Prośba o profilaktyczne sprawdzenia logów

Mates · 5 Listopad 2007 18:13

Witam chciałbym prosic o profilaktyczne sprawdzenie logów.

HijackThis

Logfile of HijackThis v1.99.1 Scan saved at 19:52:17, on 2007-11-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\CursorXP\CursorXP.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe E:\Programy(instalki)\HijackThis 1.99.1\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM…\Run: [skyTel] SkyTel.EXE O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe runtime -Delay O4 - HKLM…\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe -atboottime O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe O4 - HKLM…\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe O4 - HKCU…\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microso…b?1192269025859 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe /service (file missing) O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

Silent Runners:

Silent Runners.vbs, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by {++} Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe [MS] BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} = C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [Nero AG] CursorXP = C:\Program Files\CursorXP\CursorXP.exe [] Odkurzacz-MCD = C:\Program Files\Odkurzacz\odk_mcd.exe [Franmo Software] odk_mcd = (empty string) [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} SkyTel = SkyTel.EXE [Realtek Semiconductor Corp.] RTHDCPL = RTHDCPL.EXE [Realtek Semiconductor Corp.] Alcmtr = ALCMTR.EXE [Realtek Semiconductor Corp.] ATICCC = C:\Program Files\ATI Technologies\ATI.ACE\cli.exe runtime -Delay [null data] RemoteControl = C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [Cyberlink Corp.] NeroFilterCheck = C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [Nero AG] avast! = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [ALWIL Software] QuickTime Task = C:\Program Files\QuickTime\qttask.exe -atboottime [Apple Computer, Inc.] SunJavaUpdateSched = C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [sun Microsystems, Inc.] GrooveMonitor = C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = Adobe PDF Reader Link Helper \InProcServer32(Default) = C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe Systems Incorporated] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}(Default) = (no title provided) -> {HKLM…CLSID} = Groove GFS Browser Helper \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = SSVHelper Class \InProcServer32(Default) = C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [sun Microsystems, Inc.] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ {42071714-76d4-11d1-8b24-00a0c9068ff3} = Rozszerzenie CPL kadrowania wyświetlania -> {HKLM…CLSID} = Rozszerzenie CPL kadrowania wyświetlania \InProcServer32(Default) = deskpan.dll [file not found] {88895560-9AA2-1069-930E-00AA0030EBC8} = Rozszerzenie ikony HyperTerminalu -> {HKLM…CLSID} = HyperTerminal Icon Ext \InProcServer32(Default) = C:\WINDOWS\system32\hticons.dll [Hilgraeve, Inc.] {3028902F-6374-48b2-8DC6-9725E775B926} = IE Microsoft AutoComplete -> {HKLM…CLSID} = IE Microsoft AutoComplete \InProcServer32(Default) = C:\WINDOWS\system32\browseui.dll [MS] {EFA24E62-B078-11d0-89E4-00C04FC9E26E} = History Band -> {HKLM…CLSID} = History Band \InProcServer32(Default) = C:\WINDOWS\system32\shdocvw.dll [MS] {5E2121EE-0300-11D4-8D3B-444553540000} = Catalyst Context Menu extension -> {HKLM…CLSID} = SimpleShlExt Class \InProcServer32(Default) = C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll [empty string] {32020A01-506E-484D-A2A8-BE3CF17601C3} = AlcoholShellEx -> {HKLM…CLSID} = AlcoholShellEx \InProcServer32(Default) = C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll [Alcohol Soft Development Team] {453D1B6D-BD6A-4FA1-B876-9E4DD848D434} = AQQ File Transfer Shell Extension -> {HKLM…CLSID} = AQQ File Transfer Shell Extension \InProcServer32(Default) = C:\PROGRA~1\WapSter\AQQ\System\AQQSHE~1.DLL [null data] {472083B0-C522-11CF-8763-00608CC02F24} = avast -> {HKLM…CLSID} = avast \InProcServer32(Default) = C:\Program Files\Alwil Software\Avast4\ashShell.dll [ALWIL Software] {72853161-30C5-4D22-B7F9-0BBC1D38A37E} = Groove GFS Browser Helper -> {HKLM…CLSID} = Groove GFS Browser Helper \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} = Groove GFS Explorer Bar -> {HKLM…CLSID} = Groove Folder Synchronization \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {A449600E-1DC6-4232-B948-9BD794D62056} = Groove GFS Stub Icon Handler -> {HKLM…CLSID} = Groove GFS Stub Icon Handler \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {B5A7F190-DDA6-4420-B3BA-52453494E6CD} = Groove GFS Stub Execution Hook -> {HKLM…CLSID} = Groove GFS Stub Execution Hook \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {6C467336-8281-4E60-8204-430CED96822D} = Groove GFS Context Menu Handler -> {HKLM…CLSID} = Groove GFS Context Menu Handler \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {387E725D-DC16-4D76-B310-2C93ED4752A0} = Groove XML Icon Handler -> {HKLM…CLSID} = Groove XML Icon Handler \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {16F3DD56-1AF5-4347-846D-7C10C4192619} = Groove Explorer Icon Overlay 3 (GFS Folder) -> {HKLM…CLSID} = Groove Explorer Icon Overlay 3 (GFS Folder) \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} = Groove Explorer Icon Overlay 2 (GFS Stub) -> {HKLM…CLSID} = Groove Explorer Icon Overlay 2 (GFS Stub) \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} = Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {HKLM…CLSID} = Groove Explorer Icon Overlay 4 (GFS Unread Mark) \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {99FD978C-D287-4F50-827F-B2C658EDA8E7} = Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {HKLM…CLSID} = Groove Explorer Icon Overlay 1 (GFS Unread Stub) \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {920E6DB1-9907-4370-B3A0-BAFC03D81399} = Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {HKLM…CLSID} = Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] {0006F045-0000-0000-C000-000000000046} = Microsoft Office Outlook Custom Icon Handler -> {HKLM…CLSID} = Outlook File Icon Extension \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL [MS] {00020D75-0000-0000-C000-000000000046} = Microsoft Office Outlook Desktop Icon Handler -> {HKLM…CLSID} = Microsoft Office Outlook \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL [MS] {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} = Microsoft Office OneNote Namespace Extension for Windows Desktop Search -> {HKLM…CLSID} = Microsoft Office OneNote Namespace Extension for Windows Desktop Search \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL [MS] {42042206-2D85-11D3-8CFF-005004838597} = Microsoft Office HTML Icon Handler -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = C:\Program Files\Microsoft Office\Office12\msohevi.dll [MS] {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} = Microsoft Office Metadata Handler -> {HKLM…CLSID} = Microsoft Office Metadata Handler \InProcServer32(Default) = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll [MS] {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} = Microsoft Office Thumbnail Handler -> {HKLM…CLSID} = Microsoft Office Thumbnail Handler \InProcServer32(Default) = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> {B5A7F190-DDA6-4420-B3BA-52453494E6CD} = Groove GFS Stub Execution Hook -> {HKLM…CLSID} = Groove GFS Stub Execution Hook \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <> BootExecute = autocheck autochk *|lsdelete [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = Ati2evxx.dll [ATI Technologies Inc.] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = {807563E5-5146-11D5-A672-00B0D022E945} -> {HKLM…CLSID} = Microsoft Office InfoPath XML Mime Filter \InProcServer32(Default) = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = PDF Column Info -> {HKLM…CLSID} = PDF Shell Extension \InProcServer32(Default) = C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll [Adobe Systems, Inc.] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ AQQFileTransfer(Default) = {453D1B6D-BD6A-4FA1-B876-9E4DD848D434} -> {HKLM…CLSID} = AQQ File Transfer Shell Extension \InProcServer32(Default) = C:\PROGRA~1\WapSter\AQQ\System\AQQSHE~1.DLL [null data] Ashampoo Magical Security 2007 Shell Extension(Default) = {E7BC3CE1-0CA1-41eb-BD77-2340BA86D05F} -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = C:\Program Files\Ashampoo\Ashampoo Magical Security 2007\ashppcor.dll [null data] avast(Default) = {472083B0-C522-11CF-8763-00608CC02F24} -> {HKLM…CLSID} = avast \InProcServer32(Default) = C:\Program Files\Alwil Software\Avast4\ashShell.dll [ALWIL Software] XXX Groove GFS Context Menu Handler XXX(Default) = {6C467336-8281-4E60-8204-430CED96822D} -> {HKLM…CLSID} = Groove GFS Context Menu Handler \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ Ashampoo Magical Security 2007 Shell Extension(Default) = {E7BC3CE1-0CA1-41eb-BD77-2340BA86D05F} -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = C:\Program Files\Ashampoo\Ashampoo Magical Security 2007\ashppcor.dll [null data] XXX Groove GFS Context Menu Handler XXX(Default) = {6C467336-8281-4E60-8204-430CED96822D} -> {HKLM…CLSID} = Groove GFS Context Menu Handler \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = {472083B0-C522-11CF-8763-00608CC02F24} -> {HKLM…CLSID} = avast \InProcServer32(Default) = C:\Program Files\Alwil Software\Avast4\ashShell.dll [ALWIL Software] XXX Groove GFS Context Menu Handler XXX(Default) = {6C467336-8281-4E60-8204-430CED96822D} -> {HKLM…CLSID} = Groove GFS Context Menu Handler \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ XXX Groove GFS Context Menu Handler XXX(Default) = {6C467336-8281-4E60-8204-430CED96822D} -> {HKLM…CLSID} = Groove GFS Context Menu Handler \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ shutdownwithoutlogon = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} undockwithoutlogon = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ Wallpaper = C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ Wallpaper = C:\Documents and Settings\Borys\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp Startup items in Borys & All Users startup folders: ------------------------------------------------------- C:\Documents and Settings\Borys\Menu Start\Programy\Autostart Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007 -> shortcut to: C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [MS] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart Adobe Reader Speed Launch -> shortcut to: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [Adobe Systems Incorporated] Adobe Reader Synchronizer -> shortcut to: C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = %SystemRoot%\System32\mswsock.dll [MS] 000000000002\LibraryPath = %SystemRoot%\System32\winrnr.dll [MS] 000000000003\LibraryPath = %SystemRoot%\System32\mswsock.dll [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}(Default) = Groove Folder Synchronization Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [MS] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = &Poszukaj Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ MenuText = Sun Java Console CLSIDExtension = {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} -> {HKCU…CLSID} = Java Plug-in 1.6.0_03 \InProcServer32(Default) = C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [sun Microsystems, Inc.] -> {HKLM…CLSID} = Java Plug-in 1.6.0_03 \InProcServer32(Default) = C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll [sun Microsystems, Inc.] {2670000A-7350-4F3C-8081-5663EE0C6C49}\ ButtonText = Wyślij do programu OneNote MenuText = Wyślij &do programu OneNote CLSIDExtension = {48E73304-E1D6-4330-914C-F5F514E3486C} -> {HKLM…CLSID} = Send to OneNote from Internet Explorer button \InProcServer32(Default) = C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll [MS] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ ButtonText = Research {FB5F1910-F110-11D2-BB9E-00C04F795683}\ ButtonText = Messenger MenuText = Windows Messenger Exec = C:\Program Files\Messenger\msmsgs.exe [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ad-Aware 2007 Service, aawservice, C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [Lavasoft AB] Ati HotKey Poller, Ati HotKey Poller, C:\WINDOWS\system32\Ati2evxx.exe [ATI Technologies Inc.] avast! Antivirus, avast! Antivirus, C:\Program Files\Alwil Software\Avast4\ashServ.exe [ALWIL Software] avast! iAVS4 Control Service, aswUpdSv, C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [ALWIL Software] avast! Mail Scanner, avast! Mail Scanner, C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe /service [ALWIL Software] avast! Web Scanner, avast! Web Scanner, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe /service [ALWIL Software] LightScribeService Direct Disc Labeling Service, LightScribeService, C:\Program Files\Common Files\LightScribe\LSSrvc.exe [Hewlett-Packard Company] NMIndexingService, NMIndexingService, C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [Nero AG] Sunbelt Kerio Personal Firewall 4, KPF4, C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [sunbelt Software] Windows User Mode Driver Framework, UMWdf, C:\WINDOWS\system32\wdfmgr.exe [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ HP Standard TCP/IP Port\Driver = HpTcpMon.dll [Hewlett Packard] hpzlnt12\Driver = hpzlnt12.dll [HP] Send To Microsoft OneNote Monitor\Driver = msonpmon.dll [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 40 seconds. ---------- (total run time: 67 seconds)

Krzychuu · 5 Listopad 2007 19:27

Fix w HJT.

Daj loga z ComboFix.

Przejrzyj Optymalizację Autostartu.

Mates · 5 Listopad 2007 19:53

tu jest log z ComboFIX

jessica · 5 Listopad 2007 20:05

Log jest czysty.

Zrób jeszcze tylko to:

Do Notatnika wklej:

Windows Registry Editor Version 5.00


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"odk_mcd"=-

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na: “Wszystkie pliki” >>> Zapisz jako FIX.REG >>>

plik uruchom (dwuklik i OK).

Zrestartuj komputer.

To wszystko.

jessi

Mates · 5 Listopad 2007 20:57

OK. Dzięki za sprawdzenie logów.