Regulamin forum
1. Każdy temat powinien odzwierciedlać treść wątku.2. W przypadku wklejania logów; należy je wykonać od razu przynajmniej z dwóch narzędzi: FRST oraz z GMER
3. Wszelkie logi proszę publikować na przeznaczonych do tego stronach a w poście wklejać tylko link.
4. Nie wskazane jest skracanie logów, należy wkleić cały - od początku, do końca.
5. Nie wskazane jest podczepianie się do tematów innych użytkowników - proszę założyć nowy temat w dziale Bezpieczeństwo, ułatwi to pomoc sprawdzającemu.
6. Osoby nie posiadające odpowiedniej wiedzy, nie powinny sprawdzać logów, ponieważ grozi to poważnym uszkodzeniem systemu lub aplikacji zainstalowanych na komputerze.
7. Należy dokładnie opisać problem, występujące objawy oraz wszelkie podjęte działania.
8. Każdy skrypt jest unikatowy, napisany dla każdego przypadku z osobna, więc nie może być stosowany przez innych.
9. W przypadku zamieszczenia zrzutu ekranu (screenshot'a) proszę korzystać z zewnętrznego serwisu oferującego hosting zdjęć.
Prosze o sprawdzenie log'a
20 Sie 2007, 15:58
Ten log jest robiony ComboFix jak cos to moge jesczze dac z HiJackThis.
ComboFix 07-08-17.2 - "Druss" 2007-08-20 15:48:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.115 [GMT 2:00]
* Created a new restore point
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000009_.tmp.dll
C:\WINDOWS\system32\_000013_.tmp.dll
((((((((((((((((((((((((( Files Created from 2007-07-20 to 2007-08-20 )))))))))))))))))))))))))))))))
2007-08-20 15:48 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-20 15:47 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-19 23:55 9,836,989 --------- C:\WINDOWS\system32\svchast.exe
2007-08-19 23:55 8,955,904 --a------ C:\WINDOWS\DiRT.exe
2007-08-19 20:21 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2007-08-19 20:21 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-08-19 20:21 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-08-19 20:21 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2007-08-19 20:21 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2007-08-19 15:56 122,880 --a------ C:\WINDOWS\UnGins.exe
2007-08-19 14:51 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2007-08-12 15:57 29,217 --a------ C:\WINDOWS\DIIUnin.dat
2007-08-12 15:57 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-08-12 15:57 106,496 --a------ C:\WINDOWS\DIIUnin.exe
2007-08-11 17:41 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2007-08-11 17:41 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2007-08-11 17:41 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2007-08-01 16:35 <DIR> d-------- C:\DOCUME~1\Druss\DANEAP~1\Ahead
2007-07-30 00:10 <DIR> d-------- C:\Plyty z muza do przesluchania
2007-07-28 23:25 <DIR> d-------- C:\Program Files\PowerStrip
2007-07-28 21:06 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-07-27 20:28 <DIR> d-------- C:\Program Files\Ray Adams
2007-07-27 20:28 <DIR> d-------- C:\DOCUME~1\Druss\DANEAP~1\atitray
2007-07-27 03:15 <DIR> d-------- C:\Program Files\SpeedFan
2007-07-26 16:44 79,320 -ra------ C:\WINDOWS\system32\atiicdxx.dat
2007-07-26 16:44 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-07-26 16:44 299,008 -ra------ C:\WINDOWS\system32\atiiiexx.dll
2007-07-26 16:30 <DIR> d-------- C:\DOCUME~1\Druss\DANEAP~1\Help
2007-07-25 16:32 5,120 --a------ C:\WINDOWS\system32\drivers\BS_I2cIo.sys
2007-07-25 16:32 <DIR> d-------- C:\Program Files\WarpSpeeder
2007-07-25 00:05 <DIR> d-------- C:\3D Mark 2006
2007-07-25 00:04 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2007-07-25 00:04 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2007-07-25 00:04 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2007-07-25 00:04 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-07-25 00:04 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-07-25 00:04 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2007-07-25 00:02 <DIR> d-------- C:\Program Files\Futuremark
2007-07-23 20:34 <DIR> d-------- C:\Program Files\BurnInTest
2007-07-23 20:31 <DIR> d-------- C:\Program Files\CPU RightMark Lite
2007-07-21 01:48 63,488 --a------ C:\WINDOWS\system32\unam4ie.exe
2007-07-21 01:48 4,608 --a------ C:\WINDOWS\system32\w95inf32.dll
2007-07-21 01:48 38,160 --a------ C:\WINDOWS\system32\LMRTREND.dll
2007-07-21 01:48 2,272 --a------ C:\WINDOWS\system32\w95inf16.dll
2007-07-21 01:48 194,320 --a------ C:\WINDOWS\system32\qcut.dll
2007-07-21 01:48 182,032 --a------ C:\WINDOWS\system32\dxtmsft3.dll
2007-07-21 01:48 10,240 --a------ C:\WINDOWS\system32\vidx16.dll
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-20 00:07 --------- d-------- C:\Program Files\eMule
2007-08-19 20:07 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-12 00:29 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-07-26 16:45 --------- d-------- C:\Program Files\ATI Technologies
2007-07-09 01:59 --------- d-------- C:\Program Files\Audacity
2007-07-07 14:01 --------- d-------- C:\Program Files\Gadu-Gadu
2007-06-27 01:57 --------- d-------- C:\DOCUME~1\Druss\DANEAP~1\Nokia Multimedia Player
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41943050-65CC-454B-81E4-9C8A9D7CBAEA}]
C:\WINDOWS\system32\localsplnet.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 10:54 C:\WINDOWS\SOUNDMAN.EXE]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-03-31 02:04]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2005-12-14 16:14]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" []
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 21:05]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 22:21]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2007-04-08 15:22]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-17 23:41]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-02-10 17:00]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"<NO NAME>"=
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
ATI CATALYST System Tray.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-02-22 22:21:26]
WarpSpeeder Tray Icon.lnk - C:\Program Files\WarpSpeeder\BSTrayicon.exe [2007-07-25 16:32:43]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
"C:\Program Files\BearShare\BearShare.exe" /pause
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
"C:\Program Files\Spy Emergency 2005\SpyEmergency.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
R1 BS_I2cIo;BS_I2cIo;\??\C:\WINDOWS\system32\drivers\BS_I2cIo.sys
R2 PStrip;PStrip;C:\WINDOWS\system32\drivers\pstrip.sys
R2 SetupNT;SetupNT;C:\WINDOWS\system32\SetupNT.sys
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys
S1 SpyEmrg;Spy Emergency Driver;C:\WINDOWS\system32\Drivers\spyemrg.sys
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys
S3 ddxgb;ddxgb;\??\C:\DOCUME~1\Druss\USTAWI~1\Temp\ddxgb.sys
S3 iteio;iteio;\??\C:\WINDOWS\system32\drivers\iteio.sys
S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DDDFC9C8-A0F8-E0CF-AF00-F0F423E36752}]
C:\WINDOWS\system32\svchast.exe
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-20 15:55:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Creative Detector = "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R???w0??w????*??w???w????O??w:???m????? ?????????????L???L??????????wO??w:???m????? ?????????????k!?sO??w:???m????? ?????L??????????sm????? ?????m???????$??????sm????? ?????????????rl?w?? ?N??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-20 15:56:17 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-20 15:56
--- E O F ---
ComboFix 07-08-17.2 - "Druss" 2007-08-20 15:48:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.115 [GMT 2:00]
* Created a new restore point
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000009_.tmp.dll
C:\WINDOWS\system32\_000013_.tmp.dll
((((((((((((((((((((((((( Files Created from 2007-07-20 to 2007-08-20 )))))))))))))))))))))))))))))))
2007-08-20 15:48 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-20 15:47 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-19 23:55 9,836,989 --------- C:\WINDOWS\system32\svchast.exe
2007-08-19 23:55 8,955,904 --a------ C:\WINDOWS\DiRT.exe
2007-08-19 20:21 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2007-08-19 20:21 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-08-19 20:21 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-08-19 20:21 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2007-08-19 20:21 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2007-08-19 15:56 122,880 --a------ C:\WINDOWS\UnGins.exe
2007-08-19 14:51 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2007-08-12 15:57 29,217 --a------ C:\WINDOWS\DIIUnin.dat
2007-08-12 15:57 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-08-12 15:57 106,496 --a------ C:\WINDOWS\DIIUnin.exe
2007-08-11 17:41 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2007-08-11 17:41 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2007-08-11 17:41 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2007-08-01 16:35 <DIR> d-------- C:\DOCUME~1\Druss\DANEAP~1\Ahead
2007-07-30 00:10 <DIR> d-------- C:\Plyty z muza do przesluchania
2007-07-28 23:25 <DIR> d-------- C:\Program Files\PowerStrip
2007-07-28 21:06 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-07-27 20:28 <DIR> d-------- C:\Program Files\Ray Adams
2007-07-27 20:28 <DIR> d-------- C:\DOCUME~1\Druss\DANEAP~1\atitray
2007-07-27 03:15 <DIR> d-------- C:\Program Files\SpeedFan
2007-07-26 16:44 79,320 -ra------ C:\WINDOWS\system32\atiicdxx.dat
2007-07-26 16:44 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-07-26 16:44 299,008 -ra------ C:\WINDOWS\system32\atiiiexx.dll
2007-07-26 16:30 <DIR> d-------- C:\DOCUME~1\Druss\DANEAP~1\Help
2007-07-25 16:32 5,120 --a------ C:\WINDOWS\system32\drivers\BS_I2cIo.sys
2007-07-25 16:32 <DIR> d-------- C:\Program Files\WarpSpeeder
2007-07-25 00:05 <DIR> d-------- C:\3D Mark 2006
2007-07-25 00:04 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2007-07-25 00:04 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2007-07-25 00:04 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2007-07-25 00:04 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-07-25 00:04 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-07-25 00:04 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2007-07-25 00:02 <DIR> d-------- C:\Program Files\Futuremark
2007-07-23 20:34 <DIR> d-------- C:\Program Files\BurnInTest
2007-07-23 20:31 <DIR> d-------- C:\Program Files\CPU RightMark Lite
2007-07-21 01:48 63,488 --a------ C:\WINDOWS\system32\unam4ie.exe
2007-07-21 01:48 4,608 --a------ C:\WINDOWS\system32\w95inf32.dll
2007-07-21 01:48 38,160 --a------ C:\WINDOWS\system32\LMRTREND.dll
2007-07-21 01:48 2,272 --a------ C:\WINDOWS\system32\w95inf16.dll
2007-07-21 01:48 194,320 --a------ C:\WINDOWS\system32\qcut.dll
2007-07-21 01:48 182,032 --a------ C:\WINDOWS\system32\dxtmsft3.dll
2007-07-21 01:48 10,240 --a------ C:\WINDOWS\system32\vidx16.dll
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-20 00:07 --------- d-------- C:\Program Files\eMule
2007-08-19 20:07 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-12 00:29 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-07-26 16:45 --------- d-------- C:\Program Files\ATI Technologies
2007-07-09 01:59 --------- d-------- C:\Program Files\Audacity
2007-07-07 14:01 --------- d-------- C:\Program Files\Gadu-Gadu
2007-06-27 01:57 --------- d-------- C:\DOCUME~1\Druss\DANEAP~1\Nokia Multimedia Player
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41943050-65CC-454B-81E4-9C8A9D7CBAEA}]
C:\WINDOWS\system32\localsplnet.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 10:54 C:\WINDOWS\SOUNDMAN.EXE]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-03-31 02:04]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2005-12-14 16:14]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" []
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 21:05]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 22:21]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2007-04-08 15:22]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-17 23:41]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-02-10 17:00]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"<NO NAME>"=
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
ATI CATALYST System Tray.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-02-22 22:21:26]
WarpSpeeder Tray Icon.lnk - C:\Program Files\WarpSpeeder\BSTrayicon.exe [2007-07-25 16:32:43]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
"C:\Program Files\BearShare\BearShare.exe" /pause
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
"C:\Program Files\Spy Emergency 2005\SpyEmergency.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
R1 BS_I2cIo;BS_I2cIo;\??\C:\WINDOWS\system32\drivers\BS_I2cIo.sys
R2 PStrip;PStrip;C:\WINDOWS\system32\drivers\pstrip.sys
R2 SetupNT;SetupNT;C:\WINDOWS\system32\SetupNT.sys
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys
S1 SpyEmrg;Spy Emergency Driver;C:\WINDOWS\system32\Drivers\spyemrg.sys
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys
S3 ddxgb;ddxgb;\??\C:\DOCUME~1\Druss\USTAWI~1\Temp\ddxgb.sys
S3 iteio;iteio;\??\C:\WINDOWS\system32\drivers\iteio.sys
S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DDDFC9C8-A0F8-E0CF-AF00-F0F423E36752}]
C:\WINDOWS\system32\svchast.exe
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-20 15:55:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Creative Detector = "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R???w0??w????*??w???w????O??w:???m????? ?????????????L???L??????????wO??w:???m????? ?????????????k!?sO??w:???m????? ?????L??????????sm????? ?????m???????$??????sm????? ?????????????rl?w?? ?N??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-20 15:56:17 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-20 15:56
--- E O F ---
20 Sie 2007, 16:04
O2 - BHO: Local Spool Net support DLL - {41943050-65CC-454B-81E4-9C8A9D7CBAEA} - C:\WINDOWS\system32\localsplnet.dll
Usun to w HiJacku.
Usun to w HiJacku.
20 Sie 2007, 16:23
i tylko to ??
czy wkleic tez log z HiJack'a ??
czy wkleic tez log z HiJack'a ??
20 Sie 2007, 18:06
Usuń w awaryjnym albo Kill-Boxem.
C:\WINDOWS\system32\svchast.exe
No i log z HJT.
C:\WINDOWS\system32\svchast.exe
No i log z HJT.
20 Sie 2007, 19:42
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:40:23, on 2007-08-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\program files\powerstrip\pstrip.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\WarpSpeeder\BSTrayicon.exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: WarpSpeeder Tray Icon.lnk = ?
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE9B9E42-11FF-4744-B896-8EF7691691D8}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 6252 bytes
Scan saved at 19:40:23, on 2007-08-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\program files\powerstrip\pstrip.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\WarpSpeeder\BSTrayicon.exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: WarpSpeeder Tray Icon.lnk = ?
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE9B9E42-11FF-4744-B896-8EF7691691D8}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 6252 bytes
20 Sie 2007, 21:00
Czysto.
21 Sie 2007, 01:03
Dzieki wielkie.
pozdro.
pozdro.
21 Sie 2007, 12:19
Czysto jak czysto 
a flasget ?
flasget wersja free = spyware
Usun troche programow z autostartu.
a flasget ?
flasget wersja free = spyware
Usun troche programow z autostartu.
21 Sie 2007, 15:19
Byc może używa FlashGeta? Ale racja, przydałoby się usunąć.
21 Sie 2007, 16:07
No juz dosc bardzo zadko uzywam FlashGet'a bo teraz wszystko sciaga mi Opera. i mysle zeby usunac tego flasget'a.
a jakie programy proponujecie zeby usunac z autostartu ??
a jakie programy proponujecie zeby usunac z autostartu ??
21 Sie 2007, 17:31
SoundMan
NBJ
SunJavaUpdateSched
StartCCC
NBJ
SunJavaUpdateSched
StartCCC
21 Sie 2007, 19:01
Ja bym proponował:
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: WarpSpeeder Tray Icon.lnk = ?
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: WarpSpeeder Tray Icon.lnk = ?
22 Sie 2007, 17:08
Ja bym wywalila prawie wszystko,chodz nie wiem jak bedzie z ATI , ale mozna pokombinowac , bynajmniej sprobowac (jakby nie bylo tez oprogramowanie szpiegowskie)
Wylacz ctfmon , musisz to wylaczyc przez panel sterowania i w uslugach.
Panel sterowania
Opcje Regionalne i Jezykowe Jezyki Szczegoly Zaawansowane Wylacz Zaawansowane Uslugi Tekstowe (zaznacz)
Co do uslug to polecam ten temat
http://instalki.pl/forum/viewtopic.php?t=7834
Drusss napisał(a):O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: WarpSpeeder Tray Icon.lnk = ?
Wylacz ctfmon , musisz to wylaczyc przez panel sterowania i w uslugach.
Panel sterowania
Opcje Regionalne i Jezykowe Jezyki Szczegoly Zaawansowane Wylacz Zaawansowane Uslugi Tekstowe (zaznacz)
Co do uslug to polecam ten temat
http://instalki.pl/forum/viewtopic.php?t=7834
22 Sie 2007, 20:03
PowerStrip'a niech zostawi, w końcu to program do zarządzania parametrami karty graficznej, więc żeby działało to co ustawił, musi być ON.
22 Sie 2007, 21:24
niunka napisał(a):chodz nie wiem jak bedzie z ATI , ale mozna pokombinowac , bynajmniej sprobowac (jakby nie bylo tez oprogramowanie szpiegowskie)
Ati płata figle, nie radze. Przeinstalowywałem juz z 10 razy. Nawet po czysczeni CCleanerem potrafi się zepsuć...