Usunalem ostatnio kilka smieci i prosze o sprawdzenie logow czy wszystko OK 
GMER 1.0.10.10122 - http://www.gmer.net
Rootkit 2006-08-02 01:31:04
Windows 5.1.2600 Dodatek Service Pack 2
---- System - GMER 1.0.10 ----
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwClose
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateProcessEx
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateSection
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateSymbolicLinkObject
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDeleteKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDeleteValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDuplicateObject
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwEnumerateKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwEnumerateValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwFlushKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwInitializeRegistry
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwLoadKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwLoadKey2
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwNotifyChangeKey
SSDT kl1.sys ZwOpenFile
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenSection
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryMultipleValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQuerySystemInformation
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwReplaceKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwRestoreKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwResumeThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSaveKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetContextThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationFile
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetSecurityObject
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSuspendThread
SSDT \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS ZwTerminateProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwUnloadKey
SSDT \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS ZwWriteVirtualMemory
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[284]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[285]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[286]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[287]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[288]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[289]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[290]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[291]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[292]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[293]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[294]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[295]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[296]
---- Devices - GMER 1.0.10 ----
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 82077E90
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CREATE 82379E30
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 823C5808
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 823C5808
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 823C5808
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 823C5808
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 823C5A40
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 823C5A40
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 81CFE310
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_NAMED_PIPE 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLOSEIRP_MJ_READ 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_WRITE 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_INFORMATION 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_INFORMATION 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_EA 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_EA 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FLUSH_BUFFERS 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_VOLUME_INFORMATION 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_VOLUME_INFORMATION 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DIRECTORY_CONTROL 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FILE_SYSTEM_CONTROL 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CONTROL 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_INTERNAL_DEVICE_CONTROL 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SHUTDOWN 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_LOCK_CONTROL 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLEANUP 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_MAILSLOT 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_SECURITY 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_SECURITY 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_POWER 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SYSTEM_CONTROL 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CHANGE 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_QUOTA 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_QUOTA 820130E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_PNP 820130E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 81CFE310
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CREATE 823C5A40
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 81CFE310
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_CREATE 823C5A40
Device \Driver\Ftdisk \Device\HarddiskVolume5 IRP_MJ_CREATE 823C5A40
Device \Driver\Ftdisk \Device\HarddiskVolume6 IRP_MJ_CREATE 823C5A40
Device \Driver\Ftdisk \Device\HarddiskVolume7 IRP_MJ_CREATE 823C5A40
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 81FDBEB0
Device \Driver\nvatabus \Device\00000079 IRP_MJ_CREATE 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_CREATE_NAMED_PIPE 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_CLOSEIRP_MJ_READ 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_WRITE 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_QUERY_INFORMATION 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_SET_INFORMATION 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_QUERY_EA 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_SET_EA 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_FLUSH_BUFFERS 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_QUERY_VOLUME_INFORMATION 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_SET_VOLUME_INFORMATION 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_DIRECTORY_CONTROL 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_FILE_SYSTEM_CONTROL 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_DEVICE_CONTROL 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_INTERNAL_DEVICE_CONTROL 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys
Device \Driver\nvatabus \Device\00000079 IRP_MJ_LOCK_CONTROL 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_CLEANUP 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_CREATE_MAILSLOT 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_QUERY_SECURITY 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_SET_SECURITY 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_POWER 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_SYSTEM_CONTROL 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_DEVICE_CHANGE 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_QUERY_QUOTA 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_SET_QUOTA 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_PNP 823C5298
Device \Driver\nvatabus \Device\00000079 IRP_MJ_PNP_POWER 823C5298
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 81FDBEB0
Device \Driver\00000064 \Device\0000005b IRP_MJ_SYSTEM_CONTROL [F8451EA8] sptd.sys
Device \Driver\00000064 \Device\0000005b IRP_MJ_DEVICE_CHANGE [F8465A70] sptd.sys
Device \Driver\00000064 \Device\0000005b IRP_MJ_PNP_POWER [F845E728] sptd.sys
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CREATE 823790E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{13A16E71-89CE-489F-96E4-803EFAA7CF87} IRP_MJ_CREATE 81FDBEB0
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_CREATE 823790E8
Device \Driver\nvatabus \Device\0000007a IRP_MJ_CREATE 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_CREATE_NAMED_PIPE 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_CLOSEIRP_MJ_READ 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_WRITE 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_QUERY_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_SET_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_QUERY_EA 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_SET_EA 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_FLUSH_BUFFERS 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_QUERY_VOLUME_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_SET_VOLUME_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_DIRECTORY_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_FILE_SYSTEM_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_DEVICE_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_INTERNAL_DEVICE_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys
Device \Driver\nvatabus \Device\0000007a IRP_MJ_LOCK_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_CLEANUP 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_CREATE_MAILSLOT 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_QUERY_SECURITY 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_SET_SECURITY 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_POWER 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_SYSTEM_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_DEVICE_CHANGE 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_QUERY_QUOTA 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_SET_QUOTA 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_PNP 823C5298
Device \Driver\nvatabus \Device\0000007a IRP_MJ_PNP_POWER 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CREATE 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CREATE_NAMED_PIPE 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CLOSEIRP_MJ_READ 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_WRITE 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_INFORMATION 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_INFORMATION 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_EA 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_EA 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_FLUSH_BUFFERS 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_VOLUME_INFORMATION 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_VOLUME_INFORMATION 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_DIRECTORY_CONTROL 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_FILE_SYSTEM_CONTROL 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_DEVICE_CONTROL 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_INTERNAL_DEVICE_CONTROL 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_LOCK_CONTROL 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CLEANUP 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CREATE_MAILSLOT 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_SECURITY 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_SECURITY 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_POWER 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SYSTEM_CONTROL 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_DEVICE_CHANGE 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_QUOTA 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_QUOTA 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_PNP 823C5298
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_PNP_POWER 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_CREATE 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_CREATE_NAMED_PIPE 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_CLOSEIRP_MJ_READ 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_WRITE 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_QUERY_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_SET_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_QUERY_EA 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_SET_EA 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_FLUSH_BUFFERS 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_QUERY_VOLUME_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_SET_VOLUME_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_DIRECTORY_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_FILE_SYSTEM_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_DEVICE_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_INTERNAL_DEVICE_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys
Device \Driver\nvatabus \Device\0000007b IRP_MJ_LOCK_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_CLEANUP 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_CREATE_MAILSLOT 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_QUERY_SECURITY 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_SET_SECURITY 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_POWER 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_SYSTEM_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_DEVICE_CHANGE 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_QUERY_QUOTA 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_SET_QUOTA 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_PNP 823C5298
Device \Driver\nvatabus \Device\0000007b IRP_MJ_PNP_POWER 823C5298
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSEIRP_MJ_READ 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP 820180E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP_POWER 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_NAMED_PIPE 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLOSEIRP_MJ_READ 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_WRITE 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_INFORMATION 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_INFORMATION 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_EA 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_EA 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FLUSH_BUFFERS 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_VOLUME_INFORMATION 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_VOLUME_INFORMATION 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DIRECTORY_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FILE_SYSTEM_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_INTERNAL_DEVICE_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SHUTDOWN 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_LOCK_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLEANUP 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_MAILSLOT 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_SECURITY 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_SECURITY 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_POWER 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SYSTEM_CONTROL 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CHANGE 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_QUOTA 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_QUOTA 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP 820180E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP_POWER 820180E8
Device \Driver\nvatabus \Device\0000007c IRP_MJ_CREATE 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_CREATE_NAMED_PIPE 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_CLOSEIRP_MJ_READ 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_WRITE 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_QUERY_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_SET_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_QUERY_EA 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_SET_EA 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_FLUSH_BUFFERS 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_QUERY_VOLUME_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_SET_VOLUME_INFORMATION 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_DIRECTORY_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_FILE_SYSTEM_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_DEVICE_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_INTERNAL_DEVICE_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys
Device \Driver\nvatabus \Device\0000007c IRP_MJ_LOCK_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_CLEANUP 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_CREATE_MAILSLOT 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_QUERY_SECURITY 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_SET_SECURITY 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_POWER 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_SYSTEM_CONTROL 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_DEVICE_CHANGE 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_QUERY_QUOTA 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_SET_QUOTA 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_PNP 823C5298
Device \Driver\nvatabus \Device\0000007c IRP_MJ_PNP_POWER 823C5298
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE 8200E0E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE_NAMED_PIPE 8200E0E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CLOSEIRP_MJ_READ 8200E0E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_WRITE 8200E0E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_INFORMATION 8200E0E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_SET_INFORMATION 8200E0E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_EA 8200E0E8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CREATE 823C5A40
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CREATE 81FE70E8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port1Path0Target0Lun0 IRP_MJ_CREATE 821E97C0
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port1Path0Target0Lun0 IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys
Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_CREATE 821E97C0
Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys
Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE 82379E30
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE 81F18C18
---- Files - GMER 1.0.10 ----
File D:\System Volume Information\MountPointManagerRemoteDatabase
File D:\System Volume Information\tracking.log
File E:\System Volume Information\MountPointManagerRemoteDatabase
File E:\System Volume Information\tracking.log
File F:\System Volume Information\MountPointManagerRemoteDatabase
File F:\System Volume Information\tracking.log
File G:\System Volume Information\MountPointManagerRemoteDatabase
File G:\System Volume Information\tracking.log
---- EOF - GMER 1.0.10 ----
Logfile of HijackThis v1.99.1
Scan saved at 01:37:23, on 2006-08-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\WINDOWS\Explorer.EXE
D:\Programy\DAEMON Tools\daemon.exe
D:\Programy\Gadu-Gadu\gg.exe
D:\Programy\NetMeter\NetMeter.exe
D:\Programy\BitComet\BitComet.exe
D:\Programy\Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Documents and Settings\Jarek\Pulpit\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Programy\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [D] D:\Programy\NetMeter\NetMeter.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Programy\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - D:\Programy\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - D:\Programy\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programy\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Programy\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Programy\FlashGet\flashget.exe
O15 - Trusted Zone: http://www.mks.com.pl
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152891455640
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""D:\Programy\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"]
"D:\Programy\NetMeter\NetMeter.exe" = "D:\Programy\NetMeter\NetMeter.exe" [null data]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"DAEMON Tools" = ""D:\Programy\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"kav" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"" ["Kaspersky Lab"]
"(Default)" = (empty string)
"Outpost Firewall" = "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice" ["Agnitum Ltd."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "D:\Programy\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References"
-> {HKLM...CLSID} = "ShellLink for Application References"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References"
-> {HKLM...CLSID} = "Shell Icon Handler for Application References"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Ochrona WWW"
-> {HKLM...CLSID} = "Ochrona WWW"
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll" ["Kaspersky Lab"]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! klogon\DLLName = "C:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"]
HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]
HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "D:\Programy\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll" ["Kaspersky Lab"]
TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
\InProcServer32\(Default) = ""D:\Programy\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programy\WinRAR\rarext.dll" [null data]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
\InProcServer32\(Default) = ""D:\Programy\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programy\WinRAR\rarext.dll" [null data]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programy\WinRAR\rarext.dll" [null data]
Active Desktop and Wallpaper:
-----------------------------
Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Jarek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Enabled Screen Saver:
---------------------
HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\LONGHORN.SCR" [MS]
Enabled Scheduled Tasks:
------------------------
"1-Click Maintenance" -> launches: "D:\Programy\TuneUp Utilities 2006\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Explorer Bars
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\
{21569614-B795-46B1-85F4-E737A8DC09AD}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\
"ButtonText" = "Ochrona WWW"
{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"
{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "D:\Programy\FlashGet\flashget.exe" ["FlashGet.com"]
Miscellaneous IE Hijack Points
------------------------------
HKLM\Software\Microsoft\Internet Explorer\AboutURLs\
Missing lines (compared with English-language version):
HIJACK WARNING! "TuneUp" = "file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css" [file not found]
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
Kaspersky Anti-Virus 6.0, AVP, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r" ["Kaspersky Lab"]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Outpost Firewall Service, OutpostFirewall, "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /service" ["Agnitum Ltd."]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
Print Monitors:
---------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
PrimoMon\Driver = "Primomonnt.dll" [null data]
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 17 seconds, including 3 seconds for message boxes)