Pozostałości po aplikacjach

adam9870 · 25 Grudzień 2006 21:57

Sprawdź czy na dysku znajduje się ten plik, a jeśli tak to usuń go (najlepiej będąc w trybie awaryjnym).

Czy na pewno skopiowałeś z nagłówkiem Windows Registry Editor Version 5.00 i bez żadnych dodatkowych znaków etc. ??

Usuń obecnego FixWareOut i pobierz od nowa. Spróbuj kilka razy lub z innych przeglądarek (jeśli masz) jeśli problem nadal będzie występował.

kennex · 25 Grudzień 2006 22:23

To może dlatego, że podałeś wpis z dwoma “” Zmieniłem i wszedł :).

Jest ten plik, przeskanowałem na virusscan.jotti.org i oto wyniki:

AntiVir - Found TR/Dldr.DNSChanger.Gen

ArcaVir - Found nothing

Avast - Found nothing

AVG Antivirus Found nothing

BitDefender - Found MemScan:Trojan.Downloader.Agent.NC

ClamAV - Found nothing

Dr.Web - Found Trojan.DnsChange

F-Prot Antivirus - Found Possibly a new variant of W32/new-malware!Maximus

F-Secure Anti-Virus - Found Trojan.Win32.DNSChanger.hj

Fortinet - Found W32/DNSChanger.HJ!tr

Kaspersky Anti-Virus - Found Trojan.Win32.DNSChanger.hj

NOD32 - Found probably a variant of Win32/Small.FB (probable variant)

Norman Virus Control - Found nothing

VirusBuster - Found nothing

VBA32 - Found Trojan.DnsChange

Musiałem się poskarżyć na Avasta, chyba go zmienię . Plik usunięty thx .

Mógłbyś mi wysłać innego linka do tego programu?

Cały czas brakuje tych plików w folderze po rozpakowaniu z pliku .exe…

A tak na przyszłość: W Silent Runners mam włączać supplementary search czy nie?

Bieniol · 26 Grudzień 2006 07:46

Uruchamiasz narzędzie KillBox, zaznaczasz Delete on reboot , w polu full path of file wklej ścieżkę:

C:\WINDOWS\system32\kdlzw.exe

Klikasz X i restart kompa

Po zabiegach wklej zestaw logów: Hijack + Silent + l2mfix (wybierasz opcje 1) + ComboFix

kennex · 26 Grudzień 2006 10:12

Logfile of HijackThis v1.99.1 Scan saved at 11:09, on 06-12-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe D:\Downloads\Programy\Everest Ultimate 3\everest.exe C:\PROGRA~1\Ad-Aware SE Professional\Ad-Watch.exe C:\PROGRAM FILES\FRAPS\FRAPS.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\BlackICE\blackice.exe C:\Program Files\Rainlendar\Rainlendar.exe C:\Program Files\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\BlackICE\blackd.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Registry Defragmentation\RegManServ.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Downloads\Programy\Hijack This.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = <*KenneX*> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot S&D\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-2fe89c996183} - c:\program files\steganos internet anonym 7\sia7iep.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [bootSkin Startup Jobs] “C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKCU…\Run: [CursorXP] C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe O4 - HKCU…\Run: [EVEREST Ultimate Edition 2006] D:\Downloads\Programy\Everest Ultimate 3\everest.exe O4 - HKCU…\Run: [AWMON] “C:\PROGRA~1\Ad-Aware SE Professional\Ad-Watch.exe” O4 - HKCU…\Run: [Fraps] C:\PROGRAM FILES\FRAPS\FRAPS.EXE O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe O4 - Startup: Registration Heroes of Might & Magic 5.LNK = F:\Heroes V\registration\RegistrationReminder.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\BlackICE\blackice.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\BlackICE\blackd.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\BlackICE\rapapp.exe O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Registry Defragmentation\RegManServ.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CursorXP” = “C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe” [" "] “EVEREST Ultimate Edition 2006” = “D:\Downloads\Programy\Everest Ultimate 3\everest.exe” [“Lavalys, Inc.”] “AWMON” = ““C:\PROGRA~1\Ad-Aware SE Professional\Ad-Watch.exe”” [“Lavasoft Sweden”] “Fraps” = “C:\PROGRAM FILES\FRAPS\FRAPS.EXE” [“Beepa P/L”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “BootSkin Startup Jobs” = ““C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs” [empty string] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “NvMediaCenter” = “RunDLL32.exe NvMCTray.dll,NvTaskbarInit” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\PROGRA~1\Spybot S&D\SDHelper.dll” [“Safer Networking Limited”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] {C333CF63-767F-4831-94AC-E683D962C63C}(Default) = (no title provided) -> {HKLM…CLSID} = “CoTGT_BHO Class” \InProcServer32(Default) = “C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” = “UnlockerShellExtension” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{EFA24E62-B078-11d0-89E4-00C04FC9E26E}” = “History Band” -> {HKLM…CLSID} = “History Band” \InProcServer32(Default) = “C:\WINDOWS\system32\SHDOCVW.DLL” [MS] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“Anti-Malware Development a.s.”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] Default executables: -------------------- HKLM\Software\Classes.hta\ = (key not found) Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoSMBalloonTip” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “CDRAutoRun” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoLowDiskSpaceChecks” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoClose” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoAutoTrayNotify” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveTrack” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartBanner” = (REG_BINARY) hex:00 00 00 00 {Remove “Click here to begin” from Start button} “NoWelcomeScreen” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoDesktopCleanupWizard” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “ForceClassicControlPanel” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMConfigurePrograms” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoDrives” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “MemCheckBoxInRunDlg” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments_XXX_Temp” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Favorites menu from Start Menu} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Documents menu from Start Menu} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove My Pictures icon from Start Menu} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoUserNameInStartMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoStartMenuPinnedList” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments” = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Remove Shared Documents from My Computer} “NoRecycleFiles” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “GreyMSIAds” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoViewOnDrive” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoLogoff” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System|Logon/Logoff| Disable Logoff} “NoInstrumentation” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ForceStartMenuLogoff” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoAddPrinter” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoDeletePrinter” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoSaveSettings” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop| Don’t save settings at exit} “NoThemesTab” = (REG_SZ) 1 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoRemoteRecursiveEvents” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoStrCmpLogical” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoClose” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoInstrumentation” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoSimpleStartMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegedit” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “DisableRegistryTools” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\ “DisableWindowsUpdateAccess” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Update| Remove access to use all Windows Update features} HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\ “NoUpdateCheck” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “RunStartupScriptSync” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “SynchronousMachineGroupPolicy” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “SynchronousUserGroupPolicy” = (REG_DWORD) hex:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\CopperDeckII_1600.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\CopperDeckII_1600.bmp” Startup items in “User” & “All Users” startup folders: ------------------------------------------------------ C:\Documents and Settings\User\Menu Start\Programy\Autostart “Rainlendar” -> shortcut to: “C:\Program Files\Rainlendar\Rainlendar.exe” [“Rainy”] “Registration Heroes of Might & Magic 5” -> shortcut to: “F:\Heroes V\registration\RegistrationReminder.exe -d 802909 -l polish -r 7 -g Heroes of Might & Magic 5 -c us -i 2579” [empty string] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “BlackICE PC Protection” -> shortcut to: “C:\Program Files\BlackICE\blackice.exe -closed” [“Internet Security Systems, Inc.”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\System32\nwprovau.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\Program Files\Secure Surfing Engine\sselsp.dll [null data], 01 - 03, 22 %SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 09 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] “{00000000-5736-4205-0008-2FE89C996183}” -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{00000000-5736-4205-0008-2FE89C996183}” -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{00000000-5736-4205-0008-2FE89C996183}” = (no title provided) -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{00000000-5736-4205-0009-2FE89C996183}(Default) = “Prywatna lista ulubionych Steganos” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {E2E2DD38-D088-4134-82B7-F2BA38496583}\ “MenuText” = “@xpsp3res.dll,-20001” “Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS] Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to “Reset Web Settings”) Added lines (compared with English-language version): : ˙ţ[V e r s i o n] : S i g n a t u r e = " $ C H I C A G O $ " : A d v a n c e d I N F = 2 . 5 , " Y o u n e e d a n e w v e r s i o n o f a d v p a c k . d l l " : : [R e s t o r e H o m e P a g e] : A d d R e g = R e s t o r e H o m e P a g e . r e g : : [R e s t o r e B r o w s e r S e t t i n g s] : A d d R e g = R e s t o r e B r o w s e r S e t t i n g s . r e g : D e l R e g = D e l e t e T e m p l a t e s . r e g , D e l e t e A u t o s e a r c h . r e g : : [R e s t o r e H o m e P a g e . r e g] : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S t a r t P a g e " , 0 , % S T A R T _ P A G E _ U R L % : : [R e s t o r e B r o w s e r S e t t i n g s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ P a g e _ U R L " , 0 , % S T A R T _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ S e a r c h _ U R L " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 1 " , 0 , " w w w . % s . c o m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 2 " , 0 , " w w w . % s . o r g " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 3 " , 0 , " w w w . % s . n e t " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 4 " , 0 , " w w w . % s . e d u " : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ S e a r c h U r l " , " P r o v i d e r " , 0 , " " : : t m " : t m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ I n t e r n e t S e t t i n g s \ S a f e S i t e s " , % S A F E S I T E _ V A L U E % , 0 , " h t t p : / / i e . s e a r c h . m s n . c o m / * " : : [D e l e t e T e m p l a t e s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 5 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 6 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 7 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 8 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 9 " : : [D e l e t e A u t o s e a r c h . r e g] : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " A u t o S e a r c h " : : [S t r i n g s] : S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : S E A R C H _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & a r = i e s e a r c h " : S A F E S I T E _ V A L U E = " i e . s e a r c h . m s n . c o m " : : ; I M P O R T A N T N O T E : : ; I E b r a n d i n g d l l ( i e d k c s 3 2 . d l l ) u s e s t h e f o l l o w i n g e n t r i e s t o r e s t o r e t h e d e f a u l t M S v a l u e s . : ; I n t h e v a n i l l a v e r s i o n o f I E , t h e v a l u e s m u s t b e t h e s a m e a s t h e i r c o r r e s p o n d i n g n o n M S _ * v a l u e s . : ; F o r e x a m p l e , S T A R T _ P A G E _ U R L a n d M S _ S T A R T _ P A G E _ U R L m u s t h a v e t h e s a m e U R L i n t h e I E v e r s i o n r e l e a s e d b y M S . : M S _ S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : Missing lines (compared with English-language version): [Version]: 2 lines [RestoreHomePage]: 1 line [RestoreHomePage.reg]: 1 line [RestoreBrowserSettings.reg]: 12 lines [DeleteTemplates.reg]: 5 lines [DeleteAutosearch.reg]: 1 line [strings]: 1 line [RestoreBrowserSettings]: 2 lines [strings]: 3 lines HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ <> “TuneUp” = “file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css” [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, “C:\Program Files\AVG Anti-Spyware 7.5\guard.exe” [“Anti-Malware Development a.s.”] BlackICE, BlackICE, ““C:\Program Files\BlackICE\blackd.exe”” [“Internet Security Systems, Inc.”] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] Registry Management Service, RegManServ, “C:\Program Files\Registry Defragmentation\RegManServ.exe” [null data] StyleXPService, StyleXPService, ““C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe”” [empty string] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 29 seconds, including 5 seconds for message boxes)

Logi za długie, tamte 2 będę mógł dołączyć w następnym poście =P.

Bieniol · 26 Grudzień 2006 10:34

Tutaj jest czysto.

Wrzuć kolejne dwa

kennex · 26 Grudzień 2006 10:40

L2MFIX find log 051206 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 “Logoff”=“ChainWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Logoff”=“CryptnetWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] “DLLName”=“cscdll.dll” “Logon”=“WinlogonLogonEvent” “Logoff”=“WinlogonLogoffEvent” “ScreenSaver”=“WinlogonScreenSaverEvent” “Startup”=“WinlogonStartupEvent” “Shutdown”=“WinlogonShutdownEvent” “StartShell”=“WinlogonStartShellEvent” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] “DLLName”=“wlnotify.dll” “Logon”=“SCardStartCertProp” “Logoff”=“SCardStopCertProp” “Lock”=“SCardSuspendCertProp” “Unlock”=“SCardResumeCertProp” “Enabled”=dword:00000001 “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “StartShell”=“SchedStartShell” “Logoff”=“SchedEventLogOff” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] “Logoff”=“WLEventLogoff” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 “DllName”=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] “DLLName”=“WlNotify.dll” “Lock”=“SensLockEvent” “Logon”=“SensLogonEvent” “Logoff”=“SensLogoffEvent” “Safe”=dword:00000001 “MaxWait”=dword:00000258 “StartScreenSaver”=“SensStartScreenSaverEvent” “StopScreenSaver”=“SensStopScreenSaverEvent” “Startup”=“SensStartupEvent” “Shutdown”=“SensShutdownEvent” “StartShell”=“SensStartShellEvent” “PostShell”=“SensPostShellEvent” “Disconnect”=“SensDisconnectEvent” “Reconnect”=“SensReconnectEvent” “Unlock”=“SensUnlockEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “Logoff”=“TSEventLogoff” “Logon”=“TSEventLogon” “PostShell”=“TSEventPostShell” “Shutdown”=“TSEventShutdown” “StartShell”=“TSEventStartShell” “Startup”=“TSEventStartup” “MaxWait”=dword:00000258 “Reconnect”=“TSEventReconnect” “Disconnect”=“TSEventDisconnect” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] “DLLName”=“wlnotify.dll” “Logon”=“RegisterTicketExpiredNotificationEvent” “Logoff”=“UnregisterTicketExpiredNotificationEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] “SV1”="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] “{00022613-0000-0000-C000-000000000046}”=“Karta waciwoci pliku multimedialnego” “{176d6597-26d3-11d1-b350-080036a75b03}”=“ZarzĄdzanie skanerem ICM” “{1F2E5C40-9550-11CE-99D2-00AA006E086C}”=“Strona zabezpieczeä NTFS” “{3EA48300-8CF6-101B-84FB-666CCB9BCD32}”=“Strona waciwoci OLE Docfile” “{40dd6e20-7c17-11ce-a804-00aa003ca9f6}”=“Rozszerzenia powoki dla udost©pniania zasob˘w” “{41E300E0-78B6-11ce-849B-444553540000}”=“PlusPack CPL Extension” “{42071712-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL karty graficznej” “{42071713-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL monitora wywietlania” “{42071714-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL kadrowania wywietlania” “{4E40F770-369C-11d0-8922-00A024AB2DBB}”=“Strona zabezpieczeä usugi DS” “{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}”=“Strona zgodnoci” “{56117100-C0CD-101B-81E2-00AA004AE837}”=“Program obsugi danych wycinkowych powoki” “{59099400-57FF-11CE-BD94-0020AF85B590}”=“Rozszerzenie Disc Copy” “{59be4990-f85c-11ce-aff7-00aa003ca9f6}”=“Rozszerzenia powoki dla obiekt˘w Microsoft Windows Network” “{5DB2625A-54DF-11D0-B6C4-0800091AA605}”=“ZarzĄdzanie monitorem ICM” “{675F097E-4C4D-11D0-B6C1-0800091AA605}”=“ZarzĄdzanie drukarkĄ ICM” “{764BF0E1-F219-11ce-972D-00AA00A14F56}”=“Rozszerzenia powoki dla kompresji plik˘w” “{77597368-7b15-11d0-a0c2-080036af3f03}”=“Rozszerzenie powoki drukarek sieci Web” “{7988B573-EC89-11cf-9C00-00AA00A14F56}”=“Disk Quota UI” “{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}”=“Menu kontekstowe szyfrowania” “{85BBD920-42A0-1069-A2E4-08002B30309D}”=“Akt˘wka” “{88895560-9AA2-1069-930E-00AA0030EBC8}”=“Rozszerzenie ikony HyperTerminalu” “{BD84B380-8CA2-1069-AB1D-08000948F534}”=“Fonts” “{DBCE2480-C732-101B-BE72-BA78E9AD5B27}”=“Profil ICC” “{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}”=“Strona zabezpieczeä drukarek” “{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}”=“Rozszerzenia powoki dla udost©pniania zasob˘w” “{f92e8c40-3d33-11d2-b1aa-080036a75b03}”=“Display TroubleShoot CPL Extension” “{7444C717-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto PKO” “{7444C719-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto Sign” “{7007ACC7-3202-11D1-AAD2-00805FC1270E}”=“PoĄczenia sieciowe” “{992CFFA0-F557-101A-88EC-00DD010CCC48}”=“PoĄczenia sieciowe” “{E211B736-43FD-11D1-9EFB-0000F8757FCD}”="&Skanery i aparaty fotograficzne" “{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}”="&Skanery i aparaty fotograficzne" “{905667aa-acd6-11d2-8080-00805f6596d2}”="&Skanery i aparaty fotograficzne" “{3F953603-1008-4f6e-A73A-04AAC7A992F1}”="&Skanery i aparaty fotograficzne" “{83bbcbf3-b28a-4919-a5aa-73027445d672}”="&Skanery i aparaty fotograficzne" “{F0152790-D56E-4445-850E-4F3117DB740C}”=“Remote Sessions CPL Extension” “{60254CA5-953B-11CF-8C96-00AA00B8708C}”=“Rozszerzenie powloki dla programu Windows Script Host” “{2206CDB2-19C1-11D1-89E0-00C04FD7A829}”=“Microsoft Data Link” “{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}”=“Tasks Folder Icon Handler” “{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}”=“Tasks Folder Shell Extension” “{D6277990-4C6A-11CF-8D87-00AA0060F5BF}”=“Zaplanowane zadania” “{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}”=“Set Program Access and Defaults” “{5F327514-6C5E-4d60-8F16-D07FA08A78ED}”=“Auto Update Property Sheet Extension” “{0DF44EAA-FF21-4412-828E-260A8728E7F1}”=“Pasek zadaä i menu Start” “{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}”=“Wyszukaj” “{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}”=“Pomoc i obsuga techniczna” “{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}”=“Pomoc i obsuga techniczna” “{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}”=“Uruchom…” “{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}”=“Internet” “{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}”=“E-mail” “{D20EA4E1-3957-11d2-A40B-0C5020524152}”=“Czcionki” “{D20EA4E1-3957-11d2-A40B-0C5020524153}”=“Narz©dzia administracyjne” “{596AB062-B4D2-4215-9F74-E9109B0A8153}”=“Strona waciwoci Poprzednie wersje” “{9DB7A13C-F208-4981-8353-73CC61AE2783}”=“Poprzednie wersje” “{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}”=“Audio Media Properties Handler” “{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}”=“Video Media Properties Handler” “{E4B29F9D-D390-480b-92FD-7DDB47101D71}”=“Wav Properties Handler” “{87D62D94-71B3-4b9a-9489-5FE6850DC73E}”=“Avi Properties Handler” “{A6FD9E45-6E44-43f9-8644-08598F5A74D9}”=“Midi Properties Handler” “{c5a40261-cd64-4ccf-84cb-c394da41d590}”=“Video Thumbnail Extractor” “{5E6AB780-7743-11CF-A12B-00AA004AE837}”=“Pasek narz©dzi programu Microsoft Internet” “{22BF0C20-6DA7-11D0-B373-00A0C9034938}”=“Stan pobierania” “{91EA3F8B-C99B-11d0-9815-00C04FD91972}”=“Folder powoki zwi©kszonej” “{6413BA2C-B461-11d1-A18A-080036B11A03}”=“Folder powoki zwi©kszonej 2” “{F61FFEC1-754F-11d0-80CA-00AA005B4383}”=“BandProxy” “{7BA4C742-9E81-11CF-99D3-00AA004AE837}”=“Pasek przeglĄdarki Microsoft” “{30D02401-6A81-11d0-8274-00C04FD5AE38}”=“Pasek wyszukiwania” “{169A0691-8DF9-11d1-A1C4-00C04FD75D13}”=“Wyszukiwanie w okienku” “{07798131-AF23-11d1-9111-00A0C98BA67D}”=“Wyszukiwanie w sieci Web” “{AF4F6510-F982-11d0-8595-00AA004CD6D8}”=“Narz©dzie opcji drzewa rejestru” “{01E04581-4EEE-11d0-BFE9-00AA005B4383}”="&Adres" “{A08C11D2-A228-11d0-825B-00AA005B4383}”=“Pole edycji adresu” “{00BB2763-6A77-11D0-A535-00C04FD7D062}”=“Autouzupenianie Microsoft” “{7376D660-C583-11d0-A3A5-00C04FD706EC}”=“Wyodr©bnianie obraz˘w Trident” “{6756A641-DE71-11d0-831B-00AA005B4383}”=“Lista autouzupeniania MRU” “{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}”=“Niestandardowa lista autouzupeniania MRU” “{7e653215-fa25-46bd-a339-34a2790f3cb7}”=“Dost©pny” “{acf35015-526e-4230-9596-becbe19f0ac9}”=“Pasek podr©czny ledzenia” “{00BB2764-6A77-11D0-A535-00C04FD7D062}”=“Lista autouzupeniania historii Microsoft” “{03C036F1-A186-11D0-824A-00AA005B4383}”=“Lista autouzupeniania folderu powoki Microsoft” “{00BB2765-6A77-11D0-A535-00C04FD7D062}”=“Kontener wielu list autouzupeniania Microsoft” “{ECD4FC4E-521C-11D0-B792-00A0C90312E1}”=“Menu witryny paska powoki” “{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}”=“Shell DeskBarApp” “{ECD4FC4C-521C-11D0-B792-00A0C90312E1}”=“Pasek pulpitu powoki” “{ECD4FC4D-521C-11D0-B792-00A0C90312E1}”=“Shell Rebar BandSite” “{DD313E04-FEFF-11d1-8ECD-0000F87A470C}”=“Pomoc dla uľytkownika” “{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}”=“Globalne ustawienia folder˘w” “{EFA24E61-B078-11d0-89E4-00C04FC9E26E}”=“Favorites Band” “{0A89A860-D7B1-11CE-8350-444553540000}”=“Shell Automation Inproc Service” “{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}”=“Shell DocObject Viewer” “{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}”=“Microsoft Browser Architecture” “{FBF23B40-E3F0-101B-8488-00AA003E56F8}”=“InternetShortcut” “{3C374A40-BAE4-11CF-BF7D-00AA006946EE}”=“Microsoft Url History Service” “{FF393560-C2A7-11CF-BFF4-444553540000}”=“Historia” “{7BD29E00-76C1-11CF-9DD0-00A0C9034933}”=“Tymczasowe pliki internetowe” “{7BD29E01-76C1-11CF-9DD0-00A0C9034933}”=“Tymczasowe pliki internetowe” “{CFBFAE00-17A6-11D0-99CB-00C04FD64497}”=“Microsoft Url Search Hook” “{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}”=“Ekran powitalny pakietu IE4” “{67EA19A0-CCEF-11d0-8024-00C04FD75D13}”=“CDF Extension Copy Hook” “{131A6951-7F78-11D0-A979-00C04FD705A2}”=“ISFBand OC” “{9461b922-3c5a-11d2-bf8b-00c04fb93661}”=“Search Assistant OC” “{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}”=“Internet” “{871C5380-42A0-1069-A2EA-08002B30309D}”=“Internet Name Space” “{EFA24E64-B078-11d0-89E4-00C04FC9E26E}”=“Pasek eksploratora” “{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}”=“Sendmail service” “{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}”=“Sendmail service” “{88C6C381-2E85-11D0-94DE-444553540000}”=“Folder pami©ci podr©cznej ActiveX” “{E6FB5E20-DE35-11CF-9C87-00AA005127ED}”=“WebCheck” “{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}”=“Subscription Mgr” “{F5175861-2688-11d0-9C5E-00AA00A45957}”=“Folder subskrypcji” “{08165EA0-E946-11CF-9C87-00AA005127ED}”=“WebCheckWebCrawler” “{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}”=“WebCheckChannelAgent” “{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}”=“TrayAgent” “{7D559C10-9FE9-11d0-93F7-00AA0059CE02}”=“Code Download Agent” “{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}”=“ConnectionAgent” “{D8BD2030-6FC9-11D0-864F-00AA006809D9}”=“PostAgent” “{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}”=“WebCheck SyncMgr Handler” “{352EC2B7-8B9A-11D1-B8AE-006008059382}”=“Menedľer aplikacji powoki” “{0B124F8F-91F0-11D1-B8B5-006008059382}”=“Wyliczanie zainstalowanych aplikacji” “{CFCCC7A0-A282-11D1-9082-006008059382}”=“Publikator aplikacji Darwin” “{CC6EEFFB-43F6-46c5-9619-51D571967F7D}”=“Kreator publikacji w sieci Web” “{add36aa8-751a-4579-a266-d66f5202ccbb}”=“Zamawianie odbitek w sieci Web” “{6b33163c-76a5-4b6c-bf21-45de9cd503a1}”=“Obiekt powoki kreatora publikacji” “{58f1f272-9240-4f51-b6d4-fd63d1618591}”=“Kreator uzyskiwania profilu usugi Passport” “{7A9D77BD-5403-11d2-8785-2E0420524153}”=“Konta uľytkownik˘w” “{BD472F60-27FA-11cf-B8B4-444553540000}”=“Compressed (zipped) Folder Right Drag Handler” “{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}”=“Compressed (zipped) Folder SendTo Target” “{f39a0dc0-9cc8-11d0-a599-00c04fd64433}”=“Plik kanau” “{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}”=“Skr˘t kanau” “{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}”=“Obiekt obsugi kanau” “{f3da0dc0-9cc8-11d0-a599-00c04fd64437}”=“Channel Menu” “{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}”=“Channel Properties” “{692F0339-CBAA-47e6-B5B5-3B84DB604E87}”=“Extensions Manager Folder” “{63da6ec0-2e98-11cf-8d82-444553540000}”=“FTP Folders Webview” “{883373C3-BF89-11D1-BE35-080036B11A03}”=“Microsoft DocProp Shell Ext” “{A9CF0EAE-901A-4739-A481-E35B73E47F6D}”=“Microsoft DocProp Inplace Edit Box Control” “{8EE97210-FD1F-4B19-91DA-67914005F020}”=“Microsoft DocProp Inplace ML Edit Box Control” “{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}”=“Microsoft DocProp Inplace Droplist Combo Control” “{6A205B57-2567-4A2C-B881-F787FAB579A3}”=“Microsoft DocProp Inplace Calendar Control” “{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}”=“Microsoft DocProp Inplace Time Control” “{8A23E65E-31C2-11d0-891C-00A024AB2DBB}”=“Directory Query UI” “{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}”=“Shell properties for a DS object” “{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}”=“Directory Object Find” “{F020E586-5264-11d1-A532-0000F8757D7E}”=“Directory Start/Search Find” “{0D45D530-764B-11d0-A1CA-00AA00C16E65}”=“Directory Property UI” “{62AE1F9A-126A-11D0-A14B-0800361B1103}”=“Directory Context Menu Verbs” “{ECF03A33-103D-11d2-854D-006008059367}”=“MyDocs Copy Hook” “{ECF03A32-103D-11d2-854D-006008059367}”=“MyDocs Drop Target” “{4a7ded0a-ad25-11d0-98a8-0800361b1103}”=“MyDocs Properties” “{750fdf0e-2a26-11d1-a3ea-080036587f03}”=“Offline Files Menu” “{10CFC467-4392-11d2-8DB4-00C04FA31A66}”=“Offline Files Folder Options” “{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}”=“Folder plik˘w trybu offline” “{143A62C8-C33B-11D1-84FE-00C04FA34A14}”=“Microsoft Agent Character Property Sheet Handler” “{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}”=“DfsShell” “{60fd46de-f830-4894-a628-6fa81bc0190d}”="%DESC_PublishDropTarget%" “{7A80E4A8-8005-11D2-BCF8-00C04F72C717}”=“MMC Icon Handler” “{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}”=".CAB file viewer" “{32714800-2E5F-11d0-8B85-00AA0044F941}”="&Do os˘b…" “{8DD448E6-C188-4aed-AF92-44956194EB1F}”=“Windows Media Player Play as Playlist Context Menu Handler” “{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}”=“Windows Media Player Burn Audio CD Context Menu Handler” “{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}”=“Windows Media Player Add to Playlist Context Menu Handler” “{472083B0-C522-11CF-8763-00608CC02F24}”=“avast” “{BDEADF00-C265-11D0-BCED-00A0C90AB50F}”=“Foldery w sieci Web” “{42042206-2D85-11D3-8CFF-005004838597}”=“Microsoft Office HTML Icon Handler” “{21569614-B795-46b1-85F4-E737A8DC09AD}”=“Shell Search Band” “{6F45BB01-537B-11D3-A2A6-444553540000}”=“FineCrypt” “{D9341527-6C0C-42D4-ABC6-320CB28AC6D4}”=“CAR / CPH Extension DLL” “{1D2680C9-0E2A-469d-B787-065558BC7D43}”=“Fusion Cache” “{e82a2d71-5b2f-43a0-97b8-81be15854de8}”=“ShellLink for Application References” “{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}”=“Shell Icon Handler for Application References” “{640167b4-59b0-47a6-b335-a6b3c0695aea}”=“Portable Media Devices” “{cc86590a-b60a-48e6-996b-41d25ed39a1e}”=“Portable Media Devices Menu” “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}”=“UnlockerShellExtension” “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”=“WinRAR shell extension” “{e84fda7c-1d6a-45f6-b725-cb260c236066}”=“Shell Image Verbs” “{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}”=“Shell Image Data Factory” “{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}”=“Autoplay for SlideShow” “{3F30C968-480A-4C6C-862D-EFC0897BB84B}”=“GDI+program wyodr©bniajĄcy miniatury plik˘w” “{9DBD2C50-62AD-11d0-B806-00C04FD706EC}”=“Informacje podsumowujĄce obsugi miniatur (DOCFILES)” “{EAB841A0-9550-11cf-8C16-00805F1408F3}”=“Wyodr©bnianie miniatur HTML” “{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}”=“Shell Image Property Handler” “{EFA24E62-B078-11d0-89E4-00C04FC9E26E}”=“History Band” “{A70C977A-BF00-412C-90B7-034C51DA2439}”=“NvCpl DesktopContext Class” “{FFB699E0-306A-11d3-8BD1-00104B6F7516}”=“Play on my TV helper” “{1CDB2949-8F65-4355-8456-263E7C208A5D}”=“Desktop Explorer” “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}”=“Desktop Explorer Menu” “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}”=“nView Desktop Context Menu” ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ browseui.dll Mon Oct 23 2006 4:35:44p A… 1,022,976 999.00 K cdfview.dll Mon Oct 23 2006 4:35:44p A… 151,552 148.00 K danim.dll Mon Oct 23 2006 4:35:44p A… 1,055,744 1.00 M divx.dll Mon Oct 2 2006 8:04:40p A… 635,486 620.59 K dxtmsft.dll Mon Oct 23 2006 4:35:44p A… 357,888 349.50 K dxtrans.dll Mon Oct 23 2006 4:35:44p A… 205,312 200.50 K extmgr.dll Mon Oct 23 2006 4:35:44p A… 55,808 54.50 K frapsvid.dll Sat Oct 21 2006 4:05:42a A… 40,960 40.00 K iepeers.dll Mon Oct 23 2006 4:35:46p A… 251,904 246.00 K inetcomm.dll Wed Nov 8 2006 6:07:56a A… 679,424 663.50 K inseng.dll Mon Oct 23 2006 4:35:46p A… 96,768 94.50 K jsproxy.dll Mon Oct 23 2006 4:35:46p A… 15,872 15.50 K mshtml.dll Mon Oct 23 2006 4:35:46p A… 3,082,240 2.94 M mshtmled.dll Mon Oct 23 2006 4:35:46p A… 448,512 438.00 K msrating.dll Mon Oct 23 2006 4:35:46p A… 146,432 143.00 K mstime.dll Mon Oct 23 2006 4:35:46p A… 532,480 520.00 K nv4_disp.dll Sun Oct 22 2006 12:22:00p A… 4,527,488 4.32 M nvapi.dll Sun Oct 22 2006 12:22:00p A… 212,992 208.00 K nvcod.dll Sun Oct 22 2006 12:22:00p A… 35,840 35.00 K nvcodins.dll Sun Oct 22 2006 12:22:00p A… 35,840 35.00 K nvcpl.dll Sun Oct 22 2006 12:22:00p A… 7,700,480 7.34 M nvcpluir.dll Sun Oct 22 2006 12:22:00p A… 1,011,712 988.00 K nvdisps.dll Sun Oct 22 2006 12:22:00p A… 5,619,712 5.36 M nvdispsr.dll Sun Oct 22 2006 12:22:00p A… 5,255,168 5.01 M nvexpbar.dll Sun Oct 22 2006 12:22:00p A… 311,296 304.00 K nvgames.dll Sun Oct 22 2006 12:22:00p A… 3,047,424 2.91 M nvgamesr.dll Sun Oct 22 2006 12:22:00p A… 3,203,072 3.05 M nvhwvid.dll Sun Oct 22 2006 12:22:00p A… 581,632 568.00 K nview.dll Sun Oct 22 2006 12:22:00p A… 1,470,464 1.40 M nvmccs.dll Sun Oct 22 2006 12:22:00p A… 229,376 224.00 K nvmccsrs.dll Sun Oct 22 2006 12:22:00p A… 45,056 44.00 K nvmccss.dll Sun Oct 22 2006 12:22:00p A… 188,416 184.00 K nvmccssr.dll Sun Oct 22 2006 12:22:00p A… 458,752 448.00 K nvmctray.dll Sun Oct 22 2006 12:22:00p A… 86,016 84.00 K nvmobls.dll Sun Oct 22 2006 12:22:00p A… 888,832 868.00 K nvmoblsr.dll Sun Oct 22 2006 12:22:00p A… 2,859,008 2.73 M nvnt4cpl.dll Sun Oct 22 2006 12:22:00p A… 286,720 280.00 K nvoglnt.dll Sun Oct 22 2006 12:22:00p A… 5,644,288 5.38 M nvrsar.dll Sun Oct 22 2006 12:22:00p A… 323,584 316.00 K nvrscs.dll Sun Oct 22 2006 12:22:00p A… 241,664 236.00 K nvrsda.dll Sun Oct 22 2006 12:22:00p A… 245,760 240.00 K nvrsde.dll Sun Oct 22 2006 12:22:00p A… 270,336 264.00 K nvrsel.dll Sun Oct 22 2006 12:22:00p A… 274,432 268.00 K nvrseng.dll Sun Oct 22 2006 12:22:00p A… 241,664 236.00 K nvrses.dll Sun Oct 22 2006 12:22:00p A… 274,432 268.00 K nvrsesm.dll Sun Oct 22 2006 12:22:00p A… 266,240 260.00 K nvrsfi.dll Sun Oct 22 2006 12:22:00p A… 241,664 236.00 K nvrsfr.dll Sun Oct 22 2006 12:22:00p A… 278,528 272.00 K nvrshe.dll Sun Oct 22 2006 12:22:00p A… 323,584 316.00 K nvrshu.dll Sun Oct 22 2006 12:22:00p A… 253,952 248.00 K nvrsit.dll Sun Oct 22 2006 12:22:00p A… 274,432 268.00 K nvrsja.dll Sun Oct 22 2006 12:22:00p A… 262,144 256.00 K nvrsko.dll Sun Oct 22 2006 12:22:00p A… 258,048 252.00 K nvrsnl.dll Sun Oct 22 2006 12:22:00p A… 266,240 260.00 K nvrsno.dll Sun Oct 22 2006 12:22:00p A… 249,856 244.00 K nvrspl.dll Sun Oct 22 2006 12:22:00p A… 249,856 244.00 K nvrspt.dll Sun Oct 22 2006 12:22:00p A… 266,240 260.00 K nvrsptb.dll Sun Oct 22 2006 12:22:00p A… 262,144 256.00 K nvrsru.dll Sun Oct 22 2006 12:22:00p A… 262,144 256.00 K nvrssk.dll Sun Oct 22 2006 12:22:00p A… 249,856 244.00 K nvrssl.dll Sun Oct 22 2006 12:22:00p A… 249,856 244.00 K nvrssv.dll Sun Oct 22 2006 12:22:00p A… 245,760 240.00 K nvrstr.dll Sun Oct 22 2006 12:22:00p A… 249,856 244.00 K nvrszhc.dll Sun Oct 22 2006 12:22:00p A… 221,184 216.00 K nvrszht.dll Sun Oct 22 2006 12:22:00p A… 118,784 116.00 K nvshell.dll Sun Oct 22 2006 12:22:00p A… 466,944 456.00 K nvvitvs.dll Sun Oct 22 2006 12:22:00p A… 2,924,544 2.79 M nvvitvsr.dll Sun Oct 22 2006 12:22:00p A… 2,973,696 2.84 M nvwddi.dll Sun Oct 22 2006 12:22:00p A… 81,920 80.00 K nvwdmcpl.dll Sun Oct 22 2006 12:22:00p A… 1,662,976 1.59 M nvwimg.dll Sun Oct 22 2006 12:22:00p A… 1,019,904 996.00 K nvwrsar.dll Sun Oct 22 2006 12:22:00p A… 282,624 276.00 K nvwrscs.dll Sun Oct 22 2006 12:22:00p A… 286,720 280.00 K nvwrsda.dll Sun Oct 22 2006 12:22:00p A… 294,912 288.00 K nvwrsde.dll Sun Oct 22 2006 12:22:00p A… 311,296 304.00 K nvwrsel.dll Sun Oct 22 2006 12:22:00p A… 335,872 328.00 K nvwrseng.dll Sun Oct 22 2006 12:22:00p A… 286,720 280.00 K nvwrses.dll Sun Oct 22 2006 12:22:00p A… 335,872 328.00 K nvwrsesm.dll Sun Oct 22 2006 12:22:00p A… 327,680 320.00 K nvwrsfi.dll Sun Oct 22 2006 12:22:00p A… 303,104 296.00 K nvwrsfr.dll Sun Oct 22 2006 12:22:00p A… 327,680 320.00 K nvwrshe.dll Sun Oct 22 2006 12:22:00p A… 278,528 272.00 K nvwrshu.dll Sun Oct 22 2006 12:22:00p A… 315,392 308.00 K nvwrsit.dll Sun Oct 22 2006 12:22:00p A… 323,584 316.00 K nvwrsja.dll Sun Oct 22 2006 12:22:00p A… 212,992 208.00 K nvwrsko.dll Sun Oct 22 2006 12:22:00p A… 196,608 192.00 K nvwrsnl.dll Sun Oct 22 2006 12:22:00p A… 319,488 312.00 K nvwrsno.dll Sun Oct 22 2006 12:22:00p A… 299,008 292.00 K nvwrspl.dll Sun Oct 22 2006 12:22:00p A… 294,912 288.00 K nvwrspt.dll Sun Oct 22 2006 12:22:00p A… 323,584 316.00 K nvwrsptb.dll Sun Oct 22 2006 12:22:00p A… 319,488 312.00 K nvwrsru.dll Sun Oct 22 2006 12:22:00p A… 315,392 308.00 K nvwrssk.dll Sun Oct 22 2006 12:22:00p A… 299,008 292.00 K nvwrssl.dll Sun Oct 22 2006 12:22:00p A… 303,104 296.00 K nvwrssv.dll Sun Oct 22 2006 12:22:00p A… 294,912 288.00 K nvwrstr.dll Sun Oct 22 2006 12:22:00p A… 303,104 296.00 K nvwrszhc.dll Sun Oct 22 2006 12:22:00p A… 163,840 160.00 K nvwrszht.dll Sun Oct 22 2006 12:22:00p A… 167,936 164.00 K nvwss.dll Sun Oct 22 2006 12:22:00p A… 1,236,992 1.18 M nvwssr.dll Sun Oct 22 2006 12:22:00p A… 1,732,608 1.65 M nwapi32.dll Fri Oct 13 2006 1:41:12p A… 64,000 62.50 K nwprovau.dll Fri Oct 13 2006 1:41:12p A… 143,872 140.50 K nwwks.dll Fri Oct 13 2006 1:41:12p A… 65,536 64.00 K openal32.dll Tue Oct 3 2006 7:51:26p A… 86,016 84.00 K pngfilt.dll Mon Oct 23 2006 4:35:46p A… 39,424 38.50 K shdocvw.dll Mon Oct 23 2006 4:35:48p A… 1,497,600 1.43 M shlwapi.dll Mon Oct 23 2006 4:35:48p A… 474,112 463.00 K sxs.dll Fri Oct 20 2006 2:41:08a A… 714,240 697.50 K urlmon.dll Mon Oct 23 2006 4:35:48p A… 616,960 602.50 K wininet.dll Mon Oct 23 2006 4:35:48p A… 667,136 651.50 K wmvcore.dll Thu Dec 7 2006 6:29:34a A… 2,374,472 2.26 M wrap_oal.dll Tue Oct 3 2006 7:51:26p A… 262,144 256.00 K xpsp3res.dll Mon Oct 23 2006 12:43:20p A… 265,216 259.00 K 113 items found: 113 files, 0 directories. Total of file sizes: 86,594,854 bytes 82.58 M Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Wolumin w stacji C nie ma etykiety. Numer seryjny woluminu: 586D-2A4B Katalog: C:\WINDOWS\System32 06-12-19 19:09 06-10-11 16:03 06-08-21 18:37 0 plik(˘w) 0 bajt˘w 3 katalog(˘w) 6,247,432,192 bajt˘w wolnych

User - 06-12-26 11:12:21.18 Dodatek Service Pack 2 ComboFix 06.11.22 - Running from: “D:\Downloads\Programy” ((((((((((((((((((((((((((((((( Files Created from 2006-11-26 to 2006-12-26 )))))))))))))))))))))))))))))))))) 2006-12-26 00:00 2006-12-25 20:59 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-12-25 20:59 2006-12-24 20:29 2006-12-24 20:29 2006-12-24 20:29 2006-12-24 14:54 2006-12-19 23:22 2006-12-19 14:07 2006-12-18 12:26 2006-12-18 11:23 2006-12-17 19:11 9,216 --a------ C:\WINDOWS\usc_japanese.dll 2006-12-17 19:11 14,848 --a------ C:\WINDOWS\usc_spanish.dll 2006-12-17 19:11 13,312 --a------ C:\WINDOWS\usc_italian.dll 2006-12-09 23:34 2006-12-09 23:26 2006-12-09 23:20 18,432 --a------ C:\WINDOWS\system32\drivers\prcmondrv1041.sys 2006-12-06 17:49 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe 2006-12-06 17:49 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2006-12-06 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2006-12-04 21:39 90,112 --a------ C:\WINDOWS\system32\regdacl.exe 2006-12-04 21:39 53,248 --a------ C:\WINDOWS\system32\process.exe 2006-12-04 21:39 42,496 --a------ C:\WINDOWS\system32\swreg.exe 2006-12-04 21:39 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-12-04 21:39 4,096 --a------ C:\WINDOWS\system32\reboot.exe 2006-12-04 21:39 2006-12-02 11:47 2006-12-01 15:25 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2006-11-27 21:33 80 --a------ C:\WINDOWS\gmer_uninstall.cmd (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-26 11:00 -------- d-------- C:\Program Files\Mozilla Firefox 2006-12-26 10:59 -------- d-------- C:\Program Files\BlackICE 2006-12-25 17:01 -------- d-------- C:\Program Files\GameJack 5 2006-12-24 20:04 -------- d-------- C:\Program Files\eMule 2006-12-19 19:05 16384 --a------ C:\WINDOWS\system32\restart.exe 2006-12-19 14:07 -------- d-------- C:\Program Files\Gadu-Gadu 2006-12-18 12:25 -------- d-------- C:\Program Files\Active Security Monitor 2006-12-17 10:52 -------- d-------- C:\Program Files\Internet Explorer 2006-12-17 10:51 -------- d-------- C:\Program Files\Outlook Express 2006-12-17 10:51 -------- d-------- C:\Program Files\Common Files\System 2006-12-16 22:37 25992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe 2006-12-14 18:11 -------- d–h----- C:\Program Files\InstallShield Installation Information 2006-12-09 22:31 -------- d-------- C:\Program Files\Registry Defragmentation 2006-12-09 22:30 -------- d-------- C:\Documents and Settings\User\Dane aplikacji\Registry Booster 2006-12-07 06:29 2374472 --a------ C:\WINDOWS\system32\wmvcore.dll 2006-11-23 18:25 -------- d-------- C:\Program Files\RivaTuner v2.0 RC 16.1 2006-11-12 12:14 -------- d-------- C:\Program Files\Spybot S&D 2006-11-08 06:07 679424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-11-04 13:39 -------- d-------- C:\Documents and Settings\User\Dane aplikacji\Google 2006-11-02 12:07 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2006-11-02 10:54 -------- d-------- C:\Program Files\Common Files\PocketSoft 2006-11-02 10:54 -------- d-------- C:\Program Files\Common Files 2006-11-01 19:49 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2006-11-01 19:40 -------- d-------- C:\Program Files\Registry Repair 2006-11-01 19:31 -------- d-------- C:\Documents and Settings\User\Dane aplikacji\Uniblue 2006-10-29 15:14 -------- d-------- C:\Program Files\Common Files\3DO Shared 2006-10-29 15:07 -------- d-------- C:\Program Files\3DO 2006-10-28 17:05 -------- d-------- C:\Program Files\Google 2006-10-22 15:06 208896 --a------ C:\WINDOWS\system32\nvusmb.exe 2006-10-22 15:06 208896 --a------ C:\WINDOWS\system32\nvunrm.exe 2006-10-22 15:06 208896 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2006-10-22 15:06 208896 --a------ C:\WINDOWS\system32\nvuide.exe 2006-10-22 15:06 208896 --a------ C:\WINDOWS\system32\nvugart.exe 2006-10-22 12:22 888832 --a------ C:\WINDOWS\system32\nvmobls.dll 2006-10-22 12:22 86016 --a------ C:\WINDOWS\system32\nvmctray.dll 2006-10-22 12:22 81920 --a------ C:\WINDOWS\system32\nvwddi.dll 2006-10-22 12:22 794624 --a------ C:\WINDOWS\system32\nvcplui.exe 2006-10-22 12:22 7700480 --a------ C:\WINDOWS\system32\nvcpl.dll 2006-10-22 12:22 581632 --a------ C:\WINDOWS\system32\nvhwvid.dll 2006-10-22 12:22 5644288 --a------ C:\WINDOWS\system32\nvoglnt.dll 2006-10-22 12:22 5619712 --a------ C:\WINDOWS\system32\nvdisps.dll 2006-10-22 12:22 5255168 --a------ C:\WINDOWS\system32\nvdispsr.dll 2006-10-22 12:22 466944 --a------ C:\WINDOWS\system32\nvshell.dll 2006-10-22 12:22 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll 2006-10-22 12:22 4527488 --a------ C:\WINDOWS\system32\nv4_disp.dll 2006-10-22 12:22 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll 2006-10-22 12:22 442368 --a------ C:\WINDOWS\system32\nvappbar.exe 2006-10-22 12:22 425984 --a------ C:\WINDOWS\system32\keystone.exe 2006-10-22 12:22 35840 --a------ C:\WINDOWS\system32\nvcodins.dll 2006-10-22 12:22 35840 --a------ C:\WINDOWS\system32\nvcod.dll 2006-10-22 12:22 335872 --a------ C:\WINDOWS\system32\nvwrses.dll 2006-10-22 12:22 335872 --a------ C:\WINDOWS\system32\nvwrsel.dll 2006-10-22 12:22 327680 --a------ C:\WINDOWS\system32\nvwrsfr.dll 2006-10-22 12:22 327680 --a------ C:\WINDOWS\system32\nvwrsesm.dll 2006-10-22 12:22 323584 --a------ C:\WINDOWS\system32\nvwrspt.dll 2006-10-22 12:22 323584 --a------ C:\WINDOWS\system32\nvwrsit.dll 2006-10-22 12:22 323584 --a------ C:\WINDOWS\system32\nvrshe.dll 2006-10-22 12:22 323584 --a------ C:\WINDOWS\system32\nvrsar.dll 2006-10-22 12:22 3203072 --a------ C:\WINDOWS\system32\nvgamesr.dll 2006-10-22 12:22 319488 --a------ C:\WINDOWS\system32\nvwrsptb.dll 2006-10-22 12:22 319488 --a------ C:\WINDOWS\system32\nvwrsnl.dll 2006-10-22 12:22 315392 --a------ C:\WINDOWS\system32\nvwrsru.dll 2006-10-22 12:22 315392 --a------ C:\WINDOWS\system32\nvwrshu.dll 2006-10-22 12:22 311296 --a------ C:\WINDOWS\system32\nvwrsde.dll 2006-10-22 12:22 311296 --a------ C:\WINDOWS\system32\nvexpbar.dll 2006-10-22 12:22 3047424 --a------ C:\WINDOWS\system32\nvgames.dll 2006-10-22 12:22 303104 --a------ C:\WINDOWS\system32\nvwrstr.dll 2006-10-22 12:22 303104 --a------ C:\WINDOWS\system32\nvwrssl.dll 2006-10-22 12:22 303104 --a------ C:\WINDOWS\system32\nvwrsfi.dll 2006-10-22 12:22 299008 --a------ C:\WINDOWS\system32\nvwrssk.dll 2006-10-22 12:22 299008 --a------ C:\WINDOWS\system32\nvwrsno.dll 2006-10-22 12:22 2973696 --a------ C:\WINDOWS\system32\nvvitvsr.dll 2006-10-22 12:22 294912 --a------ C:\WINDOWS\system32\nvwrssv.dll 2006-10-22 12:22 294912 --a------ C:\WINDOWS\system32\nvwrspl.dll 2006-10-22 12:22 294912 --a------ C:\WINDOWS\system32\nvwrsda.dll 2006-10-22 12:22 2924544 --a------ C:\WINDOWS\system32\nvvitvs.dll 2006-10-22 12:22 286720 --a------ C:\WINDOWS\system32\nvwrseng.dll 2006-10-22 12:22 286720 --a------ C:\WINDOWS\system32\nvwrscs.dll 2006-10-22 12:22 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2006-10-22 12:22 2859008 --a------ C:\WINDOWS\system32\nvmoblsr.dll 2006-10-22 12:22 282624 --a------ C:\WINDOWS\system32\nvwrsar.dll 2006-10-22 12:22 278528 --a------ C:\WINDOWS\system32\nvwrshe.dll 2006-10-22 12:22 278528 --a------ C:\WINDOWS\system32\nvrsfr.dll 2006-10-22 12:22 274432 --a------ C:\WINDOWS\system32\nvrsit.dll 2006-10-22 12:22 274432 --a------ C:\WINDOWS\system32\nvrses.dll 2006-10-22 12:22 274432 --a------ C:\WINDOWS\system32\nvrsel.dll 2006-10-22 12:22 270336 --a------ C:\WINDOWS\system32\nvrsde.dll 2006-10-22 12:22 266240 --a------ C:\WINDOWS\system32\nvrspt.dll 2006-10-22 12:22 266240 --a------ C:\WINDOWS\system32\nvrsnl.dll 2006-10-22 12:22 266240 --a------ C:\WINDOWS\system32\nvrsesm.dll 2006-10-22 12:22 262144 --a------ C:\WINDOWS\system32\nvrsru.dll 2006-10-22 12:22 262144 --a------ C:\WINDOWS\system32\nvrsptb.dll 2006-10-22 12:22 262144 --a------ C:\WINDOWS\system32\nvrsja.dll 2006-10-22 12:22 258048 --a------ C:\WINDOWS\system32\nvrsko.dll 2006-10-22 12:22 253952 --a------ C:\WINDOWS\system32\nvrshu.dll 2006-10-22 12:22 249856 --a------ C:\WINDOWS\system32\nvrstr.dll 2006-10-22 12:22 249856 --a------ C:\WINDOWS\system32\nvrssl.dll 2006-10-22 12:22 249856 --a------ C:\WINDOWS\system32\nvrssk.dll 2006-10-22 12:22 249856 --a------ C:\WINDOWS\system32\nvrspl.dll 2006-10-22 12:22 249856 --a------ C:\WINDOWS\system32\nvrsno.dll 2006-10-22 12:22 245760 --a------ C:\WINDOWS\system32\nvrssv.dll 2006-10-22 12:22 245760 --a------ C:\WINDOWS\system32\nvrsda.dll 2006-10-22 12:22 241664 --a------ C:\WINDOWS\system32\nvrsfi.dll 2006-10-22 12:22 241664 --a------ C:\WINDOWS\system32\nvrseng.dll 2006-10-22 12:22 241664 --a------ C:\WINDOWS\system32\nvrscs.dll 2006-10-22 12:22 229376 --a------ C:\WINDOWS\system32\nvmccs.dll 2006-10-22 12:22 221184 --a------ C:\WINDOWS\system32\nvrszhc.dll 2006-10-22 12:22 212992 --a------ C:\WINDOWS\system32\nvwrsja.dll 2006-10-22 12:22 212992 --a------ C:\WINDOWS\system32\nvapi.dll 2006-10-22 12:22 208896 --a------ C:\WINDOWS\system32\nvudisp.exe 2006-10-22 12:22 196608 --a------ C:\WINDOWS\system32\nvwrsko.dll 2006-10-22 12:22 188416 --a------ C:\WINDOWS\system32\nvmccss.dll 2006-10-22 12:22 1732608 --a------ C:\WINDOWS\system32\nvwssr.dll 2006-10-22 12:22 167936 --a------ C:\WINDOWS\system32\nvwrszht.dll 2006-10-22 12:22 1662976 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2006-10-22 12:22 163840 --a------ C:\WINDOWS\system32\nvwrszhc.dll 2006-10-22 12:22 1622016 --a------ C:\WINDOWS\system32\nwiz.exe 2006-10-22 12:22 159810 --a------ C:\WINDOWS\system32\nvsvc32.exe 2006-10-22 12:22 147456 --a------ C:\WINDOWS\system32\nvcolor.exe 2006-10-22 12:22 1470464 --a------ C:\WINDOWS\system32\nview.dll 2006-10-22 12:22 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe 2006-10-22 12:22 1236992 --a------ C:\WINDOWS\system32\nvwss.dll 2006-10-22 12:22 118784 --a------ C:\WINDOWS\system32\nvrszht.dll 2006-10-22 12:22 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll 2006-10-22 12:22 1011712 --a------ C:\WINDOWS\system32\nvcpluir.dll 2006-10-21 04:05 40960 --a------ C:\WINDOWS\system32\frapsvid.dll 2006-10-20 02:41 714240 --a------ C:\WINDOWS\system32\sxs.dll 2006-10-13 13:41 65536 --a------ C:\WINDOWS\system32\nwwks.dll 2006-10-13 13:41 64000 --a------ C:\WINDOWS\system32\nwapi32.dll 2006-10-13 13:41 143872 --a------ C:\WINDOWS\system32\nwprovau.dll 2006-10-04 13:39 61440 --a------ C:\WINDOWS\keygen.dll 2006-10-03 19:51 86016 --a------ C:\WINDOWS\system32\OpenAL32.dll 2006-10-03 19:51 262144 --a------ C:\WINDOWS\system32\wrap_oal.dll 2006-10-02 20:04 806912 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2006-10-02 20:04 806912 --a------ C:\WINDOWS\system32\divx_xx07.dll 2006-10-02 20:04 790528 --a------ C:\WINDOWS\system32\divx_xx11.dll 2006-10-02 20:04 635486 --a------ C:\WINDOWS\system32\DivX.dll 2006-10-02 14:37 724992 --a------ C:\WINDOWS\iun6002.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “CursorXP”=“C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe” “EVEREST Ultimate Edition 2006”=“D:\Downloads\Programy\Everest Ultimate 3\everest.exe” “AWMON”="“C:\PROGRA~1\Ad-Aware SE Professional\Ad-Watch.exe”" “Fraps”=“C:\PROGRAM FILES\FRAPS\FRAPS.EXE” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” “BootSkin Startup Jobs”="“C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs" “NvCplDaemon”=“RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” “NvMediaCenter”=“RunDLL32.exe NvMCTray.dll,NvTaskbarInit” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] “Installed”=“1” “NoChange”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] “Installed”=“1” [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] “DeskHtmlVersion”=dword:00000110 “DeskHtmlMinorVersion”=dword:00000005 “Settings”=dword:00000001 “GeneralFlags”=dword:00000004 [HKEY_USERS.default\software\microsoft\windows\currentversion\runonce] “SIA7”="“C:\Program Files\Steganos Internet Anonym 7\SIA7.exe” -firstboot" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce] “SIA7”="“C:\Program Files\Steganos Internet Anonym 7\SIA7.exe” -firstboot" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] “{438755C2-A8BA-11D1-B96B-00A0C90312E1}”=“Moduł wstępnego ładowania interfejsu Browseui” “{8C7461EF-2B13-11d2-BE35-3078302C2030}”=“Demon buforu kategorii składników” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] “{AEB6717E-7E19-11d0-97EE-00C04FD91972}”="" “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“AVG Anti-Spyware 7.5” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] “DisableRegedit”=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSMBalloonTip”=dword:00000000 “CDRAutoRun”=dword:00000001 “NoDriveTypeAutoRun”=dword:00000091 “NoLowDiskSpaceChecks”=dword:00000000 “NoClose”=dword:00000000 “NoAutoTrayNotify”=dword:00000000 “NoResolveTrack”=dword:00000000 “NoResolveSearch”=dword:00000000 “LinkResolveIgnoreLinkInfo”=dword:00000000 “NoStartBanner”=hex:00,00,00,00 “NoWelcomeScreen”=dword:00000000 “NoDesktopCleanupWizard”=dword:00000000 “ForceClassicControlPanel”=dword:00000000 “NoSMConfigurePrograms”=dword:00000001 “NoDrives”=dword:00000000 “MemCheckBoxInRunDlg”=dword:00000000 “NoSharedDocuments_XXX_Temp”=hex:01,00,00,00 “NoRecentDocsMenu”=dword:00000001 “NoFavoritesMenu”=dword:00000000 “NoSMMyDocs”=dword:00000000 “NoSMMyPictures”=dword:00000000 “NoStartMenuMyMusic”=dword:00000000 “NoRecentDocsHistory”=dword:00000001 “ClearRecentDocsOnExit”=dword:00000001 “NoRecentDocsNetHood”=dword:00000000 “NoSMHelp”=dword:00000000 “NoRun”=dword:00000000 “NoUserNameInStartMenu”=dword:00000001 “NoStartMenuPinnedList”=dword:00000000 “NoSharedDocuments”=dword:00000001 “NoRecycleFiles”=dword:00000001 “GreyMSIAds”=dword:00000001 “NoViewOnDrive”=dword:00000000 “NoLogoff”=dword:00000000 “NoInstrumentation”=dword:00000001 “ForceStartMenuLogoff”=dword:00000001 “NoAddPrinter”=hex:01,00,00,00 “NoDeletePrinter”=hex:01,00,00,00 “NoSaveSettings”=dword:00000000 “NoThemesTab”=“1” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “dontdisplaylastusername”=dword:00000001 “legalnoticecaption”="" “legalnoticetext”="" “shutdownwithoutlogon”=dword:00000001 “undockwithoutlogon”=dword:00000001 “RunStartupScriptSync”=dword:00000000 “SynchronousMachineGroupPolicy”=dword:00000000 “SynchronousUserGroupPolicy”=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoRemoteRecursiveEvents”=dword:00000001 “NoStrCmpLogical”=dword:00000000 “NoClose”=dword:00000000 “LinkResolveIgnoreLinkInfo”=dword:00000000 “NoResolveSearch”=dword:00000001 “NoRecentDocsMenu”=dword:00000001 “NoFavoritesMenu”=dword:00000000 “NoSMMyDocs”=dword:00000000 “NoSMMyPictures”=dword:00000000 “NoStartMenuMyMusic”=dword:00000000 “NoRecentDocsHistory”=dword:00000001 “NoRecentDocsNetHood”=dword:00000000 “NoSMHelp”=dword:00000000 “NoRun”=dword:00000000 “NoInstrumentation”=dword:00000001 “NoSimpleStartMenu”=dword:00000001 “ClearRecentDocsOnExit”=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_USERS.default\software\microsoft\windows\currentversion\policies\explorer] “NoDriveTypeAutoRun”=hex:91,00,00,00 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] “NoDriveTypeAutoRun”=hex:91,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] “PostBootReminder”="{7849596a-48ea-486e-8937-a2a3009f31a9}" “CDBurn”="{fbeb8a05-beee-4442-804e-409d6c4515e9}" “WebCheck”="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" “SysTray”="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TuneUp MemOptimizer] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“MemOptimizer” “hkey”=“HKCU” “inimapping”=“0” [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] “SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll” Completion time: 06-12-26 11:12:49.89 C:\ComboFix.txt … 06-12-26 11:12

Widzę jakiś wpis z TuneUp a już nie mam programu, jak można się go pozbyć?

Bieniol · 26 Grudzień 2006 10:53

Otwórz notatnik i wklej w nim to:

Plik -> zapisz jako -> zmień rozszerzenie na wszystkie pliki -> zapisz pod nazwą FIX.REG

Odpal plik FIX.REG i potwierdź dodanie do rejestru i reset kompa

Jak wygląda sytuacja z kompem?

kennex · 27 Grudzień 2006 20:07

Spybot, Ad-Aware, AVG, Avast! czysto. Ściągnąłem SpySweeper:

W wersji niezarejestrowanej nie ma opcji usuń, usunąłbym ręcznie, ale nie znam lokalizacji

Bieniol · 27 Grudzień 2006 20:14

Tym bardziej my nie znamy tej lokalizacji, ponieważ wróżki na składzie nie mamy

Skoro AVG i inne skanery pokazują, że jest czysto nie przejmuj się

kennex · 8 Styczeń 2007 18:42

Ok już nawet tego nie mam . Ale mam pytanko.

PPM na Mój Komputer i Właściwości, Zaawansowane, Ustawienia przy Uruchamianie i Odzyskiwanie.

Tutaj można wyłączyć i wybrać domyślny system operacyjny lub ten sam system z innym bootscrenem bez potrzeby wybierania —> OK.

Start, Uruchom, control userpasswords2 i odptaszkować opcję w zakładce Użytkownicy a z zakładki Zaawansowane wejść

w Zarządzanie Użytkownikami i wyłączyć wszystkie prócz swojego konta z uprawnieniami administratora. Nie trzeba będzie się logować za każdym razem ----> OK.

Jak przywrócić/włączyć podstawowy niebieski ekran powitalny i pożegnalny?

Wyświetla mi się te małe okienko, gdzie wpisywałem wcześniej (zanim wykonałem poprzednie czynności) login i hasło.

Chciałbym mieć z powrotem niebiesko tło z napisem zapraszamy

Dzięki za odpowiedź :mrgreen:

adam9870 · 8 Styczeń 2007 19:44

Poczytaj:

Zmiana ekranów startowych

kennex · 9 Styczeń 2007 16:32

W linku jest porada, jak je usunąć, ale działa to w odwrotną stronę. Ja mam włączoną opcję “używaj ekranu powitalnego”, lecz mi go nie wyświetla.

Czy jest możliwe, że szablon usunął mi się z dysku? Kiedyś miałem program LogonStudio, ale był płatny i po usunięciu znów wracało do podstawowego.

Teraz nawet tego nie mam .

Otóż mam jeszcze problem, nie umiem zmienić strony startowej ani innych ustawień Internet Explorera, jak można tą blokadę usunąć?

Dam logi na wszelki wypadek (w SR chyba to widać).

Logfile of HijackThis v1.99.1 Scan saved at 17:26, on 07-01-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe D:\Downloads\Programy\Everest Ultimate 3\everest.exe C:\PROGRAM FILES\FRAPS\FRAPS.EXE C:\Program Files\Rainlendar\Rainlendar.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Registry Defragmentation\RegManServ.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Spy Sweeper\SpySweeper.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\WINDOWS\system32\msiexec.exe D:\Downloads\Programy\Hijack This.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = <*KenneX*> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot S&D\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-2fe89c996183} - c:\program files\steganos internet anonym 7\sia7iep.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [bootSkin Startup Jobs] “C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs O4 - HKLM…\Run: [NvCplDaemon] “RUNDLL32.EXE” C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [NvMediaCenter] “RunDLL32.exe” NvMCTray.dll,NvTaskbarInit O4 - HKLM…\Run: [spySweeper] “C:\Program Files\Spy Sweeper\SpySweeperUI.exe” /startintray O4 - HKLM…\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k O4 - HKCU…\Run: [CursorXP] “C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe” O4 - HKCU…\Run: [EVEREST Ultimate Edition 2006] “D:\Downloads\Programy\Everest Ultimate 3\everest.exe” O4 - HKCU…\Run: [Fraps] “C:\PROGRAM FILES\FRAPS\FRAPS.EXE” O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Registry Defragmentation\RegManServ.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Spy Sweeper\SpySweeper.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CursorXP” = ““C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe”” [" "] “EVEREST Ultimate Edition 2006” = ““D:\Downloads\Programy\Everest Ultimate 3\everest.exe”” [“Lavalys, Inc.”] “Fraps” = ““C:\PROGRAM FILES\FRAPS\FRAPS.EXE”” [“Beepa P/L”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “BootSkin Startup Jobs” = ““C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs” [empty string] “NvCplDaemon” = ““RUNDLL32.EXE” C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “NvMediaCenter” = ““RunDLL32.exe” NvMCTray.dll,NvTaskbarInit” [MS] “SpySweeper” = ““C:\Program Files\Spy Sweeper\SpySweeperUI.exe” /startintray” [“Webroot Software, Inc.”] “KernelFaultCheck” = “C:\WINDOWS\system32\dumprep 0 -k” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\PROGRA~1\Spybot S&D\SDHelper.dll” [“Safer Networking Limited”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] {C333CF63-767F-4831-94AC-E683D962C63C}(Default) = (no title provided) -> {HKLM…CLSID} = “CoTGT_BHO Class” \InProcServer32(Default) = “C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” = “UnlockerShellExtension” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{EFA24E62-B078-11d0-89E4-00C04FC9E26E}” = “History Band” -> {HKLM…CLSID} = “History Band” \InProcServer32(Default) = “C:\WINDOWS\system32\SHDOCVW.DLL” [MS] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” = “Webroot Spy Sweeper Context Menu Integration” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“Anti-Malware Development a.s.”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ “System” = (value not set) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> WRNotifier\DLLName = “WRLogonNTF.dll” [“Webroot Software, Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] Default executables: -------------------- HKLM\Software\Classes.hta\ = (key not found) Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoSMBalloonTip” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “CDRAutoRun” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoLowDiskSpaceChecks” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoClose” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoAutoTrayNotify” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveTrack” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartBanner” = (REG_BINARY) hex:00 00 00 00 {Remove “Click here to begin” from Start button} “NoWelcomeScreen” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoDesktopCleanupWizard” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “ForceClassicControlPanel” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMConfigurePrograms” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoDrives” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “MemCheckBoxInRunDlg” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments_XXX_Temp” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Favorites menu from Start Menu} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Documents menu from Start Menu} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove My Pictures icon from Start Menu} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoUserNameInStartMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoStartMenuPinnedList” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments” = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Remove Shared Documents from My Computer} “NoRecycleFiles” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “GreyMSIAds” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoViewOnDrive” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoLogoff” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System|Logon/Logoff| Disable Logoff} “NoInstrumentation” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ForceStartMenuLogoff” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoAddPrinter” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoDeletePrinter” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoSaveSettings” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop| Don’t save settings at exit} “NoThemesTab” = (REG_SZ) 1 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoRemoteRecursiveEvents” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoStrCmpLogical” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoClose” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoInstrumentation” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoSimpleStartMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegedit” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “DisableRegistryTools” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\ “DisableWindowsUpdateAccess” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Update| Remove access to use all Windows Update features} HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\ “NoUpdateCheck” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “RunStartupScriptSync” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “SynchronousMachineGroupPolicy” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “SynchronousUserGroupPolicy” = (REG_DWORD) hex:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\CopperDeckII_1600.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\CopperDeckII_1600.bmp” Startup items in “User” & “All Users” startup folders: ------------------------------------------------------ C:\Documents and Settings\User\Menu Start\Programy\Autostart “Rainlendar” -> shortcut to: “C:\Program Files\Rainlendar\Rainlendar.exe” [“Rainy”] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\System32\nwprovau.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\Program Files\Secure Surfing Engine\sselsp.dll [null data], 01 - 03, 22 %SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 09 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] “{00000000-5736-4205-0008-2FE89C996183}” -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{00000000-5736-4205-0008-2FE89C996183}” -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{00000000-5736-4205-0008-2FE89C996183}” = (no title provided) -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{00000000-5736-4205-0009-2FE89C996183}(Default) = “Prywatna lista ulubionych Steganos” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to “Reset Web Settings”) Added lines (compared with English-language version): : ˙ţ[V e r s i o n] : S i g n a t u r e = " $ C H I C A G O $ " : A d v a n c e d I N F = 2 . 5 , " Y o u n e e d a n e w v e r s i o n o f a d v p a c k . d l l " : : [R e s t o r e H o m e P a g e] : A d d R e g = R e s t o r e H o m e P a g e . r e g : : [R e s t o r e B r o w s e r S e t t i n g s] : A d d R e g = R e s t o r e B r o w s e r S e t t i n g s . r e g : D e l R e g = D e l e t e T e m p l a t e s . r e g , D e l e t e A u t o s e a r c h . r e g : : [R e s t o r e H o m e P a g e . r e g] : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S t a r t P a g e " , 0 , % S T A R T _ P A G E _ U R L % : : [R e s t o r e B r o w s e r S e t t i n g s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ P a g e _ U R L " , 0 , % S T A R T _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ S e a r c h _ U R L " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 1 " , 0 , " w w w . % s . c o m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 2 " , 0 , " w w w . % s . o r g " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 3 " , 0 , " w w w . % s . n e t " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 4 " , 0 , " w w w . % s . e d u " : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ S e a r c h U r l " , " P r o v i d e r " , 0 , " " : : t m " : t m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ I n t e r n e t S e t t i n g s \ S a f e S i t e s " , % S A F E S I T E _ V A L U E % , 0 , " h t t p : / / i e . s e a r c h . m s n . c o m / * " : : [D e l e t e T e m p l a t e s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 5 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 6 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 7 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 8 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 9 " : : [D e l e t e A u t o s e a r c h . r e g] : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " A u t o S e a r c h " : : [S t r i n g s] : S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : S E A R C H _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & a r = i e s e a r c h " : S A F E S I T E _ V A L U E = " i e . s e a r c h . m s n . c o m " : : ; I M P O R T A N T N O T E : : ; I E b r a n d i n g d l l ( i e d k c s 3 2 . d l l ) u s e s t h e f o l l o w i n g e n t r i e s t o r e s t o r e t h e d e f a u l t M S v a l u e s . : ; I n t h e v a n i l l a v e r s i o n o f I E , t h e v a l u e s m u s t b e t h e s a m e a s t h e i r c o r r e s p o n d i n g n o n M S _ * v a l u e s . : ; F o r e x a m p l e , S T A R T _ P A G E _ U R L a n d M S _ S T A R T _ P A G E _ U R L m u s t h a v e t h e s a m e U R L i n t h e I E v e r s i o n r e l e a s e d b y M S . : M S _ S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : Missing lines (compared with English-language version): [Version]: 2 lines [RestoreHomePage]: 1 line [RestoreHomePage.reg]: 1 line [RestoreBrowserSettings.reg]: 12 lines [DeleteTemplates.reg]: 5 lines [DeleteAutosearch.reg]: 1 line [strings]: 1 line [RestoreBrowserSettings]: 2 lines [strings]: 3 lines Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, “C:\Program Files\AVG Anti-Spyware 7.5\guard.exe” [“Anti-Malware Development a.s.”] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] Registry Management Service, RegManServ, “C:\Program Files\Registry Defragmentation\RegManServ.exe” [null data] StyleXPService, StyleXPService, ““C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe”” [empty string] Sunbelt Kerio Personal Firewall 4, KPF4, ““C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe”” [“Sunbelt Software”] Webroot Spy Sweeper Engine, WebrootSpySweeperService, ““C:\Program Files\Spy Sweeper\SpySweeper.exe”” [“Webroot Software, Inc.”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 34 seconds, including 3 seconds for message boxes)

Pojawia się też bluescreen dotyczący pliku afd.sys:

Bieniol · 9 Styczeń 2007 17:49

Otwórz notatnik i wklej w nim to:

Plik -> zapisz jako -> zmień rozszerzenie na wszystkie pliki -> zapisz pod nazwą FIX.REG

Odpal plik FIX.REG i potwierdź dodanie do rejestru i reset kompa

Ściągnij i zastosuj -> UnHookExec.inf

Po zabiegach nowe logi

kennex · 9 Styczeń 2007 18:18

Logfile of HijackThis v1.99.1 Scan saved at 19:19, on 07-01-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe D:\Downloads\Programy\Everest Ultimate 3\everest.exe C:\PROGRAM FILES\FRAPS\FRAPS.EXE C:\Program Files\Rainlendar\Rainlendar.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Registry Defragmentation\RegManServ.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Spy Sweeper\SpySweeper.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Winamp\winamp.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Gadu-Gadu\gg.exe D:\Downloads\Programy\Hijack This.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = <*KenneX*> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot S&D\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-2fe89c996183} - c:\program files\steganos internet anonym 7\sia7iep.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [bootSkin Startup Jobs] “C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs O4 - HKLM…\Run: [NvCplDaemon] “RUNDLL32.EXE” C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [NvMediaCenter] “RunDLL32.exe” NvMCTray.dll,NvTaskbarInit O4 - HKLM…\Run: [spySweeper] “C:\Program Files\Spy Sweeper\SpySweeperUI.exe” /startintray O4 - HKLM…\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k O4 - HKCU…\Run: [CursorXP] “C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe” O4 - HKCU…\Run: [EVEREST Ultimate Edition 2006] “D:\Downloads\Programy\Everest Ultimate 3\everest.exe” O4 - HKCU…\Run: [Fraps] “C:\PROGRAM FILES\FRAPS\FRAPS.EXE” O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Registry Defragmentation\RegManServ.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Spy Sweeper\SpySweeper.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CursorXP” = ““C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe”” [" “] “EVEREST Ultimate Edition 2006” = ““D:\Downloads\Programy\Everest Ultimate 3\everest.exe”” [“Lavalys, Inc.”] “Fraps” = ““C:\PROGRAM FILES\FRAPS\FRAPS.EXE”” [“Beepa P/L”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “BootSkin Startup Jobs” = ““C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs” [empty string] “NvCplDaemon” = ““RUNDLL32.EXE” C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “NvMediaCenter” = ““RunDLL32.exe” NvMCTray.dll,NvTaskbarInit” [MS] “SpySweeper” = ““C:\Program Files\Spy Sweeper\SpySweeperUI.exe” /startintray” [“Webroot Software, Inc.”] “KernelFaultCheck” = “C:\WINDOWS\system32\dumprep 0 -k” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\PROGRA~1\Spybot S&D\SDHelper.dll” [“Safer Networking Limited”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] {C333CF63-767F-4831-94AC-E683D962C63C}(Default) = (no title provided) -> {HKLM…CLSID} = “CoTGT_BHO Class” \InProcServer32(Default) = “C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” = “UnlockerShellExtension” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{EFA24E62-B078-11d0-89E4-00C04FC9E26E}” = “History Band” -> {HKLM…CLSID} = “History Band” \InProcServer32(Default) = “C:\WINDOWS\system32\SHDOCVW.DLL” [MS] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” = “Webroot Spy Sweeper Context Menu Integration” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“Anti-Malware Development a.s.”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> WRNotifier\DLLName = “WRLogonNTF.dll” [“Webroot Software, Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] Default executables: -------------------- HKLM\Software\Classes.hta\ = (key not found) <> HKLM\Software\Classes\scrfile\shell\open\command(Default) = “”%1” %*" [file not found] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoSMBalloonTip” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “CDRAutoRun” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoLowDiskSpaceChecks” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoClose” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoAutoTrayNotify” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveTrack” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartBanner” = (REG_BINARY) hex:00 00 00 00 {Remove “Click here to begin” from Start button} “NoWelcomeScreen” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoDesktopCleanupWizard” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “ForceClassicControlPanel” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMConfigurePrograms” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoDrives” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “MemCheckBoxInRunDlg” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments_XXX_Temp” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Favorites menu from Start Menu} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Documents menu from Start Menu} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove My Pictures icon from Start Menu} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoUserNameInStartMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoStartMenuPinnedList” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments” = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Remove Shared Documents from My Computer} “NoRecycleFiles” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “GreyMSIAds” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoViewOnDrive” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoLogoff” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System|Logon/Logoff| Disable Logoff} “NoInstrumentation” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ForceStartMenuLogoff” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoAddPrinter” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoDeletePrinter” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoSaveSettings” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop| Don’t save settings at exit} “NoThemesTab” = (REG_SZ) 1 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoRemoteRecursiveEvents” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoStrCmpLogical” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoClose” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoInstrumentation” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoSimpleStartMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegedit” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “DisableRegistryTools” = (REG_SZ) 0 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\ “DisableWindowsUpdateAccess” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Update| Remove access to use all Windows Update features} HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\ “NoUpdateCheck” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “RunStartupScriptSync” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “SynchronousMachineGroupPolicy” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “SynchronousUserGroupPolicy” = (REG_DWORD) hex:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\CopperDeckII_1600.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\CopperDeckII_1600.bmp” Startup items in “User” & “All Users” startup folders: ------------------------------------------------------ C:\Documents and Settings\User\Menu Start\Programy\Autostart “Rainlendar” -> shortcut to: “C:\Program Files\Rainlendar\Rainlendar.exe” [“Rainy”] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\System32\nwprovau.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\Program Files\Secure Surfing Engine\sselsp.dll [null data], 01 - 03, 22 %SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 09 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] “{00000000-5736-4205-0008-2FE89C996183}” -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{00000000-5736-4205-0008-2FE89C996183}” -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{00000000-5736-4205-0008-2FE89C996183}” = (no title provided) -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{00000000-5736-4205-0009-2FE89C996183}(Default) = “Prywatna lista ulubionych Steganos” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to “Reset Web Settings”) Added lines (compared with English-language version): : ˙ţ[V e r s i o n] : S i g n a t u r e = " $ C H I C A G O $ " : A d v a n c e d I N F = 2 . 5 , " Y o u n e e d a n e w v e r s i o n o f a d v p a c k . d l l " : : [R e s t o r e H o m e P a g e] : A d d R e g = R e s t o r e H o m e P a g e . r e g : : [R e s t o r e B r o w s e r S e t t i n g s] : A d d R e g = R e s t o r e B r o w s e r S e t t i n g s . r e g : D e l R e g = D e l e t e T e m p l a t e s . r e g , D e l e t e A u t o s e a r c h . r e g : : [R e s t o r e H o m e P a g e . r e g] : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S t a r t P a g e " , 0 , % S T A R T _ P A G E _ U R L % : : [R e s t o r e B r o w s e r S e t t i n g s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ P a g e _ U R L " , 0 , % S T A R T _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ S e a r c h _ U R L " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 1 " , 0 , " w w w . % s . c o m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 2 " , 0 , " w w w . % s . o r g " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 3 " , 0 , " w w w . % s . n e t " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 4 " , 0 , " w w w . % s . e d u " : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ S e a r c h U r l " , " P r o v i d e r " , 0 , " " : : t m " : t m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ I n t e r n e t S e t t i n g s \ S a f e S i t e s " , % S A F E S I T E _ V A L U E % , 0 , " h t t p : / / i e . s e a r c h . m s n . c o m / * " : : [D e l e t e T e m p l a t e s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 5 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 6 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 7 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 8 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 9 " : : [D e l e t e A u t o s e a r c h . r e g] : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " A u t o S e a r c h " : : [S t r i n g s] : S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : S E A R C H _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & a r = i e s e a r c h " : S A F E S I T E _ V A L U E = " i e . s e a r c h . m s n . c o m " : : ; I M P O R T A N T N O T E : : ; I E b r a n d i n g d l l ( i e d k c s 3 2 . d l l ) u s e s t h e f o l l o w i n g e n t r i e s t o r e s t o r e t h e d e f a u l t M S v a l u e s . : ; I n t h e v a n i l l a v e r s i o n o f I E , t h e v a l u e s m u s t b e t h e s a m e a s t h e i r c o r r e s p o n d i n g n o n M S _ * v a l u e s . : ; F o r e x a m p l e , S T A R T _ P A G E _ U R L a n d M S _ S T A R T _ P A G E _ U R L m u s t h a v e t h e s a m e U R L i n t h e I E v e r s i o n r e l e a s e d b y M S . : M S _ S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : Missing lines (compared with English-language version): [Version]: 2 lines [RestoreHomePage]: 1 line [RestoreHomePage.reg]: 1 line [RestoreBrowserSettings.reg]: 12 lines [DeleteTemplates.reg]: 5 lines [DeleteAutosearch.reg]: 1 line [strings]: 1 line [RestoreBrowserSettings]: 2 lines [strings]: 3 lines Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, “C:\Program Files\AVG Anti-Spyware 7.5\guard.exe” [“Anti-Malware Development a.s.”] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] Registry Management Service, RegManServ, “C:\Program Files\Registry Defragmentation\RegManServ.exe” [null data] StyleXPService, StyleXPService, ““C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe”” [empty string] Sunbelt Kerio Personal Firewall 4, KPF4, ““C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe”” [“Sunbelt Software”] Webroot Spy Sweeper Engine, WebrootSpySweeperService, ““C:\Program Files\Spy Sweeper\SpySweeper.exe”” [“Webroot Software, Inc.”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 48 seconds, including 3 seconds for message boxes)

Bieniol · 9 Styczeń 2007 18:24

Logi są już ok

kennex · 14 Styczeń 2007 21:17

Coś złapałem, i to jeszcze z Kerio, SpySweeper’em i Avastem w tle, omg :P.

Logfile of HijackThis v1.99.1 Scan saved at 22:15, on 07-01-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Spy Sweeper\SpySweeperUI.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spy Sweeper\SpySweeper.exe D:\Downloads\Programy\Everest Ultimate 3\everest.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Rainlendar\Rainlendar.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\eMule\emule.exe C:\Program Files\uTorrent\uTorrent.exe D:\Downloads\Programy\Hijack This.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = <*KenneX*> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza F2 - REG:system.ini: Shell=Explorer.exe scvhost.exe F3 - REG:win.ini: run=C:\WINDOWS\scvhost.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot S&D\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-2fe89c996183} - c:\program files\steganos internet anonym 7\sia7iep.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [bootSkin Startup Jobs] “C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs O4 - HKLM…\Run: [NvCplDaemon] “RUNDLL32.EXE” C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [NvMediaCenter] “RunDLL32.exe” NvMCTray.dll,NvTaskbarInit O4 - HKLM…\Run: [spySweeper] “C:\Program Files\Spy Sweeper\SpySweeperUI.exe” /startintray O4 - HKLM…\Run: [Windows Update] C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [msconfig] C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [icq lite] C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [update Checker] C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [AntiVir] C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [Windows Update] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [msconfig] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [icq lite] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [update Checker] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [AntiVir] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [Windows Update] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [msconfig] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [icq lite] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [update Checker] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [AntiVir] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [] C:\WINDOWS\scvhost.exe O4 - HKCU…\Run: [CursorXP] C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe O4 - HKCU…\Run: [Fraps] “C:\PROGRAM FILES\FRAPS\FRAPS.EXE” O4 - HKCU…\Run: [Kerio Personal Firewall] “C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe” O4 - HKCU…\Run: [Everest] “D:\Downloads\Programy\Everest Ultimate 3\everest.exe” O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_08) - O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} (Java Plug-in 1.5.0_08) - O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.5.0_08) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Spy Sweeper\SpySweeper.exe

Gutek · 14 Styczeń 2007 21:36

F2 - REG:system.ini: Shell=Explorer.exe scvhost.exe F3 - REG:win.ini: run=C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [Windows Update] C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [msconfig] C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [icq lite] C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [update Checker] C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [AntiVir] C:\WINDOWS\scvhost.exe O4 - HKLM…\Run: [] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [Windows Update] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [msconfig] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [icq lite] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [update Checker] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [AntiVir] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunServices: [] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [Windows Update] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [msconfig] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [icq lite] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [update Checker] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [AntiVir] C:\WINDOWS\scvhost.exe O4 - HKLM…\RunOnce: [] C:\WINDOWS\scvhost.exe O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_08) - O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} (Java Plug-in 1.5.0_08) - O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.5.0_08) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

wpisy usuń HJT

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot i w polu Full Path of File to Delete wklejasz ścieżkę

C:\WINDOWS\scvhost.exe

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

kennex · 14 Styczeń 2007 21:55

Dziękuję .

Logfile of HijackThis v1.99.1 Scan saved at 22:53, on 07-01-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Spy Sweeper\SpySweeperUI.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spy Sweeper\SpySweeper.exe D:\Downloads\Programy\Everest Ultimate 3\everest.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Rainlendar\Rainlendar.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\eMule\emule.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE D:\Downloads\Programy\Hijack This.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = <*KenneX*> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot S&D\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-2fe89c996183} - c:\program files\steganos internet anonym 7\sia7iep.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [bootSkin Startup Jobs] “C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs O4 - HKLM…\Run: [NvCplDaemon] “RUNDLL32.EXE” C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [NvMediaCenter] “RunDLL32.exe” NvMCTray.dll,NvTaskbarInit O4 - HKLM…\Run: [spySweeper] “C:\Program Files\Spy Sweeper\SpySweeperUI.exe” /startintray O4 - HKCU…\Run: [CursorXP] C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe O4 - HKCU…\Run: [Fraps] “C:\PROGRAM FILES\FRAPS\FRAPS.EXE” O4 - HKCU…\Run: [Kerio Personal Firewall] “C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe” O4 - HKCU…\Run: [Everest] “D:\Downloads\Programy\Everest Ultimate 3\everest.exe” O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Spy Sweeper\SpySweeper.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CursorXP” = “C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe” [" “] “Fraps” = ““C:\PROGRAM FILES\FRAPS\FRAPS.EXE”” [“Beepa P/L”] “Kerio Personal Firewall” = ““C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe”” [“Sunbelt Software”] “Everest” = ““D:\Downloads\Programy\Everest Ultimate 3\everest.exe”” [“Lavalys, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “BootSkin Startup Jobs” = ““C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs” [empty string] “NvCplDaemon” = ““RUNDLL32.EXE” C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “NvMediaCenter” = ““RunDLL32.exe” NvMCTray.dll,NvTaskbarInit” [MS] “SpySweeper” = ““C:\Program Files\Spy Sweeper\SpySweeperUI.exe” /startintray” [“Webroot Software, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\ {++} “msconfig” = “C:\WINDOWS\scvhost.exe” [file not found] “Update Checker” = “C:\WINDOWS\scvhost.exe” [file not found] “(Default)” = “C:\WINDOWS\scvhost.exe” [file not found] HKLM\Software\Microsoft\Active Setup\Installed Components\ {CD00DB00-F21D-A767-E000-C4BF580C3EA1}(Default) = (no title provided) \StubPath = “C:\WINDOWS\scvhost.exe” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\PROGRA~1\Spybot S&D\SDHelper.dll” [“Safer Networking Limited”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] {C333CF63-767F-4831-94AC-E683D962C63C}(Default) = (no title provided) -> {HKLM…CLSID} = “CoTGT_BHO Class” \InProcServer32(Default) = “C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” = “UnlockerShellExtension” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{EFA24E62-B078-11d0-89E4-00C04FC9E26E}” = “History Band” -> {HKLM…CLSID} = “History Band” \InProcServer32(Default) = “C:\WINDOWS\system32\SHDOCVW.DLL” [MS] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” = “Webroot Spy Sweeper Context Menu Integration” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“Anti-Malware Development a.s.”] HKLM\System\CurrentControlSet\Control\Session Manager\ <> “BootExecute” = “autocheck autochk *”|“pgdfgsvc C 1 -o” [“Sysinternals - http://www.sysinternals.com”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> WRNotifier\DLLName = “WRLogonNTF.dll” [“Webroot Software, Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] Default executables: -------------------- HKLM\Software\Classes.hta\ = (key not found) <> HKLM\Software\Classes\scrfile\shell\open\command(Default) = “”%1” %*" [file not found] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoSMBalloonTip” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “CDRAutoRun” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoLowDiskSpaceChecks” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoClose” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoAutoTrayNotify” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveTrack” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartBanner” = (REG_BINARY) hex:00 00 00 00 {Remove “Click here to begin” from Start button} “NoWelcomeScreen” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoDesktopCleanupWizard” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “ForceClassicControlPanel” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMConfigurePrograms” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoDrives” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “MemCheckBoxInRunDlg” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments_XXX_Temp” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Favorites menu from Start Menu} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Documents menu from Start Menu} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove My Pictures icon from Start Menu} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoUserNameInStartMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoStartMenuPinnedList” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments” = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Remove Shared Documents from My Computer} “NoRecycleFiles” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “GreyMSIAds” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoViewOnDrive” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoLogoff” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System|Logon/Logoff| Disable Logoff} “NoInstrumentation” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ForceStartMenuLogoff” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoAddPrinter” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoDeletePrinter” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoSaveSettings” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop| Don’t save settings at exit} “NoThemesTab” = (REG_SZ) 1 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoRemoteRecursiveEvents” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoStrCmpLogical” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoClose” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoInstrumentation” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoSimpleStartMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegedit” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “DisableRegistryTools” = (REG_SZ) 0 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\ “DisableWindowsUpdateAccess” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Update| Remove access to use all Windows Update features} HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\ “NoUpdateCheck” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “RunStartupScriptSync” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “SynchronousMachineGroupPolicy” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “SynchronousUserGroupPolicy” = (REG_DWORD) hex:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\CopperDeckII_1600.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\CopperDeckII_1600.bmp” Startup items in “User” & “All Users” startup folders: ------------------------------------------------------ C:\Documents and Settings\User\Menu Start\Programy\Autostart “Rainlendar” -> shortcut to: “C:\Program Files\Rainlendar\Rainlendar.exe” [“Rainy”] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\System32\nwprovau.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\Program Files\Secure Surfing Engine\sselsp.dll [null data], 01 - 03, 22 %SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 09 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] “{00000000-5736-4205-0008-2FE89C996183}” -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{00000000-5736-4205-0008-2FE89C996183}” -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{00000000-5736-4205-0008-2FE89C996183}” = (no title provided) -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{00000000-5736-4205-0009-2FE89C996183}(Default) = “Prywatna lista ulubionych Steganos” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to “Reset Web Settings”) Added lines (compared with English-language version): : ˙ţ[V e r s i o n] : S i g n a t u r e = " $ C H I C A G O $ " : A d v a n c e d I N F = 2 . 5 , " Y o u n e e d a n e w v e r s i o n o f a d v p a c k . d l l " : : [R e s t o r e H o m e P a g e] : A d d R e g = R e s t o r e H o m e P a g e . r e g : : [R e s t o r e B r o w s e r S e t t i n g s] : A d d R e g = R e s t o r e B r o w s e r S e t t i n g s . r e g : D e l R e g = D e l e t e T e m p l a t e s . r e g , D e l e t e A u t o s e a r c h . r e g : : [R e s t o r e H o m e P a g e . r e g] : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S t a r t P a g e " , 0 , % S T A R T _ P A G E _ U R L % : : [R e s t o r e B r o w s e r S e t t i n g s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ P a g e _ U R L " , 0 , % S T A R T _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ S e a r c h _ U R L " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 1 " , 0 , " w w w . % s . c o m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 2 " , 0 , " w w w . % s . o r g " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 3 " , 0 , " w w w . % s . n e t " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 4 " , 0 , " w w w . % s . e d u " : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ S e a r c h U r l " , " P r o v i d e r " , 0 , " " : : t m " : t m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ I n t e r n e t S e t t i n g s \ S a f e S i t e s " , % S A F E S I T E _ V A L U E % , 0 , " h t t p : / / i e . s e a r c h . m s n . c o m / * " : : [D e l e t e T e m p l a t e s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 5 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 6 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 7 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 8 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 9 " : : [D e l e t e A u t o s e a r c h . r e g] : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " A u t o S e a r c h " : : [S t r i n g s] : S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : S E A R C H _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & a r = i e s e a r c h " : S A F E S I T E _ V A L U E = " i e . s e a r c h . m s n . c o m " : : ; I M P O R T A N T N O T E : : ; I E b r a n d i n g d l l ( i e d k c s 3 2 . d l l ) u s e s t h e f o l l o w i n g e n t r i e s t o r e s t o r e t h e d e f a u l t M S v a l u e s . : ; I n t h e v a n i l l a v e r s i o n o f I E , t h e v a l u e s m u s t b e t h e s a m e a s t h e i r c o r r e s p o n d i n g n o n M S _ * v a l u e s . : ; F o r e x a m p l e , S T A R T _ P A G E _ U R L a n d M S _ S T A R T _ P A G E _ U R L m u s t h a v e t h e s a m e U R L i n t h e I E v e r s i o n r e l e a s e d b y M S . : M S _ S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : Missing lines (compared with English-language version): [Version]: 2 lines [RestoreHomePage]: 1 line [RestoreHomePage.reg]: 1 line [RestoreBrowserSettings.reg]: 12 lines [DeleteTemplates.reg]: 5 lines [DeleteAutosearch.reg]: 1 line [strings]: 1 line [RestoreBrowserSettings]: 2 lines [strings]: 3 lines Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] StyleXPService, StyleXPService, ““C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe”” [empty string] Sunbelt Kerio Personal Firewall 4, KPF4, ““C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe”” [“Sunbelt Software”] Webroot Spy Sweeper Engine, WebrootSpySweeperService, ““C:\Program Files\Spy Sweeper\SpySweeper.exe”” [“Webroot Software, Inc.”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 32 seconds. ---------- (total run time: 81 seconds)

adam9870 · 14 Styczeń 2007 22:04

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG i uruchom go w trybie awaryjnym.

Dodatkowo start >>> uruchom >>> regdit >>> przejdź do klucza:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

i usuń z prawokliku wartość, która będzie miała dane C:\WINDOWS\scvhost.exe.

Po wykonaniu wklej nowe logi.

kennex · 28 Styczeń 2007 22:34

Nowe logi (trochę minęło ):

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CursorXP” = ““C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe”” [" “] “Fraps” = ““C:\PROGRAM FILES\FRAPS\FRAPS.EXE”” [“Beepa P/L”] “Kerio Personal Firewall” = ““C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe”” [“Sunbelt Software”] “Everest” = ““D:\Downloads\Programy\Everest Ultimate 3\everest.exe”” [“Lavalys, Inc.”] “Steam” = ““f:\pacsteam\steam.exe” -silent” [“Valve Corporation”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “BootSkin Startup Jobs” = ““C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs” [empty string] “NvCplDaemon” = ““RUNDLL32.EXE” C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “NvMediaCenter” = ““RunDLL32.exe” NvMCTray.dll,NvTaskbarInit” [MS] “SpySweeper” = ““C:\Program Files\Spy Sweeper\SpySweeperUI.exe” /startintray” [“Webroot Software, Inc.”] “KernelFaultCheck” = “C:\WINDOWS\system32\dumprep 0 -k” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\PROGRA~1\Spybot S&D\SDHelper.dll” [“Safer Networking Limited”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] {C333CF63-767F-4831-94AC-E683D962C63C}(Default) = (no title provided) -> {HKLM…CLSID} = “CoTGT_BHO Class” \InProcServer32(Default) = “C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” = “UnlockerShellExtension” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{EFA24E62-B078-11d0-89E4-00C04FC9E26E}” = “History Band” -> {HKLM…CLSID} = “History Band” \InProcServer32(Default) = “C:\WINDOWS\system32\SHDOCVW.DLL” [MS] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” = “Webroot Spy Sweeper Context Menu Integration” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“Anti-Malware Development a.s.”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> WRNotifier\DLLName = “WRLogonNTF.dll” [“Webroot Software, Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Spy Sweeper\SSCtxMnu.dll” [“Webroot Software, Inc.”] UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] Default executables: -------------------- HKLM\Software\Classes.hta\ = (key not found) <> HKLM\Software\Classes\scrfile\shell\open\command(Default) = “”%1” %*" [file not found] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoSMBalloonTip” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “CDRAutoRun” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoLowDiskSpaceChecks” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoClose” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoAutoTrayNotify” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveTrack” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartBanner” = (REG_BINARY) hex:00 00 00 00 {Remove “Click here to begin” from Start button} “NoWelcomeScreen” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoDesktopCleanupWizard” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “ForceClassicControlPanel” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMConfigurePrograms” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoDrives” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “MemCheckBoxInRunDlg” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments_XXX_Temp” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Favorites menu from Start Menu} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Documents menu from Start Menu} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove My Pictures icon from Start Menu} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoUserNameInStartMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoStartMenuPinnedList” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments” = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Remove Shared Documents from My Computer} “NoRecycleFiles” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “GreyMSIAds” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoViewOnDrive” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoLogoff” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System|Logon/Logoff| Disable Logoff} “NoInstrumentation” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ForceStartMenuLogoff” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoAddPrinter” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoDeletePrinter” = (REG_BINARY) hex:01 00 00 00 {unrecognized setting} “NoSaveSettings” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop| Don’t save settings at exit} “NoThemesTab” = (REG_SZ) 1 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoRemoteRecursiveEvents” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoStrCmpLogical” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoClose” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoInstrumentation” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoSimpleStartMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegedit” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\ “DisableWindowsUpdateAccess” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Update| Remove access to use all Windows Update features} HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\ “NoUpdateCheck” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “RunStartupScriptSync” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “SynchronousMachineGroupPolicy” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “SynchronousUserGroupPolicy” = (REG_DWORD) hex:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\CopperDeckII_1600.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\CopperDeckII_1600.bmp” Startup items in “User” & “All Users” startup folders: ------------------------------------------------------ C:\Documents and Settings\User\Menu Start\Programy\Autostart “Rainlendar” -> shortcut to: “C:\Program Files\Rainlendar\Rainlendar.exe” [“Rainy”] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\System32\nwprovau.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\Program Files\Secure Surfing Engine\sselsp.dll [null data], 01 - 03, 22 %SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 09 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] “{00000000-5736-4205-0008-2FE89C996183}” -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{00000000-5736-4205-0008-2FE89C996183}” -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{00000000-5736-4205-0008-2FE89C996183}” = (no title provided) -> {HKLM…CLSID} = “Steganos Internet Anonym” \InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{00000000-5736-4205-0009-2FE89C996183}(Default) = “Prywatna lista ulubionych Steganos” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “c:\program files\steganos internet anonym 7\sia7iep.dll” [null data] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to “Reset Web Settings”) Added lines (compared with English-language version): : ˙ţ[V e r s i o n] : S i g n a t u r e = " $ C H I C A G O $ " : A d v a n c e d I N F = 2 . 5 , " Y o u n e e d a n e w v e r s i o n o f a d v p a c k . d l l " : : [R e s t o r e H o m e P a g e] : A d d R e g = R e s t o r e H o m e P a g e . r e g : : [R e s t o r e B r o w s e r S e t t i n g s] : A d d R e g = R e s t o r e B r o w s e r S e t t i n g s . r e g : D e l R e g = D e l e t e T e m p l a t e s . r e g , D e l e t e A u t o s e a r c h . r e g : : [R e s t o r e H o m e P a g e . r e g] : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S t a r t P a g e " , 0 , % S T A R T _ P A G E _ U R L % : : [R e s t o r e B r o w s e r S e t t i n g s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ P a g e _ U R L " , 0 , % S T A R T _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ S e a r c h _ U R L " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 1 " , 0 , " w w w . % s . c o m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 2 " , 0 , " w w w . % s . o r g " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 3 " , 0 , " w w w . % s . n e t " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 4 " , 0 , " w w w . % s . e d u " : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ S e a r c h U r l " , " P r o v i d e r " , 0 , " " : : t m " : t m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ I n t e r n e t S e t t i n g s \ S a f e S i t e s " , % S A F E S I T E _ V A L U E % , 0 , " h t t p : / / i e . s e a r c h . m s n . c o m / * " : : [D e l e t e T e m p l a t e s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 5 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 6 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 7 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 8 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 9 " : : [D e l e t e A u t o s e a r c h . r e g] : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " A u t o S e a r c h " : : [S t r i n g s] : S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : S E A R C H _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & a r = i e s e a r c h " : S A F E S I T E _ V A L U E = " i e . s e a r c h . m s n . c o m " : : ; I M P O R T A N T N O T E : : ; I E b r a n d i n g d l l ( i e d k c s 3 2 . d l l ) u s e s t h e f o l l o w i n g e n t r i e s t o r e s t o r e t h e d e f a u l t M S v a l u e s . : ; I n t h e v a n i l l a v e r s i o n o f I E , t h e v a l u e s m u s t b e t h e s a m e a s t h e i r c o r r e s p o n d i n g n o n M S _ * v a l u e s . : ; F o r e x a m p l e , S T A R T _ P A G E _ U R L a n d M S _ S T A R T _ P A G E _ U R L m u s t h a v e t h e s a m e U R L i n t h e I E v e r s i o n r e l e a s e d b y M S . : M S _ S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : Missing lines (compared with English-language version): [Version]: 2 lines [RestoreHomePage]: 1 line [RestoreHomePage.reg]: 1 line [RestoreBrowserSettings.reg]: 12 lines [DeleteTemplates.reg]: 5 lines [DeleteAutosearch.reg]: 1 line [strings]: 1 line [RestoreBrowserSettings]: 2 lines [strings]: 3 lines Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, “C:\Program Files\AVG Anti-Spyware 7.5\guard.exe” [“Anti-Malware Development a.s.”] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] StyleXPService, StyleXPService, ““C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe”” [empty string] Webroot Spy Sweeper Engine, WebrootSpySweeperService, ““C:\Program Files\Spy Sweeper\SpySweeper.exe”” [“Webroot Software, Inc.”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 89 seconds, including 34 seconds for message boxes)

“User” - 07-01-28 23:07:51 Dodatek Service Pack 2 ComboFix 07-01-25 - Running from: “C:\Documents and Settings\User\Pulpit” ((((((((((((((((((((((((((((((( Files Created from 2006-12-28 to 2007-01-28 )))))))))))))))))))))))))))))))))) 2007-01-24 23:40 2007-01-24 22:08 2007-01-22 20:41 2007-01-22 20:41 2007-01-21 18:16 2007-01-21 18:15 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2007-01-21 18:14 2007-01-21 18:14 2007-01-20 11:21 2007-01-15 14:50 178,408 --a------ C:\WINDOWS\system32\muweb.dll 2007-01-15 14:50 173,536 --a------ C:\WINDOWS\system32\wuweb.dll 2007-01-14 21:01 2007-01-13 16:20 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll 2007-01-13 16:20 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll 2007-01-13 16:20 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll 2007-01-13 13:35 2007-01-09 17:16 2007-01-09 06:40 2007-01-07 14:29 381,952 --a------ C:\WINDOWS\system32\system32.exe 2007-01-06 20:23 2006-12-28 18:11 57,344 --a------ C:\WINDOWS\Unwash6.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-01-28 23:03 -------- d-------- C:\Program Files\mozilla firefox 2007-01-28 12:14 -------- d-------- C:\Program Files\spy sweeper 2007-01-28 01:08 -------- d-------- C:\Program Files\avg anti-spyware 7.5 2007-01-24 22:59 25992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe 2007-01-21 18:16 -------- d–h----- C:\Program Files\installshield installation information 2007-01-21 15:44 -------- d-------- C:\Program Files\emule 2007-01-21 15:35 -------- d-------- C:\Program Files\spybot s&d 2007-01-20 12:28 -------- d-------- C:\Program Files\gamejack 5 2007-01-20 11:17 -------- d-------- C:\Program Files\fraps 2007-01-18 22:20 -------- d-------- C:\Program Files\registryfix 2007-01-18 22:20 -------- d-------- C:\Program Files\registry speedup 2007-01-18 22:20 -------- d-------- C:\Program Files\regdoctor 2007-01-18 22:20 -------- d-------- C:\Program Files\regcure 2007-01-18 22:00 -------- d-------- C:\DOCUME~1\User\Dane aplikacji\utorrent 2007-01-15 18:32 689280 --a------ C:\WINDOWS\system32\aswboot.exe 2007-01-15 18:26 23352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-01-15 18:25 43176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-01-14 21:01 724992 --a------ C:\WINDOWS\iun6002.exe 2007-01-12 12:18 90112 --a------ C:\WINDOWS\system32\avastss.scr 2006-12-28 18:12 -------- d-------- C:\DOCUME~1\User\Dane aplikacji\webroot 2006-12-28 18:06 -------- d-------- C:\DOCUME~1\User\Dane aplikacji\registry booster 2006-12-25 12:34 49152 --a------ C:\WINDOWS\winmload.exe 2006-12-24 20:29 -------- d-------- C:\Program Files\ageia technologies 2006-12-21 00:56 94424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2006-12-21 00:56 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2006-12-21 00:51 31560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2006-12-19 19:05 90112 --a------ C:\WINDOWS\system32\regdacl.exe 2006-12-19 19:05 53248 --a------ C:\WINDOWS\system32\process.exe 2006-12-19 19:05 42496 --a------ C:\WINDOWS\system32\swreg.exe 2006-12-19 19:05 40960 --a------ C:\WINDOWS\system32\swsc.exe 2006-12-19 19:05 4096 --a------ C:\WINDOWS\system32\reboot.exe 2006-12-19 19:05 16384 --a------ C:\WINDOWS\system32\restart.exe 2006-12-19 14:07 -------- d-------- C:\Program Files\gadu-gadu 2006-12-09 23:20 18432 --a------ C:\WINDOWS\system32\drivers\prcmondrv1041.sys 2006-12-08 14:49 15872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys 2006-12-08 14:49 15360 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2006-12-08 14:49 14848 --a------ C:\WINDOWS\system32\drivers\SSFS0509.sys 2006-12-08 14:49 122368 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys 2006-12-07 06:29 2374472 --a------ C:\WINDOWS\system32\wmvcore.dll 2006-12-02 11:47 -------- d-------- C:\DOCUME~1\User\Dane aplikacji\pf 2006-12-01 15:25 98304 --a------ C:\WINDOWS\system32\cmdlineext.dll 2006-12-01 05:20 79360 --a------ C:\WINDOWS\system32\swxcacls.exe 2006-11-27 21:33 80 --a------ C:\WINDOWS\gmer_uninstall.cmd 2006-11-08 06:07 679424 --a------ C:\WINDOWS\system32\inetcomm.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “CursorXP”="“C:\Program Files\Stardock\Object Desktop\CursorXP\CursorXP.exe”" “Fraps”="“C:\PROGRAM FILES\FRAPS\FRAPS.EXE”" “Kerio Personal Firewall”="“C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe”" “Everest”="“D:\Downloads\Programy\Everest Ultimate 3\everest.exe”" “Steam”="“f:\pacsteam\steam.exe” -silent" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” “BootSkin Startup Jobs”="“C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe” /StartupJobs" “NvCplDaemon”="“RUNDLL32.EXE” C:\WINDOWS\system32\NvCpl.dll,NvStartup" “NvMediaCenter”="“RunDLL32.exe” NvMCTray.dll,NvTaskbarInit" “SpySweeper”="“C:\Program Files\Spy Sweeper\SpySweeperUI.exe” /startintray" “KernelFaultCheck”=“C:\WINDOWS\system32\dumprep 0 -k” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] “Installed”=“1” “NoChange”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] “Installed”=“1” [HKEY_USERS.default\software\microsoft\windows\currentversion\runonce] “SIA7”="“C:\Program Files\Steganos Internet Anonym 7\SIA7.exe” -firstboot" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce] “SIA7”="“C:\Program Files\Steganos Internet Anonym 7\SIA7.exe” -firstboot" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“AVG Anti-Spyware 7.5” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “RunStartupScriptSync”=dword:00000000 “SynchronousMachineGroupPolicy”=dword:00000000 “SynchronousUserGroupPolicy”=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] “DisableRegedit”=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoRemoteRecursiveEvents”=dword:00000001 “NoStrCmpLogical”=dword:00000000 “NoClose”=dword:00000000 “LinkResolveIgnoreLinkInfo”=dword:00000000 “NoResolveSearch”=dword:00000001 “NoRecentDocsMenu”=dword:00000001 “NoFavoritesMenu”=dword:00000000 “NoSMMyDocs”=dword:00000000 “NoSMMyPictures”=dword:00000000 “NoStartMenuMyMusic”=dword:00000000 “NoRecentDocsHistory”=dword:00000001 “NoRecentDocsNetHood”=dword:00000000 “NoSMHelp”=dword:00000000 “NoRun”=dword:00000000 “NoInstrumentation”=dword:00000001 “NoSimpleStartMenu”=dword:00000001 “ClearRecentDocsOnExit”=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSMBalloonTip”=dword:00000000 “CDRAutoRun”=dword:00000001 “NoLowDiskSpaceChecks”=dword:00000000 “NoClose”=dword:00000000 “NoAutoTrayNotify”=dword:00000000 “NoResolveTrack”=dword:00000000 “NoResolveSearch”=dword:00000000 “LinkResolveIgnoreLinkInfo”=dword:00000000 “NoStartBanner”=hex:00,00,00,00 “NoWelcomeScreen”=dword:00000000 “NoDesktopCleanupWizard”=dword:00000000 “ForceClassicControlPanel”=dword:00000000 “NoSMConfigurePrograms”=dword:00000001 “MemCheckBoxInRunDlg”=dword:00000000 “NoSharedDocuments_XXX_Temp”=hex:01,00,00,00 “NoRecentDocsMenu”=dword:00000001 “NoFavoritesMenu”=dword:00000000 “NoSMMyDocs”=dword:00000000 “NoSMMyPictures”=dword:00000000 “NoStartMenuMyMusic”=dword:00000000 “NoRecentDocsHistory”=dword:00000001 “ClearRecentDocsOnExit”=dword:00000001 “NoRecentDocsNetHood”=dword:00000000 “NoSMHelp”=dword:00000000 “NoRun”=dword:00000000 “NoUserNameInStartMenu”=dword:00000001 “NoStartMenuPinnedList”=dword:00000000 “NoSharedDocuments”=dword:00000001 “NoRecycleFiles”=dword:00000001 “GreyMSIAds”=dword:00000001 “NoViewOnDrive”=dword:00000000 “NoLogoff”=dword:00000000 “NoInstrumentation”=dword:00000001 “ForceStartMenuLogoff”=dword:00000001 “NoAddPrinter”=hex:01,00,00,00 “NoDeletePrinter”=hex:01,00,00,00 “NoSaveSettings”=dword:00000000 “NoThemesTab”=“1” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] “SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll” HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_EVERESTDRIVER Completion time: 07-01-28 23:14:11

(http://spywarefiles.prevx.com/RRDJDE1896/system32%252Eexe.html)

Cyżby siedział tydzień wcześniej od ostatniego sprawdzenia loga?