Avast wykrył trojana w: C:\program files\common files\microsoft shared\web folders\ibm000
AVG też wykrył trojana :? oto raport:
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 14:36:25 2007-04-09
+ Scan result:
D:\System Volume Information\_restore{3CFD67A4-F631-4A09-8248-0F7CD8A1EFA0}\RP16\A0004691.exe -> Adware.Altnet : No action taken.
E:\System Volume Information\_restore{BFF8BCA6-DC26-4FD9-9F6E-E277715124EA}\RP6\A0000229.exe -> Adware.Altnet : No action taken.
E:\System Volume Information\_restore{FD575BCD-9A1B-4F39-9974-2491D76DE89C}\RP1\A0000105.exe -> Adware.Altnet : No action taken.
:mozilla.50:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.51:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@edsa.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
:mozilla.94:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.95:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@adbrite[2].txt -> TrackingCookie.Adbrite : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@ads.addynamix[2].txt -> TrackingCookie.Addynamix : No action taken.
:mozilla.110:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.111:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.112:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.113:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.45:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.46:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.59:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.60:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.61:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.62:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@ad.adocean[1].txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@gde.adocean[1].txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@gg.adocean[2].txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@idg.adocean[2].txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@my.adocean[1].txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@adtech[2].txt -> TrackingCookie.Adtech : No action taken.
:mozilla.80:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.78:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Bluemountain : No action taken.
:mozilla.24:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.25:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.26:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.27:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.28:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.29:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.30:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.31:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@casalemedia[2].txt -> TrackingCookie.Casalemedia : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@as1.falkag[2].txt -> TrackingCookie.Falkag : No action taken.
:mozilla.32:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.33:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@fastclick[2].txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@ilead.itrack[1].txt -> TrackingCookie.Itrack : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@ivwbox[1].txt -> TrackingCookie.Ivwbox : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@www.lop[2].txt -> TrackingCookie.Lop : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.149:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.150:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.151:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@edge.ru4[2].txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.103:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.104:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.43:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.44:C:\Documents and Settings\freyja\Dane aplikacji\Mozilla\Firefox\Profiles\kdo37t09.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : No action taken.
C:\Documents and Settings\freyja\Cookies\freyja@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken.
E:\Wojsko+\Pen LG mp3\egzamin ze szkolenia specjalisty\comment.htt -> Trojan.Starter.a : No action taken.
::Report end
nie ruszałam tego, bo nie wiem czy usuwać czy kwarantannę zrobić… ai jeszcze log z silenta:
"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."]
"Komunikator" = "C:\Program Files\Tlen.pl\tlen.exe" ["o2.pl Sp. z o.o."]
"swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" ["Google Inc."]
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]
"ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime" [null data]
"RemoteControl" = ""C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."]
"InCD" = "C:\Program Files\Ahead\InCD\InCD.exe" ["Nero AG"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Device Detector" = "DevDetect.exe -autorun" ["ACD Systems, Ltd."]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data]
"BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"PE2CKFNT SE" = "C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe" [null data]
"HP Software Update" = "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Development Company, L.P."]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"" ["Sun Microsystems, Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."]
{D5792AA9-D373-4039-8670-2CDAB6A71F15}\(Default) = (no title provided)
-> {HKLM...CLSID} = "WebManager Class"
\InProcServer32\(Default) = "C:\Program Files\BitDownload\TorrentManager.dll" ["WakeNet"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
-> {HKLM...CLSID} = "SimpleShlExt Class"
\InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{950FF917-7A57-46BC-8017-59D9BF474000}" = "Shell Extension for CDRW"
-> {HKLM...CLSID} = "Shell Extension for CDRW"
\InProcServer32\(Default) = "C:\Program Files\Ahead\InCD\incdshx.dll" ["Nero AG"]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\axshlex.dll" ["Alcohol Soft Development Team"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}" = "TuneUp Shredder Shell Context Menu Extension"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
\InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
"{8932AEFE-9DB6-4f43-AFB2-5682F55E773A}" = "VPCHostCopyHook"
-> {HKCU...CLSID} = "VPCHostCopyHook"
\InProcServer32\(Default) = "C:\Program Files\vm\VPCShExH.DLL" [MS]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
MorpheusShellExt\(Default) = "{7DBF2913-1F89-4104-B1F4-932A29945C13}"
-> {HKLM...CLSID} = "ExplorerMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Morpheus\MorphShellExt.dll" [null data]
TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
\InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
\InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
MorpheusShellExt\(Default) = "{7DBF2913-1F89-4104-B1F4-932A29945C13}"
-> {HKLM...CLSID} = "ExplorerMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Morpheus\MorphShellExt.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------
Note: detected settings may not have any effect.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\freyja\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Enabled Screen Saver:
---------------------
HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS]
Startup items in "freyja" & "All Users" startup folders:
--------------------------------------------------------
C:\Documents and Settings\freyja\Menu Start\Programy\Autostart
"Morpheus" -> shortcut to: "C:\Program Files\Morpheus\Morpheus.exe -min" ["Streamcast Networks, Inc"]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"ATI CATALYST – pasek zadań" -> shortcut to: "C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe SystemTray" [null data]
"BlueSoleil" -> shortcut to: "C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe" ["IVT Corporation"]
"HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Development Company, L.P."]
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
"Photo Express Calendar Checker SE" -> shortcut to: "C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe" ["Ulead Systems, Inc."]
"VIA RAID TOOL" -> shortcut to: "C:\Program Files\VIA\RAID\raid_tool.exe" ["VIA Technologies"]
"WinZip Quick Pick" -> shortcut to: "C:\Program Files\WinZip\WZQKPICK.EXE" ["WinZip Computing LP"]
Enabled Scheduled Tasks:
------------------------
"1-Click Maintenance" -> launches: "C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 20
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.5.0_11"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_11"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."]
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
Miscellaneous IE Hijack Points
------------------------------
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "*g" (unwritable string)
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
HKLM\Software\Microsoft\Internet Explorer\AboutURLs\
<> "TuneUp" = "file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css" [file not found]
HOSTS file
----------
C:\WINDOWS\System32\drivers\etc\HOSTS
maps: 74 domain names to IP addresses,
3 of the IP addresses are *not* localhost!
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data]
avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data]
avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
BlueSoleil Hid Service, BlueSoleil Hid Service, "C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe" [null data]
Bluetooth Support Service, BthServ, "C:\WINDOWS\system32\svchost.exe -k bthsvcs" {"C:\WINDOWS\System32\bthserv.dll" [MS]}
gb, gb, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.dll" [null data]}
InCD Helper, InCDsrv, "C:\Program Files\Ahead\InCD\InCDsrv.exe" ["Nero AG"]
StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
Print Monitors:
---------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
LIDIL hpzll054\Driver = "hpzll054.dll" ["Hewlett-Packard Company"]
----------
<>: Suspicious data at a malware launch point.
<>: Suspicious data at a browser hijack point.
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 52 seconds, including 4 seconds for message boxes)
proszę o pomoc, bo chyba nie jest dobrze :?
chyba, że chodzi o to:
dziękuję za pomoc 