {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” - {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” - {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” - {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\sss\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\sss\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “sss” “All Users” startup folders: ----------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” - shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “Microsoft Office” - shortcut to: “C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” - {HKLM…CLSID} = “Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar2.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) - {HKLM…CLSID} = “Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar2.dll” [“Google Inc.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] BlueSoleil Hid Service, BlueSoleil Hid Service, “C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe” [null data] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 180 seconds. ---------- (total run time: 359 seconds)

Czy juz wszystko jest ok???

adam9870 · 15 Styczeń 2007 19:14

Czysto.

Proponuję zainstalować dodatek Service Pack 2. Poprawia on bezpieczeństwo w systemie etc.

http://dobreprogramy.pl/index.php?dz=2&t=35&id=795

Możesz zajrzeć: Optymalizacja i odchudzanie Windowsa XP.

margoo2 · 15 Styczeń 2007 19:21

Dzięki wielkie :biggrin: Wiedzilam ze moge na was liczyc.

Pozdrawiam… Pa