System alert masz trojana!

Dla specjalistów Bezpieczeństwo
#1

Dostałem progrm “w prezencie” pmmon.exe oraz pmsngr.exe i system alert odsyła mnie ciągle do stron z antywirusami. O czywiście po odinstalowaniu programu nadal nie mogę usunąć tych dwoch programów. Jak mogę się tego pozbyć??? Prosze o pomoc i wskazowki. Nie jestem bieglym informatykiem, a do tego mój system windows xp jest w języku norweskim. :frowning: :cry:

#2

Użyj narzędzia SmitFraudFix z opcji numer 2 w trybie awaryjnym z wyłączonym przywracaniem systemu.

Po wykonaniu pokaż log z hjt, SilentRunners oraz c:\rapport.txt.

#3

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by “{++}”

Startup items buried in registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

“MSMSGS” = ““C:\Programfiler\Messenger\msmsgs.exe” /background” [MS]

“ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS]

“Skype” = ““C:\APPS\skype\phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”]

“Yahoo! Pager” = ““C:\Programfiler\Yahoo!\Messenger\YahooMessenger.exe” -quiet” [file not found]

“OM_Monitor” = “C:\Programfiler\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart” [file not found]

“Creative WebCam Tray” = ““C:\Programfiler\Creative\Shared Files\CamTray.exe”” [“Creative Technology Ltd”]

“Gadu-Gadu” = ““C:\Programfiler\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}

“none” = “C:\Programfiler\Key Generator\pmsngr.exe” [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

“IMJPMIG8.1” = ““C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” /Spoil /RemAdvDef /Migration32” [MS]

“PHIME2002ASync” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC” [MS]

“PHIME2002A” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName” [MS]

“SynTPLpr” = “C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe” [“Synaptics, Inc.”]

“SynTPEnh” = “C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe” [“Synaptics, Inc.”]

“VTTimer” = “VTTimer.exe” [“S3 Graphics, Inc.”]

“VTTrayp” = “VTtrayp.exe” [“S3 Graphics Co., Ltd.”]

“STDSB” = “C:\WINDOWS\system32\drivers\STDSB.exe” [null data]

“Icon” = “C:\WINDOWS\system32\drivers\Icon.exe” [empty string]

“SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”]

“SunJavaUpdateSched” = “C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe” [“Sun Microsystems, Inc.”]

“ccApp” = ““C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe”” [“Symantec Corporation”]

“PCMService” = ““c:\Apps\Powercinema\PCMService.exe”” [“CyberLink Corp.”]

“Symantec NetDriver Monitor” = “C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer” [“Symantec Corporation”]

“Easy-PrintToolBox” = “C:\Programfiler\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon” [“CANON INC.”]

“WinampAgent” = “C:\Programfiler\Winamp\winampa.exe” [null data]

“DC6_check” = ““C:\Programfiler\Fellesfiler\dc6_startupmon.exe”” [file not found]

“ERS_check” = ““C:\Programfiler\Fellesfiler\ers_startupmon.exe”” [file not found]

“QuickTime Task” = ““C:\Programfiler\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”]

“iTunesHelper” = ““C:\Programfiler\iTunes\iTunesHelper.exe”” [“Apple Computer, Inc.”]

“AVG7_CC” = “C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP” [“GRISOFT, s.r.o.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{02478D38-C3F9-4EFB-9B51-7695ECA05670}(Default) = (no title provided)

-> {HKLM…CLSID} = “Yahoo! Toolbar Helper”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided)

-> {HKLM…CLSID} = “AcroIEHlprObj Class”

\InProcServer32(Default) = “C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided)

-> {HKLM…CLSID} = “SSVHelper Class”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”]

{9ECB9560-04F9-4bbc-943D-298DDF1699E1}(Default) = (no title provided)

-> {HKLM…CLSID} = “CNisExtBho Class”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

{BDF3E430-B101-42AD-A544-FADC6B084872}(Default) = (no title provided)

-> {HKLM…CLSID} = “CNavExtBho Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

“{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Kontrollpanelsutvidelse for skjermpanorering”

-> {HKLM…CLSID} = “Kontrollpanelsutvidelse for skjermpanorering”

\InProcServer32(Default) = “deskpan.dll” [file not found]

“{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Ikonutvidelse for HyperTerminal”

-> {HKLM…CLSID} = “HyperTerminal Icon Ext”

\InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”]

“{2F603045-309F-11CF-9774-0020AFD0CFF6}” = “Synaptics Control Panel”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = “C:\Programfiler\Synaptics\SynTP\SynTPCpl.dll” [“Synaptics, Inc.”]

“{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu”

-> {HKLM…CLSID} = “Portable Media Devices Menu”

\InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS]

“{DEE12703-6333-4D4E-8F34-738C4DCC2E04}” = “RecordNow! SendToExt”

-> {HKLM…CLSID} = “RecordNow! SendToExt”

\InProcServer32(Default) = “C:\Apps\RecordNow\shlext.dll” [null data]

“{e57ce731-33e8-4c51-8354-bb4de9d215d1}” = “Universelle Plug and Play-enheter”

-> {HKLM…CLSID} = “Universelle Plug and Play-enheter”

\InProcServer32(Default) = “C:\WINDOWS\system32\upnpui.dll” [MS]

“{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}” = “iTunes”

-> {HKLM…CLSID} = “iTunes”

\InProcServer32(Default) = “C:\Programfiler\iTunes\iTunesMiniPlayer.dll” [“Apple Computer, Inc.”]

“{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

“{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}” = “AVG7 Shell Extension”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

“{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}” = “AVG7 Find Extension”

-> {HKLM…CLSID} = “AVG7 Find Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

HKLM\System\CurrentControlSet\Control\Session Manager\

<> “BootExecute” = “autocheck autochk *”|“stera” [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info”

-> {HKLM…CLSID} = “PDF Shell Extension”

\InProcServer32(Default) = “C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”]

HKLM\Software\Classes*\shellex\ContextMenuHandlers\

AVG7 Shell Extension(Default) = “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {HKLM…CLSID} = “IEContextMenu Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

AVG7 Shell Extension(Default) = “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {HKLM…CLSID} = “IEContextMenu Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

Group Policies {policy setting}:

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

“shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001

{Shutdown: Allow system to be shut down without having to log on}

“undockwithoutlogon” = (REG_DWORD) hex:0x00000001

{Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:

Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

“Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Lokale innstillinger\Programdata\Microsoft\Wallpaper1.bmp”

Enabled Screen Saver:

HKCU\Control Panel\Desktop\

“SCRNSAVE.EXE” = “C:\WINDOWS\system32\ssmypics.scr” [MS]

Startup items in “Bruker” & “All Users” startup folders:

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart

“Hurtigstart for Adobe Reader” -> shortcut to: “C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”]

“ymetray” -> shortcut to: “C:\Programfiler\Yahoo!\Yahoo! Music Jukebox\ymetray.exe C:\Programfiler\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe -preload” [null data]

Enabled Scheduled Tasks:

“HDReg” -> launches: “c:\Apps\HDReg\HDRegRem.exe” [null data]

Winsock2 Service Provider DLLs:

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS]

000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

“{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}”

-> {HKLM…CLSID} = “Norton Internet Security”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}”

-> {HKLM…CLSID} = “Norton AntiVirus”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}”

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\

“{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}” = “Norton Internet Security”

-> {HKLM…CLSID} = “Norton Internet Security”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}” = “Norton AntiVirus”

-> {HKLM…CLSID} = “Norton AntiVirus”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = (no title provided)

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

“MenuText” = “Sun Java Console”

“CLSIDExtension” = “{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}”

-> {HKCU…CLSID} = “Java Plug-in”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”]

-> {HKLM…CLSID} = “Java Plug-in 1.5.0_06”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.5.0_06\bin\npjpi150_06.dll” [“Sun Microsystems, Inc.”]

{E2E2DD38-D088-4134-82B7-F2BA38496583}\

“MenuText” = “@xpsp3res.dll,-20001”

“Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS]

{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}\

“ButtonText” = “Yahoo! Messenger”

“MenuText” = “Yahoo! Messenger”

“Exec” = “C:\Programfiler\Yahoo!\Messenger\YahooMessenger.exe” [file not found]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\

“ButtonText” = “Messenger”

“MenuText” = “Windows Messenger”

“Exec” = “C:\Programfiler\Messenger\msmsgs.exe” [MS]

Miscellaneous IE Hijack Points

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

<> “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = “*f” (unwritable string)

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

Running Services (Display Name, Service Name, Path {Service DLL}):

Automatisk LiveUpdate-planlegging, Automatisk LiveUpdate-planlegging, ““C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe”” [“Symantec Corporation”]

AVG E-mail Scanner, AVGEMS, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe” [“GRISOFT, s.r.o.”]

AVG7 Alert Manager Server, Avg7Alrt, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe” [“GRISOFT, s.r.o.”]

AVG7 Update Service, Avg7UpdSvc, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe” [“GRISOFT, s.r.o.”]

Belkin High-Speed Mode Wireless G USB Driver, Belkin High-Speed Mode Wireless G USB Network Adapter Service, “C:\Programfiler\Belkin\F5D7051\WLService.exe” [null data]

CyberLink Background Capture Service (CBCS), CLCapSvc, ““c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe”” [empty string]

CyberLink Media Library Service, CyberLink Media Library Service, ““C:\Programfiler\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe”” [“Cyberlink”]

CyberLink Task Scheduler (CTS), CLSched, ““c:\APPS\Powercinema\Kernel\TV\CLSched.exe”” [empty string]

Generic Service for HID Keyboard Input Collections, GenericHidService, “c:\APPS\HIDSERVICE\HIDSERVICE.exe” [null data]

iPod Service, iPod Service, ““C:\Programfiler\iPod\bin\iPodService.exe”” [“Apple Computer, Inc.”]

ISSvc, ISSVC, ““C:\Programfiler\Norton Internet Security\ISSVC.exe”” [“Symantec Corporation”]

Norton AntiVirus Auto-Protect-tjeneste, navapsvc, ““C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe”” [“Symantec Corporation”]

SmartLinkService, SLService, “slmdmsr.exe” [" "]

Symantec Event Manager, ccEvtMgr, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe”” [“Symantec Corporation”]

Symantec Network Drivers Service, SNDSrvc, ““C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe”” [“Symantec Corporation”]

Symantec Network Proxy, ccProxy, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe”” [“Symantec Corporation”]

Symantec Settings Manager, ccSetMgr, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe”” [“Symantec Corporation”]

Symantec SPBBCSvc, SPBBCSvc, ““C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe”” [“Symantec Corporation”]

Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS]

Print Monitors:

HKLM\System\CurrentControlSet\Control\Print\Monitors\

Canon BJ Language Monitor iP1200\Driver = “CNMLM76.DLL” [“CANON INC.”]

<>: Suspicious data at a malware launch point.

<>: Suspicious data at a browser hijack point.

  • This report excludes default entries except where indicated.

  • To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

  • To search all directories of local fixed drives for DESKTOP.INI

DLL launch points, use the -supp parameter or answer “No” at the

first message box and “Yes” at the second message box.

---------- (total run time: 83 seconds, including 15 seconds for message boxes)

Złączono Posty : 14.01.2007 (Nie) 21:30

czy powinienem jeszcze coś zrobić i czy trzeba usunąć programy Smit… i silent… ???

Złączono Posty : 14.01.2007 (Nie) 21:32

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by “{++}”

Startup items buried in registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

“MSMSGS” = ““C:\Programfiler\Messenger\msmsgs.exe” /background” [MS]

“ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS]

“Skype” = ““C:\APPS\skype\phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”]

“Yahoo! Pager” = ““C:\Programfiler\Yahoo!\Messenger\YahooMessenger.exe” -quiet” [file not found]

“OM_Monitor” = “C:\Programfiler\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart” [file not found]

“Creative WebCam Tray” = ““C:\Programfiler\Creative\Shared Files\CamTray.exe”” [“Creative Technology Ltd”]

“Gadu-Gadu” = ““C:\Programfiler\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}

“none” = “C:\Programfiler\Key Generator\pmsngr.exe” [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

“IMJPMIG8.1” = ““C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” /Spoil /RemAdvDef /Migration32” [MS]

“PHIME2002ASync” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC” [MS]

“PHIME2002A” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName” [MS]

“SynTPLpr” = “C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe” [“Synaptics, Inc.”]

“SynTPEnh” = “C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe” [“Synaptics, Inc.”]

“VTTimer” = “VTTimer.exe” [“S3 Graphics, Inc.”]

“VTTrayp” = “VTtrayp.exe” [“S3 Graphics Co., Ltd.”]

“STDSB” = “C:\WINDOWS\system32\drivers\STDSB.exe” [null data]

“Icon” = “C:\WINDOWS\system32\drivers\Icon.exe” [empty string]

“SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”]

“SunJavaUpdateSched” = “C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe” [“Sun Microsystems, Inc.”]

“ccApp” = ““C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe”” [“Symantec Corporation”]

“PCMService” = ““c:\Apps\Powercinema\PCMService.exe”” [“CyberLink Corp.”]

“Symantec NetDriver Monitor” = “C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer” [“Symantec Corporation”]

“Easy-PrintToolBox” = “C:\Programfiler\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon” [“CANON INC.”]

“WinampAgent” = “C:\Programfiler\Winamp\winampa.exe” [null data]

“DC6_check” = ““C:\Programfiler\Fellesfiler\dc6_startupmon.exe”” [file not found]

“ERS_check” = ““C:\Programfiler\Fellesfiler\ers_startupmon.exe”” [file not found]

“QuickTime Task” = ““C:\Programfiler\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”]

“iTunesHelper” = ““C:\Programfiler\iTunes\iTunesHelper.exe”” [“Apple Computer, Inc.”]

“AVG7_CC” = “C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP” [“GRISOFT, s.r.o.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{02478D38-C3F9-4EFB-9B51-7695ECA05670}(Default) = (no title provided)

-> {HKLM…CLSID} = “Yahoo! Toolbar Helper”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided)

-> {HKLM…CLSID} = “AcroIEHlprObj Class”

\InProcServer32(Default) = “C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided)

-> {HKLM…CLSID} = “SSVHelper Class”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”]

{9ECB9560-04F9-4bbc-943D-298DDF1699E1}(Default) = (no title provided)

-> {HKLM…CLSID} = “CNisExtBho Class”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

{BDF3E430-B101-42AD-A544-FADC6B084872}(Default) = (no title provided)

-> {HKLM…CLSID} = “CNavExtBho Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

“{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Kontrollpanelsutvidelse for skjermpanorering”

-> {HKLM…CLSID} = “Kontrollpanelsutvidelse for skjermpanorering”

\InProcServer32(Default) = “deskpan.dll” [file not found]

“{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Ikonutvidelse for HyperTerminal”

-> {HKLM…CLSID} = “HyperTerminal Icon Ext”

\InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”]

“{2F603045-309F-11CF-9774-0020AFD0CFF6}” = “Synaptics Control Panel”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = “C:\Programfiler\Synaptics\SynTP\SynTPCpl.dll” [“Synaptics, Inc.”]

“{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu”

-> {HKLM…CLSID} = “Portable Media Devices Menu”

\InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS]

“{DEE12703-6333-4D4E-8F34-738C4DCC2E04}” = “RecordNow! SendToExt”

-> {HKLM…CLSID} = “RecordNow! SendToExt”

\InProcServer32(Default) = “C:\Apps\RecordNow\shlext.dll” [null data]

“{e57ce731-33e8-4c51-8354-bb4de9d215d1}” = “Universelle Plug and Play-enheter”

-> {HKLM…CLSID} = “Universelle Plug and Play-enheter”

\InProcServer32(Default) = “C:\WINDOWS\system32\upnpui.dll” [MS]

“{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}” = “iTunes”

-> {HKLM…CLSID} = “iTunes”

\InProcServer32(Default) = “C:\Programfiler\iTunes\iTunesMiniPlayer.dll” [“Apple Computer, Inc.”]

“{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

“{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}” = “AVG7 Shell Extension”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

“{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}” = “AVG7 Find Extension”

-> {HKLM…CLSID} = “AVG7 Find Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

HKLM\System\CurrentControlSet\Control\Session Manager\

<> “BootExecute” = “autocheck autochk *”|“stera” [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info”

-> {HKLM…CLSID} = “PDF Shell Extension”

\InProcServer32(Default) = “C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”]

HKLM\Software\Classes*\shellex\ContextMenuHandlers\

AVG7 Shell Extension(Default) = “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {HKLM…CLSID} = “IEContextMenu Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

AVG7 Shell Extension(Default) = “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {HKLM…CLSID} = “IEContextMenu Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

Group Policies {policy setting}:

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

“shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001

{Shutdown: Allow system to be shut down without having to log on}

“undockwithoutlogon” = (REG_DWORD) hex:0x00000001

{Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:

Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

“Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Lokale innstillinger\Programdata\Microsoft\Wallpaper1.bmp”

Enabled Screen Saver:

HKCU\Control Panel\Desktop\

“SCRNSAVE.EXE” = “C:\WINDOWS\system32\ssmypics.scr” [MS]

Startup items in “Bruker” & “All Users” startup folders:

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart

“Hurtigstart for Adobe Reader” -> shortcut to: “C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”]

“ymetray” -> shortcut to: “C:\Programfiler\Yahoo!\Yahoo! Music Jukebox\ymetray.exe C:\Programfiler\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe -preload” [null data]

Enabled Scheduled Tasks:

“HDReg” -> launches: “c:\Apps\HDReg\HDRegRem.exe” [null data]

Winsock2 Service Provider DLLs:

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS]

000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

“{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}”

-> {HKLM…CLSID} = “Norton Internet Security”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}”

-> {HKLM…CLSID} = “Norton AntiVirus”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}”

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\

“{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}” = “Norton Internet Security”

-> {HKLM…CLSID} = “Norton Internet Security”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}” = “Norton AntiVirus”

-> {HKLM…CLSID} = “Norton AntiVirus”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = (no title provided)

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

“MenuText” = “Sun Java Console”

“CLSIDExtension” = “{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}”

-> {HKCU…CLSID} = “Java Plug-in”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”]

-> {HKLM…CLSID} = “Java Plug-in 1.5.0_06”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.5.0_06\bin\npjpi150_06.dll” [“Sun Microsystems, Inc.”]

{E2E2DD38-D088-4134-82B7-F2BA38496583}\

“MenuText” = “@xpsp3res.dll,-20001”

“Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS]

{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}\

“ButtonText” = “Yahoo! Messenger”

“MenuText” = “Yahoo! Messenger”

“Exec” = “C:\Programfiler\Yahoo!\Messenger\YahooMessenger.exe” [file not found]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\

“ButtonText” = “Messenger”

“MenuText” = “Windows Messenger”

“Exec” = “C:\Programfiler\Messenger\msmsgs.exe” [MS]

Miscellaneous IE Hijack Points

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

<> “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = “*f” (unwritable string)

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

Running Services (Display Name, Service Name, Path {Service DLL}):

Automatisk LiveUpdate-planlegging, Automatisk LiveUpdate-planlegging, ““C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe”” [“Symantec Corporation”]

AVG E-mail Scanner, AVGEMS, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe” [“GRISOFT, s.r.o.”]

AVG7 Alert Manager Server, Avg7Alrt, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe” [“GRISOFT, s.r.o.”]

AVG7 Update Service, Avg7UpdSvc, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe” [“GRISOFT, s.r.o.”]

Belkin High-Speed Mode Wireless G USB Driver, Belkin High-Speed Mode Wireless G USB Network Adapter Service, “C:\Programfiler\Belkin\F5D7051\WLService.exe” [null data]

CyberLink Background Capture Service (CBCS), CLCapSvc, ““c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe”” [empty string]

CyberLink Media Library Service, CyberLink Media Library Service, ““C:\Programfiler\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe”” [“Cyberlink”]

CyberLink Task Scheduler (CTS), CLSched, ““c:\APPS\Powercinema\Kernel\TV\CLSched.exe”” [empty string]

Generic Service for HID Keyboard Input Collections, GenericHidService, “c:\APPS\HIDSERVICE\HIDSERVICE.exe” [null data]

iPod Service, iPod Service, ““C:\Programfiler\iPod\bin\iPodService.exe”” [“Apple Computer, Inc.”]

ISSvc, ISSVC, ““C:\Programfiler\Norton Internet Security\ISSVC.exe”” [“Symantec Corporation”]

Norton AntiVirus Auto-Protect-tjeneste, navapsvc, ““C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe”” [“Symantec Corporation”]

SmartLinkService, SLService, “slmdmsr.exe” [" "]

Symantec Event Manager, ccEvtMgr, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe”” [“Symantec Corporation”]

Symantec Network Drivers Service, SNDSrvc, ““C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe”” [“Symantec Corporation”]

Symantec Network Proxy, ccProxy, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe”” [“Symantec Corporation”]

Symantec Settings Manager, ccSetMgr, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe”” [“Symantec Corporation”]

Symantec SPBBCSvc, SPBBCSvc, ““C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe”” [“Symantec Corporation”]

Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS]

Print Monitors:

HKLM\System\CurrentControlSet\Control\Print\Monitors\

Canon BJ Language Monitor iP1200\Driver = “CNMLM76.DLL” [“CANON INC.”]

<>: Suspicious data at a malware launch point.

<>: Suspicious data at a browser hijack point.

  • This report excludes default entries except where indicated.

  • To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

  • To search all directories of local fixed drives for DESKTOP.INI

DLL launch points, use the -supp parameter or answer “No” at the

first message box and “Yes” at the second message box.

---------- (total run time: 83 seconds, including 15 seconds for message boxes)

dodaje jeszcze ten raport

Złączono Posty : 14.01.2007 (Nie) 21:37

adam9870 proszę jeszcze o podpowiedź co mam dalej robic i czy to już po wszyskim?

#4

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Po wykonaniu możesz pokazać nowy log z Silenta.

Proponuję przeczyścić rejestr ponieważ masz kilka pustych kluczy opis.

#5

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by “{++}”

Startup items buried in registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

“MSMSGS” = ““C:\Programfiler\Messenger\msmsgs.exe” /background” [MS]

“ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS]

“Skype” = ““C:\APPS\skype\phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”]

“Yahoo! Pager” = ““C:\Programfiler\Yahoo!\Messenger\YahooMessenger.exe” -quiet” [file not found]

“OM_Monitor” = “C:\Programfiler\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart” [file not found]

“Creative WebCam Tray” = ““C:\Programfiler\Creative\Shared Files\CamTray.exe”” [“Creative Technology Ltd”]

“Gadu-Gadu” = ““C:\Programfiler\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

“IMJPMIG8.1” = ““C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” /Spoil /RemAdvDef /Migration32” [MS]

“PHIME2002ASync” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC” [MS]

“PHIME2002A” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName” [MS]

“SynTPLpr” = “C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe” [“Synaptics, Inc.”]

“SynTPEnh” = “C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe” [“Synaptics, Inc.”]

“VTTimer” = “VTTimer.exe” [“S3 Graphics, Inc.”]

“VTTrayp” = “VTtrayp.exe” [“S3 Graphics Co., Ltd.”]

“STDSB” = “C:\WINDOWS\system32\drivers\STDSB.exe” [null data]

“Icon” = “C:\WINDOWS\system32\drivers\Icon.exe” [empty string]

“SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”]

“SunJavaUpdateSched” = “C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe” [“Sun Microsystems, Inc.”]

“ccApp” = ““C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe”” [“Symantec Corporation”]

“PCMService” = ““c:\Apps\Powercinema\PCMService.exe”” [“CyberLink Corp.”]

“Symantec NetDriver Monitor” = “C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer” [“Symantec Corporation”]

“Easy-PrintToolBox” = “C:\Programfiler\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon” [“CANON INC.”]

“WinampAgent” = “C:\Programfiler\Winamp\winampa.exe” [null data]

“DC6_check” = ““C:\Programfiler\Fellesfiler\dc6_startupmon.exe”” [file not found]

“ERS_check” = ““C:\Programfiler\Fellesfiler\ers_startupmon.exe”” [file not found]

“QuickTime Task” = ““C:\Programfiler\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”]

“iTunesHelper” = ““C:\Programfiler\iTunes\iTunesHelper.exe”” [“Apple Computer, Inc.”]

“AVG7_CC” = “C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP” [“GRISOFT, s.r.o.”]

Złączono Posty : 14.01.2007 (Nie) 22:07

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by “{++}”

Startup items buried in registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

“MSMSGS” = ““C:\Programfiler\Messenger\msmsgs.exe” /background” [MS]

“ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS]

“Skype” = ““C:\APPS\skype\phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”]

“Yahoo! Pager” = ““C:\Programfiler\Yahoo!\Messenger\YahooMessenger.exe” -quiet” [file not found]

“OM_Monitor” = “C:\Programfiler\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart” [file not found]

“Creative WebCam Tray” = ““C:\Programfiler\Creative\Shared Files\CamTray.exe”” [“Creative Technology Ltd”]

“Gadu-Gadu” = ““C:\Programfiler\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

“IMJPMIG8.1” = ““C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” /Spoil /RemAdvDef /Migration32” [MS]

“PHIME2002ASync” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC” [MS]

“PHIME2002A” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName” [MS]

“SynTPLpr” = “C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe” [“Synaptics, Inc.”]

“SynTPEnh” = “C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe” [“Synaptics, Inc.”]

“VTTimer” = “VTTimer.exe” [“S3 Graphics, Inc.”]

“VTTrayp” = “VTtrayp.exe” [“S3 Graphics Co., Ltd.”]

“STDSB” = “C:\WINDOWS\system32\drivers\STDSB.exe” [null data]

“Icon” = “C:\WINDOWS\system32\drivers\Icon.exe” [empty string]

“SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”]

“SunJavaUpdateSched” = “C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe” [“Sun Microsystems, Inc.”]

“ccApp” = ““C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe”” [“Symantec Corporation”]

“PCMService” = ““c:\Apps\Powercinema\PCMService.exe”” [“CyberLink Corp.”]

“Symantec NetDriver Monitor” = “C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer” [“Symantec Corporation”]

“Easy-PrintToolBox” = “C:\Programfiler\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon” [“CANON INC.”]

“WinampAgent” = “C:\Programfiler\Winamp\winampa.exe” [null data]

“DC6_check” = ““C:\Programfiler\Fellesfiler\dc6_startupmon.exe”” [file not found]

“ERS_check” = ““C:\Programfiler\Fellesfiler\ers_startupmon.exe”” [file not found]

“QuickTime Task” = ““C:\Programfiler\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”]

“iTunesHelper” = ““C:\Programfiler\iTunes\iTunesHelper.exe”” [“Apple Computer, Inc.”]

“AVG7_CC” = “C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP” [“GRISOFT, s.r.o.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{02478D38-C3F9-4EFB-9B51-7695ECA05670}(Default) = (no title provided)

-> {HKLM…CLSID} = “Yahoo! Toolbar Helper”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided)

-> {HKLM…CLSID} = “AcroIEHlprObj Class”

\InProcServer32(Default) = “C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided)

-> {HKLM…CLSID} = “SSVHelper Class”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”]

{9ECB9560-04F9-4bbc-943D-298DDF1699E1}(Default) = (no title provided)

-> {HKLM…CLSID} = “CNisExtBho Class”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

{BDF3E430-B101-42AD-A544-FADC6B084872}(Default) = (no title provided)

-> {HKLM…CLSID} = “CNavExtBho Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

“{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Kontrollpanelsutvidelse for skjermpanorering”

-> {HKLM…CLSID} = “Kontrollpanelsutvidelse for skjermpanorering”

\InProcServer32(Default) = “deskpan.dll” [file not found]

“{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Ikonutvidelse for HyperTerminal”

-> {HKLM…CLSID} = “HyperTerminal Icon Ext”

\InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”]

“{2F603045-309F-11CF-9774-0020AFD0CFF6}” = “Synaptics Control Panel”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = “C:\Programfiler\Synaptics\SynTP\SynTPCpl.dll” [“Synaptics, Inc.”]

“{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu”

-> {HKLM…CLSID} = “Portable Media Devices Menu”

\InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS]

“{DEE12703-6333-4D4E-8F34-738C4DCC2E04}” = “RecordNow! SendToExt”

-> {HKLM…CLSID} = “RecordNow! SendToExt”

\InProcServer32(Default) = “C:\Apps\RecordNow\shlext.dll” [null data]

“{e57ce731-33e8-4c51-8354-bb4de9d215d1}” = “Universelle Plug and Play-enheter”

-> {HKLM…CLSID} = “Universelle Plug and Play-enheter”

\InProcServer32(Default) = “C:\WINDOWS\system32\upnpui.dll” [MS]

“{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}” = “iTunes”

-> {HKLM…CLSID} = “iTunes”

\InProcServer32(Default) = “C:\Programfiler\iTunes\iTunesMiniPlayer.dll” [“Apple Computer, Inc.”]

“{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

“{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}” = “AVG7 Shell Extension”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

“{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}” = “AVG7 Find Extension”

-> {HKLM…CLSID} = “AVG7 Find Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

HKLM\System\CurrentControlSet\Control\Session Manager\

<> “BootExecute” = “autocheck autochk *”|“stera” [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info”

-> {HKLM…CLSID} = “PDF Shell Extension”

\InProcServer32(Default) = “C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”]

HKLM\Software\Classes*\shellex\ContextMenuHandlers\

AVG7 Shell Extension(Default) = “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {HKLM…CLSID} = “IEContextMenu Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

AVG7 Shell Extension(Default) = “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”]

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {HKLM…CLSID} = “IEContextMenu Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

Group Policies {policy setting}:

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

“shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001

{Shutdown: Allow system to be shut down without having to log on}

“undockwithoutlogon” = (REG_DWORD) hex:0x00000001

{Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:

Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

“Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Lokale innstillinger\Programdata\Microsoft\Wallpaper1.bmp”

Enabled Screen Saver:

HKCU\Control Panel\Desktop\

“SCRNSAVE.EXE” = “C:\WINDOWS\system32\ssmypics.scr” [MS]

Startup items in “Bruker” & “All Users” startup folders:

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart

“Hurtigstart for Adobe Reader” -> shortcut to: “C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”]

“ymetray” -> shortcut to: “C:\Programfiler\Yahoo!\Yahoo! Music Jukebox\ymetray.exe C:\Programfiler\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe -preload” [null data]

Enabled Scheduled Tasks:

“HDReg” -> launches: “c:\Apps\HDReg\HDRegRem.exe” [null data]

Winsock2 Service Provider DLLs:

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS]

000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

“{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}”

-> {HKLM…CLSID} = “Norton Internet Security”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}”

-> {HKLM…CLSID} = “Norton AntiVirus”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}”

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\

“{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}” = “Norton Internet Security”

-> {HKLM…CLSID} = “Norton Internet Security”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}” = “Norton AntiVirus”

-> {HKLM…CLSID} = “Norton AntiVirus”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = (no title provided)

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

“MenuText” = “Sun Java Console”

“CLSIDExtension” = “{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}”

-> {HKCU…CLSID} = “Java Plug-in”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”]

-> {HKLM…CLSID} = “Java Plug-in 1.5.0_06”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.5.0_06\bin\npjpi150_06.dll” [“Sun Microsystems, Inc.”]

{E2E2DD38-D088-4134-82B7-F2BA38496583}\

“MenuText” = “@xpsp3res.dll,-20001”

“Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS]

{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}\

“ButtonText” = “Yahoo! Messenger”

“MenuText” = “Yahoo! Messenger”

“Exec” = “C:\Programfiler\Yahoo!\Messenger\YahooMessenger.exe” [file not found]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\

“ButtonText” = “Messenger”

“MenuText” = “Windows Messenger”

“Exec” = “C:\Programfiler\Messenger\msmsgs.exe” [MS]

Miscellaneous IE Hijack Points

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

<> “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = “*n” (unwritable string)

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

Running Services (Display Name, Service Name, Path {Service DLL}):

Automatisk LiveUpdate-planlegging, Automatisk LiveUpdate-planlegging, ““C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe”” [“Symantec Corporation”]

AVG E-mail Scanner, AVGEMS, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe” [“GRISOFT, s.r.o.”]

AVG7 Alert Manager Server, Avg7Alrt, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe” [“GRISOFT, s.r.o.”]

AVG7 Update Service, Avg7UpdSvc, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe” [“GRISOFT, s.r.o.”]

Belkin High-Speed Mode Wireless G USB Driver, Belkin High-Speed Mode Wireless G USB Network Adapter Service, “C:\Programfiler\Belkin\F5D7051\WLService.exe” [null data]

CyberLink Background Capture Service (CBCS), CLCapSvc, ““c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe”” [empty string]

CyberLink Media Library Service, CyberLink Media Library Service, ““C:\Programfiler\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe”” [“Cyberlink”]

CyberLink Task Scheduler (CTS), CLSched, ““c:\APPS\Powercinema\Kernel\TV\CLSched.exe”” [empty string]

Generic Service for HID Keyboard Input Collections, GenericHidService, “c:\APPS\HIDSERVICE\HIDSERVICE.exe” [null data]

iPod Service, iPod Service, ““C:\Programfiler\iPod\bin\iPodService.exe”” [“Apple Computer, Inc.”]

ISSvc, ISSVC, ““C:\Programfiler\Norton Internet Security\ISSVC.exe”” [“Symantec Corporation”]

Norton AntiVirus Auto-Protect-tjeneste, navapsvc, ““C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe”” [“Symantec Corporation”]

SmartLinkService, SLService, “slmdmsr.exe” [" "]

Symantec Event Manager, ccEvtMgr, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe”” [“Symantec Corporation”]

Symantec Network Drivers Service, SNDSrvc, ““C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe”” [“Symantec Corporation”]

Symantec Network Proxy, ccProxy, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe”” [“Symantec Corporation”]

Symantec Settings Manager, ccSetMgr, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe”” [“Symantec Corporation”]

Symantec SPBBCSvc, SPBBCSvc, ““C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe”” [“Symantec Corporation”]

Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS]

Print Monitors:

HKLM\System\CurrentControlSet\Control\Print\Monitors\

Canon BJ Language Monitor iP1200\Driver = “CNMLM76.DLL” [“CANON INC.”]

<>: Suspicious data at a malware launch point.

<>: Suspicious data at a browser hijack point.

  • This report excludes default entries except where indicated.

  • To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

  • To search all directories of local fixed drives for DESKTOP.INI

DLL launch points, use the -supp parameter or answer “No” at the

first message box and “Yes” at the second message box.

---------- (total run time: 170 seconds, including 3 seconds for message boxes)

#6

jaszyn18 proszę poprawić posty z logami i objąć je znacznikami. Inaczej temat wyleci :evil:

#7

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Ustaw rozszerzenie z TXT na Wszystkie pliki >>> zapisz pod nazwą FIX.REG >>> kliknij podwójnie zrobiony plik i potwierdź >>> reset kompa

#8

jak mam poprawić posty z logami i objąć je znacznikami ??? :o

Złączono Posty : 15.01.2007 (Pon) 20:40

Zrobiłem tak: Plik >>> Zapisz jako >>> Ustaw rozszerzenie z TXT na Wszystkie pliki >>> zapisz pod nazwą FIX.REG >>> kliknij podwójnie zrobiony plik i potwierdź >>> reset kompa następnie uruchomilem silent runers. Co teraz? :shock:

#9

Wklej nowy log tylko jeśli dodałeś FIX, który miał na początku dwa razy Windows Registry Editor Version 5.00 tak jak podał Gutek, to zrób nowy FIX:

i go dodaj do rejestru.

#10

przepraszam że zawracam głowę tyle razy, ale nie radzę sobie z wklejeniem raportu do rejestru i jak mam zrobić to quote.Proszę o więcej szczegółow jak mam to wszystko wykonać.nie chcę być już więcej taki upierdliwy.

#11

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na plik i potwierdź dodanie do rejestru >>> restart.

Tutaj jest pokazane jak to powinno być ustawione przy zapisywaniu w Notatniku:

http://img84.imageshack.us/img84/4023/schowek01ux9.jpg

Do Notatnika wklejasz to co się znajduje poniżej słowa Cytat i jest na białym polu.

#12

Złączono Posty : 15.01.2007 (Pon) 21:59

to był program pmmon.exe proszę jeszcze o statni raz o odpowiedż czy coś mam jeszcze zrobic i czy to już jest po problemie i czy mój komputer jest bezpieczny??? a czy polączenia z internetem będą teraz bezpieczne? chodzi mi o placenie krtą i netbank. chcialem jeszcze podziękowac wszystkim, ktorzy mi pomagali! !!

#13

Wszystko jest już ok.

Proponuję przeczyścić rejestr ponieważ masz kilka pustych kluczy opis.