obadajcie logi brak wyłącz komputer, uruchom, ctrl+alt+del
06 Lis 2006, 22:08
tak jak w temacie, nie mam pod startem uruchom, wyłącz komputer, a jak wciskam trzy magiczne to mi wyskakuje że menadżer urzadzeń został wyłączony przez administratora. prosze pomóżcie
log z Evido
log z Hijacka
log z Silent Runners
[code[/code]
log z Evido
- Kod:
---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------
+ Created at: 19:57:19 2006-11-06
+ Scan result:
C:Program FilesPrintViewprinthook030.dll -> Adware.PrintView : Cleaned.
C:Program FilesPrintViewpvmodule.exe -> Adware.PrintView : Cleaned.
C:WINDOWSsystem32wkwpafek.dll -> Adware.PurityScan : Cleaned.
C:Program FilesDeskbar -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarCache -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarabout.html -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarasis.xml -> Adware.Softomate : Cleaned.
C:Program FilesDeskbardeskbar.crc -> Adware.Softomate : Cleaned.
C:Program FilesDeskbardeskbar.dll -> Adware.Softomate : Cleaned.
C:Program FilesDeskbardeskbar.inf -> Adware.Softomate : Cleaned.
C:Program FilesDeskbaricons.bmp -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarinst.bat -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarmbback.bmp -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarmbbigopen.bmp -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarmbclose.bmp -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarmbfwd.bmp -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarmblogo.bmp -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarmbsep.bmp -> Adware.Softomate : Cleaned.
C:Program FilesDeskbaroptions.html -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarsoftomate.gif -> Adware.Softomate : Cleaned.
C:Program FilesDeskbarversion.txt -> Adware.Softomate : Cleaned.
HKLMSOFTWAREClassesCLSID{A8B28872-3324-4CD2-8AA3-7D555C872D96} -> Adware.Softomate : Cleaned.
HKLMSOFTWAREClassesCLSID{D7CC80D4-376C-4586-B023-4F35C2CEB28E} -> Adware.Softomate : Cleaned.
HKLMSOFTWAREClassesCLSID{D8C2D4B4-EEAF-4EC4-B1F8-9B6ED15D5A38} -> Adware.Softomate : Cleaned.
HKLMSOFTWAREClassesTypeLib{A4C8F181-6CDB-4DCC-9FC9-BB9933C81E1F} -> Adware.Softomate : Cleaned.
HKUS-1-5-21-1085031214-1844823847-839522115-1003SoftwareMicrosoftWindowsCurrentVersionExtStats{A8B28872-3324-4CD2-8AA3-7D555C872D96} -> Adware.Softomate : Cleaned.
C:WINDOWSsystem32sporder.dll -> Adware.WinAntiVirus : Cleaned.
C:mc44a3.exe -> Downloader.Adload.fu : Cleaned.
C:kybrdff_e33.exe -> Downloader.Adload.gw : Cleaned.
E:ŚciągnięteMobtime Cell Phone Manager 2006 6.0.9 Crack(1).rar/crack.exe -> Downloader.Agent.aey : Cleaned.
C:Program FilesCommon Filesѕуstem32
tvdm.exe -> Downloader.PurityScan.dr : Cleaned.
C:Documents and SettingsPaffełPulpitprogramy do siemensaJokerV034JokerV0343JokerV0343.exe -> Downloader.Small : Cleaned.
E:ŚciągnięteMobTime Cell Phone Manager 2006 6.1.0 crack.rar/crack.exe -> Dropper.Agent.anl : Cleaned.
E:ŚciągnięteMobTime Cell Phone Manager 2006 6.1.0 crackcrack.exe -> Dropper.Agent.anl : Cleaned.
E:ŚciągnięteMobtime Cell Phone Manager 2006 6.1.0 Crack(2).rar/crack.exe -> Dropper.Agent.anl : Cleaned.
E:ŚciągnięteMobtime Cell Phone Manager 2006 6.1.0 Crack(2)crack.exe -> Dropper.Agent.anl : Cleaned.
C:Program FilesCommon FilesMicrosoft SharedMSWNInfoUpdService.exe -> Dropper.Delf.vt : Cleaned.
C:Program FilesCommon FilesMicrosoft SharedMSWNInfoServiceDLLrun.exe -> Hijacker.Delf.fm : Cleaned.
:mozilla.300:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.301:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.302:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.337:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.40:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.41:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.42:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.113:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.114:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.117:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.118:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.26:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.27:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.385:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.386:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.392:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.393:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.398:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.399:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.53:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.54:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.62:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.63:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.209:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.211:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.190:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.61:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.197:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.228:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.298:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.367:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.177:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.178:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.179:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.180:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.250:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.251:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.252:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:Documents and SettingsPaffełCookiespaffeł@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:Documents and SettingsPaffełCookiespaffeł@media.fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.289:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.72:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.144:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.145:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.260:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.261:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.262:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.120:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Itrack : Cleaned.
:mozilla.384:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Ivwbox : Cleaned.
:mozilla.299:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.175:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.176:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.155:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Paypopup : Cleaned.
:mozilla.156:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Paypopup : Cleaned.
:mozilla.157:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Paypopup : Cleaned.
:mozilla.321:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.322:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.188:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.189:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.223:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.224:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.225:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.226:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.227:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.387:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.389:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.390:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.171:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Spylog : Cleaned.
:mozilla.275:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.277:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.33:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.34:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.35:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.36:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.37:C:Documents and SettingsmamaDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.71:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.72:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
C:Documents and SettingsPaffełCookiespaffeł@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.173:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.152:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.153:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.154:C:Documents and SettingsPaffełDane aplikacjiMozillaFirefoxProfiles
2cm95iu.defaultcookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:dfndrff_e33.exe -> Trojan.Pakes : Cleaned.
C:
wnmff_e33.exe -> Trojan.Pakes : Cleaned.
::Report end
log z Hijacka
- Kod:
Logfile of HijackThis v1.99.1
Scan saved at 20:52:52, on 2006-11-06
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesIVT CorporationBlueSoleilBTNtService.exe
C:Program Filesewido anti-spyware 4.0guard.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesGadu-Gadugg.exe
C:Program FilesAdobeAcrobat 7.0Reader eader_sl.exe
C:WINDOWSsystem32wuauclt.exe
C:Documents and SettingsPaffełPulpit óżne skróty do utrzymania porządku na dyskuhijackthisHijackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://google.bearshare.com/pl/
O4 - HKCU..Run: [Gadu-Gadu] "C:Program FilesGadu-Gadugg.exe" /tray
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Reader eader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_06inssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_06inssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:Program FilesIVT CorporationBlueSoleilBTNtService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:Program Filesewido anti-spyware 4.0guard.exe
log z Silent Runners
- Kod:
"Silent Runners.vbs", revision 49, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCUSoftwareMicrosoftWindowsCurrentVersionRun {++}
"Gadu-Gadu" = ""C:Program FilesGadu-Gadugg.exe" /tray" ["Gadu-Gadu Sp. z o.o."]
HKLMSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
InProcServer32(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
InProcServer32(Default) = "C:WINDOWSSystem32hticons.dll" ["Hilgraeve, Inc."]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
-> {HKLM...CLSID} = "SimpleShlExt Class"
InProcServer32(Default) = "C:Program FilesATI TechnologiesATI.ACEatiacmxx.dll" [empty string]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
InProcServer32(Default) = "C:Program FilesMicrosoft OfficeOffice10OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
InProcServer32(Default) = "C:Program FilesMicrosoft OfficeOffice10msohev.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"
-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"
InProcServer32(Default) = "C:Program FilesCommon FilesAheadlibNeroDigitalExt.dll" ["Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"
-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"
InProcServer32(Default) = "C:Program FilesCommon FilesAheadlibNeroDigitalExt.dll" ["Nero AG"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
InProcServer32(Default) = "C:Program FilesReal Alternative pshell.dll" ["RealNetworks, Inc."]
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Uniwersalne urządzenia Plug and Play"
-> {HKLM...CLSID} = "Uniwersalne urządzenia Plug and Play"
InProcServer32(Default) = "C:WINDOWSsystem32upnpui.dll" [MS]
"{79BC0345-1015-11D2-A299-006008312725}" = "blue.shell"
-> {HKLM...CLSID} = "Studio.Project"
InProcServer32(Default) = "C:Program FilesPinnacleStudio 10programsBlueShellExt.dll" [file not found]
"{ED65AB21-B24F-11d3-BA80-00C0CA16AA37}" = "Mobile"
-> {HKLM...CLSID} = "Mobile"
InProcServer32(Default) = "C:Program FilesSiemens Data SuiteDESDESShellExt.dll" ["Siemens AG"]
"{ED65AB22-B24F-11d3-BA80-00C0CA16AA37}" = "Mobile ContextMenuHandler"
-> {HKLM...CLSID} = "Mobile ContextMenuHandler"
InProcServer32(Default) = "C:Program FilesSiemens Data SuiteDESDESShellExt.dll" ["Siemens AG"]
"{ED65AB23-B24F-11d3-BA80-00C0CA16AA37}" = "Mobile PropertySheetHandler"
-> {HKLM...CLSID} = "Mobile PropertySheetHandler"
InProcServer32(Default) = "C:Program FilesSiemens Data SuiteDESDESShellExt.dll" ["Siemens AG"]
HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
InProcServer32(Default) = "C:Program Filesewido anti-spyware 4.0shellexecutehook.dll" ["Anti-Malware Development a.s."]
HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogonNotify
<<!>> AtiExtEventDLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
HKLMSoftwareClassesFoldershellexColumnHandlers
{7D4D6379-F301-4311-BEBA-E26EB0561882}(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
InProcServer32(Default) = "C:Program FilesCommon FilesAheadlibNeroDigitalExt.dll" ["Nero AG"]
{F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 7.0ActiveXPDFShell.dll" ["Adobe Systems, Inc."]
HKLMSoftwareClasses*shellexContextMenuHandlers
ewido anti-spyware(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
InProcServer32(Default) = "C:Program Filesewido anti-spyware 4.0context.dll" ["Anti-Malware Development a.s."]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]
HKLMSoftwareClassesDirectoryshellexContextMenuHandlers
ewido anti-spyware(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
InProcServer32(Default) = "C:Program Filesewido anti-spyware 4.0context.dll" ["Anti-Malware Development a.s."]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]
HKLMSoftwareClassesFoldershellexContextMenuHandlers
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]
Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------
Note: detected settings may not have any effect.
HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
"NoChangeStartMenu" = (REG_DWORD) hex:0x00000001
{unrecognized setting}
"NoClose" = (REG_DWORD) hex:0x00000001
{unrecognized setting}
"NoLogOff" = (REG_DWORD) hex:0x00000001
{User Configuration|Administrative Templates|System|Logon/Logoff|
Disable Logoff}
"NoRun" = (REG_DWORD) hex:0x00000001
{unrecognized setting}
HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
"DisableTaskMgr" = (REG_DWORD) hex:0x00000001
{User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options|
Remove Task Manager}
"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|System|
Prevent access to registry editing tools}
HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShellState
Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCUSoftwareMicrosoftInternet ExplorerDesktopGeneral
"Wallpaper" = "C:WINDOWSsystem32configsystemprofileUstawienia lokalneDane aplikacjiMicrosoftWallpaper1.bmp"
Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCUControl PanelDesktop
"Wallpaper" = "C:Documents and SettingsPaffełUstawienia lokalneDane aplikacjiMicrosoftWallpaper1.bmp"
Enabled Screen Saver:
---------------------
HKCUControl PanelDesktop
"SCRNSAVE.EXE" = "C:WINDOWSSystem32ssmypics.scr" [MS]
Startup items in "Paffeł" & "All Users" startup folders:
--------------------------------------------------------
C:Documents and SettingsAll UsersMenu StartProgramyAutostart
"Adobe Reader Speed Launch" -> shortcut to: "C:Program FilesAdobeAcrobat 7.0Reader eader_sl.exe" ["Adobe Systems Incorporated"]
"BlueSoleil" -> shortcut to: "C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe" ["IVT Corporation"]
"Microsoft Office" -> shortcut to: "C:Program FilesMicrosoft OfficeOffice10OSA.EXE -b -l" [MS]
Enabled Scheduled Tasks:
------------------------
"AppleSoftwareUpdate" -> launches: "C:Program FilesApple Software UpdateSoftwareUpdate.exe -Task" ["Apple Computer, Inc."]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLMSystemCurrentControlSetServicesWinsock2ParametersNameSpace_Catalog5Catalog_Entries {++}
000000000001LibraryPath = "%SystemRoot%System32mswsock.dll" [MS]
000000000002LibraryPath = "%SystemRoot%System32winrnr.dll" [MS]
000000000003LibraryPath = "%SystemRoot%System32mswsock.dll" [MS]
Transport Service Providers
HKLMSystemCurrentControlSetServicesWinsock2ParametersProtocol_Catalog9Catalog_Entries {++}
0000000000##PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%system32mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%system32 svpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Extensions (Tools menu items, main toolbar menu buttons)
HKLMSoftwareMicrosoftInternet ExplorerExtensions
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
InProcServer32(Default) = "C:Program FilesJavajre1.5.0_06inssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
InProcServer32(Default) = "C:Program FilesJavajre1.5.0_06in
pjpi150_06.dll" ["Sun Microsystems, Inc."]
{FB5F1910-F110-11D2-BB9E-00C04F795683}
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:Program FilesMessengermsmsgs.exe" [MS]
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
Ati HotKey Poller, Ati HotKey Poller, "C:WINDOWSsystem32Ati2evxx.exe" ["ATI Technologies Inc."]
BlueSoleil Hid Service, BlueSoleil Hid Service, "C:Program FilesIVT CorporationBlueSoleilBTNtService.exe" [null data]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:Program Filesewido anti-spyware 4.0guard.exe" ["Anti-Malware Development a.s."]
Windows User Mode Driver Framework, UMWdf, "C:WINDOWSsystem32wdfmgr.exe" [MS]
----------
<<!>>: Suspicious data at a malware launch point.
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 29 seconds.
---------- (total run time: 59 seconds)
[code[/code]
06 Lis 2006, 22:19
dfndrff_e33.exe
Składnik SmitFraudFixa. Proszę o loga z opcji nr.1
http://siri.urz.free.fr/Fix/SmitfraudFix.php
Składnik SmitFraudFixa. Proszę o loga z opcji nr.1
http://siri.urz.free.fr/Fix/SmitfraudFix.php
06 Lis 2006, 22:22
Bitte Sehr
- Kod:
SmitFraudFix v2.97
Scan done at 21:21:35,64, 2006-11-06
Run from C:Documents and SettingsPaffeˆPulpit
˘ľne skr˘ty do utrzymania porzĄdku na dyskuSmitfraudFixSmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
Fix ran in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:
»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem
»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSWeb
»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem32
»»»»»»»»»»»»»»»»»»»»»»»» C:Documents and SettingsPaffeˆApplication Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:DOCUME~1PAFFE~1Ulubione
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
06 Lis 2006, 22:25
mogę jeszcze zarzucić z l2mfix
06 Lis 2006, 22:26
Tak poprosze. Jakby co to podem podam ostateczny log. Czy to co znalazł Ewido zostało usunięte?
06 Lis 2006, 22:27
- Kod:
L2MFIX find log 051206
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotify]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotifycrypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotifycryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotifycscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotifyScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotifySchedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotifysclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotifySensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotify ermsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotifywlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsUser AgentPost Platform]
"SV1"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShell ExtensionsApproved]
"{00022613-0000-0000-C000-000000000046}"="Karta wˆa˜ciwo˜ci pliku multimedialnego"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ZarzĄdzanie skanerem ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Strona zabezpieczeä NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Strona wˆa˜ciwo˜ci OLE Docfile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Rozszerzenia powˆoki dla udost©pniania zasob˘w"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL karty graficznej"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL monitora wy˜wietlania"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL kadrowania wy˜wietlania"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Strona zabezpieczeä usˆugi DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Strona zgodno˜ci"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Program obsˆugi danych wycinkowych powˆoki"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Rozszerzenie Disc Copy"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Rozszerzenia powˆoki dla obiekt˘w Microsoft Windows Network"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ZarzĄdzanie monitorem ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ZarzĄdzanie drukarkĄ ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Rozszerzenia powˆoki dla kompresji plik˘w"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Rozszerzenie powˆoki drukarek sieci Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu kontekstowe szyfrowania"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Akt˘wka"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Rozszerzenie ikony HyperTerminalu"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Strona zabezpieczeä drukarek"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Rozszerzenia powˆoki dla udost©pniania zasob˘w"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Rozszerzenie Crypto PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Rozszerzenie Crypto Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="PoˆĄczenia sieciowe"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="PoˆĄczenia sieciowe"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Skanery i aparaty fotograficzne"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Skanery i aparaty fotograficzne"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Skanery i aparaty fotograficzne"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Skanery i aparaty fotograficzne"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Skanery i aparaty fotograficzne"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Rozszerzenia powˆoki dla hosta skrypt˘w systemu Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Zaplanowane zadania"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Pasek zadaä i menu Start"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Wyszukaj"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Pomoc i obsˆuga techniczna"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Pomoc i obsˆuga techniczna"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Uruchom..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Czcionki"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Narz©dzia administracyjne"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Pasek narz©dzi programu Microsoft Internet"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Stan pobierania"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Folder powˆoki zwi©kszonej"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Folder powˆoki zwi©kszonej 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Pasek przeglĄdarki Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Pasek wyszukiwania"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Pasek multimedi˘w"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Wyszukiwanie w okienku"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Wyszukiwanie w sieci Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Narz©dzie opcji drzewa rejestru"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adres"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Pole edycji adresu"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Autouzupeˆnianie Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="Wyodr©bnianie obraz˘w Trident"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Lista autouzupeˆniania MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Niestandardowa lista autouzupeˆniania MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Dost©pny"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Pasek podr©czny ˜ledzenia"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analizator paska adresu"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lista autouzupeˆniania historii Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Lista autouzupeˆniania folderu powˆoki Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Kontener wielu list autouzupeˆniania Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu witryny paska powˆoki"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Pasek pulpitu powˆoki"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Pomoc dla uľytkownika"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Globalne ustawienia folder˘w"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historia"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Tymczasowe pliki internetowe"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Tymczasowe pliki internetowe"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Ekran powitalny pakietu IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Pasek eksploratora"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Folder pami©ci podr©cznej ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Folder subskrypcji"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Menedľer aplikacji powˆoki"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Wyliczanie zainstalowanych aplikacji"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publikator aplikacji Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+program wyodr©bniajĄcy miniatury plik˘w"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Informacje podsumowujĄce obsˆugi miniatur (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Wyodr©bnianie miniatur HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Kreator publikacji w sieci Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Zamawianie odbitek w sieci Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Obiekt powˆoki kreatora publikacji"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Kreator uzyskiwania profilu usˆugi Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Konta uľytkownik˘w"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Plik kanaˆu"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Skr˘t kanaˆu"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Obiekt obsˆugi kanaˆu"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Folder plik˘w trybu offline"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Do os˘b..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}"="ShellLink for Application References"
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}"="Shell Icon Handler for Application References"
"{5E2121EE-0300-11D4-8D3B-444553540000}"="Catalyst Context Menu extension"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Foldery w sieci Web"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{B327765E-D724-4347-8B16-78AE18552FC3}"="NeroDigitalIconHandler"
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}"="NeroDigitalPropSheetHandler"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Uniwersalne urzĄdzenia Plug and Play"
"{79BC0345-1015-11D2-A299-006008312725}"="blue.shell"
"{ED65AB21-B24F-11d3-BA80-00C0CA16AA37}"="Mobile"
"{ED65AB22-B24F-11d3-BA80-00C0CA16AA37}"="Mobile ContextMenuHandler"
"{ED65AB23-B24F-11d3-BA80-00C0CA16AA37}"="Mobile PropertySheetHandler"
**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:
C:WINDOWSSYSTEM32
ecbdba_s.dll Mon 2006-10-02 15:57:28 A.SH. 5 0,00 K
1 item found: 1 file (1 H/S), 0 directories.
Total of file sizes: 5 bytes 0,00 K
Locate .tmp files:
No matches found.
**********************************************************************************
Directory Listing of system files:
Wolumin w stacji C nie ma etykiety.
Numer seryjny woluminu: 30F1-3E48
Katalog: C:WINDOWSSystem32
2006-11-06 21:23 <DIR> ..
2006-11-06 21:23 <DIR> .
2006-11-06 16:47 <DIR> dllcache
2006-10-02 15:57 5 ecbdba_s.dll
2006-08-17 19:05 <DIR> Microsoft
1 plik(˘w) 5 bajt˘w
4 katalog(˘w) 28˙988˙764˙160 bajt˘w wolnych
06 Lis 2006, 22:31
nio właśnie niewiem jak to jest z tym czy ewido to usunął
tego folderu nie widzę
ale niewiem jak z tymi śmieciami siedzącymi w systemie
tego folderu nie widzę
- Kod:
C:Program FilesDeskbar
ale niewiem jak z tymi śmieciami siedzącymi w systemie
06 Lis 2006, 22:35
C:/WINDOWS/SYSTEM32/ecbdba_s.dll
Znasz może ten plik?? Prosiłby, abyś przepisał mi jego właściwości.
Dodatkowo - Gmera www.gmer.net w dwoch opcjach:
# Rootkit >>> zaznaczone wszystko do skanu oprocz pokazuj wszystko >>> Szukaj >>> Kopiuj >>> Ctrl + V do posta
# Rootkit >>> zaznaczone tylko Pokazuj wszystko + Usługi >>> Szukaj >>> Kopiuj >>> Ctrl + V do posta
Oba logi z Gmera wrzucasz na rapida czy na jakąś wrzutnie plików i dajesz linki, bo inaczej nie wejdą.
Pozdrawiam
Znasz może ten plik?? Prosiłby, abyś przepisał mi jego właściwości.
Dodatkowo - Gmera www.gmer.net w dwoch opcjach:
# Rootkit >>> zaznaczone wszystko do skanu oprocz pokazuj wszystko >>> Szukaj >>> Kopiuj >>> Ctrl + V do posta
# Rootkit >>> zaznaczone tylko Pokazuj wszystko + Usługi >>> Szukaj >>> Kopiuj >>> Ctrl + V do posta
Oba logi z Gmera wrzucasz na rapida czy na jakąś wrzutnie plików i dajesz linki, bo inaczej nie wejdą.
Pozdrawiam
06 Lis 2006, 22:43
qrde mam taki durny problem, mam powłanczane wszystko żeby mi widział pliki systemowe a niema system 32 
06 Lis 2006, 22:51
Plik Porady.txt.doc został pomyślnie wysłany na serwer WyslijTo.pl
Możesz go ściagnąć z adresu: http://s003.wyslijto.pl/?file_id=42891248526802027788
Możesz go ściagnąć z adresu: http://s003.wyslijto.pl/?file_id=42891248526802027788
06 Lis 2006, 22:52
- Kod:
GMER 1.0.12.11879 - http://www.gmer.net
Rootkit scan 2006-11-06 21:49:22
Windows 5.1.2600 Dodatek Service Pack 2
---- System - GMER 1.0.12 ----
SSDT ??C:Program Filesewido anti-spyware 4.0guard.sys ZwOpenProcess
SSDT ??C:Program Filesewido anti-spyware 4.0guard.sys ZwTerminateProcess
---- Kernel code sections - GMER 1.0.12 ----
.text ntoskrnl.exe!_abnormal_termination + 567 804DBF08 4 Bytes
.text ntoskrnl.exe!_abnormal_termination + 1107 804DC124 4 Bytes
---- User code sections - GMER 1.0.12 ----
.text C:Program FilesWinampwinamp.exe[2688] USER32.dll!SetScrollInfo 77D3902C 7 Bytes JMP 01CC9B03 C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2688] USER32.dll!GetScrollPos 77D3F66F 5 Bytes JMP 01CC9AB3 C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2688] USER32.dll!SetScrollRange 77D3F6BB 5 Bytes JMP 01CC9B59 C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2688] USER32.dll!SetScrollPos 77D3F780 5 Bytes JMP 01CC9B2E C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2688] USER32.dll!GetScrollRange 77D3F7B7 5 Bytes JMP 01CC9AD8 C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2688] USER32.dll!ShowScrollBar 77D40142 5 Bytes JMP 01CC9B87 C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2688] USER32.dll!GetScrollInfo 77D43A2F 7 Bytes JMP 01CC9A8B C:Program FilesWinampPluginsgen_jumpex.dll
.text C:Program FilesWinampwinamp.exe[2688] USER32.dll!EnableScrollBar 77D87BAD 7 Bytes JMP 01CC9A63 C:Program FilesWinampPluginsgen_jumpex.dll
---- Registry - GMER 1.0.12 ----
Reg RegistryMACHINESOFTWAREClassesCLSID{47629D4B-2AD3-4e50-B716-A66C15C63153}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{47629D4B-2AD3-4e50-B716-A66C15C63153}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{47629D4B-2AD3-4e50-B716-A66C15C63153}InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 ...
Reg RegistryMACHINESOFTWAREClassesCLSID{604BB98A-A94F-4a5c-A67C-D8D3582C741C}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{604BB98A-A94F-4a5c-A67C-D8D3582C741C}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{604BB98A-A94F-4a5c-A67C-D8D3582C741C}InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 ...
Reg RegistryMACHINESOFTWAREClassesCLSID{684373FB-9CD8-4e47-B990-5A4466C16034}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{684373FB-9CD8-4e47-B990-5A4466C16034}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{684373FB-9CD8-4e47-B990-5A4466C16034}InprocServer32@2c81e34222e8052573023a60d06dd016 0x25 0xDA 0xEC 0x7E ...
Reg RegistryMACHINESOFTWAREClassesCLSID{74554CCD-F60F-4708-AD98-D0152D08C8B9}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{74554CCD-F60F-4708-AD98-D0152D08C8B9}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{74554CCD-F60F-4708-AD98-D0152D08C8B9}InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ...
Reg RegistryMACHINESOFTWAREClassesCLSID{7EB537F9-A916-4339-B91B-DED8E83632C0}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{7EB537F9-A916-4339-B91B-DED8E83632C0}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{7EB537F9-A916-4339-B91B-DED8E83632C0}InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...
Reg RegistryMACHINESOFTWAREClassesCLSID{948395E8-7A56-4fb1-843B-3E52D94DB145}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{948395E8-7A56-4fb1-843B-3E52D94DB145}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{948395E8-7A56-4fb1-843B-3E52D94DB145}InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xDF 0x20 0x58 0x62 ...
Reg RegistryMACHINESOFTWAREClassesCLSID{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x97 0x20 0x4E 0x9A ...
Reg RegistryMACHINESOFTWAREClassesCLSID{DE5654CA-EB84-4df9-915B-37E957082D6D}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{DE5654CA-EB84-4df9-915B-37E957082D6D}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{DE5654CA-EB84-4df9-915B-37E957082D6D}InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x83 0x6C 0x56 0x8B ...
Reg RegistryMACHINESOFTWAREClassesCLSID{E39C35E8-7488-4926-92B2-2F94619AC1A5}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{E39C35E8-7488-4926-92B2-2F94619AC1A5}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{E39C35E8-7488-4926-92B2-2F94619AC1A5}InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xB2 0x46 0x9A 0xE2 ...
Reg RegistryMACHINESOFTWAREClassesCLSID{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x37 0xA4 0xAA 0xC3 ...
Reg RegistryMACHINESOFTWAREClassesCLSID{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0x2A 0xB7 0xCC 0xB5 ...
Reg RegistryMACHINESOFTWAREClassesCLSID{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}InprocServer32@ThreadingModel Apartment
Reg RegistryMACHINESOFTWAREClassesCLSID{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}InprocServer32@ C:WINDOWSsystem32OLE32.DLL
Reg RegistryMACHINESOFTWAREClassesCLSID{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E ...
---- EOF - GMER 1.0.12 ----
- Kod:
GMER 1.0.12.11879 - http://www.gmer.net
Rootkit scan 2006-11-06 21:51:10
Windows 5.1.2600 Dodatek Service Pack 2
---- Services - GMER 1.0.12 ----
Service .NET CLR Data
Service .NET CLR Networking
Service .NET Data Provider for Oracle
Service .NET Data Provider for SqlServer
Service .NETFramework
Service [DISABLED] Abiosdsk
Service [DISABLED] abp480n5
Service C:WINDOWSSystem32DRIVERSACPI.sys [BOOT] ACPI
Service [DISABLED] ACPIEC
Service [DISABLED] adpu160m
Service C:WINDOWSsystem32driversaec.sys [MANUAL] aec
Service C:WINDOWSSystem32driversafd.sys [SYSTEM] AFD
Service [DISABLED] Aha154x
Service [DISABLED] aic78u2
Service [DISABLED] aic78xx
Service C:WINDOWSsystem32driversALCXWDM.SYS [MANUAL] ALCXWDM
Service C:WINDOWSSystem32svchost.exe [DISABLED] Alerter
Service C:WINDOWSSystem32alg.exe [MANUAL] ALG
Service [DISABLED] AliIde
Service [DISABLED] amsint
Service C:WINDOWSsystem32svchost.exe [MANUAL] AppMgmt
Service ASAPIW2K
Service [DISABLED] asc
Service [DISABLED] asc3350p
Service [DISABLED] asc3550
Service ASP.NET
Service ASP.NET_2.0.50727
Service C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [MANUAL] aspnet_state
Service C:WINDOWSSystem32DRIVERSasyncmac.sys [MANUAL] AsyncMac
Service C:WINDOWSSystem32DRIVERSatapi.sys [BOOT] atapi
Service [DISABLED] Atdisk
Service C:WINDOWSsystem32Ati2evxx.exe [AUTO] Ati HotKey Poller
Service C:WINDOWSsystem32ati2sgag.exe [AUTO] ATI Smart
Service C:WINDOWSSystem32DRIVERSati2mtag.sys [MANUAL] ati2mtag
Service Atierecord
Service C:WINDOWSSystem32DRIVERSatmarpc.sys [MANUAL] Atmarpc
Service C:WINDOWSSystem32svchost.exe [AUTO] AudioSrv
Service C:WINDOWSSystem32DRIVERSaudstub.sys [MANUAL] audstub
Service BattC
Service [SYSTEM] Beep
Service C:WINDOWSSystem32driversBIOS.sys [SYSTEM] BIOS
Service C:WINDOWSSystem32svchost.exe [MANUAL] BITS
Service C:WINDOWSsystem32DRIVERSlueletaudio.sys [MANUAL] BlueletAudio
Service C:Program FilesIVT CorporationBlueSoleilBTNtService.exe [AUTO] BlueSoleil Hid Service
Service C:WINDOWSSystem32svchost.exe [AUTO] Browser
Service C:WINDOWSsystem32DRIVERStnetdrv.sys [MANUAL] BT
Service C:WINDOWSSystem32Driverstcusb.sys [MANUAL] Btcsrusb
Service C:WINDOWSsystem32DRIVERSvbtenum.sys [MANUAL] BTHidEnum
Service C:WINDOWSSystem32DriversBTHidMgr.sys [BOOT] BTHidMgr
Service [DISABLED] cbidf2k
Service C:WINDOWSsystem32DRIVERSCCDECODE.sys [MANUAL] CCDECODE
Service [DISABLED] cd20xrnt
Service [SYSTEM] Cdaudio
Service [DISABLED] Cdfs
Service C:WINDOWSSystem32DRIVERScdrom.sys [SYSTEM] Cdrom
Service [SYSTEM] Changer
Service C:WINDOWSSystem32cisvc.exe [MANUAL] cisvc
Service C:WINDOWSsystem32clipsrv.exe [DISABLED] ClipSrv
Service C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [MANUAL] clr_optimization_v2.0.50727_32
Service [DISABLED] CmdIde
Service C:WINDOWSSystem32dllhost.exe [MANUAL] COMSysApp
Service ContentFilter
Service ContentIndex
Service [DISABLED] Cpqarray
Service C:WINDOWSsystem32svchost.exe [AUTO] CryptSvc
Service [DISABLED] dac2w2k
Service [DISABLED] dac960nt
Service C:WINDOWSsystem32svchost.exe [AUTO] DcomLaunch
Service C:WINDOWSSystem32svchost.exe [AUTO] Dhcp
Service C:WINDOWSSystem32DRIVERSdisk.sys [BOOT] Disk
Service C:WINDOWSSystem32dmadmin.exe [MANUAL] dmadmin
Service C:WINDOWSSystem32driversdmboot.sys [DISABLED] dmboot
Service C:WINDOWSSystem32driversdmio.sys [BOOT] dmio
Service C:WINDOWSSystem32driversdmload.sys [BOOT] dmload
Service C:WINDOWSSystem32svchost.exe [AUTO] dmserver
Service C:WINDOWSsystem32driversDMusic.sys [MANUAL] DMusic
Service C:WINDOWSSystem32svchost.exe [AUTO] Dnscache
Service [DISABLED] dpti2o
Service C:WINDOWSsystem32driversdrmkaud.sys [MANUAL] drmkaud
Service C:WINDOWSSystem32svchost.exe [AUTO] ERSvc
Service C:WINDOWSsystem32services.exe [AUTO] Eventlog
Service C:WINDOWSSystem32svchost.exe [MANUAL] EventSystem
Service C:Program Filesewido anti-spyware 4.0guard.sys [SYSTEM] ewido anti-spyware 4.0 driver
Service C:Program Filesewido anti-spyware 4.0guard.exe [AUTO] ewido anti-spyware 4.0 guard
Service [DISABLED] Fastfat
Service C:WINDOWSSystem32svchost.exe [MANUAL] FastUserSwitchingCompatibility
Service C:WINDOWSSystem32DRIVERSfdc.sys [MANUAL] Fdc
Service [SYSTEM] Fips
Service C:WINDOWSSystem32DRIVERSflpydisk.sys [MANUAL] Flpydisk
Service C:WINDOWSsystem32driversfltmgr.sys [BOOT] FltMgr
Service [SYSTEM] Fs_Rec
Service C:WINDOWSSystem32DRIVERSftdisk.sys [BOOT] Ftdisk
Service C:WINDOWSSystem32DRIVERSgmer.sys [MANUAL] gmer
Service C:WINDOWSSystem32DRIVERSmsgpc.sys [MANUAL] Gpc
Service C:WINDOWSSystem32svchost.exe [AUTO] helpsvc
Service C:WINDOWSSystem32svchost.exe [DISABLED] HidServ
Service C:WINDOWSSystem32DRIVERShidusb.sys [MANUAL] hidusb
Service [DISABLED] hpn
Service [DISABLED] hpt3xx
Service C:WINDOWSSystem32DriversHTTP.sys [MANUAL] HTTP
Service C:WINDOWSSystem32svchost.exe [MANUAL] HTTPFilter
Service [SYSTEM] i2omgmt
Service [DISABLED] i2omp
Service C:WINDOWSSystem32DRIVERSi8042prt.sys [SYSTEM] i8042prt
Service [SYSTEM] Imapi
Service C:WINDOWSSystem32imapi.exe [MANUAL] ImapiService
Service system32driversInCDFs.sys [DISABLED] InCDFs
Service system32driversInCDPass.sys [SYSTEM] InCDPass
Service system32driversInCDRm.sys [SYSTEM] InCDRm
Service inetaccs
Service [DISABLED] ini910u
Service Inport
Service [DISABLED] IntelIde
Service C:WINDOWSsystem32driversip6fw.sys [MANUAL] ip6fw
Service C:WINDOWSSystem32DRIVERSipfltdrv.sys [MANUAL] IpFilterDriver
Service C:WINDOWSSystem32DRIVERSipinip.sys [MANUAL] IpInIp
Service C:WINDOWSSystem32DRIVERSipnat.sys [MANUAL] IpNat
Service C:WINDOWSSystem32DRIVERSipsec.sys [SYSTEM] IPSec
Service C:WINDOWSSystem32DRIVERSirenum.sys [MANUAL] IRENUM
Service ISAPISearch
Service C:WINDOWSSystem32DRIVERSisapnp.sys [BOOT] isapnp
Service C:WINDOWSSystem32DRIVERSkbdclass.sys [SYSTEM] Kbdclass
Service C:WINDOWSsystem32driverskmixer.sys [MANUAL] kmixer
Service [BOOT] KSecDD
Service C:WINDOWSSystem32svchost.exe [AUTO] lanmanserver
Service C:WINDOWSSystem32svchost.exe [AUTO] lanmanworkstation
Service [SYSTEM] lbrtfdc
Service ldap
Service LicenseService
Service C:WINDOWSSystem32svchost.exe [AUTO] LmHosts
Service lzx32
Service C:WINDOWSSystem32svchost.exe [AUTO] Messenger
Service [SYSTEM] mnmdd
Service C:WINDOWSSystem32mnmsrvc.exe [MANUAL] mnmsrvc
Service [MANUAL] Modem
Service C:WINDOWSSystem32DRIVERSmouclass.sys [SYSTEM] Mouclass
Service C:WINDOWSSystem32DRIVERSmouhid.sys [MANUAL] mouhid
Service [BOOT] MountMgr
Service [DISABLED] mraid35x
Service C:WINDOWSSystem32DRIVERSmrxdav.sys [MANUAL] MRxDAV
Service C:WINDOWSSystem32DRIVERSmrxsmb.sys [SYSTEM] MRxSmb
Service C:WINDOWSSystem32msdtc.exe [MANUAL] MSDTC
Service [SYSTEM] Msfs
Service msguard
Service C:WINDOWSSystem32msiexec.exe [MANUAL] MSIServer
Service C:WINDOWSsystem32driversMSKSSRV.sys [MANUAL] MSKSSRV
Service C:WINDOWSsystem32driversMSPCLOCK.sys [MANUAL] MSPCLOCK
Service C:WINDOWSsystem32driversMSPQM.sys [MANUAL] MSPQM
Service C:WINDOWSSystem32DRIVERSmssmbios.sys [MANUAL] mssmbios
Service C:WINDOWSsystem32driversMSTEE.sys [MANUAL] MSTEE
Service [BOOT] Mup
Service C:WINDOWSSystem32DRIVERSNABTSFEC.sys [MANUAL] NABTSFEC
Service [BOOT] NDIS
Service C:WINDOWSSystem32DRIVERSNdisIP.sys [MANUAL] NdisIP
Service C:WINDOWSSystem32DRIVERS
distapi.sys [MANUAL] NdisTapi
Service C:WINDOWSSystem32DRIVERS
disuio.sys [MANUAL] Ndisuio
Service C:WINDOWSSystem32DRIVERS
diswan.sys [MANUAL] NdisWan
Service [MANUAL] NDProxy
Service C:WINDOWSSystem32DRIVERS
etbios.sys [SYSTEM] NetBIOS
Service C:WINDOWSSystem32DRIVERS
etbt.sys [SYSTEM] NetBT
Service C:WINDOWSsystem32
etdde.exe [DISABLED] NetDDE
Service C:WINDOWSsystem32
etdde.exe [DISABLED] NetDDEdsdm
Service C:WINDOWSSystem32lsass.exe [MANUAL] Netlogon
Service C:WINDOWSSystem32svchost.exe [MANUAL] Netman
Service C:Program [DISABLED] Network Monitor
Service C:WINDOWSSystem32svchost.exe [MANUAL] Nla
Service [SYSTEM] Npfs
Service [DISABLED] Ntfs
Service C:WINDOWSSystem32lsass.exe [MANUAL] NtLmSsp
Service C:WINDOWSsystem32svchost.exe [MANUAL] NtmsSvc
Service [SYSTEM] Null
Service C:WINDOWSSystem32DRIVERSNVENETFD.sys [MANUAL] NVENETFD
Service C:WINDOWSSystem32DRIVERS
vnetbus.sys [MANUAL] nvnetbus
Service C:WINDOWSSystem32DRIVERS
v_agp.sys [BOOT] nv_agp
Service C:WINDOWSSystem32DRIVERS
wlnkflt.sys [MANUAL] NwlnkFlt
Service C:WINDOWSSystem32DRIVERS
wlnkfwd.sys [MANUAL] NwlnkFwd
Service C:WINDOWSSystem32DRIVERSparport.sys [MANUAL] Parport
Service [BOOT] PartMgr
Service [AUTO] ParVdm
Service C:WINDOWSSystem32DRIVERSpci.sys [BOOT] PCI
Service [SYSTEM] PCIDump
Service C:WINDOWSSystem32DRIVERSpciide.sys [BOOT] PCIIde
Service C:WINDOWSsystem32driverspclepci.sys [SYSTEM] PCLEPCI
Service [DISABLED] Pcmcia
Service [MANUAL] PDCOMP
Service [MANUAL] PDFRAME
Service [MANUAL] PDRELI
Service [MANUAL] PDRFRAME
Service pe386
Service [DISABLED] perc2
Service [DISABLED] perc2hib
Service PerfDisk
Service PerfNet
Service PerfOS
Service PerfProc
Service C:WINDOWSsystem32services.exe [AUTO] PlugPlay
Service C:WINDOWSSystem32lsass.exe [AUTO] PolicyAgent
Service C:WINDOWSSystem32DRIVERS aspptp.sys [MANUAL] PptpMiniport
Service [SYSTEM] PQNTDrv
Service C:WINDOWSSystem32DRIVERSprocessr.sys [SYSTEM] Processor
Service C:WINDOWSsystem32lsass.exe [AUTO] ProtectedStorage
Service C:WINDOWSSystem32DRIVERSpsched.sys [MANUAL] PSched
Service C:WINDOWSSystem32DRIVERSptilink.sys [MANUAL] Ptilink
Service C:WINDOWSSystem32DriversPxHelp20.sys [BOOT] PxHelp20
Service [DISABLED] ql1080
Service [DISABLED] Ql10wnt
Service [DISABLED] ql12160
Service [DISABLED] ql1240
Service [DISABLED] ql1280
Service C:WINDOWSSystem32DRIVERS asacd.sys [SYSTEM] RasAcd
Service C:WINDOWSSystem32svchost.exe [MANUAL] RasAuto
Service C:WINDOWSSystem32DRIVERS asl2tp.sys [MANUAL] Rasl2tp
Service C:WINDOWSSystem32svchost.exe [MANUAL] RasMan
Service C:WINDOWSSystem32DRIVERS aspppoe.sys [MANUAL] RasPppoe
Service C:WINDOWSSystem32DRIVERS aspti.sys [MANUAL] Raspti
Service C:WINDOWSSystem32DRIVERS dbss.sys [SYSTEM] Rdbss
Service C:WINDOWSSystem32DRIVERSRDPCDD.sys [SYSTEM] RDPCDD
Service RDPDD
Service C:WINDOWSSystem32DRIVERS dpdr.sys [MANUAL] rdpdr
Service RDPNP
Service [MANUAL] RDPWD
Service C:WINDOWSsystem32sessmgr.exe [MANUAL] RDSessMgr
Service C:WINDOWSSystem32DRIVERS edbook.sys [SYSTEM] redbook
Service C:WINDOWSSystem32svchost.exe [DISABLED] RemoteAccess
Service C:WINDOWSsystem32svchost.exe [AUTO] RemoteRegistry
Service C:WINDOWSSystem32DriversRootMdm.sys [MANUAL] ROOTMODEM
Service C:WINDOWSSystem32locator.exe [MANUAL] RpcLocator
Service C:WINDOWSsystem32svchost.exe [AUTO] RpcSs
Service C:WINDOWSSystem32 svp.exe [MANUAL] RSVP
Service C:WINDOWSsystem32lsass.exe [AUTO] SamSs
Service C:WINDOWSSystem32SCardSvr.exe [MANUAL] SCardSvr
Service C:WINDOWSSystem32svchost.exe [AUTO] Schedule
Service ScsiPort
Service C:WINDOWSSystem32DRIVERSsecdrv.sys [MANUAL] Secdrv
Service C:WINDOWSSystem32svchost.exe [AUTO] seclogon
Service C:WINDOWSsystem32svchost.exe [AUTO] SENS
Service C:WINDOWSSystem32DRIVERSserenum.sys [MANUAL] serenum
Service C:WINDOWSSystem32DRIVERSserial.sys [SYSTEM] Serial
Service [SYSTEM] Sfloppy
Service C:WINDOWSSystem32svchost.exe [AUTO] SharedAccess
Service C:WINDOWSSystem32svchost.exe [AUTO] ShellHWDetection
Service [DISABLED] Simbad
Service C:WINDOWSSystem32DRIVERSSLIP.sys [MANUAL] SLIP
Service [DISABLED] Sparrow
Service C:WINDOWSsystem32driverssplitter.sys [MANUAL] splitter
Service C:WINDOWSsystem32spoolsv.exe [AUTO] Spooler
Service C:WINDOWSSystem32DRIVERSsr.sys [BOOT] sr
Service C:WINDOWSSystem32svchost.exe [AUTO] srservice
Service C:WINDOWSSystem32DRIVERSsrv.sys [MANUAL] Srv
Service C:WINDOWSSystem32svchost.exe [AUTO] SSDPSRV
Service C:WINDOWSSystem32svchost.exe [MANUAL] stisvc
Service C:WINDOWSSystem32DRIVERSStreamIP.sys [MANUAL] streamip
Service C:WINDOWSSystem32DRIVERSswenum.sys [MANUAL] swenum
Service C:WINDOWSsystem32driversswmidi.sys [MANUAL] swmidi
Service C:WINDOWSSystem32dllhost.exe [MANUAL] SwPrv
Service swwd
Service [DISABLED] symc810
Service [DISABLED] symc8xx
Service [DISABLED] sym_hi
Service [DISABLED] sym_u3
Service C:WINDOWSsystem32driverssysaudio.sys [MANUAL] sysaudio
Service C:WINDOWSsystem32smlogsvc.exe [MANUAL] SysmonLog
Service C:WINDOWSSystem32svchost.exe [MANUAL] TapiSrv
Service C:WINDOWSSystem32DRIVERS cpip.sys [SYSTEM] Tcpip
Service [MANUAL] TDPIPE
Service [MANUAL] TDTCP
Service C:WINDOWSSystem32DRIVERS ermdd.sys [SYSTEM] TermDD
Service C:WINDOWSSystem32svchost.exe [MANUAL] TermService
Service C:WINDOWSSystem32svchost.exe [AUTO] Themes
Service C:WINDOWSSystem32 lntsvr.exe [MANUAL] TlntSvr
Service [DISABLED] TosIde
Service C:WINDOWSsystem32svchost.exe [AUTO] TrkWks
Service TSDDD
Service [DISABLED] Udfs
Service [DISABLED] ultra
Service C:WINDOWSsystem32wdfmgr.exe [AUTO] UMWdf
Service C:WINDOWSSystem32DRIVERSupdate.sys [MANUAL] Update
Service C:WINDOWSSystem32svchost.exe [AUTO] upnphost
Service C:WINDOWSSystem32ups.exe [MANUAL] UPS
Service C:WINDOWSsystem32DRIVERSusb2vcom.sys [MANUAL] usb2vcom
Service C:WINDOWSSystem32DRIVERSusbehci.sys [MANUAL] usbehci
Service C:WINDOWSSystem32DRIVERSusbhub.sys [MANUAL] usbhub
Service C:WINDOWSSystem32DRIVERSusbohci.sys [MANUAL] usbohci
Service C:WINDOWSsystem32DRIVERSusbprint.sys [MANUAL] usbprint
Service C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [MANUAL] USBSTOR
Service C:WINDOWSsystem32DRIVERSVComm.sys [MANUAL] VComm
Service C:WINDOWSSystem32DriversVcommMgr.sys [MANUAL] VcommMgr
Service C:WINDOWSSystem32driversvga.sys [SYSTEM] VgaSave
Service [DISABLED] ViaIde
Service [BOOT] VolSnap
Service C:WINDOWSSystem32vssvc.exe [MANUAL] VSS
Service C:WINDOWSSystem32svchost.exe [AUTO] W32Time
Service W3SVC
Service C:WINDOWSSystem32DRIVERSwanarp.sys [MANUAL] Wanarp
Service [MANUAL] WDICA
Service C:WINDOWSsystem32driverswdmaud.sys [MANUAL] wdmaud
Service C:WINDOWSSystem32svchost.exe [AUTO] WebClient
Service C:WINDOWSsystem32svchost.exe [AUTO] winmgmt
Service [MANUAL] Winsock
Service WinSock2
Service WinTrust
Service C:WINDOWSSystem32svchost.exe [MANUAL] WmdmPmSN
Service C:WINDOWSSystem32svchost.exe [MANUAL] Wmi
Service WmiApRpl
Service C:WINDOWSSystem32wbemwmiapsrv.exe [MANUAL] WmiApSrv
Service C:WINDOWSSystem32driversws2ifsl.sys [DISABLED] WS2IFSL
Service C:WINDOWSSystem32svchost.exe [AUTO] wscsvc
Service C:WINDOWSSystem32DRIVERSWSTCODEC.SYS [MANUAL] WSTCODEC
Service C:WINDOWSSystem32svchost.exe [AUTO] wuauserv
Service C:WINDOWSSystem32svchost.exe [AUTO] WZCSVC
Service C:WINDOWSSystem32svchost.exe [MANUAL] xmlprov
Service {7252C981-BCDE-41AD-ADE3-319C1FAA469C}
Service {E301C35F-410E-4D73-8B8D-05163F0A98CF}
Service {ECDD2905-DE50-4FEA-8B76-32FB15D10081}
---- EOF - GMER 1.0.12 ----
06 Lis 2006, 23:23
qrde wywala mi błędy kasowania plików
06 Lis 2006, 23:29
Pisze, że plików nie znaleziono? Jeśli tak to zostały one usunięte.
Czy opróćz blokaday taskmrg.exe coś jeszce nie działa??
Czy opróćz blokaday taskmrg.exe coś jeszce nie działa??
07 Lis 2006, 08:41
Wyskoczyło mi że
- Kod:
Wystąpił błąd nr 0xC0000034 w czasie kasowania pliku "CWINDOWSsystem32wkwpafekk.dll"