Zawieszenie po uruchomieniu systemu


(Sadekdawid) #1

Witam!

Mam taki problem: mianowicie po włączeniu komputera, podłączeniu neostardy, włączeniu przeglądarki komputer"przyjmuje zawieche" na ok. 7 minut. jest to bardzo uciążliwe.

Proszę o porady.

LOG-Hijack:

Logfile of HijackThis v1.99.1 

Scan saved at 14:36:12, on 2006-08-31 

Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) 

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) 


Running processes: 

C:\WINDOWS\System32\smss.exe 

C:\WINDOWS\system32\winlogon.exe 

C:\WINDOWS\system32\services.exe 

C:\WINDOWS\system32\lsass.exe 

C:\WINDOWS\system32\svchost.exe 

C:\WINDOWS\System32\svchost.exe 

C:\WINDOWS\system32\spoolsv.exe 

C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe 

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 

C:\WINDOWS\Explorer.EXE 

C:\Program Files\Alwil Software\Avast4\ashServ.exe 

C:\WINDOWS\system32\drivers\KodakCCS.exe 

C:\WINDOWS\System32\nvsvc32.exe 

D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe 

C:\WINDOWS\System32\svchost.exe 

C:\WINDOWS\system32\ZONELABS\vsmon.exe 

D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe 

C:\PROGRA~1\NEOSTR~1\CnxMon.exe 

C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe 

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 

C:\Program Files\VIA\RAID\raid_tool.exe 

C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe 

D:\instalki\inne\gamma\gamma.exe 

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 

C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe 

C:\PROGRA~1\NEOSTR~1\ComComp.exe 

C:\PROGRA~1\NEOSTR~1\Watch.exe 

C:\Program Files\Avant Browser\avant.exe 

C:\WINDOWS\System32\wuauclt.exe 

E:\Program Files\Gadu-Gadu\gg.exe 

D:\Program Files\BearShare\BearShare.exe 

C:\Program Files\WinRAR\WinRAR.exe 

C:\DOCUME~1\Dawid\USTAWI~1\Temp\Rar$EX00.062\HijackThis.exe 


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza 

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL 

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll 

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - E:\PROGRA~1\FLASHGET\jccatch.dll 

O2 - BHO: SafeIE Utility - {B5D4581D-ED6A-4905-A267-25BAF7BE79C1} - C:\WINDOWS\System32\safeie.dll 

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx 

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup 

O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe 

O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe 

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe 

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe 

O4 - HKLM\..\Run: [Odkurzacz-MCD] E:\Program Files\Odkurzacz 10.1 Pro\odk_mcd.exe 

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" 

O4 - Startup: gamma.lnk = D:\instalki\inne\gamma\gamma.exe 

O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe 

O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe 

O8 - Extra context menu item: &Ściągnij wszystko za pomocą WellGeta - E:\Program Files\WellGet\nxall.htm 

O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - C:\Program Files\Avant Browser\AddAllToADBlackList.htm 

O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program Files\Avant Browser\AddToADBlackList.htm 

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 

O8 - Extra context menu item: Otwórz w nowym Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm 

O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... - C:\Program Files\Avant Browser\OpenAllLinks.htm 

O8 - Extra context menu item: Podświetl - C:\Program Files\Avant Browser\Highlight.htm 

O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm 

O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_link.htm 

O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_all.htm 

O8 - Extra context menu item: Ściągnij za pomocą &WellGeta - E:\Program Files\WellGet\nxcatch.htm 

O9 - Extra button: WellGet - {35980F6E-A258-4E50-953D-813BB8556899} - E:\Program Files\WellGet\WellGet.exe 

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FLASHGET\flashget.exe 

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FLASHGET\flashget.exe 

O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/pl/downloads/sysinfo.cab 

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab 

O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp03.photoprintit.de/microsite/1661/defaults/activex/IPSUploader.cab 

O17 - HKLM\System\CCS\Services\Tcpip\..\{2A6F1B6B-1795-46A5-B747-14B8C6163687}: NameServer = 194.204.152.34 217.98.63.164 

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe 

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) 

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) 

O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe 

O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe 

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe 

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe 

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

LOG-Silent Runners:

"Silent Runners.vbs", revision 47, http://www.silentrunners.org/ 

Operating System: Windows XP 

Output limited to non-default values, except where indicated by "{++}" 



Startup items buried in registry: 

--------------------------------- 


HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} 

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"" [file not found] 

"Wengo" = (empty string) 


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} 

"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] 

"Zone Labs Client" = "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" ["Zone Labs, LLC"] 

"WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string] 

"WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] 

"WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] 

"Odkurzacz-MCD" = "E:\Program Files\Odkurzacz 10.1 Pro\odk_mcd.exe" ["FranmoSoft"] 

"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] 


HKLM\Software\Microsoft\Active Setup\Installed Components\ 

{306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided) 

                                       \StubPath = ""C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser" [MS] 


HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ 

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) 

  -> {HKLM...CLSID} = "AcroIEHlprObj Class" 

                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] 

{A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) 

  -> {HKLM...CLSID} = "IeCatch2 Class" 

                   \InProcServer32\(Default) = "E:\PROGRA~1\FLASHGET\jccatch.dll" ["Amaze Soft"] 

{B5D4581D-ED6A-4905-A267-25BAF7BE79C1}\(Default) = "SafeIE Utility" 

  -> {HKLM...CLSID} = "FiltrateIE Class" 

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\safeie.dll" [empty string] 


HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ 

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" 

  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" 

                   \InProcServer32\(Default) = "*U*U **A****" (unwritable string) [file not found] 

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" 

  -> {HKLM...CLSID} = "HyperTerminal Icon Ext" 

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] 

"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" 

  -> {HKLM...CLSID} = "DesktopContext Class" 

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] 

"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" 

  -> {HKLM...CLSID} = "NVIDIA CPL Extension" 

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] 

"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" 

  -> {HKLM...CLSID} = "Desktop Explorer" 

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] 

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" 

  -> {HKLM...CLSID} = (no title provided) 

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] 

"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" 

  -> {HKLM...CLSID} = "nView Desktop Context Menu" 

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] 

"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" 

  -> {HKLM...CLSID} = "Microsoft Office Outlook" 

                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] 

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" 

  -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" 

                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] 

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" 

  -> {HKLM...CLSID} = (no title provided) 

                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] 

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" 

  -> {HKLM...CLSID} = "WinRAR" 

                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] 

"{C1728FC8-0162-4827-85B0-8420B5B20263}" = "All Converter" 

  -> {HKLM...CLSID} = "All Converter" 

                   \InProcServer32\(Default) = "*d" (unwritable string) [file not found] 

"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" 

  -> {HKLM...CLSID} = "AlcoholShellEx" 

                   \InProcServer32\(Default) = "D:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] 

"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" 

  -> {HKLM...CLSID} = "Portable Media Devices" 

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS] 

"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" 

  -> {HKLM...CLSID} = "Portable Media Devices Menu" 

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS] 

"{acb4a560-3606-11d3-aef4-00104bd0f92d}" = "KodakShellExtension" 

  -> {HKLM...CLSID} = "KodakShellExtension" 

                   \InProcServer32\(Default) = "C:\Program Files\Common Files\KODAK\IFSCore\kodakshx.dll" ["Eastman Kodak Company"] 

"{19F500E0-9964-11cf-B63D-08002B317C03}" = "Desktop Icon Layout" 

  -> {HKLM...CLSID} = "Desktop Icon Layout" 

                   \InProcServer32\(Default) = "Layout.dll" ["Microsoft"] 

"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" 

  -> {HKLM...CLSID} = "avast" 

                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] 

"{ABC70703-32AF-11d4-90C4-D483A70F4825}" = "CMenuExtender" 

  -> {HKLM...CLSID} = "CMenuExtender" 

                   \InProcServer32\(Default) = "E:\Program Files\iColorFolder\CMExt.dll" ["Revenger inc."] 


HKLM\Software\Classes\PROTOCOLS\Filter\ 

INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" 

  -> {HKLM...CLSID} = (no title provided) 

                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] 


HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ 

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" 

  -> {HKLM...CLSID} = "PDF Shell Extension" 

                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] 


HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 

avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" 

  -> {HKLM...CLSID} = "avast" 

                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] 

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 

  -> {HKLM...CLSID} = "WinRAR" 

                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] 


HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 

CMenuExtender\(Default) = "{ABC70703-32AF-11d4-90C4-D483A70F4825}" 

  -> {HKLM...CLSID} = "CMenuExtender" 

                   \InProcServer32\(Default) = "E:\Program Files\iColorFolder\CMExt.dll" ["Revenger inc."] 

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 

  -> {HKLM...CLSID} = "WinRAR" 

                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] 


HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ 

avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" 

  -> {HKLM...CLSID} = "avast" 

                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] 

IconLayout\(Default) = "{19F500E0-9964-11cf-B63D-08002B317C03}" 

  -> {HKLM...CLSID} = "Desktop Icon Layout" 

                   \InProcServer32\(Default) = "Layout.dll" ["Microsoft"] 

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 

  -> {HKLM...CLSID} = "WinRAR" 

                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] 



Active Desktop and Wallpaper: 

----------------------------- 


Active Desktop is disabled at this entry: 

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState 


HKCU\Control Panel\Desktop\ 

"Wallpaper" = "C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" 



Startup items in "Dawid" & "All Users" startup folders: 

------------------------------------------------------- 


C:\Documents and Settings\Dawid\Menu Start\Programy\Autostart 

"gamma" -> shortcut to: "D:\instalki\inne\gamma\gamma.exe" [null data] 


C:\Documents and Settings\All Users\Menu Start\Programy\Autostart 

"VIA RAID TOOL" -> shortcut to: "C:\Program Files\VIA\RAID\raid_tool.exe" ["VIA Technologies"] 

"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe" [empty string] 



Winsock2 Service Provider DLLs: 

------------------------------- 


Namespace Service Providers 


HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 


Transport Service Providers 


HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: 

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 20 

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 



Toolbars, Explorer Bars, Extensions: 

------------------------------------ 


Explorer Bars 


HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\ 

{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = (no title provided) 

  -> {HKLM...CLSID} = "Volet Wanadoo" 

                   \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] 

{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = (no title provided) 

  -> {HKLM...CLSID} = "&Badanie" 

                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] 


Extensions (Tools menu items, main toolbar menu buttons) 


HKLM\Software\Microsoft\Internet Explorer\Extensions\ 

{35980F6E-A258-4E50-953D-813BB8556899}\ 

"ButtonText" = "WellGet" 

"Exec" = "E:\Program Files\WellGet\WellGet.exe" [empty string] 


{92780B25-18CC-41C8-B9BE-3C9C571A8263}\ 

"ButtonText" = "Badanie" 


{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ 

"ButtonText" = "FlashGet" 

"MenuText" = "&FlashGet" 

"Exec" = "E:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"] 



Miscellaneous IE Hijack Points 

------------------------------ 


HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ 


Missing lines (compared with English-language version): 

"{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) 

  -> {HKLM...CLSID} = "Search Class" 

                   \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] 



Running Services (Display Name, Service Name, Path {Service DLL}): 

------------------------------------------------------------------ 


avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data] 

avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data] 

avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] 

avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] 

Kodak Camera Connection Software, KodakCCS, "C:\WINDOWS\system32\drivers\KodakCCS.exe" ["Eastman Kodak Company"] 

Netropa NHK Server, nhksrv, "C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe" [null data] 

NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] 

StarWind iSCSI Service, StarWindService, "D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] 

TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZONELABS\vsmon.exe -service" ["Zone Labs, LLC"] 

Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS] 



Keyboard Driver Filters: 

------------------------ 


HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\ 

"UpperFilters" = INFECTION WARNING! "msikbd2k" ["Netropa Corporation"] 



Print Monitors: 

--------------- 


HKLM\System\CurrentControlSet\Control\Print\Monitors\ 

hpzsnt10\Driver = "hpzsnt10.dll" ["HP"] 

Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] 



---------- 

+ This report excludes default entries except where indicated. 

+ To see *everywhere* the script checks and *everything* it finds, 

  launch it from a command prompt or a shortcut with the -all parameter. 

+ To search all directories of local fixed drives for DESKTOP.INI 

  DLL launch points and all Registry CLSIDs for dormant Explorer Bars, 

  use the -supp parameter or answer "No" at the first message box. 

---------- (total run time: 224 seconds, including 18 seconds for message boxes)

(Tycyan) #2

usuń te pozycje:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe

O8 - Extra context menu item: &Œci¹gnij wszystko za pomoc¹ WellGeta - E:\Program Files\WellGet\nxall.htm

O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/pl/dow ... ysinfo.cab

Przeskanuj kompa na wypadek śmieci skanerami:

http://www.webroot.com/services/spyaudit_03.htm

http://www.windowsecurity.com/trojanscan/

http://fr.trendmicro-europe.com/consume ... launch.php

i koniecznie zainstaluj service packa 2