Prosba O Sprawdzenie Loga

[hef44]

Jak w temacie.

 

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "ComboFix Log"

ComboFix 09-03-19.02 - NR1 2009-03-20 19:01:40.1 - NTFSx86 MINIMAL

Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1803 [GMT 1:00]

Uruchomiony z: c:\documents and settings\NR1\Pulpit\ComboFix.exe

AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated)

 

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!

.

 

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\autorun.inf

c:\program files\Mozilla Firefox\components\iamfamous.dll

c:\windows\system32\drivers\gaopdxktklnapp.sys

c:\windows\system32\drivers\gaopdxnospbyap.sys

c:\windows\system32\drivers\gaopdxwstiocfi.sys

c:\windows\system32\gaopdxcounter

c:\windows\system32\gaopdxpetidqoe.dll

D:\Autorun.inf

 

.

((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Service_gaopdxserv.sys

 

 

((((((((((((((((((((((((( Pliki utworzone od 2009-02-20 do 2009-03-20 )))))))))))))))))))))))))))))))

.

 

2009-03-20 18:50 . 2009-03-20 19:03 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne

2009-03-20 18:50 . 2009-02-01 12:16 <DIR> d-------- c:\documents and settings\Administrator\Ulubione

2009-03-20 18:50 . 2009-02-01 11:24 <DIR> d--h----- c:\documents and settings\Administrator\Szablony

2009-03-20 18:50 . 2009-02-01 12:16 <DIR> d-------- c:\documents and settings\Administrator\Pulpit

2009-03-20 18:50 . 2009-02-01 12:16 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty

2009-03-20 18:50 . 2009-02-01 12:16 <DIR> dr------- c:\documents and settings\Administrator\Menu Start

2009-03-20 18:50 . 2009-02-01 12:16 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji

2009-03-20 18:50 . 2009-03-20 18:50 <DIR> d-------- c:\documents and settings\Administrator

2009-03-05 23:39 . 1998-02-06 21:37 299,520 --a------ c:\windows\uninst.exe

2009-03-05 23:38 . 2009-03-05 23:38 <DIR> d-------- c:\documents and settings\NR1\WINDOWS

2009-03-03 15:22 . 2009-03-10 09:03 <DIR> d-------- c:\documents and settings\NR1\Dane aplikacji\U3

2009-03-01 00:27 . 2009-03-01 00:27 <DIR> d-------- c:\program files\ArKaos VJ 3.6.1 FC2

2009-03-01 00:05 . 2009-03-01 00:05 <DIR> d-------- c:\program files\Resolume 2.3

2009-02-24 18:38 . 2009-02-24 18:38 <DIR> d-------- c:\documents and settings\NR1\Dane aplikacji\Apple Computer

2009-02-24 18:27 . 2009-02-24 18:53 <DIR> d-------- c:\program files\QuickTime

2009-02-24 18:27 . 2009-02-24 18:27 <DIR> d-------- c:\program files\Apple Software Update

2009-02-24 18:27 . 2009-02-24 18:27 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer

2009-02-24 18:27 . 2009-02-24 18:27 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple

2009-02-22 14:45 . 2009-02-22 14:45 <DIR> d-------- c:\windows\system32\LogFiles

2009-02-21 23:14 . 2009-02-21 23:14 <DIR> d-------- c:\documents and settings\NR1\Dane aplikacji\DriverCure

2009-02-21 23:14 . 2009-02-21 23:14 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ParetoLogic

2009-02-21 23:14 . 2009-02-22 14:18 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\DriverCure

2009-02-21 22:51 . 2009-02-21 22:52 <DIR> d-------- c:\documents and settings\NR1\Dane aplikacji\EssentialPIM

 

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-20 17:46 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\Skype

2009-03-20 17:28 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\skypePM

2009-03-15 23:40 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\Azureus

2009-03-13 11:17 --------- d-----w c:\program files\Konnekt

2009-03-12 00:09 --------- d-----w c:\program files\Vuze

2009-03-08 12:29 --------- d-----w c:\program files\Mininova-Vuze

2009-02-28 23:27 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-24 17:28 --------- d-----w c:\program files\ArKaos VJ 3.5 FC1

2009-02-24 17:26 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\uTorrent

2009-02-18 14:22 --------- d-----w c:\program files\Audacity

2009-02-18 14:10 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP

2009-02-17 11:47 --------- d-----w c:\program files\MSXML 4.0

2009-02-16 19:10 --------- d-----w c:\program files\Haunted Hotel 2 Believe the Lies

2009-02-16 13:52 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\HP

2009-02-16 13:49 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP

2009-02-16 13:48 --------- d-----w c:\program files\Common Files\Sonic Shared

2009-02-16 13:48 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sonic

2009-02-16 13:47 --------- d-----w c:\program files\Common Files\HP

2009-02-16 13:45 --------- d-----w c:\program files\Hewlett-Packard

2009-02-16 13:44 --------- d-----w c:\program files\HP

2009-02-15 23:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\PlayPond

2009-02-15 23:20 --------- d-----w c:\program files\Conduit

2009-02-15 23:20 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Azureus

2009-02-15 21:29 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\Jetsetter

2009-02-15 19:58 --------- d-----w c:\program files\Common Files\Hewlett-Packard

2009-02-14 14:30 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\Winamp

2009-02-14 14:29 --------- d-----w c:\program files\Winamp

2009-02-14 13:38 --------- d-----w c:\program files\Common Files\Adobe AIR

2009-02-14 13:35 --------- d-----w c:\program files\Common Files\Adobe

2009-02-13 16:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\SpecialBit

2009-02-12 20:52 --------- d-----w c:\program files\Mystery Legends - Sleepy Hollow

2009-02-10 22:18 --------- d-----w c:\program files\Common Files\Skype

2009-02-10 22:18 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype

2009-02-10 22:18 --------- d-----r c:\program files\Skype

2009-02-05 07:48 --------- d-----w c:\program files\Opera

2009-02-02 18:53 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\stamina

2009-02-02 18:46 --------- d-----w c:\program files\Zoner

2009-02-02 18:46 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\Zoner

2009-02-02 18:40 --------- d-----w c:\program files\WorldOfGoo

2009-02-02 18:40 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\2DBoy

2009-02-02 18:35 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Resolume 2.4

2009-02-02 09:14 --------- d-----w c:\program files\Corel

2009-02-02 09:14 --------- d-----w c:\program files\Common Files\Corel

2009-02-02 09:10 --------- d-----w c:\program files\Common Files\InstallShield

2009-02-02 08:39 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help

2009-02-02 08:38 --------- d-----w c:\program files\Microsoft Works

2009-02-02 08:37 --------- d-----w c:\program files\Microsoft.NET

2009-02-02 08:34 --------- d-----w c:\program files\Microsoft Visual Studio 8

2009-02-02 07:53 --------- d-----w c:\program files\Reference Assemblies

2009-02-02 07:53 --------- d-----w c:\program files\MSBuild

2009-02-01 17:12 410,984 ----a-w c:\windows\system32\deploytk.dll

2009-02-01 17:12 --------- d-----w c:\program files\Java

2009-02-01 16:48 --------- d-----w c:\program files\Common Files\Java

2009-02-01 16:47 --------- d-----w c:\program files\MarBit

2009-02-01 16:45 --------- d-----w c:\program files\K-Lite Codec Pack

2009-02-01 16:45 --------- d-----w c:\program files\ESET

2009-02-01 16:45 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ESET

2009-02-01 16:43 --------- d-----w c:\program files\Common Files\Ahead

2009-02-01 16:41 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\Ahead

2009-02-01 16:40 --------- d-----w c:\program files\Nero

2009-02-01 13:34 --------- d-----w c:\program files\Atheros

2009-02-01 13:34 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\InstallShield

2009-02-01 12:35 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Atheros

2009-02-01 12:32 --------- d-----w c:\program files\Synaptics

2009-02-01 11:59 --------- d-----w c:\program files\Toshiba

2009-02-01 11:58 315,392 ----a-w c:\windows\HideWin.exe

2009-02-01 11:58 --------- d-----w c:\program files\Realtek

2009-02-01 11:57 --------- d-----w c:\documents and settings\NR1\Dane aplikacji\ATI

2009-02-01 11:57 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ATI

2009-02-01 11:51 --------- d-----w c:\program files\ATI Technologies

2009-02-01 10:29 --------- d-----w c:\program files\microsoft frontpage

2009-02-01 10:28 --------- d-----w c:\program files\Usługi online

2009-02-01 10:25 --------- d-----w c:\program files\Windows Media Connect 2

2009-01-15 01:05 911,872 ----a-w c:\windows\system32\wininet.dll

2009-01-15 01:05 43,008 ----a-w c:\windows\system32\licmgr10.dll

2009-01-15 01:04 18,944 ----a-w c:\windows\system32\corpol.dll

2009-01-15 01:03 72,704 ----a-w c:\windows\system32\admparse.dll

2009-01-15 01:03 71,680 ----a-w c:\windows\system32\iesetup.dll

2009-01-15 01:03 420,352 ----a-w c:\windows\system32\vbscript.dll

2009-01-15 01:01 34,304 ----a-w c:\windows\system32\imgutil.dll

2009-01-15 01:00 48,128 ----a-w c:\windows\system32\mshtmler.dll

2009-01-15 01:00 45,568 ----a-w c:\windows\system32\mshta.exe

2009-01-15 00:50 156,160 ----a-w c:\windows\system32\msls31.dll

.

 

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{d51d388b-f5dc-471a-a1ce-5e2d671091c0}"= "c:\program files\Mininova-Vuze\tbMin1.dll" [2009-03-08 1883672]

 

[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]

2009-03-08 13:30 1883672 --a------ c:\program files\Mininova-Vuze\tbMin1.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{d51d388b-f5dc-471a-a1ce-5e2d671091c0}"= "c:\program files\Mininova-Vuze\tbMin1.dll" [2009-03-08 1883672]

 

[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{D51D388B-F5DC-471A-A1CE-5E2D671091C0}"= "c:\program files\Mininova-Vuze\tbMin1.dll" [2009-03-08 1883672]

 

[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]

"Konnekt"="c:\program files\Konnekt\konnekt.exe" [2005-05-24 503808]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-02-04 23975720]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-16 1024000]

"SMSERIAL"="c:\windows\sm56hlpr.exe" [2006-03-21 544768]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-01 136600]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]

"RTHDCPL"="RTHDCPL.EXE" [2008-06-20 c:\windows\RTHDCPL.exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

 

c:\documents and settings\NR1\Menu Start\Programy\Autostart\

CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2007-07-17 49152]

 

c:\documents and settings\All Users\Menu Start\Programy\Autostart\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]

HP Image Zone - szybkie uruchamianie.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 73728]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACU]

--a------ 2008-04-09 04:53 450648 c:\program files\Atheros\ACU.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"enablefirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Konnekt\\konnekt.exe"=

"c:\\Program Files\\Opera\\opera.exe"=

"c:\\Program Files\\Vuze\\Azureus.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

 

S1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-07-01 34312]

S2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-07-01 468224]

S3 DCamUSBET;USB2.0 1.3M UVC WebCam;c:\windows\system32\drivers\etDevice.sys [2009-02-01 138920]

S3 FiltUSBET;ET USB Device Lower Filter;c:\windows\system32\drivers\etFilter.sys [2009-02-01 21544]

S3 ScanUSBET;ET USB Still Image Capture Device;c:\windows\system32\drivers\etScan.sys [2009-02-01 13224]

S3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [2009-02-01 57408]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]

\Shell\AutoRun\command - H:\LaunchU3.exe -a

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20cbcbde-13da-11de-bcd5-001e8c249050}]

\Shell\AutoRun\command - G:\yh.cmd

\Shell\open\Command - G:\yh.cmd

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79dd048e-0892-11de-bca1-001e8c249050}]

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL explore.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3db65a2-07fe-11de-bc9c-001e8c249050}]

\Shell\AutoRun\command - G:\LaunchU3.exe -a

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d658a6e9-0a89-11de-bcb0-001e8c249050}]

\Shell\AutoRun\command - H:\LaunchU3.exe -a

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d658a6ea-0a89-11de-bcb0-001e8c249050}]

\Shell\AutoRun\command - I:\u.com

\Shell\open\Command - I:\u.com

 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Zawartość folderu 'Zaplanowane zadania'

 

2009-03-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

.

- - - - USUNIĘTO PUSTE WPISY - - - -

 

HKCU-Run-DriverCure - c:\program files\ParetoLogic\DriverCure\DriverCure.exe

 

 

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1978305

IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath -

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-20 19:03:46

Windows 5.1.2600 Dodatek Service Pack 3 NTFS

 

skanowanie ukrytych procesów ...

 

skanowanie ukrytych wpisów autostartu ...

 

skanowanie ukrytych plików ...

 

skanowanie pomyślnie ukończone

ukryte pliki: 0

 

**************************************************************************

.

--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

 

- - - - - - - > 'winlogon.exe'(220)

c:\windows\system32\Ati2evxx.dll

.

Czas ukończenia: 2009-03-20 19:05:19

ComboFix-quarantined-files.txt 2009-03-20 18:05:18

 

Przed: 100,950,843,392 bajtów wolnych

Po: 102,326,611,968 bajtów wolnych

 

257 --- E O F --- 2009-02-18 07:00:48

Dziekuje z gory za pomoc.

[Kolobos]

Podlacz zainfekowane nosniki i uzyj Flash Disinfector.

 

Wklej do notatnika:

REGEDIT4

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20cbcbde-13da-11de-bcd5-001e8c249050}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79dd048e-0892-11de-bca1-001e8c249050}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d658a6ea-0a89-11de-bcb0-001e8c249050}]

 

Zapisz jako fix.reg i uruchom.

 

Usun w hijackthis:

Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1978305

 

Odinstaluj pasek: Mininova-Vuze

 

Na koniec zablokuj dostep do klucza mountpoints2 w rejestrze.