HijackThis,GMER,Silent Runners


(Yarekbp) #1

Usunalem ostatnio kilka smieci i prosze o sprawdzenie logow czy wszystko OK :slight_smile:

GMER 1.0.10.10122 - http://www.gmer.net

Rootkit 2006-08-02 01:31:04

Windows 5.1.2600 Dodatek Service Pack 2



---- System - GMER 1.0.10 ----


SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwClose

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateProcess

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateProcessEx

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateSection

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateSymbolicLinkObject

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateThread

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDeleteKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDeleteValueKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDuplicateObject

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwEnumerateKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwEnumerateValueKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwFlushKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwInitializeRegistry

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwLoadKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwLoadKey2

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwNotifyChangeKey

SSDT kl1.sys ZwOpenFile

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenProcess

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenSection

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryMultipleValueKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQuerySystemInformation

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryValueKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwReplaceKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwRestoreKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwResumeThread

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSaveKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetContextThread

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationFile

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationProcess

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetSecurityObject

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetValueKey

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSuspendThread

SSDT \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS ZwTerminateProcess

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwUnloadKey

SSDT \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS ZwWriteVirtualMemory

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[284]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[285]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[286]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[287]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[288]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[289]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[290]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[291]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[292]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[293]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[294]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[295]

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[296]


---- Devices - GMER 1.0.10 ----


Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 82077E90

Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CREATE 82379E30

Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 823C5808

Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 823C5808

Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 823C5808

Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 823C5808

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 823C5A40

Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 823C5A40

Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 81CFE310

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_NAMED_PIPE 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLOSEIRP_MJ_READ 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_WRITE 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_INFORMATION 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_INFORMATION 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_EA 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_EA 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FLUSH_BUFFERS 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_VOLUME_INFORMATION 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_VOLUME_INFORMATION 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DIRECTORY_CONTROL 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FILE_SYSTEM_CONTROL 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CONTROL 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_INTERNAL_DEVICE_CONTROL 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SHUTDOWN 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_LOCK_CONTROL 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLEANUP 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_MAILSLOT 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_SECURITY 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_SECURITY 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_POWER 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SYSTEM_CONTROL 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CHANGE 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_QUOTA 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_QUOTA 820130E8

Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_PNP 820130E8

Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 81CFE310

Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CREATE 823C5A40

Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 81CFE310

Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_CREATE 823C5A40

Device \Driver\Ftdisk \Device\HarddiskVolume5 IRP_MJ_CREATE 823C5A40

Device \Driver\Ftdisk \Device\HarddiskVolume6 IRP_MJ_CREATE 823C5A40

Device \Driver\Ftdisk \Device\HarddiskVolume7 IRP_MJ_CREATE 823C5A40

Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 81FDBEB0

Device \Driver\nvatabus \Device\00000079 IRP_MJ_CREATE 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_CREATE_NAMED_PIPE 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_CLOSEIRP_MJ_READ 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_WRITE 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_QUERY_INFORMATION 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_SET_INFORMATION 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_QUERY_EA 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_SET_EA 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_FLUSH_BUFFERS 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_QUERY_VOLUME_INFORMATION 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_SET_VOLUME_INFORMATION 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_DIRECTORY_CONTROL 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_FILE_SYSTEM_CONTROL 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_DEVICE_CONTROL 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_INTERNAL_DEVICE_CONTROL 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys

Device \Driver\nvatabus \Device\00000079 IRP_MJ_LOCK_CONTROL 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_CLEANUP 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_CREATE_MAILSLOT 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_QUERY_SECURITY 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_SET_SECURITY 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_POWER 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_SYSTEM_CONTROL 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_DEVICE_CHANGE 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_QUERY_QUOTA 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_SET_QUOTA 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_PNP 823C5298

Device \Driver\nvatabus \Device\00000079 IRP_MJ_PNP_POWER 823C5298

Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 81FDBEB0

Device \Driver\00000064 \Device\0000005b IRP_MJ_SYSTEM_CONTROL [F8451EA8] sptd.sys

Device \Driver\00000064 \Device\0000005b IRP_MJ_DEVICE_CHANGE [F8465A70] sptd.sys

Device \Driver\00000064 \Device\0000005b IRP_MJ_PNP_POWER [F845E728] sptd.sys

Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CREATE 823790E8

Device \Driver\NetBT \Device\NetBT_Tcpip_{13A16E71-89CE-489F-96E4-803EFAA7CF87} IRP_MJ_CREATE 81FDBEB0

Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_CREATE 823790E8

Device \Driver\nvatabus \Device\0000007a IRP_MJ_CREATE 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_CREATE_NAMED_PIPE 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_CLOSEIRP_MJ_READ 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_WRITE 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_QUERY_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_SET_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_QUERY_EA 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_SET_EA 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_FLUSH_BUFFERS 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_QUERY_VOLUME_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_SET_VOLUME_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_DIRECTORY_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_FILE_SYSTEM_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_DEVICE_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_INTERNAL_DEVICE_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys

Device \Driver\nvatabus \Device\0000007a IRP_MJ_LOCK_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_CLEANUP 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_CREATE_MAILSLOT 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_QUERY_SECURITY 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_SET_SECURITY 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_POWER 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_SYSTEM_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_DEVICE_CHANGE 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_QUERY_QUOTA 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_SET_QUOTA 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_PNP 823C5298

Device \Driver\nvatabus \Device\0000007a IRP_MJ_PNP_POWER 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CREATE 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CREATE_NAMED_PIPE 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CLOSEIRP_MJ_READ 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_WRITE 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_INFORMATION 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_INFORMATION 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_EA 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_EA 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_FLUSH_BUFFERS 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_VOLUME_INFORMATION 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_VOLUME_INFORMATION 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_DIRECTORY_CONTROL 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_FILE_SYSTEM_CONTROL 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_DEVICE_CONTROL 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_INTERNAL_DEVICE_CONTROL 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_LOCK_CONTROL 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CLEANUP 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CREATE_MAILSLOT 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_SECURITY 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_SECURITY 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_POWER 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SYSTEM_CONTROL 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_DEVICE_CHANGE 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_QUOTA 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_QUOTA 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_PNP 823C5298

Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_PNP_POWER 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_CREATE 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_CREATE_NAMED_PIPE 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_CLOSEIRP_MJ_READ 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_WRITE 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_QUERY_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_SET_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_QUERY_EA 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_SET_EA 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_FLUSH_BUFFERS 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_QUERY_VOLUME_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_SET_VOLUME_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_DIRECTORY_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_FILE_SYSTEM_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_DEVICE_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_INTERNAL_DEVICE_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys

Device \Driver\nvatabus \Device\0000007b IRP_MJ_LOCK_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_CLEANUP 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_CREATE_MAILSLOT 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_QUERY_SECURITY 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_SET_SECURITY 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_POWER 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_SYSTEM_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_DEVICE_CHANGE 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_QUERY_QUOTA 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_SET_QUOTA 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_PNP 823C5298

Device \Driver\nvatabus \Device\0000007b IRP_MJ_PNP_POWER 823C5298

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSEIRP_MJ_READ 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP 820180E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP_POWER 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_NAMED_PIPE 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLOSEIRP_MJ_READ 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_WRITE 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_INFORMATION 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_INFORMATION 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_EA 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_EA 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FLUSH_BUFFERS 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_VOLUME_INFORMATION 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_VOLUME_INFORMATION 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DIRECTORY_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FILE_SYSTEM_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_INTERNAL_DEVICE_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SHUTDOWN 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_LOCK_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLEANUP 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_MAILSLOT 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_SECURITY 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_SECURITY 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_POWER 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SYSTEM_CONTROL 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CHANGE 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_QUOTA 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_QUOTA 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP 820180E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP_POWER 820180E8

Device \Driver\nvatabus \Device\0000007c IRP_MJ_CREATE 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_CREATE_NAMED_PIPE 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_CLOSEIRP_MJ_READ 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_WRITE 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_QUERY_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_SET_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_QUERY_EA 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_SET_EA 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_FLUSH_BUFFERS 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_QUERY_VOLUME_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_SET_VOLUME_INFORMATION 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_DIRECTORY_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_FILE_SYSTEM_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_DEVICE_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_INTERNAL_DEVICE_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys

Device \Driver\nvatabus \Device\0000007c IRP_MJ_LOCK_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_CLEANUP 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_CREATE_MAILSLOT 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_QUERY_SECURITY 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_SET_SECURITY 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_POWER 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_SYSTEM_CONTROL 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_DEVICE_CHANGE 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_QUERY_QUOTA 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_SET_QUOTA 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_PNP 823C5298

Device \Driver\nvatabus \Device\0000007c IRP_MJ_PNP_POWER 823C5298

Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE 8200E0E8

Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE_NAMED_PIPE 8200E0E8

Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CLOSEIRP_MJ_READ 8200E0E8

Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_WRITE 8200E0E8

Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_INFORMATION 8200E0E8

Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_SET_INFORMATION 8200E0E8

Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_EA 8200E0E8

Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CREATE 823C5A40

Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CREATE 81FE70E8

Device \Driver\dtscsi \Device\Scsi\dtscsi1Port1Path0Target0Lun0 IRP_MJ_CREATE 821E97C0

Device \Driver\dtscsi \Device\Scsi\dtscsi1Port1Path0Target0Lun0 IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys

Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_CREATE 821E97C0

Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_SHUTDOWN [F856795C] sfsync03.sys

Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE 82379E30

Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE 81F18C18


---- Files - GMER 1.0.10 ----


File D:\System Volume Information\MountPointManagerRemoteDatabase                            

File D:\System Volume Information\tracking.log                                               

File E:\System Volume Information\MountPointManagerRemoteDatabase                            

File E:\System Volume Information\tracking.log                                               

File F:\System Volume Information\MountPointManagerRemoteDatabase                            

File F:\System Volume Information\tracking.log                                               

File G:\System Volume Information\MountPointManagerRemoteDatabase                            

File G:\System Volume Information\tracking.log                                               


---- EOF - GMER 1.0.10 ----

Logfile of HijackThis v1.99.1

Scan saved at 01:37:23, on 2006-08-02

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Agnitum\Outpost Firewall\outpost.exe

C:\WINDOWS\Explorer.EXE

D:\Programy\DAEMON Tools\daemon.exe

D:\Programy\Gadu-Gadu\gg.exe

D:\Programy\NetMeter\NetMeter.exe

D:\Programy\BitComet\BitComet.exe

D:\Programy\Firefox\firefox.exe

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\Documents and Settings\Jarek\Pulpit\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O4 - HKLM\..\Run: [DAEMON Tools] "D:\Programy\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"

O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice

O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Programy\Gadu-Gadu\gg.exe" /tray

O4 - HKCU\..\Run: [D] D:\Programy\NetMeter\NetMeter.exe

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Programy\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - D:\Programy\FlashGet\jc_link.htm

O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - D:\Programy\FlashGet\jc_all.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programy\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Programy\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Programy\FlashGet\flashget.exe

O15 - Trusted Zone: http://www.mks.com.pl

O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152891455640

O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab

O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll

O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"



Startup items buried in registry:

---------------------------------


HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"Gadu-Gadu" = ""D:\Programy\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"]

"D:\Programy\NetMeter\NetMeter.exe" = "D:\Programy\NetMeter\NetMeter.exe" [null data]


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"DAEMON Tools" = ""D:\Programy\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."]

"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]

"kav" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"" ["Kaspersky Lab"]

"(Default)" = (empty string)

"Outpost Firewall" = "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice" ["Agnitum Ltd."]


HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "AcroIEHlprObj Class"

                   \InProcServer32\(Default) = "D:\Programy\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "SSVHelper Class"

                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]


HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"

  -> {HKLM...CLSID} = "Shell Search Band"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]

"{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References"

  -> {HKLM...CLSID} = "ShellLink for Application References"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]

"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References"

  -> {HKLM...CLSID} = "Shell Icon Handler for Application References"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]

"{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Ochrona WWW"

  -> {HKLM...CLSID} = "Ochrona WWW"

                   \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll" ["Kaspersky Lab"]


HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

INFECTION WARNING! klogon\DLLName = "C:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"]


HKLM\Software\Classes\PROTOCOLS\Filter\

INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]


HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"

  -> {HKLM...CLSID} = "PDF Shell Extension"

                   \InProcServer32\(Default) = "D:\Programy\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]


HKLM\Software\Classes\*\shellex\ContextMenuHandlers\

Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll" ["Kaspersky Lab"]

TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"

  -> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"

                   \InProcServer32\(Default) = ""D:\Programy\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "D:\Programy\WinRAR\rarext.dll" [null data]


HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"

  -> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"

                   \InProcServer32\(Default) = ""D:\Programy\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "D:\Programy\WinRAR\rarext.dll" [null data]


HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll" ["Kaspersky Lab"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "D:\Programy\WinRAR\rarext.dll" [null data]



Active Desktop and Wallpaper:

-----------------------------


Active Desktop is disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState


HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\Documents and Settings\Jarek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"



Enabled Screen Saver:

---------------------


HKCU\Control Panel\Desktop\

"SCRNSAVE.EXE" = "C:\WINDOWS\system32\LONGHORN.SCR" [MS]



Enabled Scheduled Tasks:

------------------------


"1-Click Maintenance" -> launches: "D:\Programy\TuneUp Utilities 2006\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]



Winsock2 Service Provider DLLs:

-------------------------------


Namespace Service Providers


HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]


Transport Service Providers


HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05



Toolbars, Explorer Bars, Extensions:

------------------------------------


Explorer Bars


HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\

{21569614-B795-46B1-85F4-E737A8DC09AD}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "Shell Search Band"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]


Extensions (Tools menu items, main toolbar menu buttons)


HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Sun Java Console"

"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"

  -> {HKCU...CLSID} = "Java Plug-in"

                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

  -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"

                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]


{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\

"ButtonText" = "Ochrona WWW"


{92780B25-18CC-41C8-B9BE-3C9C571A8263}\

"ButtonText" = "Badanie"


{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\

"ButtonText" = "FlashGet"

"MenuText" = "&FlashGet"

"Exec" = "D:\Programy\FlashGet\flashget.exe" ["FlashGet.com"]



Miscellaneous IE Hijack Points

------------------------------


HKLM\Software\Microsoft\Internet Explorer\AboutURLs\


Missing lines (compared with English-language version):

HIJACK WARNING! "TuneUp" = "file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css" [file not found]



Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------


Kaspersky Anti-Virus 6.0, AVP, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r" ["Kaspersky Lab"]

NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]

Outpost Firewall Service, OutpostFirewall, "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /service" ["Agnitum Ltd."]

Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]



Print Monitors:

---------------


HKLM\System\CurrentControlSet\Control\Print\Monitors\

PrimoMon\Driver = "Primomonnt.dll" [null data]



----------

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

  launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

  DLL launch points and all Registry CLSIDs for dormant Explorer Bars,

  use the -supp parameter or answer "No" at the first message box.

---------- (total run time: 17 seconds, including 3 seconds for message boxes)

(Gutek) #2

Jest czysto, ale na przyszłość poczytaj - TEN TEMAT


(Yarekbp) #3

Ok, o temacie bede pamietal :slight_smile:

Mam jeszcze dwa pytania. W HJK pojawil mi sie taki wpis:

O20 - AppInit_DLLs: C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll

co to jest? Wczesniej nie mialem tego ;]

I drugie pytanie: Gadu Gadu i plik ggwhook.dll . W firewallu podlacza sie pod wiekszosc programow jako komponent? Nic w tym zlego nie ma? ;>


(Gutek) #4

to wpis od Outpost Firewall

  • zostaw jest Ok

(Yarekbp) #5

No wiem, tylko sie dziwne mi wydalo czemu sie pojawilo to dopiero teraz jak juz jakis czas zainstalowany jest :]