“Silent Runners.vbs”, revision 59, http://www.silentrunners.org/ Operating System: Windows Vista Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “AQQ” = “C:\PROGRA~2\WapSter\WAPSTE~1\AQQ.exe” [empty string] “Odkurzacz-MCD” = “C:\Program Files (x86)\Odkurzacz\odk_mcd.exe” [“Franmo Software”] HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\ {++} “Odkurzacz-FD” = ““C:\Program Files (x86)\Odkurzacz\odk_uzp.exe” /start” [“Franmo Software”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “Windows Defender” = “C:\Program Files\Windows Defender\MSASCui.exe -hide” HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}” = “Shell Extension for Malware scanning” -> {HKLM…CLSID} = “Shell Extension for Malware scanning” \InProcServer32(Default) = “C:\Program Files (x86)\Avira\AntiVir PersonalEdition Premium\shlext64.dll” [“Avira GmbH”] HKLM\SOFTWARE\Classes*\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning(Default) = “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}” -> {HKLM…CLSID} = “Shell Extension for Malware scanning” \InProcServer32(Default) = “C:\Program Files (x86)\Avira\AntiVir PersonalEdition Premium\shlext64.dll” [“Avira GmbH”] WinRAR(Default) = “{B41DB860-64E4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files (x86)\WinRAR\rarext64.dll” [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-64E4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files (x86)\WinRAR\rarext64.dll” [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning(Default) = “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}” -> {HKLM…CLSID} = “Shell Extension for Malware scanning” \InProcServer32(Default) = “C:\Program Files (x86)\Avira\AntiVir PersonalEdition Premium\shlext64.dll” [“Avira GmbH”] WinRAR(Default) = “{B41DB860-64E4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files (x86)\WinRAR\rarext64.dll” [null data] Default executables: -------------------- HKLM\SOFTWARE\Classes.hta(Default) = “htafile” <> HKLM\SOFTWARE\Classes\htafile\shell\open\command(Default) = “C:\Windows\SysWOW64\mshta.exe “%1” %*” [MS] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoActiveDesktop” = (REG_DWORD) dword:0x00000001 {unrecognized setting} “NoActiveDesktopChanges” = (REG_DWORD) dword:0x00000001 {unrecognized setting} “ForceActiveDesktopOn” = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ “ConsentPromptBehaviorAdmin” = (REG_DWORD) dword:0x00000002 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Behavior Of The Elevation Prompt For Administrators In Admin Approval Mode} “ConsentPromptBehaviorUser” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Behavior Of The Elevation Prompt For Standard Users} “EnableInstallerDetection” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Detect Application Installations And Prompt For Elevation} “EnableLUA” = (REG_DWORD) dword:0x00000000 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Run All Administrators In Admin Approval Mode} “EnableSecureUIAPaths” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Only elevate UIAccess applications that are installed in secure locations} “EnableVirtualization” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Virtualize file and registry write failures to per-user locations} “PromptOnSecureDesktop” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Switch to the secure desktop when prompting for elevation} “shutdownwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “FilterAdministratorToken” = (REG_DWORD) dword:0x00000000 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Admin Approval Mode for the Built-in Administrator Account} “EnableUIADesktopToggle” = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Windows\system32\config\systemprofile\Desktop\Bez tytułu.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Users\Vista\AppData\Roaming\Opera\Opera\profile\skin\178671.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\Windows\system32\logon.scr” [MS] Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ MSPlayCDAudioOnArrival\ “Provider” = “@wmploc.dll,-6502” “InvokeProgID” = “WMP.AudioCD” “InvokeVerb” = “play” HKLM\SOFTWARE\Classes\WMP.AudioCD\shell\play\command(Default) = ““C:\Program Files (x86)\Windows Media Player\wmplayer.exe” /prefetch:3 /device:AudioCD “%L”” [MS] MSPlayDVDMovieOnArrival\ “Provider” = “@wmploc.dll,-6502” “InvokeProgID” = “WMP.DVD” “InvokeVerb” = “play” HKLM\SOFTWARE\Classes\WMP.DVD\shell\play\command(Default) = ““C:\Program Files (x86)\Windows Media Player\wmplayer.exe” /prefetch:4 /device:DVD “%L”” [MS] MSPlaySuperVideoCDMovieOnArrival\ “Provider” = “@wmploc.dll,-6502” “InvokeProgID” = “WMP.VCD” “InvokeVerb” = “play” HKLM\SOFTWARE\Classes\WMP.VCD\shell\play\command(Default) = ““C:\Program Files (x86)\Windows Media Player\wmplayer.exe” /prefetch:4 /device:VCD “%L”” [MS] MSPlayVideoCDMovieOnArrival\ “Provider” = “@wmploc.dll,-6502” “InvokeProgID” = “WMP.VCD” “InvokeVerb” = “play” HKLM\SOFTWARE\Classes\WMP.VCD\shell\play\command(Default) = ““C:\Program Files (x86)\Windows Media Player\wmplayer.exe” /prefetch:4 /device:VCD “%L”” [MS] MSRipCDAudioOnArrival\ “Provider” = “@wmploc.dll,-6502” “InvokeProgID” = “WMP.RipCD” “InvokeVerb” = “Rip” HKLM\SOFTWARE\Classes\WMP.RipCD\shell\Rip\Command(Default) = ““C:\Program Files (x86)\Windows Media Player\wmplayer.exe” /prefetch:3 /RipAudioCD “%L” " [MS] MSWMPBurnCDOnArrival\ “Provider” = “@wmploc.dll,-6502” “InvokeProgID” = “WMP.BurnCD” “InvokeVerb” = “Burn” HKLM\SOFTWARE\Classes\WMP.BurnCD\shell\Burn\Command(Default) = ““C:\Program Files (x86)\Windows Media Player\wmplayer.exe” /prefetch:3 /Task:CDWrite /Device:”%L” " [MS] MSWMPBurnDataDVDArrival\ “Provider” = “@wmploc.dll,-6502” “InvokeProgID” = “WMP.BurnDVD” “InvokeVerb” = “Burn” HKLM\SOFTWARE\Classes\WMP.BurnDVD\shell\Burn\Command(Default) = ““C:\Program Files (x86)\Windows Media Player\wmplayer.exe” /prefetch:3 /Task:DVDWrite /Device:”%L" " [MS] Non-disabled Scheduled Tasks: ----------------------------- C:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client “AD RMS Rights Policy Template Management (Manual)” -> launches: “{BF5CB148-7C77-4d8a-A53E-D81C70CF743C}” -> {HKLM…CLSID} = “AD RMS Rights Policy Template Management (Manual) Task Handler” \InProcServer32(Default) = “C:\Windows\system32\msdrm.dll” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\Bluetooth “UninstallDeviceTask” -> launches: “BthUdTask.exe $(Arg0)” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient “SystemTask” -> launches: “{58fb76b9-ac85-4e55-ac04-427593b1d060}” -> {HKLM…CLSID} = “Certificate Services Client Task Handler” \InProcServer32(Default) = “C:\Windows\system32\dimsjob.dll” [MS] “UserTask” -> launches: “{58fb76b9-ac85-4e55-ac04-427593b1d060}” -> {HKLM…CLSID} = “Certificate Services Client Task Handler” \InProcServer32(Default) = “C:\Windows\system32\dimsjob.dll” [MS] “UserTask-Roam” -> launches: “{58fb76b9-ac85-4e55-ac04-427593b1d060}” -> {HKLM…CLSID} = “Certificate Services Client Task Handler” \InProcServer32(Default) = “C:\Windows\system32\dimsjob.dll” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program “Consolidator” -> launches: “%SystemRoot%\System32\wsqmcons.exe” [MS] “OptinNotification” -> launches: “%SystemRoot%\System32\wsqmcons.exe -n 0x1C577FA2B69CAD0” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\Defrag “ScheduledDefrag” -> launches: “%windir%\system32\defrag.exe -c -i” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic “Microsoft-Windows-DiskDiagnosticDataCollector” -> (HIDDEN!) launches: “%windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\Media Center “ehDRMInit” -> launches: “%SystemRoot%\ehome\ehPrivJob.exe /DRMInit” [MS] “mcupdate” -> launches: “%SystemRoot%\ehome\mcupdate $(Arg0) -gc” [MS] “OCURActivate” -> launches: “%SystemRoot%\ehome\ehPrivJob.exe /OCURActivate” [MS] “OCURDiscovery” -> launches: “%SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery” [MS] “UpdateRecordPath” -> launches: “%SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\MobilePC “HotStart” -> launches: “{06DA0625-9701-43da-BFD7-FBEEA2180A1E}” -> {HKLM…CLSID} = “HotStart User Agent” \InProcServer32(Default) = “C:\Windows\System32\HotStartUserAgent.dll” [MS] “TMM” -> launches: “{35EF4182-F900-4632-B072-8639E4478A61}” -> {HKLM…CLSID} = “Transient Multi-Monitor Manager” \InProcServer32(Default) = “C:\Windows\System32\TMM.dll” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\MUI “LPRemove” -> launches: “%windir%\system32\lpremove.exe” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\Multimedia “SystemSoundsService” -> launches: “{2DEA658F-54C1-4227-AF9B-260AB5FC3543}” -> {HKLM…CLSID} = “Microsoft PlaySoundService Class” \InProcServer32(Default) = “C:\Windows\System32\PlaySndSrv.dll” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\NetworkAccessProtection “NAPStatus UI” -> launches: “{f09878a1-4652-4292-aa63-8c7d4fd7648f}” -> {HKLM…CLSID} = “Nap ITask Handler Implementation” \InProcServer32(Default) = “C:\Windows\System32\QAgent.dll” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\PLA\System “ConvertLogEntries” -> (HIDDEN!) launches: “%windir%\system32\rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\RAC “RACAgent” -> (HIDDEN!) launches: “%windir%\system32\RacAgent.exe” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\RemoteAssistance “RemoteAssistanceTask” -> (HIDDEN!) launches: “%windir%\system32\RAServer.exe /offerraupdate” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\Shell “CrawlStartPages” -> launches: “{51653423-e62d-4ff7-894a-dabb2b8e21e2}” -> {HKLM…CLSID} = “CrawlStartPages Task Handler” \InProcServer32(Default) = “C:\Windows\System32\srchadmin.dll” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\SideShow “GadgetManager” -> launches: “{FF87090D-4A9A-4f47-879B-29A80C355D61}” -> {HKLM…CLSID} = “GadgetsManager Class” \InProcServer32(Default) = “C:\Windows\System32\AuxiliaryDisplayServices.dll” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\SystemRestore “SR” -> launches: “%windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\Tcpip “IpAddressConflict1” -> launches: “rundll32 ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem” [MS] “IpAddressConflict2” -> launches: “rundll32 ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework “MsCtfMonitor” -> (HIDDEN!) launches: “{01575cfe-9a55-4003-a5e1-f38d1ebdcbe1}” -> {HKLM…CLSID} = “MsCtfMonitor task handler” \InProcServer32(Default) = “C:\Windows\system32\MsCtfMonitor.dll” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\UPnP “UPnPHostConfig” -> launches: “sc.exe config upnphost start= auto” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\WDI “ResolutionHost” -> (HIDDEN!) launches: “{900be39d-6be8-461a-bc4d-b0fa71f5ecb1}” -> {HKLM…CLSID} = “DiagnosticInfrastructureCustomHandler” \InProcServer32(Default) = “C:\Windows\System32\wdi.dll” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting “QueueReporting” -> launches: “%windir%\system32\wermgr.exe -queuereporting” [MS] C:\Windows\System32\Tasks\Microsoft\Windows\Wired “GatherWiredInfo” -> launches: “%windir%\system32\gatherWiredInfo.vbs” [null data] C:\Windows\System32\Tasks\Microsoft\Windows\Wireless “GatherWirelessInfo” -> launches: “%windir%\system32\gatherWirelessInfo.vbs” [null data] C:\Windows\System32\Tasks\Microsoft\Windows Defender “MP Scheduled Scan” -> (HIDDEN!) launches: “c:\program files\windows defender\MpCmdRun.exe Scan -RestrictPrivileges” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\system32\NLAapi.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\system32\napinsp.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\system32\pnrpnsp.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\system32\pnrpnsp.dll” [MS] 000000000005\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000006\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: avsda.dll [file not found], 01 - 02, 13 %SystemRoot%\system32\mswsock.dll [MS], 03 - 12 Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Andrea ADI Filters Service, AEADIFilters, “C:\Windows\system32\AEADISRV.EXE” [“Andrea Electronics Corporation”] Ati External Event Utility, Ati External Event Utility, “C:\Windows\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] Autokonfiguracja sieci WLAN, Wlansvc, “C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted” {“C:\Windows\System32\wlansvc.dll” [MS]} Avira AntiVir Premium Guard, AntiVirService, ““C:\Program Files (x86)\Avira\AntiVir PersonalEdition Premium\avguard.exe”” [“Avira GmbH”] Avira AntiVir Premium MailGuard, AntiVirMailService, ““C:\Program Files (x86)\Avira\AntiVir PersonalEdition Premium\avmailc.exe”” [“Avira GmbH”] Avira AntiVir Premium MailGuard helper service, AVEService, ““C:\Program Files (x86)\Avira\AntiVir PersonalEdition Premium\avesvc.exe”” [“Avira GmbH”] Avira AntiVir Premium Scheduler, AntiVirScheduler, ““C:\Program Files (x86)\Avira\AntiVir PersonalEdition Premium\sched.exe”” [“Avira GmbH”] Izolacja klucza CNG, KeyIso, “C:\Windows\system32\lsass.exe” [MS] Protokół uwierzytelniania rozszerzonego (EAP), EapHost, “C:\Windows\System32\svchost.exe -k netsvcs” {“C:\Windows\System32\eapsvc.dll” [MS]} Przeglądarka komputera, Browser, “C:\Windows\System32\svchost.exe -k netsvcs” {“C:\Windows\System32\browser.dll” [MS]} Usługa powiadamiania SL UI, SLUINotify, “C:\Windows\system32\svchost.exe -k LocalService” {“C:\Windows\system32\SLUINotify.dll” [MS]} Usługa Protokół SSTP, SstpSvc, “C:\Windows\system32\svchost.exe -k LocalService” {“C:\Windows\system32\sstpsvc.dll” [MS]} Windows Driver Foundation — User-mode Driver Framework, wudfsvc, “C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted” {“C:\Windows\System32\WUDFSvc.dll” [MS]} ---------- (launch time: 2009-03-01 16:09:56) <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 27 seconds, including 11 seconds for message boxes)
