Problem z uruchamianiem aplikacji i długie wczytywanie pulpi

Gumis88Krk · 5 Październik 2006 14:30

Logfile of HijackThis v1.99.1 Scan saved at 16:26:18, on 2006-10-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programy\Avast! AntiVirus\aswUpdSv.exe C:\Programy\Avast! AntiVirus\ashServ.exe C:\Programy\Alcohol 120%\StarWind\StarWindService.exe C:\Programy\Avast! AntiVirus\ashMaiSv.exe C:\Programy\Avast! AntiVirus\ashWebSv.exe C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programy\Winamp\Winampa.exe C:\Programy\PowerDVD\PDVDServ.exe C:\Programy\AVAST!~1\ashDisp.exe C:\Programy\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Programy\Tlen.pl\tlen.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Skype\Phone\Skype.exe C:\Programy\Nikon Coolpix 5600\Picture Project\NkbMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Programy\SiISATARaid\SATARaid.exe C:\WINDOWS\system32\svchost.exe C:\Programy\INCRED~1\bin\IMApp.exe C:\Programy\Gadu-Gadu\gg.exe C:\Programy\BitComet\BitComet.exe C:\WINDOWS\System32\svchost.exe C:\Programy\Winamp\winamp.exe C:\Programy\Mozilla Firefox\firefox.exe C:\Documents and Settings\Tomek\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.incredimail.com/english R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Adobe Acrobat Reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM…\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [WinampAgent] “C:\Programy\Winamp\Winampa.exe” O4 - HKLM…\Run: [RemoteControl] C:\Programy\PowerDVD\PDVDServ.exe O4 - HKLM…\Run: [avast!] C:\Programy\AVAST!~1\ashDisp.exe O4 - HKLM…\Run: [LWBMOUSE] C:\Programy\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe O4 - HKLM…\Run: [AtiPTA] C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [Zone Labs Client] “C:\Programy\ZoneAlarm\zlclient.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [incrediMail] C:\Programy\IncrediMail\bin\IncMail.exe /c O4 - HKCU…\Run: [Komunikator] “C:\Programy\Tlen.pl\tlen.exe” --confdir=home O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Gadu-Gadu] “C:\Programy\Gadu-Gadu\gg.exe” /tray O4 - Global Startup: NkbMonitor.exe.lnk = C:\Programy\Nikon Coolpix 5600\Picture Project\NkbMonitor.exe O4 - Global Startup: SATARaid.lnk = ? O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Programy\IncrediMail\bin\resources\WebMenuImg.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O17 - HKLM\System\CCS\Services\Tcpip…{37597994-1C14-4DFF-BB19-8310880DC089}: NameServer = 85.255.116.20,85.255.112.215 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.20 85.255.112.215 O17 - HKLM\System\CS1\Services\Tcpip…{37597994-1C14-4DFF-BB19-8310880DC089}: NameServer = 85.255.116.20,85.255.112.215 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.20 85.255.112.215 O17 - HKLM\System\CS2\Services\Tcpip…{37597994-1C14-4DFF-BB19-8310880DC089}: NameServer = 85.255.116.20,85.255.112.215 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.20 85.255.112.215 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programy\Avast! AntiVirus\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programy\Avast! AntiVirus\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programy\Avast! AntiVirus\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programy\Avast! AntiVirus\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Programy\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programy\Alcohol 120%\StarWind\StarWindService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Problem jest taki ze strasznie długo ładuje się pulpit, przez ok 2-3 min widać sama tapetę i komputer nie reaguje, pozniej zaczyna sie ładowac “pasek zadan”, wystepuja błedy podczas uruchamiania różnych aplikacji, wyskakuje bład: “wystapił problem z aplikacja $$$.exe i zostanie ona zamknieta…” wgrywałem ostatnio Zone Alarm, ale chyba cos zle sie wgralo bo on nawet sie nie uruchamia, od tamtegoc zasu te zmam takie kacje, ale nie da sie go usnuan, poniwewaz wystepuje ww. bład… Wiem ze przydałby sie format ale nie ma kieddy zrobic

Bieniol · 5 Październik 2006 14:32

Użyj narzędzia FixWareOut

Po zabiegach nowy log z Hijacka + log z Silent Runners

Gutek · 5 Październik 2006 14:43

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

Gumis88Krk · 5 Październik 2006 15:10

HijackThis:

Logfile of HijackThis v1.99.1 Scan saved at 17:08:55, on 2006-10-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programy\Avast! AntiVirus\aswUpdSv.exe C:\Programy\Avast! AntiVirus\ashServ.exe C:\Programy\Alcohol 120%\StarWind\StarWindService.exe C:\Programy\Avast! AntiVirus\ashMaiSv.exe C:\Programy\Avast! AntiVirus\ashWebSv.exe C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programy\Winamp\Winampa.exe C:\Programy\PowerDVD\PDVDServ.exe C:\Programy\AVAST!~1\ashDisp.exe C:\Programy\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Programy\Tlen.pl\tlen.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Skype\Phone\Skype.exe C:\Programy\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Programy\Nikon Coolpix 5600\Picture Project\NkbMonitor.exe C:\Programy\SiISATARaid\SATARaid.exe C:\WINDOWS\system32\svchost.exe C:\Programy\INCRED~1\bin\IMApp.exe C:\PROGRAMY\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Tomek\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Adobe Acrobat Reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM…\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [WinampAgent] “C:\Programy\Winamp\Winampa.exe” O4 - HKLM…\Run: [RemoteControl] C:\Programy\PowerDVD\PDVDServ.exe O4 - HKLM…\Run: [avast!] C:\Programy\AVAST!~1\ashDisp.exe O4 - HKLM…\Run: [LWBMOUSE] C:\Programy\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe O4 - HKLM…\Run: [AtiPTA] C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [Zone Labs Client] “C:\Programy\ZoneAlarm\zlclient.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [incrediMail] C:\Programy\IncrediMail\bin\IncMail.exe /c O4 - HKCU…\Run: [Komunikator] “C:\Programy\Tlen.pl\tlen.exe” --confdir=home O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Gadu-Gadu] “C:\Programy\Gadu-Gadu\gg.exe” /tray O4 - Global Startup: NkbMonitor.exe.lnk = C:\Programy\Nikon Coolpix 5600\Picture Project\NkbMonitor.exe O4 - Global Startup: SATARaid.lnk = ? O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Programy\IncrediMail\bin\resources\WebMenuImg.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O17 - HKLM\System\CCS\Services\Tcpip…{37597994-1C14-4DFF-BB19-8310880DC089}: NameServer = 85.255.116.20,85.255.112.215 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.20 85.255.112.215 O17 - HKLM\System\CS1\Services\Tcpip…{37597994-1C14-4DFF-BB19-8310880DC089}: NameServer = 85.255.116.20,85.255.112.215 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.20 85.255.112.215 O17 - HKLM\System\CS2\Services\Tcpip…{37597994-1C14-4DFF-BB19-8310880DC089}: NameServer = 85.255.116.20,85.255.112.215 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.20 85.255.112.215 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programy\Avast! AntiVirus\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programy\Avast! AntiVirus\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programy\Avast! AntiVirus\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programy\Avast! AntiVirus\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Programy\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programy\Alcohol 120%\StarWind\StarWindService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Silent Runners:

“Silent Runners.vbs”, revision 48, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “IncrediMail” = “C:\Programy\IncrediMail\bin\IncMail.exe /c” [“IncrediMail, Ltd.”] “Komunikator” = ““C:\Programy\Tlen.pl\tlen.exe” --confdir=home” [“o2.pl Sp. z o.o.”] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}” = ““C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”” [“Nero AG”] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “Gadu-Gadu” = ““C:\Programy\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu Sp. z oo”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “(Default)” = (empty string) “PRONoMgrWired” = “C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe” [“Intel® Corporation”] “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “WinampAgent” = ““C:\Programy\Winamp\Winampa.exe”” [null data] “RemoteControl” = “C:\Programy\PowerDVD\PDVDServ.exe” [“Cyberlink Corp.”] “avast!” = “C:\Programy\AVAST!~1\ashDisp.exe” [null data] “LWBMOUSE” = “C:\Programy\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe” [empty string] “AtiPTA” = “C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE” [“ATI Technologies, Inc.”] “QuickTime Task” = ““C:\Program Files\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “SunJavaUpdateSched” = “C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [“Sun Microsystems, Inc.”] “NeroFilterCheck” = “C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [“Nero AG”] “Zone Labs Client” = ““C:\Programy\ZoneAlarm\zlclient.exe”” [“Zone Labs, LLC”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Programy\Adobe Acrobat Reader\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}” = “WinAce Archiver 2.5 Context Menu Shell Extension” -> {HKLM…CLSID} = “WinAceContext Menu Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] “{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}” = “WinAce Archiver 2.5 DragDrop Shell Extension” -> {HKLM…CLSID} = “WinAceDrag-Drop Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] “{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}” = “WinAce Archiver 2.5 Context Menu Shell Extension” -> {HKLM…CLSID} = “WinAceContext Menu (Add) Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] “{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}” = “WinAce Archiver 2.5 Property Sheet Shell Extension” -> {HKLM…CLSID} = “WinAceProperty Sheet Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Programy\Avast! AntiVirus\ashShell.dll” [“ALWIL Software”] “{640167b4-59b0-47a6-b335-a6b3c0695aea}” = “Portable Media Devices” -> {HKLM…CLSID} = “Portable Media Devices” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” -> {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “C:\Programy\ALCOHO~1\axshlex.dll” [“Alcohol Soft Development Team”] “{36518101-49AC-42CB-8E4C-40C1F328A565}” = “Rad2 Extension” -> {HKLM…CLSID} = “RadPropExt2 Class” \InProcServer32(Default) = “C:\WINDOWS\system32\Rad.dll” [empty string] “{5380C14E-C0A1-4D66-87DB-5995E6FF4623}” = “Rad Extension” -> {HKLM…CLSID} = “RadPropExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\Rad.dll” [empty string] “{75B8D633-9021-442C-9EA4-FF4BE72CE20F}” = “NRad2 Extension” -> {HKLM…CLSID} = “NRadExt2 Class” \InProcServer32(Default) = “C:\WINDOWS\system32\NRad.dll” [empty string] “{C6844A1E-2C59-415A-84B3-C6A458372779}” = “RadType Extension” -> {HKLM…CLSID} = “RadTypeExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadType.dll” [empty string] “{D00900BC-23F7-4FD6-BFA2-8232112C5C49}” = “NRad Extension” -> {HKLM…CLSID} = “NRadExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\NRad.dll” [empty string] “{D2FD83AE-994A-4D4B-9097-2C9E11ED85F0}” = “RadClkr Extension” -> {HKLM…CLSID} = “RadClkRExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadClkR.dll” [empty string] “{7700EB62-DB7C-47AF-A092-04376CA1D24C}” = “RadMnu Extension” -> {HKLM…CLSID} = “RadMnuExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadMnu.dll” [empty string] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{B327765E-D724-4347-8B16-78AE18552FC3}” = “NeroDigitalIconHandler” -> {HKLM…CLSID} = “NeroDigitalIconHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{7F1CF152-04F8-453A-B34C-E609530A9DC8}” = “NeroDigitalPropSheetHandler” -> {HKLM…CLSID} = “NeroDigitalPropSheetHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! “{35B2861B-2B26-4691-9FF0-09083722C736}” = “RadExe Extension” -> {HKLM…CLSID} = “RadExeExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadExe.dll” [empty string] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ “System” = (value not set) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}(Default) = “NeroDigitalExt.NeroDigitalColumnHandler” -> {HKLM…CLSID} = “NeroDigitalColumnHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Programy\Avast! AntiVirus\ashShell.dll” [“ALWIL Software”] IMMenuShellExt(Default) = “{F8984111-38B6-11D5-8725-0050DA2761C4}” -> {HKLM…CLSID} = “IMMenuShellExt Class” \InProcServer32(Default) = “C:\Programy\IncrediMail\bin\IMShExt.dll” [“IncrediMail, Ltd.”] ZFAdd(Default) = “{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}” -> {HKLM…CLSID} = “WinAceContext Menu (Add) Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ZFAdd(Default) = “{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}” -> {HKLM…CLSID} = “WinAceContext Menu (Add) Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Programy\Avast! AntiVirus\ashShell.dll” [“ALWIL Software”] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Tomek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “Tomek” & “All Users” startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “NkbMonitor.exe” -> shortcut to: “C:\Programy\Nikon Coolpix 5600\Picture Project\NkbMonitor.exe” [“Nikon Corporation”] “SATARaid” -> shortcut to: “C:\Programy\SiISATARaid\SATARaid.exe” [“Silicon Image, Inc.”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars Dormant Explorer Bars in “View, Explorer Bar” menu HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_06” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll” [“Sun Microsystems, Inc.”] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] avast! Antivirus, avast! Antivirus, ““C:\Programy\Avast! AntiVirus\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Programy\Avast! AntiVirus\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Programy\Avast! AntiVirus\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Programy\Avast! AntiVirus\ashWebSv.exe” /service” [“ALWIL Software”] StarWind iSCSI Service, StarWindService, “C:\Programy\Alcohol 120%\StarWind\StarWindService.exe” [“Rocket Division Software”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 13 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 10 seconds. ---------- (total run time: 40 seconds)

Bieniol · 5 Październik 2006 15:18

Usuń Hijackiem te wpisy (chyba, że DNSy są Twoje w co bardzo wątpie):

Otwórz notatnik i wklej w nim to:

Plik -> zapisz jako -> zmień rozszerzenie na wszystkie pliki -> zapisz pod nazwą FIX.REG

Odpal plik FIX.REG i potwierdź dodanie do rejestru i reset kompa

Po zabiegach nowe logi

Gumis88Krk · 5 Październik 2006 15:37

HijackThis:

Logfile of HijackThis v1.99.1 Scan saved at 17:35:11, on 2006-10-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programy\Avast! AntiVirus\aswUpdSv.exe C:\Programy\Avast! AntiVirus\ashServ.exe C:\Programy\Alcohol 120%\StarWind\StarWindService.exe C:\Programy\Avast! AntiVirus\ashMaiSv.exe C:\Programy\Avast! AntiVirus\ashWebSv.exe C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programy\Winamp\Winampa.exe C:\Programy\PowerDVD\PDVDServ.exe C:\Programy\AVAST!~1\ashDisp.exe C:\Programy\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Programy\Tlen.pl\tlen.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Skype\Phone\Skype.exe C:\Programy\Nikon Coolpix 5600\Picture Project\NkbMonitor.exe C:\Programy\SiISATARaid\SATARaid.exe C:\Programy\INCRED~1\bin\IMApp.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Programy\Gadu-Gadu\gg.exe C:\Programy\Mozilla Firefox\firefox.exe C:\Documents and Settings\Tomek\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Adobe Acrobat Reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM…\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [WinampAgent] “C:\Programy\Winamp\Winampa.exe” O4 - HKLM…\Run: [RemoteControl] C:\Programy\PowerDVD\PDVDServ.exe O4 - HKLM…\Run: [avast!] C:\Programy\AVAST!~1\ashDisp.exe O4 - HKLM…\Run: [LWBMOUSE] C:\Programy\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe O4 - HKLM…\Run: [AtiPTA] C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [Zone Labs Client] “C:\Programy\ZoneAlarm\zlclient.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [incrediMail] C:\Programy\IncrediMail\bin\IncMail.exe /c O4 - HKCU…\Run: [Komunikator] “C:\Programy\Tlen.pl\tlen.exe” --confdir=home O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Gadu-Gadu] “C:\Programy\Gadu-Gadu\gg.exe” /tray O4 - Global Startup: NkbMonitor.exe.lnk = C:\Programy\Nikon Coolpix 5600\Picture Project\NkbMonitor.exe O4 - Global Startup: SATARaid.lnk = ? O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Programy\IncrediMail\bin\resources\WebMenuImg.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programy\Avast! AntiVirus\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programy\Avast! AntiVirus\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programy\Avast! AntiVirus\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programy\Avast! AntiVirus\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Programy\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programy\Alcohol 120%\StarWind\StarWindService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Silent Runner:

“Silent Runners.vbs”, revision 48, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “IncrediMail” = “C:\Programy\IncrediMail\bin\IncMail.exe /c” [“IncrediMail, Ltd.”] “Komunikator” = ““C:\Programy\Tlen.pl\tlen.exe” --confdir=home” [“o2.pl Sp. z o.o.”] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}” = ““C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”” [“Nero AG”] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “Gadu-Gadu” = ““C:\Programy\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu Sp. z oo”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “(Default)” = (empty string) “PRONoMgrWired” = “C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe” [“Intel® Corporation”] “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “WinampAgent” = ““C:\Programy\Winamp\Winampa.exe”” [null data] “RemoteControl” = “C:\Programy\PowerDVD\PDVDServ.exe” [“Cyberlink Corp.”] “avast!” = “C:\Programy\AVAST!~1\ashDisp.exe” [null data] “LWBMOUSE” = “C:\Programy\Trust\AMI MOUSE 250SP WIRELESS OPTICAL\lwbwheel.exe” [empty string] “AtiPTA” = “C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE” [“ATI Technologies, Inc.”] “QuickTime Task” = ““C:\Program Files\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “SunJavaUpdateSched” = “C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [“Sun Microsystems, Inc.”] “NeroFilterCheck” = “C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [“Nero AG”] “Zone Labs Client” = ““C:\Programy\ZoneAlarm\zlclient.exe”” [“Zone Labs, LLC”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Programy\Adobe Acrobat Reader\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}” = “WinAce Archiver 2.5 Context Menu Shell Extension” -> {HKLM…CLSID} = “WinAceContext Menu Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] “{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}” = “WinAce Archiver 2.5 DragDrop Shell Extension” -> {HKLM…CLSID} = “WinAceDrag-Drop Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] “{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}” = “WinAce Archiver 2.5 Context Menu Shell Extension” -> {HKLM…CLSID} = “WinAceContext Menu (Add) Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] “{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}” = “WinAce Archiver 2.5 Property Sheet Shell Extension” -> {HKLM…CLSID} = “WinAceProperty Sheet Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Programy\Avast! AntiVirus\ashShell.dll” [“ALWIL Software”] “{640167b4-59b0-47a6-b335-a6b3c0695aea}” = “Portable Media Devices” -> {HKLM…CLSID} = “Portable Media Devices” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” -> {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “C:\Programy\ALCOHO~1\axshlex.dll” [“Alcohol Soft Development Team”] “{36518101-49AC-42CB-8E4C-40C1F328A565}” = “Rad2 Extension” -> {HKLM…CLSID} = “RadPropExt2 Class” \InProcServer32(Default) = “C:\WINDOWS\system32\Rad.dll” [empty string] “{5380C14E-C0A1-4D66-87DB-5995E6FF4623}” = “Rad Extension” -> {HKLM…CLSID} = “RadPropExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\Rad.dll” [empty string] “{75B8D633-9021-442C-9EA4-FF4BE72CE20F}” = “NRad2 Extension” -> {HKLM…CLSID} = “NRadExt2 Class” \InProcServer32(Default) = “C:\WINDOWS\system32\NRad.dll” [empty string] “{C6844A1E-2C59-415A-84B3-C6A458372779}” = “RadType Extension” -> {HKLM…CLSID} = “RadTypeExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadType.dll” [empty string] “{D00900BC-23F7-4FD6-BFA2-8232112C5C49}” = “NRad Extension” -> {HKLM…CLSID} = “NRadExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\NRad.dll” [empty string] “{D2FD83AE-994A-4D4B-9097-2C9E11ED85F0}” = “RadClkr Extension” -> {HKLM…CLSID} = “RadClkRExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadClkR.dll” [empty string] “{7700EB62-DB7C-47AF-A092-04376CA1D24C}” = “RadMnu Extension” -> {HKLM…CLSID} = “RadMnuExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadMnu.dll” [empty string] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{B327765E-D724-4347-8B16-78AE18552FC3}” = “NeroDigitalIconHandler” -> {HKLM…CLSID} = “NeroDigitalIconHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{7F1CF152-04F8-453A-B34C-E609530A9DC8}” = “NeroDigitalPropSheetHandler” -> {HKLM…CLSID} = “NeroDigitalPropSheetHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! “{35B2861B-2B26-4691-9FF0-09083722C736}” = “RadExe Extension” -> {HKLM…CLSID} = “RadExeExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\RadExe.dll” [empty string] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}(Default) = “NeroDigitalExt.NeroDigitalColumnHandler” -> {HKLM…CLSID} = “NeroDigitalColumnHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Programy\Avast! AntiVirus\ashShell.dll” [“ALWIL Software”] IMMenuShellExt(Default) = “{F8984111-38B6-11D5-8725-0050DA2761C4}” -> {HKLM…CLSID} = “IMMenuShellExt Class” \InProcServer32(Default) = “C:\Programy\IncrediMail\bin\IMShExt.dll” [“IncrediMail, Ltd.”] ZFAdd(Default) = “{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}” -> {HKLM…CLSID} = “WinAceContext Menu (Add) Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ZFAdd(Default) = “{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}” -> {HKLM…CLSID} = “WinAceContext Menu (Add) Extension” \InProcServer32(Default) = “C:\Programy\WinAce\arcext.dll” [“e-merge GmbH”] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Programy\Avast! AntiVirus\ashShell.dll” [“ALWIL Software”] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Tomek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “Tomek” & “All Users” startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “NkbMonitor.exe” -> shortcut to: “C:\Programy\Nikon Coolpix 5600\Picture Project\NkbMonitor.exe” [“Nikon Corporation”] “SATARaid” -> shortcut to: “C:\Programy\SiISATARaid\SATARaid.exe” [“Silicon Image, Inc.”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars Dormant Explorer Bars in “View, Explorer Bar” menu HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_06” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll” [“Sun Microsystems, Inc.”] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] avast! Antivirus, avast! Antivirus, ““C:\Programy\Avast! AntiVirus\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Programy\Avast! AntiVirus\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Programy\Avast! AntiVirus\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Programy\Avast! AntiVirus\ashWebSv.exe” /service” [“ALWIL Software”] StarWind iSCSI Service, StarWindService, “C:\Programy\Alcohol 120%\StarWind\StarWindService.exe” [“Rocket Division Software”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 59 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 10 seconds. ---------- (total run time: 95 seconds)

Złączono Posta : 05.10.2006 (Czw) 17:39

problem z uruchamianiem aplikacji zniknal, jescze to dlugie wczytywanie pulpitu…

Bieniol · 5 Październik 2006 15:39

Logi są już czyste

Przeczyść rejestr (polecam do tego jv16 PowerTools 2006 1.5.2.344), zrób defragmentację, oraz przejrzyj: Optymalizacja XP

Wejdź: Start --> uruchom --> msconfig i w zakładce uruchamianie odznacz (według Ciebie) niepotrzbne przy autostarcie programy