Podejżewam reklamiarza

Bolo92 · 5 Wrzesień 2007 13:13

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:10:46, on 2007-09-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\acs.exe C:\Program Files\AOL\Active Virus Shield\avp.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe C:\Program Files\TP-LINK\TWCU\TWCU.exe C:\Program Files\DU Meter\DUMeter.exe C:\Program Files\SmartDefrag\IObit SmartDefrag.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\AOL\Active Virus Shield\avp.exe C:\PROGRA~1\WapSter\AQQ\AQQ.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\Opera\Opera.exe E:\Tibia\Tibia.exe C:\Program Files\Tibia Auto\tibiaauto.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 217.153.219.170 L2authd.lineage2.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O4 - HKLM…\Run: [TWCU] “C:\Program Files\TP-LINK\TWCU\TWCU.exe” -nogui O4 - HKLM…\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM…\Run: [smartDefrag] “C:\Program Files\SmartDefrag\IObit SmartDefrag.exe” /startup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [ZoneAlarm Client] “C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKLM…\Run: [AVP] “C:\Program Files\AOL\Active Virus Shield\avp.exe” O4 - HKCU…\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra ‘Tools’ menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra ‘Tools’ menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip…{E1FEF5F7-D9C4-45C8-9AEB-293E5DF9826E}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\JiWire\BOT Mapping\Skype4COM.dll (file missing) O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe O23 - Service: Active Virus Shield (AVP) - Kaspersky Lab - C:\Program Files\AOL\Active Virus Shield\avp.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WPS Scanner Service (WPSScannerSvc) - Skyhook Wireless - C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe – End of file - 6813 bytes

“Silent Runners.vbs”, revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “AQQ” = “C:\PROGRA~1\WapSter\AQQ\AQQ.exe” [“AQQ Sp. z o.o.”] “Odkurzacz-MCD” = “C:\Program Files\Odkurzacz\odk_mcd.exe” [“Franmo Software”] “Steam” = “(empty string)” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “TWCU” = ““C:\Program Files\TP-LINK\TWCU\TWCU.exe” -nogui” [empty string] “DU Meter” = “C:\Program Files\DU Meter\DUMeter.exe” [“Hagel Technologies”] “SmartDefrag” = ““C:\Program Files\SmartDefrag\IObit SmartDefrag.exe” /startup” [null data] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “ZoneAlarm Client” = ““C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe”” [“Zone Labs, LLC”] “AVP” = ““C:\Program Files\AOL\Active Virus Shield\avp.exe”” [“Kaspersky Lab”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}(Default) = “flashget urlcatch” -> {HKLM…CLSID} = “FGCatchUrl” \InProcServer32(Default) = “C:\Program Files\FlashGet\jccatch.dll” [“www.flashget.com”] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}(Default) = “BitComet ClickCapture” -> {HKLM…CLSID} = “BitComet Helper” \InProcServer32(Default) = “C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll” [“BitComet”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”] {F156768E-81EF-470C-9057-481BA8380DBA}(Default) = (no title provided) -> {HKLM…CLSID} = “FlashGet GetFlash Class” \InProcServer32(Default) = “C:\Program Files\FlashGet\getflash.dll” [“www.flashget.com”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}” = “TuneUp Shredder Shell Extension” -> {HKLM…CLSID} = “TuneUp Shredder Shell Extension” \InProcServer32(Default) = “C:\Program Files\TuneUp Utilities 2006\SDShelEx-win32.dll” [“TuneUp Software GmbH”] “{44440D00-FF19-4AFC-B765-9A0970567D97}” = “TuneUp Theme Extension” -> {HKLM…CLSID} = “TuneUp Theme Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\uxtuneup.dll” [“TuneUp Software GmbH”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}” = “NeroCoverEd Live Icons” -> {HKLM…CLSID} = “NeroCoverEdLiveIcons Class” \InProcServer32(Default) = “C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll” [“Nero AG”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{D9872D13-7651-4471-9EEE-F0A00218BEBB}” = “Multiscan” -> {HKLM…CLSID} = “ZLAVShExt Class” \InProcServer32(Default) = “C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll” [“Zone Labs, LLC”] “{8A56567E-A333-4843-B6E1-C3A262E41D8C}” = “HashTab Property Page” -> {HKLM…CLSID} = “HashPage Class” \InProcServer32(Default) = “C:\Program Files\HashTab Shell Extension\HashTab.dll” [“Beeblebrox.org”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> klogon\DLLName = “C:\WINDOWS\system32\klogon.dll” [“Kaspersky Lab”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ Cover Designer(Default) = “{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}” -> {HKLM…CLSID} = “NeroCoverEdContextMenu Class” \InProcServer32(Default) = “C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll” [“Nero AG”] Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\AOL\Active Virus Shield\ShellEx.dll” [“Kaspersky Lab”] Notepad++(Default) = “{120B94B5-2E6A-4F13-94D0-414BCB64FA0F}” -> {HKLM…CLSID} = “Notepad++” \InProcServer32(Default) = “C:\Program Files\Notepad++\nppcm.dll” [“Burgaud.com”] TuneUp Shredder Shell Extension(Default) = “{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}” -> {HKLM…CLSID} = “TuneUp Shredder Shell Extension” \InProcServer32(Default) = “C:\Program Files\TuneUp Utilities 2006\SDShelEx-win32.dll” [“TuneUp Software GmbH”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] ZLAVShExt(Default) = “{D9872D13-7651-4471-9EEE-F0A00218BEBB}” -> {HKLM…CLSID} = “ZLAVShExt Class” \InProcServer32(Default) = “C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll” [“Zone Labs, LLC”] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ TuneUp Shredder Shell Extension(Default) = “{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}” -> {HKLM…CLSID} = “TuneUp Shredder Shell Extension” \InProcServer32(Default) = “C:\Program Files\TuneUp Utilities 2006\SDShelEx-win32.dll” [“TuneUp Software GmbH”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] {D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}(Default) = “{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}” -> {HKLM…CLSID} = “Wyślij na Fotosik.pl” \InProcServer32(Default) = “C:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\AOL\Active Virus Shield\ShellEx.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] ZLAVShExt(Default) = “{D9872D13-7651-4471-9EEE-F0A00218BEBB}” -> {HKLM…CLSID} = “ZLAVShExt Class” \InProcServer32(Default) = “C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll” [“Zone Labs, LLC”] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoClose” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Bolek.BOLO\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\logon.scr” [MS] Startup items in “Bolek” & “All Users” startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Logitech SetPoint” -> shortcut to: “C:\Program Files\Logitech\SetPoint\SetPoint.exe” [“Logitech Inc.”] Enabled Scheduled Tasks: ------------------------ “1-Click Maintenance” -> launches: “C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe /schedulestart” [“TuneUp Software GmbH”] “SmartDefrag” -> launches: “C:\Program Files\SmartDefrag\schedule.exe “C:\Program Files\SmartDefrag\IObit SmartDefrag.exe”” [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “C:\Program Files\Bonjour\mdnsNSP.dll” [“Apple Computer, Inc.”] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{0D704FAD-66E9-4F0A-BFED-4F665770DDB3}” = (no title provided) -> {HKLM…CLSID} = “&Tłumaczenie” \InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{175556B1-4D91-4E9A-9C4B-D6888D5DEE6C}(Default) = “&Ramka Tłumaczenia” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] HKLM\Software\Classes\CLSID{D553F157-2AB0-4B46-98D2-7BA7CA418491}(Default) = “&Słownik Podręczny” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] HKLM\Software\Classes\CLSID{E7A829CC-671F-4C3D-B590-8C0AEA72E6B2}(Default) = “BitComet Search” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll” [“BitComet”] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {461CC20B-FB6E-4F16-8FE8-C29359DB100E}\ “ButtonText” = “BitComet Search” {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {B46B0919-62BA-4D99-A5C4-916B57A6805C}\ “MenuText” = “@C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103” “CLSIDExtension” = “{B46B0919-62BA-4D99-A5C4-916B57A6805C}” -> {HKLM…CLSID} = “InternetTranslatorProperties Class” \InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ “ButtonText” = “FlashGet” “MenuText” = “FlashGet” “Exec” = “C:\Program Files\FlashGet\FlashGet.exe” [“FlashGet.com”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Miscellaneous IE Hijack Points ------------------------------ HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ <> “Tabs” = “res://ieframe.dll/tabswelcome.htm” [file not found] <> “TuneUp” = “file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css” [file not found] HOSTS file ---------- C:\WINDOWS\System32\drivers\etc\HOSTS maps: 2 domain names to IP addresses, 1 of the IP addresses is *not* localhost! Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, ““C:\Program Files\Bonjour\mDNSResponder.exe”” [“Apple Computer, Inc.”] Active Virus Shield, AVP, ““C:\Program Files\AOL\Active Virus Shield\avp.exe” -r” [“Kaspersky Lab”] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] Pml Driver HPZ12, Pml Driver HPZ12, “C:\WINDOWS\system32\HPZipm12.exe” [“HP”] Publikowanie za pomocą usługi FTP, MSFtpsvc, “C:\WINDOWS\system32\inetsrv\inetinfo.exe” [MS] TP-LINK Configuration Service, ACS, “C:\WINDOWS\System32\acs.exe” [null data] TrueVector Internet Monitor, vsmon, “C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service” [“Zone Labs, LLC”] TuneUp Design Expansion, UxTuneUp, “C:\WINDOWS\System32\svchost.exe -k netsvcs” {“C:\WINDOWS\System32\uxtuneup.dll” [“TuneUp Software GmbH”]} Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] WPS Scanner Service, WPSScannerSvc, “C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe” [“Skyhook Wireless”] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ HP Standard TCP/IP Port\Driver = “HpTcpMon.dll” [“Hewlett Packard”] Language Monitor\Driver = “hpz3l3xu.dll” [“Hewlett-Packard Company”] Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- (launch time: 2007-09-05 15:11:39) <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 64 seconds, including 3 seconds for message boxes)

Combo

ComboFix 07-08-30.3 - “Bolek” 2007-09-05 15:27:25.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.365 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((( Files Created from 2007-08-05 to 2007-09-05 ))))))))))))))))))))))))))))))) 2007-09-05 15:26 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-09-05 15:10 2007-09-01 19:26 2007-08-30 12:46 2007-08-30 12:46 2007-08-30 12:46 2007-08-29 14:09 2007-08-26 22:28 2007-08-26 13:32 12,416 --a------ C:\WINDOWS\system32\drivers\wpsnuio.sys 2007-08-26 13:32 2007-08-26 13:32 2007-08-23 11:35 65,536 -ra------ C:\WINDOWS\system32\Audio3D.dll 2007-08-23 11:35 65,536 -ra------ C:\WINDOWS\system32\a3d.dll 2007-08-23 11:35 65,536 --a–c— C:\WINDOWS\system32\dllcache\a3d.dll 2007-08-23 10:50 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-08-23 10:50 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2007-08-20 00:09 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-08-20 00:09 2007-08-20 00:09 2007-08-19 18:32 2007-08-08 23:11 719,872 --a------ C:\WINDOWS\system32\devil.dll 2007-08-08 23:11 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll 2007-08-08 23:11 66,560 --a------ C:\WINDOWS\MOTA113.exe 2007-08-08 23:11 502,784 --a------ C:\WINDOWS\x2.64.exe 2007-08-08 23:11 394,240 --a------ C:\WINDOWS\system32\Smab.dll 2007-08-08 23:11 318,976 --a------ C:\WINDOWS\system32\avisynth.dll 2007-08-08 23:11 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll 2007-08-08 23:11 240,128 --a------ C:\WINDOWS\system32\x.264.exe 2007-08-08 23:11 217,073 --a------ C:\WINDOWS\meta4.exe 2007-08-08 23:10 2007-08-08 23:09 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll 2007-08-08 23:09 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll 2007-08-08 23:08 2007-08-08 20:50 2007-08-06 12:26 2007-08-05 23:08 2007-08-05 22:22 2007-08-05 22:20 2007-08-05 13:57 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-05 15:32 16126240 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-09-05 15:03 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\AOL 2007-09-04 21:34 --------- d-------- C:\Program Files\Tibia Auto 2007-09-03 20:54 --------- d-------- C:\Program Files\ALLPlayer 2007-09-02 12:04 --------- d-------- C:\Program Files\eMule 2007-08-31 13:32 --------- d-------- C:\Program Files\FlashGet 2007-08-31 13:29 --------- d-------- C:\Program Files\uTorrent 2007-08-31 04:11 219944 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-08-30 13:35 --------- d-------- C:\Program Files\WinPcap 2007-08-30 07:07 --------- d-------- C:\Program Files\Odkurzacz 2007-08-23 18:33 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-08-23 18:28 --------- d-------- C:\Program Files\Winamp 2007-08-23 18:27 --------- d-------- C:\Program Files\NAPI-PROJEKT 2007-08-23 18:27 --------- d-------- C:\Program Files\IrfanView 2007-08-23 18:27 --------- d-------- C:\Program Files\BitComet 2007-08-23 18:27 --------- d-------- C:\Program Files\AVIcodec 2007-08-18 20:04 --------- d-------- C:\Program Files\Opera 2007-08-12 23:32 --------- d-------- C:\Program Files\WapSter 2007-08-05 21:34 --------- d-------- C:\Program Files\HyCam2 2007-08-03 21:59 --------- d-------- C:\Program Files\Mozilla Thunderbird 2007-07-31 20:45 69632 --a------ C:\WINDOWS\system32\wshext.dll 2007-07-31 20:45 413696 --a------ C:\WINDOWS\system32\vbscript.dll 2007-07-31 20:45 36864 --a------ C:\WINDOWS\system32\wshcon.dll 2007-07-31 20:45 32768 --a------ C:\WINDOWS\system32\dispex.dll 2007-07-31 20:45 163840 --a------ C:\WINDOWS\system32\scrobj.dll 2007-07-31 20:45 155648 --a------ C:\WINDOWS\system32\scrrun.dll 2007-07-31 20:45 135168 --a------ C:\WINDOWS\system32\wscript.exe 2007-07-31 20:45 114688 --a------ C:\WINDOWS\system32\cscript.exe 2007-07-30 20:06 --------- d-------- C:\Program Files\Common Files\Thraex Software 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-30 13:45 75932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-07-30 13:45 74396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-07-30 13:45 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\MailFrontier 2007-07-29 23:14 --------- d-------- C:\Program Files\Realtek AC97 2007-07-29 23:14 --------- d-------- C:\Program Files\AvRack 2007-07-29 20:38 --------- d-------- C:\Program Files\MoorHunt 2007-07-29 14:43 --------- d-------- C:\Program Files\SubEdit-Player 2007-07-29 14:36 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\FLEXnet 2007-07-29 13:17 --------- d-------- C:\Program Files\Bonjour 2007-07-29 13:04 --------- d-------- C:\Program Files\Common Files\Macrovision Shared 2007-07-29 12:45 47312 --a------ C:\WINDOWS\system32\drivers\MiniIcpt.sys 2007-07-28 11:38 --------- d-------- C:\Program Files\WellGet 2007-07-26 17:14 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles 2007-07-26 16:48 --------- d-------- C:\Program Files\netcut 2007-07-26 16:47 --------- d-------- C:\Program Files\Network Stumbler 2007-07-25 13:48 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-07-24 15:59 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys 2007-07-23 19:11 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\NVIDIA 2007-07-23 00:13 --------- d-------- C:\Program Files\Screamer Radio 2007-07-22 11:54 --------- d-------- C:\Program Files\Lavalys 2007-07-21 23:50 --------- d-------- C:\Program Files\Aspell 2007-07-21 17:20 --------- d-------- C:\Program Files\Real Alternative 2007-07-21 17:20 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-07-18 15:41 --------- d-------- C:\Program Files\Common Files\Ahead 2007-07-18 15:40 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Nero 2007-07-17 22:12 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-07-17 13:37 --------- d-------- C:\Program Files\RALINK 2007-07-16 21:15 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-07-14 11:12 --------- d-------- C:\Program Files\Techland 2007-07-08 18:34 --------- d-------- C:\Program Files\Electronic Arts 2007-06-30 22:55 2321408 --a------ C:\WINDOWS\system32\TUKernel.exe 2007-06-27 19:05 972072 --a------ C:\WINDOWS\UNNeroMediaHome.exe 2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-21 21:54 75248 --a------ C:\WINDOWS\zllsputility.exe 2007-06-21 21:54 1086952 --a------ C:\WINDOWS\system32\zpeng24.dll 2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2007-06-13 15:23 1034752 --a------ C:\WINDOWS\explorer.exe 2007-06-12 19:54 86016 --a------ C:\WINDOWS\system32\airpcap.dll 2007-06-05 12:37 9216 --a------ C:\WINDOWS\system32\cpuinf32.dll 2007-06-05 12:37 245760 --a------ C:\WINDOWS\system32\mplvpx.dll 2007-06-05 12:37 237568 --a------ C:\WINDOWS\system32\OggDS.dll 2005-05-11 23:36 12288 --a------ C:\WINDOWS\Fonts.\RandFont.dll 2006-05-03 09:06:54 163,328 --sh–r C:\WINDOWS\system32\flvDX.dll 2007-02-21 10:47:16 31,232 --sh–r C:\WINDOWS\system32\msfDX.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “TWCU”=“C:\Program Files\TP-LINK\TWCU\TWCU.exe” [2006-03-29 16:12] “DU Meter”=“C:\Program Files\DU Meter\DUMeter.exe” [2005-02-01 19:28] “SmartDefrag”=“C:\Program Files\SmartDefrag\IObit SmartDefrag.exe” [2007-04-28 21:54] “nwiz”=“nwiz.exe” [2004-03-03 10:29 C:\WINDOWS\system32\nwiz.exe] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2004-03-03 10:29] “ZoneAlarm Client”=“C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-06-21 21:54] “AVP”=“C:\Program Files\AOL\Active Virus Shield\avp.exe” [2007-04-03 11:37] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “AQQ”=“C:\PROGRA~1\WapSter\AQQ\AQQ.exe” [2007-02-28 14:18] “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” [2007-05-03 10:02] “Steam”="" [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Image Zone Fast Start.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Image Zone Fast Start.lnk backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^RaConfig2500.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\RaConfig2500.lnk backup=C:\WINDOWS\pss\RaConfig2500.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1045 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\Program Files\FlashGet\flashget.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys R2 SMTPSVC;Simple Mail Transport Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs R3 V0010bVd;Creative WebCam Vista #2;C:\WINDOWS\system32\DRIVERS\V0010bVd.sys R3 Wpsnuio;WPS NDIS Usermode I/O Protocol;C:\WINDOWS\system32\DRIVERS\wpsnuio.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;??\C:\WINDOWS\system32\NSNDIS5.SYS HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp *Newly Created Service* - CATCHME Contents of the ‘Scheduled Tasks’ folder 2007-08-31 15:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job 2007-09-05 13:03:08 C:\WINDOWS\Tasks\SmartDefrag.job - C:\Program Files\SmartDefrag\schedule.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-05 15:33:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-09-05 15:34:34 C:\ComboFix-quarantined-files.txt … 2007-09-05 15:34 — E O F —

Gutek · 5 Wrzesień 2007 15:43

Pobierz program SDFix

Bolo92 · 5 Wrzesień 2007 18:37

Proszę

SDFix: Version 1.102 Run by Bolek on 2007-09-05 at 19:34 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] “C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE”=“C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook” “C:\Program Files\Microsoft Office\Office12\GROOVE.EXE”=“C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove” “C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE”=“C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote” [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: C:\Program Files\eRightSoft\SUPER\cygwin1.dll C:\Program Files\eRightSoft\SUPER\cygz.dll C:\Program Files\eRightSoft\SUPER_Setup.dll C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll C:\WINDOWS\system32\flvDX.dll C:\WINDOWS\system32\msfDX.dll C:\Program Files\eRightSoft\SUPER\Setup.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\Tools\All.exe C:\WINDOWS\system32\Tools\Change.exe C:\WINDOWS\system32\Tools\CheckPath.exe C:\WINDOWS\system32\Tools\Counter.exe C:\WINDOWS\system32\Tools\DelFolders.exe C:\WINDOWS\system32\Tools\DirectSetup.exe C:\WINDOWS\system32\Tools\RegClean.exe C:\WINDOWS\system32\Tools\Regexe.exe C:\WINDOWS\system32\Tools\Restart.exe C:\WINDOWS\system32\Tools\RunRegexe.exe Finished

Gutek · 5 Wrzesień 2007 18:45

No czysto

Bolo92 · 6 Wrzesień 2007 13:36

Ehh… szkoda, bo czasami jakie IE mi wywala okna z dziwnymi adresami(reklamy) i czasami gram w grę okno akurat Tibie ^^ na OTS i okno staje się nieaktywne.