Prosze o ponowne sprawdzenie loga. Jakis czas temu mialem proble http://forum.dobreprogramy.pl/viewtopic … highlight= i niestety pojawil sie ponownie. Pojawil sie po wybraniu Firefoxa jako domyslnej przegladarki. Problem to wyskakujace niechciane strony.
Gdy skanuje kompa Ad-Aware na ADSy to mi wyskakuje kilka opcji do usuniecia, ale jak usune, to wywala mi sie explorer i nic nie da sie zrobic. Dobrze ze zroobilem sobie kopie rejestru Jak sie zeskanuje to napisze co tam jest.
Ponizej log.
"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows 98
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit" [MS]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"internat.exe" = "internat.exe" [MS]
"ScanRegistry" = "C:\WINDOWS\scanregw.exe /autorun" [MS]
"TaskMonitor" = "C:\WINDOWS\taskmon.exe" [MS]
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"Zasobnik systemowy" = "SysTray.Exe" [MS]
"ccApp" = ""C:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"vptray" = "C:\PROGRA~1\SYMANT~1\VPTRAY.EXE" ["Symantec Corporation"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"Tweak UI" = "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" [MS]
"SentinelProtectionServer" = "C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\Win9x\spnsrv9x.exe" ["SafeNet, Inc."]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
"ccEvtMgr" = ""C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
"ccSetMgr" = ""C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
"defwatch" = "C:\PROGRA~1\SYMANT~1\DEFWATCH.EXE" ["Symantec Corporation"]
"rtvscn95" = "C:\PROGRA~1\SYMANT~1\RTVSCN95.EXE" ["Symantec Corporation"]
"Machine Debug Manager" = "C:\WINDOWS\SYSTEM\MDM.EXE" [MS]
"WinVNC" = ""C:\WINDOWS\SYSTEM\WINVNC.EXE" -service" ["AT&T Research Labs Cambridge"]
"RNBOStart" = "C:\WINDOWS\SYSTEM\RNBOSENT\SENTSTRT.EXE" [null data]
"KB891711" = "C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]
"{2E9D3540-211C-11d0-A5F2-00A0248C37BE}" = "Nero Shell Extension Property Sheet"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Ahead\nero\neroshx.dll" ["Ahead Software AG"]
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}" = "LDVP Shell Extensions"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Eksplorator pulpitów"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]
LDVPMenu\(Default) = "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]
LDVPMenu\(Default) = "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
Active Desktop and Wallpaper:
-----------------------------
Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Startup items in "Startup" & "All Users...Startup" folders:
-----------------------------------------------------------
C:\WINDOWS\Menu Start\Programy\Autostart
"Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"Command WorkStation" -> shortcut to: "C:\Program Files\Fiery\CStation\cstation.exe" ["Electronics for Imaging, Inc."]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\WINDOWS\SYSTEM\rnr20.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
C:\WINDOWS\SYSTEM\msafd.dll [MS], 1 - 3
C:\WINDOWS\SYSTEM\rsvpsp.dll [MS], 4 - 5
C:\WINDOWS\SYSTEM\mswsosp.dll [MS], 6
Miscellaneous IE Hijack Points
------------------------------
HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
The Internet Explorer version cannot be found!
C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
The contents of IERESET.INF cannot be reliably checked!
Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
Missing lines (compared with English-language version):
[Strings]: 2 lines
Print Monitors:
---------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
SEH Print Monitor\Driver = "sehmon.dll" [null data]
Canon LPR Port\Driver = "clprmon.dll" ["CANON INC."]
SYSFMON\Driver = "SYSFMON.DLL" ["Conceptual Systems."]
RDGCOMMON Language Monitor\Driver = "RDCOMMON.DLL" ["Roland DG Corporation"]
BJ Language Monitor WW i950\Driver = "CJPLM4D.DLL" ["CANON INC."]
CP220 Port Monitor\Driver = "USBMON.DLL" [MS]
CNYCP Language Monitor\Driver = "CNYCPLM.DLL" ["CANON INC."]
PostScript Language Monitor\Driver = "PSMON.DLL" [MS]
FUJIFILM PICTRO SCSI Port\Driver = "PGPM.DLL" ["FUJI PHOTO FILM CO.,LTD."]
FUJIFILM PG4000II Language Monitor\Driver = "PG4LM.DLL" ["FUJI PHOTO FILM CO.,LTD."]
PDF Port\Driver = "C:\WINDOWS\SYSTEM\pdfports.dll" ["Adobe Systems Incorporated."]
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 12 seconds, including 6 seconds for message boxes)
Złączono Posta _: 29.11.2005 (Wto) 16:35_A oto log z Ad-Aware:
MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows\currentversion\applets\wordpad\recent file list
Description : list of recent files opened using wordpad
MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\doc find spec mru
Description : list of recently used search terms for locating files using the microsoft windows operating system
MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\runmru
Description : mru list for items opened in start | run
MRU List Object Recognized!
Location: : .DEFAULT\software\winrar\dialogedithistory\extrpath
Description : winrar "extract-to" history
Performing conditional scans...
»»»»
»»»»»
»»»»»»
»»»»»»»
»»»»»»»
»»»»»»»
»»
CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\downloadmanager
CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\main
Value : Enable Browser Extensions
CoolWebSearch Object Recognized!
Type : RegData
Data : about:blank
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\main
Value : Start Page
Data : about:blank
CoolWebSearch Object Recognized!
Type : File
Data : hosts
TAC Rating : 10
Category : Malware
Comment :
Object : C:\WINDOWS\
Conditional scan result:
»»»»
»»»»»
»»»»»»
»»»»»»»
»»»»»»»
»»»»»»»
»»
New critical objects: 4
Objects found so far: 19
16:34:49 Scan Complete
Summary Of This Scan
»»»&
raquo;»»»
»»»»»
»»»»»»
»»»»»»»
»»»»»»»»
»»»»»
Total scanning time:00:01:48.260
Objects scanned:39595
Objects identified:7
Objects ignored:0
New critical objects:7
To sa takie stronki. Jeszcze bede tu przez jakies 15-20 min. Jak cos wymyslisz to daj znac, potem bede z domu nadawal i nie bede mial mozliwosci dac loga. Ewentualnie rano moge wrzucic loga. Jak na razie odpale
