“Silent Runners.vbs”, revision 44, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “msnmsgr” = ““C:\Program Files\MSN Messenger\msnmsgr.exe” /background” [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “IgfxTray” = “C:\WINDOWS\System32\igfxtray.exe” [“Intel Corporation”] “00THotkey” = “C:\WINDOWS\System32\00THotkey.exe” [“TOSHIBA Corporation”] “000StTHK” = “000StTHK.exe” [null data] “TFNF5” = “TFNF5.exe” [“TOSHIBA Corp.”] “SigmaTel StacMon” = “C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe” [“SigmaTel Inc.”] “Apoint” = “C:\Program Files\Apoint2K\Apoint.exe” [“Alps Electric Co., Ltd.”] “TPSMain” = “TPSMain.exe” [“TOSHIBA Corporation”] “TFncKy” = “C:\Program Files\Toshiba\TOSHIBA Controls\TFncKy.exe” [“TOSHIBA Corporation”] “PRONoMgr.exe” = “c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe” [“Intel® Corporation”] “TouchED” = “C:\Program Files\TOSHIBA\TouchED\TouchED.Exe” [“TOSHIBA Corporation”] “AGRSMMSG” = “AGRSMMSG.exe” [“Agere Systems”] “TMESRV.EXE” = “C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE /Logon” [“TOSHIBA”] “TMERzCtl.EXE” = “C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE /Service” [“TOSHIBA”] “ccApp” = ““C:\Program Files\Common Files\Symantec Shared\ccApp.exe”” [“Symantec Corporation”] “Norton Ghost 10.0” = ““C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe”” [“Symantec Corporation”] HKLM\Software\Microsoft\Active Setup\Installed Components\ >{26923b43-4d38-484f-9b9e-de460746276c}(Default) = “Internet Explorer” \StubPath = “C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {9ECB9560-04F9-4bbc-943D-298DDF1699E1}(Default) = “Norton Internet Security” -> {HKLM…CLSID} = “CNisExtBho Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”] {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}(Default) = “NAV Helper” -> {HKLM…CLSID} = “CNavExtBho Class” \InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{C4213067-97B3-4929-9B98-B5600FBBBA13}” = “TouchED” -> {HKLM…CLSID} = “TouchShellExt Class” \InProcServer32(Default) = “C:\PROGRA~1\TOSHIBA\TouchED\TouchED.dll” [“TOSHIBA Corporation”] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{4CCEFB41-18FA-11D3-9EF3-00A0C9E897FD}” = “Skladnik rozszerzenia powloki CorelDRAW” -> {HKLM…CLSID} = “CorelDRAW Shell Extension Component” \InProcServer32(Default) = “C:\Program Files\Corel\Corel Graphics 11\DRAW\CDRVIEWER\CrlShell110.dll” [null data] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{640167b4-59b0-47a6-b335-a6b3c0695aea}” = “Portable Media Devices” -> {HKLM…CLSID} = “Portable Media Devices” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{2F5AC606-70CF-461C-BFE1-734234536262}” = “WindowBlinds CPL Extension” -> {HKLM…CLSID} = “DisplayCplExt Class” \InProcServer32(Default) = “C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbui.dll” [“Stardock.Net, Inc”] “{fc181130-05a0-11d6-8140-000102e745a6}” = “My P910c” -> {HKLM…CLSID} = “My P910c” \InProcServer32(Default) = “C:\Program Files\Sony Ericsson\Mobile\auexpext.dll” [“Teleca Software Solutions AB”] “{21569614-B795-46b1-85F4-E737A8DC09AD}” = “Shell Search Band” -> {HKLM…CLSID} = “Shell Search Band” \InProcServer32(Default) = “C:\WINDOWS\system32\browseui.dll” [MS] “{5EC3EA89-4453-4416-A78B-65F689DC2048}” = “Goback Drives” -> {HKLM…CLSID} = “Goback Drives” \InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton GoBack\GBDrvShX.dll” [“Symantec Corporation”] “{6809E580-A3A7-11D1-9A00-00A0C945B006}” = “GoBack Shell Extension” -> {HKLM…CLSID} = “GoBack Shell Extension” \InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton GoBack\ShellExt.dll” [“Symantec Corporation”] “{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}” = “My Logitech Pictures” -> {HKLM…CLSID} = “My Logitech Pictures” \InProcServer32(Default) = “C:\Program Files\Logitech\Video\Namespc2.dll” [“Logitech Inc.”] “{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}” = “PhoneBrowser” -> {HKLM…CLSID} = “Nokia Phone Browser” \InProcServer32(Default) = “C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll” [“Nokia”] “{C0C4375A-5B72-4efe-929D-3B848C3A1E91}” = “Message View” -> {HKLM…CLSID} = “Message View” \InProcServer32(Default) = “C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll” [“Nokia”] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ INFECTION WARNING! “AppInit_DLLs” = “wbsys.dll” [“Stardock.Net, Inc”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! igfxcui\DLLName = “igfxsrvc.dll” [“Intel Corporation”] INFECTION WARNING! Sebring\DLLName = “c:\WINDOWS\System32\LgNotify.dll” [“Intel Corporation”] INFECTION WARNING! WB\DLLName = “C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll” [“Stardock”] INFECTION WARNING! WgaLogon\DLLName = “WgaLogon.dll” [MS] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ GoBack(Default) = “{6809E580-A3A7-11D1-9A00-00A0C945B006}” -> {HKLM…CLSID} = “GoBack Shell Extension” \InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton GoBack\ShellExt.dll” [“Symantec Corporation”] Symantec.Norton.Antivirus.IEContextMenu(Default) = “{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}” -> {HKLM…CLSID} = “IEContextMenu Class” \InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Symantec.Norton.Antivirus.IEContextMenu(Default) = “{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}” -> {HKLM…CLSID} = “IEContextMenu Class” \InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Wholesaler24.com\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\scrnsave.scr” [MS] Startup items in “Wholesaler24.com” & “All Users” startup folders: ------------------------------------------------------------------ C:\Documents and Settings\Wholesaler24.com\Menu Start\Programy\Autostart “HDDlife” -> shortcut to: “C:\Program Files\BinarySense\HDDlife\HDDlifePro.exe” [“BinarySense, Ltd.”] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Norton GoBack” -> shortcut to: “C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe” [“Symantec Corporation”] “PC Health” -> shortcut to: “C:\Program Files\Toshiba\TOSHIBA Management Console\TOSHealthLocalS.vbs” [null data] Enabled Scheduled Tasks: ------------------------ “Norton SystemWorks One Button Checkup” -> launches: “C:\Program Files\Norton SystemWorks\OBC.exe /CUSTOM /SCHEDULE /AUTO” [“Symantec Corporation”] “Symantec Drmc” -> launches: “C:\Program Files\Common Files\Symantec Shared\SymDrmc.exe /CUSTOM /SCHEDULE” [“Symantec Corporation”] “Symantec NetDetect” -> launches: “C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE” [“Symantec Corporation”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}” -> {HKLM…CLSID} = “Copernic Agent” \InProcServer32(Default) = “C:\Program Files\Copernic Agent\CopernicAgentExt.dll” [“Copernic Technologies Inc.”] “{C4069E3A-68F1-403E-B40E-20066696354B}” -> {HKLM…CLSID} = “Norton AntiVirus” \InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}” -> {HKLM…CLSID} = “Norton Internet Security” \InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”] “{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}” -> {HKLM…CLSID} = “Copernic Agent” \InProcServer32(Default) = “C:\Program Files\Copernic Agent\CopernicAgentExt.dll” [“Copernic Technologies Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}” = “Norton Internet Security” -> {HKLM…CLSID} = “Norton Internet Security” \InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”] “{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}” = (no title provided) -> {HKLM…CLSID} = “Copernic Agent” \InProcServer32(Default) = “C:\Program Files\Copernic Agent\CopernicAgentExt.dll” [“Copernic Technologies Inc.”] “{C4069E3A-68F1-403E-B40E-20066696354B}” = “Norton AntiVirus” -> {HKLM…CLSID} = “Norton AntiVirus” \InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {6F480F82-C3A6-4D35-96F7-B297AD49FBE8}(Default) = (no title provided) -> {HKLM…CLSID} = “Copernic Agent Results” \InProcServer32(Default) = “C:\Program Files\Copernic Agent\CopernicAgentExt.dll” [“Copernic Technologies Inc.”] {F2E259E8-0FC8-438C-A6E0-342DD80FA53E}(Default) = (no title provided) -> {HKLM…CLSID} = “Copernic Agent” \InProcServer32(Default) = “C:\Program Files\Copernic Agent\CopernicAgentExt.dll” [“Copernic Technologies Inc.”] Dormant Explorer Bars in “View, Explorer Bar” menu HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{08B0E5C0-4FCB-11CF-AAA5-00401C608501}” {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084}\ “MenuText” = “Launch Copernic Agent” “Exec” = “C:\PROGRA~1\COPERN~1\COPERN~1.EXE” [“Copernic Technologies Inc.”] {5E638779-1818-4754-A595-EF1C63B87A56}\ “ButtonText” = “Express Cleanup” “MenuText” = “Express Cleanup” “Exec” = “C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk” [null data] {688DC797-DC11-46A7-9F1B-445F4F58CE6E}\ “ButtonText” = “Copernic Agent” “Exec” = “C:\PROGRA~1\COPERN~1\COPERN~1.EXE” [“Copernic Technologies Inc.”] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to “Reset Web Settings”) Added lines (compared with English-language version): [strings]: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html Missing lines (compared with English-language version): [strings]: 1 line HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ “{BE89472C-B803-4D1D-9A9A-0A63660E0FE3}” = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\PROGRA~1\COPERN~1\COPERN~1.DLL” [“Copernic Technologies Inc.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ConfigFree Service, CFSvcs, “C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe” [“TOSHIBA CORPORATION”] GEARSecurity, GEARSecurity, “C:\WINDOWS\System32\GEARSec.exe” [“GEAR Software”] GoBack Polling Service, GBPoll, ““C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe”” [“Symantec Corporation”] HTTP SSL, HTTPFilter, “C:\WINDOWS\System32\svchost.exe -k HTTPFilter” {“C:\WINDOWS\System32\w3ssl.dll” [MS]} ISSvc, ISSVC, ““C:\Program Files\Norton Internet Security\ISSVC.exe”” [“Symantec Corporation”] Multi-Function Station Device Monitor, KMDevmonSrv, “C:\WINDOWS\system32\KMDEVMONSRV.exe” [null data] Norton AntiVirus Firewall Monitor Service, NPFMntor, ““C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe”” [“Symantec Corporation”] Norton Ghost, Norton Ghost, “C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\VProSvc.exe” [“Symantec Corporation”] Norton UnErase Protection, NProtectService, “C:\PROGRA~1\NORTON~2\NORTON~3\NPROTECT.EXE” [“Symantec Corporation”] RegSrvc, RegSrvc, “C:\WINDOWS\System32\RegSrvc.exe” [“Intel Corporation”] SPBBCSvc, SPBBCSvc, ““C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe”” [“Symantec Corporation”] Spectrum24 Event Monitor, S24EventMonitor, “C:\WINDOWS\System32\S24EvMon.exe” ["Intel Corporation "] Speed Disk service, Speed Disk service, “C:\PROGRA~1\NORTON~2\NORTON~3\SPEEDD~1\NOPDB.EXE” [“Symantec Corporation”] Symantec Core LC, Symantec Core LC, “C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe” [“Symantec Corporation”] Symantec Event Manager, ccEvtMgr, ““C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe”” [“Symantec Corporation”] Symantec Network Drivers Service, SNDSrvc, ““C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe”” [“Symantec Corporation”] Symantec Network Proxy, ccProxy, ““C:\Program Files\Common Files\Symantec Shared\ccProxy.exe”” [“Symantec Corporation”] Symantec Settings Manager, ccSetMgr, ““C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe”” [“Symantec Corporation”] Tmesrv3, Tmesrv, ““C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe” /Service” [“TOSHIBA”] Usługa Auto-Protect programu Norton AntiVirus, navapsvc, ““C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe”” [“Symantec Corporation”] Usługa Norton Protection Center, NSCService, ““C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE”” [“Symantec Corporation”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] Panasonic FLM551/FLB751 Series PortMonitor\Driver = “KMPMONNT.DLL” [“Conexant Systems, Inc.”] Panasonic MFS LanMon\Driver = “KMPCFXLMON.DLL” [“Windows ® 2000 DDK provider”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 51 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 11 seconds. ---------- (total run time: 117 seconds)