Wysokie użycie procesora

[system]

Mam wysokie obciążenie procesora przez proces AppSvc32.exe

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “LightScribe Control Panel” = “C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden” [“Hewlett-Packard Company”] “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “ChelloInfo” = “C:\Program Files\chelloPL\chelloinfo\chelloinfo.exe” [“Wortal chelloPL (http://chelloPL.one.pl)”] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] “eMuleAutoStart” = “C:\Program Files\eMule\emule.exe -AutoStart” [“http://www.emule-project.net”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “ATIPTA” = “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [“ATI Technologies, Inc.”] “CTHelper” = “CTHELPER.EXE” [“Creative Technology Ltd”] “UpdReg” = “C:\WINDOWS\UpdReg.EXE” [“Creative Technology Ltd.”] “Jet Detection” = ““C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe”” [empty string] “Lexmark 5200 series” = ““C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe”” [“Lexmark International, Inc.”] “LXBTCATS” = “rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16” [MS] “FaxCenterServer” = ““C:\Program Files\Lexmark Fax Solutions\fm3032.exe” /s” [null data] “zBrowser Launcher” = “C:\Program Files\Logitech\iTouch\iTouch.exe” [“Logitech Inc.”] “RegDoctor” = “C:\Program Files\RegDoctor\RegDoctor.exe -Quick” [“RegDoctor”] “ccApp” = ““C:\Program Files\Common Files\Symantec Shared\ccApp.exe”” [“Symantec Corporation”] “osCheck” = ““C:\Program Files\Norton Internet Security\osCheck.exe”” [“Symantec Corporation”] “Symantec PIF AlertEng” = ““C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” /a /m “C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll”” [“Symantec Corporation”] “VirtualCloneDrive” = ““C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe” /s” [“Elaborate Bytes AG”] “Logitech Utility” = “Logi_MwX.Exe” [“Logitech Inc.”] “Windows Defender” = ““C:\Program Files\Windows Defender\MSASCui.exe” -hide” [MS] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “WinDVR SchSvr” = ““C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe”” [“InterVideo Inc.”] “NeroFilterCheck” = “C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [“Nero AG”] “QuickTime Task” = ““C:\Program Files\QuickTime\QTTask.exe” -atboottime” [“Apple Inc.”] “iTunesHelper” = ““C:\Program Files\iTunes\iTunesHelper.exe”” [“Apple Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {1E8A6170-7264-4D0F-BEAE-D42A53123C75}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll” [“Symantec Corporation”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “*g” (unwritable string) [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{B7056B8E-4F99-44f8-8CBD-282390FE5428}” = “VirtualCloneDrive” -> {HKLM…CLSID} = “VirtualCloneDrive Shell Extension” \InProcServer32(Default) = “C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll” [“Elaborate Bytes AG”] “{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}” = “jetAudio” -> {HKLM…CLSID} = “JetFlExt Class” \InProcServer32(Default) = “C:\Program Files\JetAudio\JetFlExt.dll” [“COWON America”] “{B327765E-D724-4347-8B16-78AE18552FC3}” = “NeroDigitalIconHandler” -> {HKLM…CLSID} = “NeroDigitalIconHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{7F1CF152-04F8-453A-B34C-E609530A9DC8}” = “NeroDigitalPropSheetHandler” -> {HKLM…CLSID} = “NeroDigitalPropSheetHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}” = “NeroCoverEd Live Icons” -> {HKLM…CLSID} = “NeroCoverEdLiveIcons Class” \InProcServer32(Default) = “C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll” [“Nero AG”] “{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}” = “Microsoft Office Metadata Handler” -> {HKLM…CLSID} = “Microsoft Office Metadata Handler” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll” [MS] “{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}” = “Microsoft Office Thumbnail Handler” -> {HKLM…CLSID} = “Microsoft Office Thumbnail Handler” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll” [MS] “{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}” = “iTunes” -> {HKLM…CLSID} = “iTunes” \InProcServer32(Default) = “C:\Program Files\iTunes\iTunesMiniPlayer.dll” [“Apple Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}” = “Microsoft AntiMalware ShellExecuteHook” -> {HKLM…CLSID} = “Microsoft AntiMalware ShellExecuteHook” \InProcServer32(Default) = “C:\PROGRA~1\WIFD1F~1\MpShHook.dll” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS\system32\WPDShServiceObj.dll” [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}(Default) = “NeroDigitalExt.NeroDigitalColumnHandler” -> {HKLM…CLSID} = “NeroDigitalColumnHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ Cover Designer(Default) = “{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}” -> {HKLM…CLSID} = “NeroCoverEdContextMenu Class” \InProcServer32(Default) = “C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll” [“Nero AG”] Symantec.Norton.Antivirus.IEContextMenu(Default) = “{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}” -> {HKLM…CLSID} = “IEContextMenu Class” \InProcServer32(Default) = “C:\PROGRA~1\NORTON~2\NORTON~1\NavShExt.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ jetAudio(Default) = “{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}” -> {HKLM…CLSID} = “JetFlExt Class” \InProcServer32(Default) = “C:\Program Files\JetAudio\JetFlExt.dll” [“COWON America”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ FineReader8(Default) = “{F7091C74-EBB1-49D7-94C7-FE4886CCC18D}” -> {HKLM…CLSID} = “FineReader8ExplorerContextMenuHandler” \InProcServer32(Default) = “C:\Program Files\ABBYY FineReader 8.0 Professional Edition\FECMenu.dll” [“ABBYY Software”] jetAudio(Default) = “{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}” -> {HKLM…CLSID} = “JetFlExt Class” \InProcServer32(Default) = “C:\Program Files\JetAudio\JetFlExt.dll” [“COWON America”] Symantec.Norton.Antivirus.IEContextMenu(Default) = “{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}” -> {HKLM…CLSID} = “IEContextMenu Class” \InProcServer32(Default) = “C:\PROGRA~1\NORTON~2\NORTON~1\NavShExt.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\A&A&R\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “A&A&R” & “All Users” startup folders: ------------------------------------------------------- C:\Documents and Settings\A&A&R\Menu Start\Programy\Autostart “Rejestrowanie produktów Corela” -> shortcut to: “C:\Program Files\Corel\Graphics9\Register\Remind32.exe” [“IntelliQuest Communications, Inc.”] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “Adobe Reader Synchronizer” -> shortcut to: “C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe” [null data] “InterVideo WinCinema Manager” -> shortcut to: “C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe” [empty string] “Kalendarz XP” -> shortcut to: “C:\Program Files\Kalendarz XP\Kalendarz.exe” [null data] “MpegTV Station PCITV Remote Control” -> shortcut to: “C:\Program Files\AVACS\MpegTV Station PCITV\RemoteCtl.exe” [null data] Enabled Scheduled Tasks: ------------------------ “AppleSoftwareUpdate” -> launches: “C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task” [“Apple Computer, Inc.”] “MP Scheduled Scan” -> launches: “C:\Program Files\Windows Defender\MpCmdRun.exe Scan -RestrictPrivileges” [MS] “Norton Internet Security - Uruchom pełne skanowanie systemu - A&A&R” -> launches: “C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe /TASK:“C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca”” [“Symantec Corporation”] “Norton SystemWorks One Button Checkup” -> launches: “C:\Program Files\Norton SystemWorks\OBC.exe /CUSTOM /SCHEDULE /AUTO” [“Symantec Corporation”] “Symantec Drmc” -> launches: “C:\Program Files\Common Files\Symantec Shared\SymDrmc.exe /CUSTOM /SCHEDULE” [“Symantec Corporation”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{90222687-F593-4738-B738-FBEE9C7B26DF}” = “NCO Toolbar” -> {HKLM…CLSID} = “Show Norton Toolbar” \InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll” [“Symantec Corporation”] “{0D704FAD-66E9-4F0A-BFED-4F665770DDB3}” = (no title provided) -> {HKLM…CLSID} = “&Tłumaczenie” \InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{175556B1-4D91-4E9A-9C4B-D6888D5DEE6C}(Default) = “&Ramka Tłumaczenia” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] HKLM\Software\Classes\CLSID{D553F157-2AB0-4B46-98D2-7BA7CA418491}(Default) = “&Słownik Podręczny” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.6.0_02” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.6.0_02” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll” [“Sun Microsystems, Inc.”] {5E638779-1818-4754-A595-EF1C63B87A56}\ “ButtonText” = “Express Cleanup” “MenuText” = “Express Cleanup” “Exec” = “C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk” [null data] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {B46B0919-62BA-4D99-A5C4-916B57A6805C}\ “MenuText” = “@C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103” “CLSIDExtension” = “{B46B0919-62BA-4D99-A5C4-916B57A6805C}” -> {HKLM…CLSID} = “InternetTranslatorProperties Class” \InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Apple Mobile Device, Apple Mobile Device, ““C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe”” [“Apple, Inc.”] Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] Creative Service for CDROM Access, Creative Service for CDROM Access, “C:\WINDOWS\system32\CTsvcCDA.exe” [“Creative Technology Ltd”] Harmonogram automatycznej usługi LiveUpdate, Harmonogram automatycznej usługi LiveUpdate, ““C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe”” [“Symantec Corporation”] iPod Service, iPod Service, ““C:\Program Files\iPod\bin\iPodService.exe”” [“Apple Inc.”] LightScribeService Direct Disc Labeling Service, LightScribeService, ““C:\Program Files\Common Files\LightScribe\LSSrvc.exe”” [“Hewlett-Packard Company”] LiveUpdate Notice Service Ex, LiveUpdate Notice Ex, ““C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe” /h ccCommon” [“Symantec Corporation”] Norton UnErase Protection, NProtectService, “C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE” [“Symantec Corporation”] Speed Disk service, Speed Disk service, “C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE” [“Symantec Corporation”] Symantec AppCore Service, SymAppCore, ““C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe”” [“Symantec Corporation”] Symantec Core LC, Symantec Core LC, ““C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe”” [“Symantec Corporation”] Symantec Event Manager, ccEvtMgr, ““C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe” /h ccCommon” [“Symantec Corporation”] Symantec Lic NetConnect service, CLTNetCnService, ““C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe” /h cltCommon” [“Symantec Corporation”] Symantec Network Proxy, ccProxy, ““C:\Program Files\Common Files\Symantec Shared\ccProxy.exe”” [“Symantec Corporation”] Symantec Settings Manager, ccSetMgr, ““C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe” /h ccCommon” [“Symantec Corporation”] Windows Defender, WinDefend, ““C:\Program Files\Windows Defender\MsMpEng.exe”” [MS] WMDM PMSP Service, WMDM PMSP Service, “C:\WINDOWS\system32\MsPMSPSv.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ 5200 Series Port\Driver = “lxbtlmpm.DLL” [“Lexmark International, Inc.”] Lexmark Print-2-Fax Port\Driver = “LXPRMON.DLL” [null data] Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 67 seconds, including 7 seconds for message boxes)

[arekmalek]

czysto daj log z combofix

[system]

“A&A&R” - 2007-07-16 8:29:47 - ComboFix 07-07-14.6 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-16 to 2007-07-16 ))))))))))))))))))))))))))))))) 2007-07-16 08:28 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-14 22:23 2007-07-14 12:52 98,304 --a------ C:\WINDOWS\W2BNEUnin.exe 2007-07-14 12:52 19,984 --a------ C:\WINDOWS\W2BNEUnin.dat 2007-07-14 12:51 2007-07-12 13:25 2007-07-12 13:25 2007-07-11 22:21 445 --a------ C:\WINDOWS\EntPack.dat 2007-07-09 16:50 2007-07-05 22:28 2007-07-05 22:28 2007-07-03 18:43 132,904 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys 2007-07-03 18:43 11,304 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys 2007-07-01 10:47 2007-07-01 10:34 2007-07-01 10:11 2007-07-01 10:11 2007-07-01 10:11 2007-07-01 10:10 2007-06-30 20:45 2007-06-30 20:44 9,856 --------- C:\WINDOWS\system32\drivers\pfc.sys 2007-06-30 20:44 204,800 --a------ C:\WINDOWS\system32\IVIresizeW7.dll 2007-06-30 20:44 200,704 --a------ C:\WINDOWS\system32\IVIresizeA6.dll 2007-06-30 20:44 20,480 --a------ C:\WINDOWS\system32\IVIresize.dll 2007-06-30 20:44 192,512 --a------ C:\WINDOWS\system32\IVIresizeP6.dll 2007-06-30 20:44 192,512 --a------ C:\WINDOWS\system32\IVIresizeM6.dll 2007-06-30 20:44 188,416 --a------ C:\WINDOWS\system32\IVIresizePX.dll 2007-06-30 20:44 2007-06-30 20:44 2007-06-30 20:39 73,728 --a------ C:\WINDOWS\system32\VbiCallback.dll 2007-06-30 20:39 2007-06-30 20:35 2007-06-30 20:27 2007-06-30 20:13 2007-06-30 19:58 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys 2007-06-30 19:31 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2007-06-30 19:08 414,272 -ra------ C:\WINDOWS\system32\DivXc32f.dll 2007-06-30 19:07 412,160 -ra------ C:\WINDOWS\system32\DivXc32.dll 2007-06-30 19:07 19,456 -ra------ C:\WINDOWS\system32\Mp3cnfg.exe 2007-06-30 19:01 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-06-30 19:01 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-06-30 19:01 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-06-30 19:01 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-06-30 19:01 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-06-30 19:01 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-06-30 19:01 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-06-30 19:01 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-06-30 19:01 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-06-30 19:01 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-06-30 19:01 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-06-30 19:01 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2007-06-30 19:01 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-06-30 19:00 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-06-30 19:00 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-06-30 19:00 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-06-30 19:00 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-06-30 19:00 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-06-30 19:00 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-06-30 18:58 2007-06-30 18:21 2007-06-30 18:10 2007-06-30 18:09 2007-06-30 18:08 2007-06-30 18:07 2007-06-30 18:07 2007-06-30 18:07 2007-06-30 18:00 2007-06-30 17:59 2007-06-30 17:58 2007-06-30 17:58 2007-06-30 17:21 24,816 --a------ C:\WINDOWS\system32\mdimon.dll 2007-06-30 17:20 2007-06-30 17:19 2007-06-30 17:10 1,156 --a------ C:\WINDOWS\mozver.dat 2007-06-30 17:09 0 --a------ C:\WINDOWS\nsreg.dat 2007-06-30 16:59 2007-06-30 16:52 2007-06-30 16:46 2007-06-30 16:25 2007-06-30 16:24 2007-06-30 16:17 2007-06-30 16:14 19,968 --------- C:\WINDOWS\LOGI_MWX.EXE 2007-06-30 16:05 2007-06-30 16:03 2007-06-30 15:58 2007-06-30 15:58 2007-06-30 15:56 2007-06-30 15:24 2007-06-30 15:22 2007-06-30 15:17 2007-06-30 15:16 2007-06-30 15:11 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-06-30 15:11 2007-06-30 15:00 909,824 --------- C:\WINDOWS\system32\qd3d.dll 2007-06-30 15:00 70,656 --------- C:\WINDOWS\system32\3dviewer.dll 2007-06-30 15:00 607,744 --------- C:\WINDOWS\system32\Decslib.dll 2007-06-30 15:00 553,984 --------- C:\WINDOWS\system32\rave.dll 2007-06-30 15:00 39,095 --------- C:\WINDOWS\iccsigs.dat 2007-06-30 15:00 245,760 --------- C:\WINDOWS\system32\Sccomp91.dll 2007-06-30 15:00 225,280 --------- C:\WINDOWS\system32\Scint91.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-11 06:32:24 86,968 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-11 06:32:24 494,308 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-06-30 10:03:53 806 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2007-06-30 10:03:53 8,014 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2007-06-29 17:26:36 -------- d-----w C:\Program Files\Usługi online 2007-05-16 07:18:44 95,864 ----a-w C:\WINDOWS\system32\NeroCo.dll 2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-23 14:42:50 972,336 ----a-w C:\WINDOWS\UNRecode.exe 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{1E8A6170-7264-4D0F-BEAE-D42A53123C75}] 2007-01-12 01:04 96936 -ra------ C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-06-14 18:32 509592 --a------ C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2003-02-28 21:00] “CTHelper”=“CTHELPER.EXE” [2003-08-28 10:45 C:\WINDOWS\system32\CTHELPER.EXE] “Jet Detection”=“C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe” [2001-11-29 01:00] “Lexmark 5200 series”=“C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe” [2004-03-25 15:35] “FaxCenterServer”=“C:\Program Files\Lexmark Fax Solutions\fm3032.exe” [2004-03-23 15:07] “zBrowser Launcher”=“C:\Program Files\Logitech\iTouch\iTouch.exe” [2004-03-18 09:33] “RegDoctor”=“C:\Program Files\RegDoctor\RegDoctor.exe” [2007-05-24 08:51] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2007-03-14 20:10] “osCheck”=“C:\Program Files\Norton Internet Security\osCheck.exe” [2007-01-14 01:11] “Symantec PIF AlertEng”=“C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” [2007-03-12 11:22] “VirtualCloneDrive”=“C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe” [2006-04-29 15:21] “Logitech Utility”=“Logi_MwX.Exe” [2003-12-17 09:50 C:\WINDOWS\LOGI_MWX.EXE] “Windows Defender”=“C:\Program Files\Windows Defender\MSASCui.exe” [2006-11-03 19:20] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” [2007-06-14 18:32] “WinDVR SchSvr”=“C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe” [2003-06-06 17:52] “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [2007-03-01 15:57] “QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2007-06-29 06:24] “iTunesHelper”=“C:\Program Files\iTunes\iTunesHelper.exe” [2007-07-10 09:18] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 14:00] “LightScribe Control Panel”=“C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe” [2007-05-15 17:12] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 18:24] “ChelloInfo”=“C:\Program Files\chelloPL\chelloinfo\chelloinfo.exe” [2007-02-19 22:51] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-07-02 17:10] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 09:39] “eMuleAutoStart”=“C:\Program Files\eMule\emule.exe” [2007-05-13 16:57] *Newly Created Service* - COMHOST HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{10880D85-AAD9-4558-ABDC-2AB1552D831F} “C:\Program Files\Common Files\LightScribe\LSRunOnce.exe” Contents of the ‘Scheduled Tasks’ folder 2007-06-30 15:58:59 C:\WINDOWS\tasks\AppleSoftwareUpdate.job 2007-07-16 06:16:49 C:\WINDOWS\tasks\MP Scheduled Scan.job 2007-07-13 18:44:11 C:\WINDOWS\tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - A&A&R.job 2007-07-09 13:08:23 C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job 2007-07-12 22:00:00 C:\WINDOWS\tasks\Symantec Drmc.job ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-16 08:31:19 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ha10kx2k] “ImagePath”=“system32\drivers\ha10kx2k.sys” [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hap16v2k] “ImagePath”=“System32\drivers\hap16v2k.sys” [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\H a r m o n o g r a m a u t o m a t y c z n e j u s Bu g i L i v e U p d a t e] “ImagePath”="“C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe”" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\helpsvc] “ServiceDll”="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HidServ] “ServiceDll”="%SystemRoot%\System32\hidserv.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hidusb] “ImagePath”=“system32\DRIVERS\hidusb.sys” [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hpn] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTP] “ImagePath”=“System32\Drivers\HTTP.sys” [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTPFilter] “ServiceDll”="%SystemRoot%\System32\w3ssl.dll" Completion time: 2007-07-16 8:32:11 — E O F —

[arekmalek]

Masz czysto :lol:

[system]

Bardzo Ci dziękuje za pomoc i zainteresowanie

[LostWorld]

To jakiś produkt z Symantec’a , więc bez obaw.

Zbędniki w Autostracie

Do tego

Optymalizacja XP: http://forum.dobreprogramy.pl/viewtopic.php?t=76580

W HJ okej.