Wyskakujące okienko instalatora windows

Witam. mam taki problem:

gdy kupiłem laptopa( Packard Bell), razem z XP SP2 były zainstalwane programy Sonic Record Now i Sonic MyDVD którego dotyczy problem. gdy sończyła sę darmowa licencja na ten produkt postanowiłem go odinstalować.

teraz gdy włączam coś związanego z multimediami np. progam picassa lub video rozmowa skype to wyskakuje co chwile okienko zeby włożyć dysk instalacyjny lub dyskietke. wykasowałem już chyba wszystko co związane jest z SONIC, ale to dalej wyskakuje. Proszę o pomoc w rozwiązaniu tego problemu.

tu daje logi

Cytat:

“Silent Runners.vbs”, revision 52, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by “{++}”

Startup items buried in registry:


HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

“ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS]

“Gadu-Gadu” = ““C:\Programfiler\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”]

“MsnMsgr” = ““C:\Programfiler\MSN Messenger\MsnMsgr.Exe” /background” [file not found]

“Creative WebCam Tray” = ““C:\Programfiler\Creative\Shared Files\CamTray.exe”” [“Creative Technology Ltd”]

“Skype” = ““C:\Programfiler\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

“IMJPMIG8.1” = ““C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” /Spoil /RemAdvDef /Migration32” [MS]

“PHIME2002ASync” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC” [MS]

“PHIME2002A” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName” [MS]

“SynTPLpr” = “C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe” [“Synaptics, Inc.”]

“SynTPEnh” = “C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe” [“Synaptics, Inc.”]

“VTTimer” = “VTTimer.exe” [“S3 Graphics, Inc.”]

“VTTrayp” = “VTtrayp.exe” [“S3 Graphics Co., Ltd.”]

“STDSB” = “C:\WINDOWS\system32\drivers\STDSB.exe” [null data]

“SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”]

“ccApp” = ““C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe”” [“Symantec Corporation”]

“PCMService” = ““c:\Apps\Powercinema\PCMService.exe”” [“CyberLink Corp.”]

“Symantec NetDriver Monitor” = “C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer” [file not found]

“Easy-PrintToolBox” = “C:\Programfiler\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon” [“CANON INC.”]

“AVG7_CC” = “C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP” [“GRISOFT, s.r.o.”]

“Telenor Online Start” = ““C:\Programfiler\Telenor\Online Start\Telenor.exe”” [“Telenor”]

“Picasa Media Detector” = “C:\Programfiler\Picasa2\PicasaMediaDetector.exe” [“Google Inc.”]

“KernelFaultCheck” = “C:\WINDOWS\system32\dumprep 0 -k”

“HP Software Update” = “C:\Programfiler\HP\HP Software Update\HPWuSchd2.exe” [“Hewlett-Packard Development Company, L.P.”]

“PCSuiteTrayApplication” = “C:\Programfiler\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup” [“Nokia”]

“SunJavaUpdateSched” = ““C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe”” [“Sun Microsystems, Inc.”]

“WinampAgent” = “C:\Programfiler\Winamp\winampa.exe” [null data]

“Icon” = “C:\WINDOWS\system32\drivers\Icon.exe” [empty string]

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\ {++}

“CTSU” = ““C:\Programfiler\Creative\Shared Files\Software Update\CTSURun.exe”” [“Creative Technology Ltd.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided)

-> {HKLM…CLSID} = “Adobe PDF Reader Link Helper”

\InProcServer32(Default) = “C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”]

{53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided)

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = “C:\PROGRA~1\SPYBOT~1\SDHelper.dll” [“Safer Networking Limited”]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided)

-> {HKLM…CLSID} = “SSVHelper Class”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”]

{9ECB9560-04F9-4bbc-943D-298DDF1699E1}(Default) = (no title provided)

-> {HKLM…CLSID} = “CNisExtBho Class”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

{BDF3E430-B101-42AD-A544-FADC6B084872}(Default) = (no title provided)

-> {HKLM…CLSID} = “CNavExtBho Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

{DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516}(Default) = “Online Start Plugin”

-> {HKLM…CLSID} = “Online Start Plugin”

\InProcServer32(Default) = “C:\Programfiler\Telenor\Online Start\IEFixItNowPlugin.dll” [“Telenor”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

“{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Kontrollpanelsutvidelse for skjermpanorering”

-> {HKLM…CLSID} = “Kontrollpanelsutvidelse for skjermpanorering”

\InProcServer32(Default) = “deskpan.dll” [file not found]

“{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Ikonutvidelse for HyperTerminal”

-> {HKLM…CLSID} = “HyperTerminal Icon Ext”

\InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”]

“{2F603045-309F-11CF-9774-0020AFD0CFF6}” = “Synaptics Control Panel”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = “C:\Programfiler\Synaptics\SynTP\SynTPCpl.dll” [“Synaptics, Inc.”]

“{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu”

-> {HKLM…CLSID} = “Portable Media Devices Menu”

\InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS]

“{e57ce731-33e8-4c51-8354-bb4de9d215d1}” = “Universelle Plug and Play-enheter”

-> {HKLM…CLSID} = “Universelle Plug and Play-enheter”

\InProcServer32(Default) = “C:\WINDOWS\system32\upnpui.dll” [MS]

“{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

“{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler”

-> {HKLM…CLSID} = “Microsoft Office Outlook”

\InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL” [MS]

“{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler”

-> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook”

\InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL” [MS]

“{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = “C:\Programfiler\Microsoft Office\OFFICE11\msohev.dll” [MS]

“{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}” = “AVG7 Shell Extension”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG7\avgse.dll” [“GRISOFT, s.r.o.”]

“{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}” = “AVG7 Find Extension”

-> {HKLM…CLSID} = “AVG7 Find Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG7\avgse.dll” [“GRISOFT, s.r.o.”]

“{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}” = “OpenOffice.org Column Handler”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = ““C:\Programfiler\OpenOffice.ux.pl 2.2.0\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”]

“{087B3AE3-E237-4467-B8DB-5A38AB959AC9}” = “OpenOffice.org Infotip Handler”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = ““C:\Programfiler\OpenOffice.ux.pl 2.2.0\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”]

“{63542C48-9552-494A-84F7-73AA6A7C99C1}” = “OpenOffice.org Property Sheet Handler”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = ““C:\Programfiler\OpenOffice.ux.pl 2.2.0\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”]

“{3B092F0C-7696-40E3-A80F-68D74DA84210}” = “OpenOffice.org Thumbnail Viewer”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = ““C:\Programfiler\OpenOffice.ux.pl 2.2.0\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”]

“{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}” = “Nokia Phone Browser”

-> {HKLM…CLSID} = “Nokia Phone Browser”

\InProcServer32(Default) = “C:\Programfiler\Nokia\Nokia PC Suite 6\PhoneBrowser.dll” [“Nokia”]

HKLM\Software\Classes\PROTOCOLS\Filter\

<> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}(Default) = “OpenOffice.org Column Handler”

-> {HKLM…CLSID} = (no title provided)

\InProcServer32(Default) = ““C:\Programfiler\OpenOffice.ux.pl 2.2.0\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”]

{F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info”

-> {HKLM…CLSID} = “PDF Shell Extension”

\InProcServer32(Default) = “C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”]

HKLM\Software\Classes*\shellex\ContextMenuHandlers\

AVG7 Shell Extension(Default) = “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG7\avgse.dll” [“GRISOFT, s.r.o.”]

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {HKLM…CLSID} = “IEContextMenu Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

AVG7 Shell Extension(Default) = “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}”

-> {HKLM…CLSID} = “AVG7 Shell Extension Class”

\InProcServer32(Default) = “C:\Programfiler\Grisoft\AVG7\avgse.dll” [“GRISOFT, s.r.o.”]

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {HKLM…CLSID} = “IEContextMenu Class”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {HKLM…CLSID} = “WinRAR”

\InProcServer32(Default) = “C:\Programfiler\WinRAR\rarext.dll” [null data]

Group Policies {policy setting}:


Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

“NoCDBurning” = (REG_DWORD) hex:0x00000000

{unrecognized setting}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

“shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001

{Shutdown: Allow system to be shut down without having to log on}

“undockwithoutlogon” = (REG_DWORD) hex:0x00000001

{Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:


Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

“Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Lokale innstillinger\Programdata\Microsoft\Wallpaper1.bmp”

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:

HKCU\Control Panel\Desktop\

“Wallpaper” = “C:\Documents and Settings\Bruker\Lokale innstillinger\Programdata\Microsoft\Wallpaper1.bmp”

Enabled Screen Saver:


HKCU\Control Panel\Desktop\

“SCRNSAVE.EXE” = “C:\WINDOWS\system32\ssmypics.scr” [MS]

Startup items in “Bruker” & “All Users” startup folders:


C:\Documents and Settings\Bruker\Start-meny\Programmer\Oppstart

“OpenOffice.ux.pl 2.2.0” -> shortcut to: “C:\Programfiler\OpenOffice.ux.pl 2.2.0\program\quickstart.exe” [null data]

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart

“HP Digital Imaging Monitor” -> shortcut to: “C:\Programfiler\HP\Digital Imaging\bin\hpqtra08.exe” [“Hewlett-Packard Development Company, L.P.”]

“Hurtigstart for Adobe Reader” -> shortcut to: “C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”]

Winsock2 Service Provider DLLs:


Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS]

000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

000000000004\LibraryPath = “C:\WINDOWS\system32\pnrpnsp.dll” [MS]

000000000005\LibraryPath = “C:\WINDOWS\system32\pnrpnsp.dll” [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 38

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:


Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

“{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}”

-> {HKLM…CLSID} = “Norton Internet Security”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}”

-> {HKLM…CLSID} = “Norton AntiVirus”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}”

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [file not found]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\

“{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}” = “Norton Internet Security”

-> {HKLM…CLSID} = “Norton Internet Security”

\InProcServer32(Default) = “C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}” = “Norton AntiVirus”

-> {HKLM…CLSID} = “Norton AntiVirus”

\InProcServer32(Default) = “C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie”

Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar]

InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

“MenuText” = “Sun Java Console”

“CLSIDExtension” = “{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}”

-> {HKCU…CLSID} = “Java Plug-in 1.6.0_01”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”]

-> {HKLM…CLSID} = “Java Plug-in 1.6.0_01”

\InProcServer32(Default) = “C:\Programfiler\Java\jre1.6.0_01\bin\npjpi160_01.dll” [“Sun Microsystems, Inc.”]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\

“ButtonText” = “Badanie”

{E2E2DD38-D088-4134-82B7-F2BA38496583}\

“MenuText” = “@xpsp3res.dll,-20001”

“Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\

“ButtonText” = “Messenger”

“MenuText” = “Windows Messenger”

“Exec” = “C:\Programfiler\Messenger\msmsgs.exe” [MS]

Miscellaneous IE Hijack Points


HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

<> “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = “*_” (unwritable string)

-> {HKLM…CLSID} = “Yahoo! Toolbar”

\InProcServer32(Default) = “C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll” [file not found]

Running Services (Display Name, Service Name, Path {Service DLL}):


AVG E-mail Scanner, AVGEMS, “C:\PROGRA~1\Grisoft\AVG7\avgemc.exe” [“GRISOFT, s.r.o.”]

AVG7 Alert Manager Server, Avg7Alrt, “C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe” [“GRISOFT, s.r.o.”]

AVG7 Update Service, Avg7UpdSvc, “C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe” [“GRISOFT, s.r.o.”]

Belkin High-Speed Mode Wireless G USB Driver, Belkin High-Speed Mode Wireless G USB Network Adapter Service, “C:\Programfiler\Belkin\F5D7051\WLService.exe” [null data]

Creative Service for CDROM Access, Creative Service for CDROM Access, “C:\WINDOWS\system32\CTsvcCDA.exe” [“Creative Technology Ltd”]

CT Device Query service, CTDevice_Srv, “C:\Programfiler\Creative\Shared Files\CTDevSrv.exe” [“Creative Technology Ltd”]

CyberLink Background Capture Service (CBCS), CLCapSvc, ““c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe”” [empty string]

CyberLink Media Library Service, CyberLink Media Library Service, ““C:\Programfiler\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe”” [“Cyberlink”]

CyberLink Task Scheduler (CTS), CLSched, ““c:\APPS\Powercinema\Kernel\TV\CLSched.exe”” [empty string]

Generic Service for HID Keyboard Input Collections, GenericHidService, “c:\APPS\HIDSERVICE\HIDSERVICE.exe” [null data]

IPv6-hjelpetjeneste, 6to4, “C:\WINDOWS\system32\svchost.exe -k netsvcs” {“C:\WINDOWS\System32\6to4svc.dll” [MS]}

ISSvc, ISSVC, ““C:\Programfiler\Norton Internet Security\ISSVC.exe”” [“Symantec Corporation”]

Norton AntiVirus Auto-Protect-tjeneste, navapsvc, ““C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe”” [“Symantec Corporation”]

RIP Listener, Iprip, “C:\WINDOWS\System32\svchost.exe -k netsvcs” {“C:\WINDOWS\System32\iprip.dll” [MS]}

ServiceLayer, ServiceLayer, ““C:\Programfiler\PC Connectivity Solution\ServiceLayer.exe”” [“Nokia.”]

Simple TCP/IP Services, SimpTcp, “C:\WINDOWS\system32\tcpsvcs.exe” [MS]

SmartLinkService, SLService, “slmdmsr.exe” [" "]

Symantec Event Manager, ccEvtMgr, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe”” [“Symantec Corporation”]

Symantec Network Drivers Service, SNDSrvc, ““C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe”” [“Symantec Corporation”]

Symantec Network Proxy, ccProxy, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe”” [“Symantec Corporation”]

Symantec Settings Manager, ccSetMgr, ““C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe”” [“Symantec Corporation”]

Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS]

Print Monitors:


HKLM\System\CurrentControlSet\Control\Print\Monitors\

Canon BJ Language Monitor iP1200\Driver = “CNMLM76.DLL” [“CANON INC.”]

HP Standard TCP/IP Port\Driver = “HpTcpMon.dll” [“Hewlett Packard”]

LIDIL hpzll054\Driver = “hpzll054.dll” [“Hewlett-Packard Company”]

LPR Port\Driver = “lprmon.dll” [MS]

Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS]

Microsoft Shared Fax Monitor\Driver = “FXSMON.DLL” [MS]

---------- (launch time: 2007-08-24 20:38:35)

<>: Suspicious data at a malware launch point.

<>: Suspicious data at a browser hijack point.

  • This report excludes default entries except where indicated.

  • To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

  • To search all directories of local fixed drives for DESKTOP.INI

DLL launch points, use the -supp parameter or answer “No” at the

first message box and “Yes” at the second message box.

---------- (total run time: 59 seconds, including 4 seconds for message boxes)

Cytat:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:36, on 2007-08-24

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Norton Internet Security\ISSVC.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programfiler\Belkin\F5D7051\WLService.exe

C:\Programfiler\Belkin\F5D7051\WLanCfgG.exe

C:\WINDOWS\system32\cisvc.exe

c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Programfiler\Creative\Shared Files\CTDevSrv.exe

C:\Programfiler\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Programfiler\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

c:\APPS\HIDSERVICE\HIDSERVICE.exe

C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\WINDOWS\system32\slmdmsr.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

c:\APPS\Powercinema\Kernel\TV\CLSched.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe

C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\system32\VTtrayp.exe

C:\WINDOWS\system32\drivers\STDSB.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\Apps\Powercinema\PCMService.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Programfiler\Telenor\Online Start\Telenor.exe

C:\Programfiler\Picasa2\PicasaMediaDetector.exe

C:\Programfiler\HP\HP Software Update\HPWuSchd2.exe

C:\Programfiler\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe

C:\Programfiler\Winamp\winampa.exe

C:\WINDOWS\system32\drivers\Icon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Gadu-Gadu\gg.exe

C:\Programfiler\Creative\Shared Files\CamTray.exe

C:\Programfiler\PC Connectivity Solution\ServiceLayer.exe

C:\Programfiler\HP\Digital Imaging\bin\hpqtra08.exe

C:\Programfiler\OpenOffice.ux.pl 2.2.0\program\soffice.exe

C:\Programfiler\OpenOffice.ux.pl 2.2.0\program\soffice.BIN

C:\Programfiler\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Programfiler\Skype\Phone\Skype.exe

C:\Programfiler\Skype\Plugin Manager\skypePM.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O2 - BHO: Online Start Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Programfiler\Telenor\Online Start\IEFixItNowPlugin.dll

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O4 - HKLM…\Run: [iMJPMIG8.1] “C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” /Spoil /RemAdvDef /Migration32

O4 - HKLM…\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM…\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM…\Run: [synTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM…\Run: [synTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM…\Run: [VTTimer] VTTimer.exe

O4 - HKLM…\Run: [VTTrayp] VTtrayp.exe

O4 - HKLM…\Run: [sTDSB] C:\WINDOWS\system32\drivers\STDSB.exe

O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM…\Run: [ccApp] “C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe”

O4 - HKLM…\Run: [PCMService] “c:\Apps\Powercinema\PCMService.exe”

O4 - HKLM…\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM…\Run: [Easy-PrintToolBox] C:\Programfiler\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon

O4 - HKLM…\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM…\Run: [Telenor Online Start] “C:\Programfiler\Telenor\Online Start\Telenor.exe”

O4 - HKLM…\Run: [Picasa Media Detector] C:\Programfiler\Picasa2\PicasaMediaDetector.exe

O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM…\Run: [HP Software Update] C:\Programfiler\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM…\Run: [PCSuiteTrayApplication] C:\Programfiler\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe”

O4 - HKLM…\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe

O4 - HKLM…\Run: [icon] C:\WINDOWS\system32\drivers\Icon.exe

O4 - HKLM…\RunOnce: [CTSU] “C:\Programfiler\Creative\Shared Files\Software Update\CTSURun.exe”

O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Programfiler\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [MsnMsgr] “C:\Programfiler\MSN Messenger\MsnMsgr.Exe” /background

O4 - HKCU…\Run: [Creative WebCam Tray] “C:\Programfiler\Creative\Shared Files\CamTray.exe”

O4 - HKCU…\Run: [skype] “C:\Programfiler\Skype\Phone\Skype.exe” /nosplash /minimized

O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘LOKAL TJENESTE’)

O4 - HKUS\S-1-5-19…\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User ‘LOKAL TJENESTE’)

O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘NETTVERKSTJENESTE’)

O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

O4 - Startup: OpenOffice.ux.pl 2.2.0.lnk = C:\Programfiler\OpenOffice.ux.pl 2.2.0\program\quickstart.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programfiler\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\nor.htm

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar … vSniff.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar … /cabsa.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me … b56907.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ … /CTPID.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FELLES~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - (no file)

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Belkin High-Speed Mode Wireless G USB Driver (Belkin High-Speed Mode Wireless G USB Network Adapter Service) - Unknown owner - C:\Programfiler\Belkin\F5D7051\WLService.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Programfiler\Creative\Shared Files\CTDevSrv.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programfiler\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programfiler\Norton Internet Security\ISSVC.exe

O23 - Service: Norton AntiVirus Auto-Protect-tjeneste (navapsvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Programfiler\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: ServiceLayer - Nokia. - C:\Programfiler\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slmdmsr.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

End of file - 12789 bytes

Powrót do góry

Zobacz profil autora Wyślij prywatną wiadomość Wyślij email Skype

Gadu Gadu

Gadu Gadu

qrczak13

Dołączył: 25 Paź 2006

Posty: 2234

Skąd: Z KURNIKA

PostWysłany: 24.08.2007 (Pią) 23:52 Temat postu: Zacytuj zaznaczone Odpowiedz z cytatem

Cytat:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)

O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O22 - SharedTaskScheduler: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - (no file)

Usuń w HijackThis.

Cytat:

C:\WINDOWS\system32\drivers\Icon.exe

Przeskanuj na http://www.virustotal.com/pl/ i wklej raport po skanowaniu.

Daj jeszcze log z ComboFix (opis zrobienia loga na samym dole strony).

_________________

Relax Take It Easy

Pozdrawiam Szczecin! PINOKIO Uczę się spr. logi.

Powrót do góry

Zobacz profil autora Wyślij prywatną wiadomość Odwiedź stronę autora

jaszyn18

Dołączył: 14 Sty 2007

Posty: 25

Skąd: oslo

PostWysłany: 25.08.2007 (Sob) 13:02 Temat postu: Zacytuj zaznaczone Odpowiedz z cytatem Zmień/Usuń ten post Usuń ten post

raport po virustotal

Cytat:

Antywirus Wersja Ostatnia aktualizacja Wynik

AhnLab-V3 2007.8.25.0 2007.08.24 -

AntiVir 7.4.1.63 2007.08.24 -

Authentium 4.93.8 2007.08.24 -

Avast 4.7.1029.0 2007.08.25 -

AVG 7.5.0.484 2007.08.24 -

BitDefender 7.2 2007.08.25 -

CAT-QuickHeal 9.00 2007.08.25 -

ClamAV 0.91 2007.08.24 -

DrWeb 4.33 2007.08.25 -

eSafe 7.0.15.0 2007.08.23 -

eTrust-Vet 31.1.5085 2007.08.24 -

Ewido 4.0 2007.08.24 -

FileAdvisor 1 2007.08.25 -

Fortinet 2.91.0.0 2007.08.25 -

F-Prot 4.3.2.48 2007.08.24 -

F-Secure 6.70.13030.0 2007.08.24 -

Ikarus T3.1.1.12 2007.08.25 -

Kaspersky 4.0.2.24 2007.08.25 -

McAfee 5105 2007.08.24 -

Microsoft 1.2803 2007.08.25 -

NOD32v2 2483 2007.08.24 -

Norman 5.80.02 2007.08.24 -

Panda 9.0.0.4 2007.08.24 -

Prevx1 V2 2007.08.25 -

Rising 19.37.42.00 2007.08.24 -

Sophos 4.21.0 2007.08.25 -

Sunbelt 2.2.907.0 2007.08.25 -

Symantec 10 2007.08.25 -

TheHacker 6.1.8.172 2007.08.25 -

VBA32 3.12.2.3 2007.08.24 -

VirusBuster 4.3.26:9 2007.08.24 -

Webwasher-Gateway 6.0.1 2007.08.25 -

Dodatkowe informacje

File size: 221184 bytes

MD5: 851ff453f9f892ff532770ddccd2b422

SHA1: 72a4c7cdb89a265238c0b71f96deaa5f4e002a7b

log z combofix

http://wklej.org/id/970a9ae79f

Hmm może niektóre pliki multimedialne dalej są przypisane danej aplikacji i gdy probujesz uruchomić coś co kiedyś uruchamiane było domyślnie w Sonic… on automatycznie prosi o instalacje danej aplikacji, a instalka pewnie jeszcze siedzi, w którymś z systemowych katalogów TEMP oraz w rejestrze.

Dobrze. Temp moge sprawdzic ale jak sprawdzic rejestr?