Problem z rundll - log do sprawdzenia

Range_Rover · 6 Styczeń 2007 00:38

Bardzo proszę o sprawdzenie loga w związku z tym problemem

http://forum.dobreprogramy.pl/viewtopic … 02643a71ef

Z góry dziękuje

Logfile of HijackThis v1.99.1 Scan saved at 01:39:07, on 2007-01-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Apache Software Foundation\Apache2.2\bin\httpd.exe F:\Program Files\Kaspersky Lab\AVP6\avp.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\system32\UAService7.exe C:\Apache Software Foundation\Apache2.2\bin\httpd.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe E:\Program Files\Winamp\winampa.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe F:\Program Files\Kaspersky Lab\AVP6\avp.exe D:\Program Files\Skype\Phone\Skype.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\AutoConnect\AutoConnect.exe D:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe D:\Program Files\Kalendarz XP\Kalendarz.exe C:\Program Files\LClock\LClock.exe D:\Program Files\ObjectDock\ObjectDock.exe D:\Program Files\Opera\Opera.exe D:\Program Files\mozilla.org\Mozilla\mozilla.exe D:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\Documents and Settings\All Users\Dane aplikacji\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\LieDetector.exe E:\Program Files\BearShare\BearShare.exe C:\DOCUME~1\aab\USTAWI~1\Temp\Rar$EX00.344\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\PROGRA~1\FLASHGET\jccatch.dll O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll (file missing) O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\ivo\Expressivo Demo\IH_iexplore.dll O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - E:\PROGRA~1\FLASHGET\getflash.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll (file missing) O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\ivo\Expressivo Demo\IH_iexplore.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\PROGRA~1\FLASHGET\fgiebar.dll O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll (file missing) O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [LogonStudio] “E:\Program Files\WinCustomize\LogonStudio\logonstudio.exe” /RANDOM O4 - HKLM…\Run: [WinampAgent] E:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [Google Desktop Search] “C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” /startup O4 - HKLM…\Run: [RemoteControl] “F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [Realtime Audio Engine] mmrtkrnl.exe O4 - HKLM…\Run: [Advanced Message Server] rundll32.exe usb496.dat,Execute O4 - HKLM…\Run: [Kaspersky Anti-Virus 2006] F:\Program Files\Kaspersky Lab\AVP6\avp.exe O4 - HKCU…\Run: [skype] “D:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [AutoConnect] D:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - Startup: Stardock ObjectDock.lnk = D:\Program Files\ObjectDock\ObjectDock.exe O4 - Startup: HideBUS.lnk = C:\Documents and Settings\aab\Moje dokumenty\HideBUS.exe O4 - Global Startup: Kalendarz XP.lnk = D:\Program Files\Kalendarz XP\Kalendarz.exe O4 - Global Startup: LClock.lnk = C:\Program Files\LClock\LClock.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Subscribe in Desktop Sidebar - res://E:\Program Files\Desktop Sidebar\sbhelp.dll/menuhandler.html O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - E:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - E:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - E:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra ‘Tools’ menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - E:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra button: Script Checker - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - F:\Program Files\Kaspersky Lab\AVP6\scieplugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\Program Files\IrfanView\Ebay\Ebay.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s … wflash.cab O17 - HKLM\System\CCS\Services\Tcpip…{B051070D-0947-4E42-BF4F-893FF802E34B}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: wbsys.dll,C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O20 - Winlogon Notify: WBSrv - D:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll O23 - Service: Apache2.2 - Unknown owner - C:\Apache Software Foundation\Apache2.2\bin\httpd.exe" -k runservice (file missing) O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVP - Kaspersky Lab - F:\Program Files\Kaspersky Lab\AVP6\avp.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Joan · 6 Styczeń 2007 00:46

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll (file missing) O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll (file missing) O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll (file missing) O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll (file missing) O4 - HKLM…\Run: [Advanced Message Server] rundll32.exe usb496.dat,Execute O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML

Wpisy zafixuj, zaznaczony plik do wycięcia w trybie awaryjnym.

Po zabiegach nowe logi z HiJacka oraz Silent Runners (zaznaczasz No i czekasz aż skończy pracować w tle).

squeet · 6 Styczeń 2007 08:16

Proszę zmienić tytuł swojego tematu na konkretny, mówiący o problemie.

W tym celu proszę użyć przycisku

Monczkin · 6 Styczeń 2007 09:17

Proszę takie rzeczy zamieszczać w jednym temacie. Wprowadzasz zamieszanie i bałagan.

Range_Rover · 6 Styczeń 2007 12:02

Logfile of HijackThis v1.99.1 Scan saved at 12:57:21, on 2007-01-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe E:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe E:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE C:\WINDOWS\system32\svchost.exe E:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Apache Software Foundation\Apache2.2\bin\httpd.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE E:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe C:\Apache Software Foundation\Apache2.2\bin\httpd.exe C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe E:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe E:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe C:\WINDOWS\system32\UAService7.exe E:\Program Files\Panda Software\Panda Internet Security 2007\apvxdwin.exe E:\Program Files\Winamp\winampa.exe D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe D:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe E:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE e:\program files\panda software\panda internet security 2007\WebProxy.exe C:\Program Files\LClock\LClock.exe D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe D:\Program Files\ObjectDock\ObjectDock.exe C:\Documents and Settings\aab\Pulpit\hijackthis\HijackThis.exe D:\Program Files\Opera\Opera.exe C:\WINDOWS\SYSTEM32\cidaemon.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\PROGRA~1\FLASHGET\jccatch.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\ivo\Expressivo Demo\IH_iexplore.dll O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - E:\PROGRA~1\FLASHGET\getflash.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\ivo\Expressivo Demo\IH_iexplore.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\PROGRA~1\FLASHGET\fgiebar.dll O4 - HKLM…\Run: [WinampAgent] E:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [tguard] E:\Program Files\Beniamin\tguard.exe O4 - HKLM…\Run: [sunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [sCANINICIO] “E:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe” O4 - HKLM…\Run: [RemoteControl] “F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [Realtime Audio Engine] mmrtkrnl.exe O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [LogonStudio] “E:\Program Files\WinCustomize\LogonStudio\logonstudio.exe” /RANDOM O4 - HKLM…\Run: [keyboard] C:\windows\keyboard3.exe O4 - HKLM…\Run: [iTunesHelper] “D:\Program Files\iTunes\iTunesHelper.exe” O4 - HKLM…\Run: [Google Desktop Search] “C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” /startup O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [APVXDWIN] “E:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE” /s O4 - HKCU…\Run: [VoipBuster] “E:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe” -nosplash -minimized O4 - HKCU…\Run: [skype] “D:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [intelitech Finance Reminder] E:\Program Files\Intelitech\Menedżer Finansów\Reminder.exe O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [AutoConnect] D:\Program Files\AutoConnect\AutoConnect.exe O4 - Startup: Stardock ObjectDock.lnk = D:\Program Files\ObjectDock\ObjectDock.exe O4 - Startup: HideBUS.lnk = C:\Documents and Settings\aab\Moje dokumenty\HideBUS.exe O4 - Global Startup: LClock.lnk = C:\Program Files\LClock\LClock.exe O4 - Global Startup: Kalendarz XP.lnk = D:\Program Files\Kalendarz XP\Kalendarz.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Subscribe in Desktop Sidebar - res://E:\Program Files\Desktop Sidebar\sbhelp.dll/menuhandler.html O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - E:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - E:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - E:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra ‘Tools’ menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - E:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\Program Files\IrfanView\Ebay\Ebay.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s … wflash.cab O17 - HKLM\System\CCS\Services\Tcpip…{B051070D-0947-4E42-BF4F-893FF802E34B}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: wbsys.dll,C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll O20 - Winlogon Notify: WBSrv - D:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll O23 - Service: Apache2.2 - Unknown owner - C:\Apache Software Foundation\Apache2.2\bin\httpd.exe" -k runservice (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - E:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - E:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - E:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - E:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O23 - Service: Panda TPSrv (TPSrv) - Panda Software - E:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

i

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “VoipBuster” = ““E:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe” -nosplash -minimized” [file not found] “Skype” = ““D:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “Intelitech Finance Reminder” = “E:\Program Files\Intelitech\Menedżer Finansów\Reminder.exe” [file not found] “Gadu-Gadu” = ““D:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] “ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “AutoConnect” = “D:\Program Files\AutoConnect\AutoConnect.exe” [“http://autoconnect.prv.pl”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “WinampAgent” = “E:\Program Files\Winamp\winampa.exe” [null data] “tguard” = “E:\Program Files\Beniamin\tguard.exe” [file not found] “SunJavaUpdateSched” = “D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [“Sun Microsystems, Inc.”] “SpeedTouch USB Diagnostics” = ““C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon” [“THOMSON Telecom Belgium”] “SCANINICIO” = ““E:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe”” [“Panda Software International”] “RemoteControl” = ““F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”” [“Cyberlink Corp.”] “Realtime Audio Engine” = “mmrtkrnl.exe” [“ALCATech”] “QuickTime Task” = ““C:\Program Files\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “LogonStudio” = ““E:\Program Files\WinCustomize\LogonStudio\logonstudio.exe” /RANDOM” [“Stardock and Luca Saggese”] “keyboard” = “C:\windows\keyboard3.exe” [file not found] “iTunesHelper” = ““D:\Program Files\iTunes\iTunesHelper.exe”” [“Apple Computer, Inc.”] “Google Desktop Search” = ““C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” /startup” [“Google”] “Cmaudio” = “RunDll32 cmicnfg.cpl,CMICtrlWnd” [MS] “ATIPTA” = “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [“ATI Technologies, Inc.”] “APVXDWIN” = ““E:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE” /s” [“Panda Software International”] HKLM\Software\Microsoft\Active Setup\Installed Components\ >{881dd1c5-3dcf-431b-b061-f3f88e8be88a}(Default) = “Outlook Express” \StubPath = “C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}(Default) = (no title provided) -> {HKLM…CLSID} = “IeCatch5 Class” \InProcServer32(Default) = “E:\PROGRA~1\FLASHGET\jccatch.dll” [“FlashGet”] {85F685C3-20D9-4943-95E4-EB4224056C3F}(Default) = (no title provided) -> {HKLM…CLSID} = “Expressivo” \InProcServer32(Default) = “D:\Program Files\ivo\Expressivo Demo\IH_iexplore.dll” [“IVO Software Sp. z o.o.”] {F156768E-81EF-470C-9057-481BA8380DBA}(Default) = (no title provided) -> {HKLM…CLSID} = “gFlash Class” \InProcServer32(Default) = “E:\PROGRA~1\FLASHGET\getflash.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Program Files\Real Alternative\rpshell.dll” [“RealNetworks, Inc.”] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “D:\PROGRA~1\MICROS~1\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “D:\PROGRA~1\MICROS~1\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}” = “iTunes” -> {HKLM…CLSID} = “iTunes” \InProcServer32(Default) = “D:\Program Files\iTunes\iTunesMiniPlayer.dll” [“Apple Computer, Inc.”] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] “{793960A0-4AF3-44E2-94EF-E5F71713D28E}” = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\icxmontr.dll” [file not found] “{7EE1D182-1209-49A1-A578-4A6566641391}” = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\FB20.DLL” [file not found] “{AC0B5D2E-B691-4E12-A4F9-CA88492579A2}” = “Zinio Shell Extension” -> {HKLM…CLSID} = “Zinio Magazine” \InProcServer32(Default) = “C:\Program Files\Common Files\Zinio\ZShext.dll” [“Zinio Systems, Inc.”] “{A9AACA72-1C51-4F84-804D-90EDBA0D58F4}” = “Zinio Magazine Column Provider” -> {HKLM…CLSID} = “MyMagazinesColumn Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Zinio\ZShext.dll” [“Zinio Systems, Inc.”] “{FED1E321-D977-4851-A960-654208E058FC}” = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\ioxmontr.dll” [file not found] “{F2185E5D-720E-4956-90D9-75F6AC141575}” = “Idea2 SidebarIconHandler Class” -> {HKLM…CLSID} = “SidebarIconHandler Class” \InProcServer32(Default) = “E:\Program Files\Desktop Sidebar\sbhelp.dll” [“Idea2”] “{B3F0E920-C0CB-42D8-A54A-86228C914D4F}” = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nkmsapi.dll” [file not found] “{2B3453E4-49DF-11D3-8229-0080BE509050}” = “GMail Drive” -> {HKLM…CLSID} = “GMail Drive” \InProcServer32(Default) = “C:\WINDOWS\system32\ShellExt\GMailFS.dll” [“Bjarke Viksoe”] “{2B3453E4-49DF-11D3-8229-0080BE509052}” = “GMailFS Property Sheet” -> {HKLM…CLSID} = “GMailFS Property Sheet” \InProcServer32(Default) = “C:\WINDOWS\system32\ShellExt\GMailFS.dll” [“Bjarke Viksoe”] “{2B3453E4-49DF-11D3-8229-0080BE509054}” = “GMailFS Drop Handler” -> {HKLM…CLSID} = “GMailFS Drop Handler” \InProcServer32(Default) = “C:\WINDOWS\system32\ShellExt\GMailFS.dll” [“Bjarke Viksoe”] “{2B3453E4-49DF-11D3-8229-0080BE509056}” = “GMailFS Context Menu” -> {HKLM…CLSID} = “GMailFS Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\ShellExt\GMailFS.dll” [“Bjarke Viksoe”] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” -> {HKLM…CLSID} = “SimpleShlExt Class” \InProcServer32(Default) = “C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll” [empty string] “{2F5AC606-70CF-461C-BFE1-734234536262}” = “WindowBlinds CPL Extension” -> {HKLM…CLSID} = “DisplayCplExt Class” \InProcServer32(Default) = “D:\Program Files\Stardock\Object Desktop\WindowBlinds\wbui.dll” [“Stardock.Net, Inc”] “{36518101-49AC-42CB-8E4C-40C1F328A565}” = “Rad2 Extension” -> {HKLM…CLSID} = “RadPropExt2 Class” \InProcServer32(Default) = “C:\WINDOWS\system32\Rad.dll” [empty string] “{5380C14E-C0A1-4D66-87DB-5995E6FF4623}” = “Rad Extension” -> {HKLM…CLSID} = “RadPropExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\Rad.dll” [empty string] “{75B8D633-9021-442C-9EA4-FF4BE72CE20F}” = “NRad2 Extension” -> {HKLM…CLSID} = “NRadExt2 Class” \InProcServer32(Default) = “C:\WINDOWS\system32\NRad.dll” [“ChrisW”] “{C6844A1E-2C59-415A-84B3-C6A458372779}” = “RadType Extension” -> {HKLM…CLSID} = “RadTypeExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadType.dll” [empty string] “{D00900BC-23F7-4FD6-BFA2-8232112C5C49}” = “NRad Extension” -> {HKLM…CLSID} = “NRadExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\NRad.dll” [“ChrisW”] “{D2FD83AE-994A-4D4B-9097-2C9E11ED85F0}” = “RadClkr Extension” -> {HKLM…CLSID} = “RadClkRExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadClkR.dll” [empty string] “{7700EB62-DB7C-47AF-A092-04376CA1D24C}” = “RadMnu Extension” -> {HKLM…CLSID} = “RadMnuExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadMnu.dll” [empty string] “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” = “ICQ Lite Shell Extension” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “F:\Program Files\ICQ-PL\ICQLiteShell.dll” [empty string] “{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}” = “OpenOffice.org Column Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.4\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{087B3AE3-E237-4467-B8DB-5A38AB959AC9}” = “OpenOffice.org Infotip Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.4\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{63542C48-9552-494A-84F7-73AA6A7C99C1}” = “OpenOffice.org Property Sheet Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.4\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{3B092F0C-7696-40E3-A80F-68D74DA84210}” = “OpenOffice.org Thumbnail Viewer” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.4\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}” = “Microsoft Office Metadata Handler” -> {HKLM…CLSID} = “Microsoft Office Metadata Handler” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll” [MS] “{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}” = “Microsoft Office Thumbnail Handler” -> {HKLM…CLSID} = “Microsoft Office Thumbnail Handler” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll” [MS] “{65756541-C65C-11CD-0000-4B656E696100}” = “Panda Antivirus” -> {HKLM…CLSID} = “Panda Antivirus” \InProcServer32(Default) = “E:\Program Files\Panda Software\Panda Internet Security 2007\PAVOLE.DLL” [“Panda Software”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{35B2861B-2B26-4691-9FF0-09083722C736}” = “RadExe Extension” -> {HKLM…CLSID} = “RadExeExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadExe.dll” [empty string] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <> “AppInit_DLLs” = “wbsys.dll,C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL” [file not found] HKLM\System\CurrentControlSet\Control\Session Manager\ <> “BootExecute” = “autocheck autochk *”|“sprestrt” [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> avldr\DLLName = “avldr.dll” [“Panda Software”] <> WBSrv\DLLName = “D:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll” [“Stardock Corporation”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {A9AACA72-1C51-4F84-804D-90EDBA0D58F4}(Default) = “Zinio Magazine Column Provider” -> {HKLM…CLSID} = “MyMagazinesColumn Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Zinio\ZShext.dll” [“Zinio Systems, Inc.”] {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}(Default) = “OpenOffice.org Column Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.4\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ ICQLiteMenu(Default) = “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “F:\Program Files\ICQ-PL\ICQLiteShell.dll” [empty string] Panda Antivirus(Default) = “{65756541-C65C-11CD-0000-4B656E696100}” -> {HKLM…CLSID} = “Panda Antivirus” \InProcServer32(Default) = “E:\Program Files\Panda Software\Panda Internet Security 2007\PAVOLE.DLL” [“Panda Software”] tqgnmtgy(Default) = “{b6d885d8-ab9a-43f0-b7ea-a3b69a5beac2}” -> {HKLM…CLSID} = “uireourx.class” \InProcServer32(Default) = “C:\WINDOWS\system32\rlgek.dll” [file not found] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ICQLiteMenu(Default) = “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “F:\Program Files\ICQ-PL\ICQLiteShell.dll” [empty string] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Panda Antivirus(Default) = “{65756541-C65C-11CD-0000-4B656E696100}” -> {HKLM…CLSID} = “Panda Antivirus” \InProcServer32(Default) = “E:\Program Files\Panda Software\Panda Internet Security 2007\PAVOLE.DLL” [“Panda Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoPropertiesRecycleBin” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “%APPDATA%\IrfanView\IrfanView_Wallpaper.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\aab\Dane aplikacji\IrfanView\IrfanView_Wallpaper.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\MGB_SC~1.SCR” (MGB_ScreenSaver.scr) [“Tenmiles Corporation”] Startup items in “aab” & “All Users” startup folders: ----------------------------------------------------- C:\Documents and Settings\aab\Menu Start\Programy\Autostart “Stardock ObjectDock” -> shortcut to: “D:\Program Files\ObjectDock\ObjectDock.exe” [“Stardock”] “HideBUS” -> shortcut to: “C:\Documents and Settings\aab\Moje dokumenty\HideBUS.exe” [null data] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “LClock” -> shortcut to: “C:\Program Files\LClock\LClock.exe” [null data] “Kalendarz XP” -> shortcut to: “D:\Program Files\Kalendarz XP\Kalendarz.exe” [null data] “Adobe Reader Speed Launch” -> shortcut to: “D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: e:\program files\panda software\panda internet security 2007\pavlsp.dll [“Panda Software International”], 01 - 03, 21 %SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 09 - 20 %SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{855F3B16-6D32-4FE6-8A56-BBB695989046}” -> {HKLM…CLSID} = “ICQ Toolbar” \InProcServer32(Default) = “D:\Program Files\ICQToolbar\toolbaru.dll” [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{85F685C3-20D9-4943-95E4-EB4224056C3F}” = “Expressivo” -> {HKLM…CLSID} = “Expressivo” \InProcServer32(Default) = “D:\Program Files\ivo\Expressivo Demo\IH_iexplore.dll” [“IVO Software Sp. z o.o.”] “{E0E899AB-F487-11D5-8D29-0050BA6940E3}” = “FlashGet Bar” -> {HKLM…CLSID} = “FlashGet Bar” \InProcServer32(Default) = “E:\PROGRA~1\FLASHGET\fgiebar.dll” [“Amaze Soft”]

adam9870 · 6 Styczeń 2007 12:11

Logi ogólnie czyste.

Start >>> uruchom >>> regedit >>> Powinien otworzyć się edytor rejestru w którym przejdź do:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager

Kliknij podwójnie na znajdującą nie tam wartość BootExecute i w okienku które się otworzy skasuj wszystko poza autocheck autochk *

Przeczyść rejestr ponieważ masz wiele pustych kluczy. Tutaj możesz znaleźć instrukcję w jaki sposób możesz to zrobić.

Czy problem ustąpił?

Range_Rover · 6 Styczeń 2007 12:59

adam9870 pomogło Dzięki

Joan · 6 Styczeń 2007 13:28

Zafixuj te pozostałości po trojanie i po programach, których już nie masz.

Otwórz notatnik i wklej w nim to:

Plik -> zapisz jako -> zmień rozszerzenie na wszystkie pliki -> zapisz pod nazwą FIX.REG

Odpal plik FIX.REG i potwierdź dodanie do rejestru i reset kompa.

Użyj WWDC (pozwoli Ci to zamknąć robaczywe porty), zmień znaczki z Disable na Enable (wszystkie mają być zielone lub żółte) i zresetuj sysa.