Komputer Się Zawiesza Od Wczoraj.

toms83 · 1 Kwietnia 2009

Witam.

Proszę o sprawdzenie logów. Od wczoraj komputer się zawiesza, nawet kursor mychy przestaje się ruszać, klawa też nie reaguje ( CapsLock ).

Jedyne co wczoraj zrobiłem, to usunąłem jakiś pliczek "uninstall" z katalogu autostart. Pewnie jakiś syf i teraz robi problem.

Sprzęt przeskanowany AdAware, nic nie wykrył. Skanerem online Pandy - też nic szczególnego.

Za to Avast wykrył jakiegoś wirusa i trojana ale wszystko pousuwał ( siedziało w różnych .exe ale nic z systemowych ). No ale nie mogę dokończyć testu, bo się zawiesza w którymś momencie przy skanowaniu.

-

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - ComboFix

ComboFix 09-03-31.03 - Tomek 2009-04-01 17:37:07.3 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.3326.1666 [GMT 2:00]

Uruchomiony z: c:\documents and settings\Tomek\Pulpit\ComboFix.exe

AV: avast! antivirus 4.8.1335 [VPS 090331-0] *On-access scanning disabled* (Updated)

* Utworzono nowy punkt przywracania

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!

.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\pthreadGC2.dll

.

((((((((((((((((((((((((( Pliki utworzone od 2009-03-01 do 2009-04-01 )))))))))))))))))))))))))))))))

.

2009-03-27 12:52 . 2009-03-27 12:52 <DIR> d-------- c:\program files\NETPLUS

2009-03-10 10:39 . 2008-12-17 19:22 57,344 --a------ c:\windows\system32\ff_vfw.dll

2009-03-10 10:39 . 2008-12-11 13:27 547 --a------ c:\windows\system32\ff_vfw.dll.manifest

2009-03-10 00:02 . 2009-03-10 00:02 <DIR> d-------- c:\program files\CoreCodec

2009-03-08 12:56 . 2009-03-08 13:00 40 --a------ c:\windows\plugSpk.INI

2009-03-08 12:52 . 1999-01-21 18:31 2,259,070 --a------ c:\windows\system32\drivers\eapci2m.ecw

2009-03-08 12:52 . 2001-08-14 16:17 775,296 --a------ c:\windows\system32\drivers\emu10k1f.sys

2009-03-08 12:52 . 2000-05-11 01:00 90,112 --a------ c:\windows\Updreg.exe

2009-03-08 12:52 . 1998-10-14 17:03 59,392 --a------ c:\windows\system32\dllcache\a3d.dll

2009-03-08 12:52 . 1998-10-14 17:03 59,392 --a------ c:\windows\system32\a3d.dll

2009-03-08 12:52 . 1999-10-11 02:01 41,984 --a------ c:\windows\CTREGRUN.EXE

2009-03-08 12:52 . 2001-08-31 14:37 36,992 --a------ c:\windows\system32\drivers\sfman.sys

2009-03-08 12:52 . 2001-07-11 12:34 6,912 --a------ c:\windows\system32\drivers\ctlface.sys

2009-03-08 12:51 . 1998-02-25 03:00 2,259,067 --a------ c:\windows\system32\DEFAULT.ECW

2009-03-08 12:51 . 1998-01-08 01:00 1,048,576 --------- c:\windows\system32\sfman.dat

2009-03-08 12:51 . 1995-01-13 14:10 149,504 --------- c:\windows\system32\mfcans32.dll

2009-03-08 12:51 . 1995-01-13 14:10 108,032 --------- c:\windows\system32\mfcuia32.dll

2009-03-08 12:51 . 1998-06-05 02:00 84,992 --------- c:\windows\system32\sfcvrt32.dll

2009-03-08 12:51 . 1995-08-30 02:02 82,432 --------- c:\windows\system32\Ctwflt32.dll

2009-03-08 12:51 . 1994-12-05 03:11 53,552 --------- c:\windows\ctccw.dll

2009-03-08 12:51 . 1997-06-02 04:06 34,816 --------- c:\windows\CTRes32.dll

2009-03-08 12:51 . 1995-07-13 02:01 26,768 --------- c:\windows\system32\ctl3d.dll

2009-03-08 12:51 . 1996-05-23 02:24 24,976 --------- c:\windows\ctres.dll

2009-03-08 12:51 . 1999-01-14 14:04 231 --------- c:\windows\ac3api.ini

2009-03-08 12:50 . 1999-10-07 02:00 55,808 --a------ c:\windows\system32\CtMp3.Crl

2009-03-08 12:50 . 2009-03-08 12:51 128 --a------ c:\windows\SBWIN.INI

2009-03-08 12:49 . 2001-01-31 01:01 307,200 --------- c:\windows\system32\CtMp3Lib.dll

2009-03-08 12:49 . 2001-01-23 01:05 110,592 --------- c:\windows\system32\ctmp3io2.dll

2009-03-08 12:49 . 1998-10-20 16:05 54,784 --------- c:\windows\system32\Inetwh32.dll

2009-03-08 12:49 . 2000-05-30 01:00 12,288 --------- c:\windows\system32\CTNMSP.crl

2009-03-08 12:49 . 2000-11-20 01:00 6,656 --------- c:\windows\system32\CTMP3io2.crl

2009-03-08 12:49 . 2009-03-06 12:22 255 --a------ c:\windows\SYSTEM.I~I

2009-03-08 12:42 . 2009-03-08 12:42 <DIR> d-------- c:\windows\_ISTMP1.DIR

2009-03-01 10:58 . 2009-03-01 10:58 <DIR> d-------- c:\program files\Break For Games

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-16 18:49 43,520 ----a-w c:\windows\system32\CmdLineExt03.dll

2009-02-20 10:35 --------- d-----w c:\program files\coolpro2

2009-01-22 10:36 359,040 ----a-w c:\windows\system32\dllcache\tcpip.sys

2008-12-19 22:46 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll

2008-12-19 22:46 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll

2008-12-19 22:46 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll

2008-12-19 22:46 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll

2008-12-19 22:46 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll

.

------- Sigcheck -------

2009-01-22 12:36 359040 7b11118b078b88f87183fe69eda43137 c:\windows\system32\drivers\tcpip.sys

2009-01-22 12:36 359040 7b11118b078b88f87183fe69eda43137 c:\windows\system32\dllcache\tcpip.sys

2009-01-22 12:36 359040 7b11118b078b88f87183fe69eda43137 c:\windows\ServicePackFiles\i386\tcpip.sys

2001-08-18 06:24 327168 e7774698bb0d14b0710a9a31e209f9b6 c:\windows\$NtServicePackUninstall$\tcpip.sys

2004-08-04 00:44 57856 76ecad93a7320e45432cf07bb49c69a3 c:\windows\system32\spoolsv.exe

2004-08-04 00:44 57856 bebe8a85954ff460374fd5a0cd21e19b c:\windows\ServicePackFiles\i386\spoolsv.exe

2001-10-26 17:30 51200 414af353e9eeed8637d90370fd0c3b68 c:\windows\$NtServicePackUninstall$\spoolsv.exe

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]

"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]

"Komunikator"="c:\program files\Tlen.pl\tlen.exe" [2008-01-15 6290944]

"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CloneCDElbyCDFL"="c:\program files\Elaborate Bytes\CloneCD\ElbyCheck.exe" [2002-11-02 45056]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]

"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

"Resume copy"="copyfstq.exe" [2008-03-31 c:\windows\copyfstq.exe]

"nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.xvid"= xvid.dll

"aux"= ctwdm32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^uninstall.exe]

path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\uninstall.exe

backup=c:\windows\pss\uninstall.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Tomek^Menu Start^Programy^Autostart^HDDlife.lnk]

path=c:\documents and settings\Tomek\Menu Start\Programy\Autostart\HDDlife.lnk

backup=c:\windows\pss\HDDlife.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AHQInit]

--a------ 2001-05-10 17:49 102400 c:\program files\Creative\SBLive\Program\AHQInit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]

--a------ 2007-09-25 10:10 2007088 c:\program files\FlashGet\flashget.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]

--a------ 2008-03-20 12:04 2127296 c:\program files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

--a------ 2004-11-02 20:24 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2008-06-10 04:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]

--a------ 2000-05-11 01:00 90112 c:\windows\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\Tlen.pl\\tlen.exe"=

"c:\\Program Files\\eMule0.48a\\emule.exe"=

"c:\\Program Files\\FlashGet\\flashget.exe"=

"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\totalcmd\\TOTALCMD.EXE"=

R0 ElbyVCD;ElbyVCD;c:\windows\system32\drivers\ElbyVCD.sys [2002-11-02 21632]

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-07-10 28544]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-20 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-20 20560]

S1 TVicPort64;TVicPort64;\??\c:\windows\SysWOW64\drivers\TVicPort64.sys --> c:\windows\SysWOW64\drivers\TVicPort64.sys [?]

S3 RTCore;RTCore;\??\c:\documents and settings\Tomek\Pulpit\rmclock_13_bin_fix\RTCore.sys --> c:\documents and settings\Tomek\Pulpit\rmclock_13_bin_fix\RTCore.sys [?]

S4 WRamDisk;WRamDisk;\??\c:\windows\system32\DRIVERS\WRAMDISK.SYS --> c:\windows\system32\DRIVERS\WRAMDISK.SYS [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eda2131b-a35b-11dd-9e5a-000129a35784}]

\Shell\AutoRun\command - H:\NCDSTART.EXE

.

Zawartość folderu 'Zaplanowane zadania'

2009-03-30 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

.

- - - - USUNIĘTO PUSTE WPISY - - - -

MSConfigStartUp-Steam - w:\half life 2\\Steam.exe

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.wp.pl/

mStart Page = file://c:/windows/homepage.html

IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm

IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm

TCP: {5D96BCBB-D898-4E32-BBB3-3AF10A5F44B4} = 194.204.152.34,194.204.159.1

FF - ProfilePath - c:\documents and settings\Tomek\Dane aplikacji\Mozilla\Firefox\Profiles\xelltuj2.default\

FF - prefs.js: browser.startup.homepage - www.wp.pl

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-01 17:37:35

Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone

ukryte pliki: 0

**************************************************************************

.

Czas ukończenia: 2009-04-01 17:37:56

ComboFix-quarantined-files.txt 2009-04-01 15:37:56

Przed: 2 062 098 432 bajtów wolnych

Po: 2,405,310,464 bajtów wolnych

167

-

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:34:18, on 2009-04-01

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL

O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear

O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{5D96BCBB-D898-4E32-BBB3-3AF10A5F44B4}: NameServer = 194.204.152.34,194.204.159.1

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)

--

End of file - 6249 bytes

-

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - Silent Runners

"Silent Runners.vbs", revision 59, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:

---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]

"NVIDIA nTune" = ""C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear" ["NVIDIA"]

"Komunikator" = "C:\Program Files\Tlen.pl\tlen.exe" ["o2.pl Sp. z o.o."]

"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"CloneCDElbyCDFL" = ""C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL" ["Elaborate Bytes AG"]

"Resume copy" = "copyfstq.exe /startup" [null data]

"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]

"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]

"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]

"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]

"QuickTime Task" = ""C:\Program Files\QuickTime\QTTask.exe" -atboottime" ["Apple Inc."]

"DLA" = "C:\WINDOWS\System32\DLA\DLACTRLW.EXE" ["Sonic Solutions"]

"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)

-> {HKLM...CLSID} = "AcroIEHlprObj Class"

\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]

{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch"

-> {HKLM...CLSID} = "FGCatchUrl"

\InProcServer32\(Default) = "C:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"]

{5CA3D70E-1895-11CF-8E15-001234567890}\(Default) = (no title provided)

-> {HKLM...CLSID} = "DriveLetterAccess"

\InProcServer32\(Default) = "C:\WINDOWS\System32\DLA\DLASHX_W.DLL" ["Sonic Solutions"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

-> {HKLM...CLSID} = "SSVHelper Class"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]

{F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided)

-> {HKLM...CLSID} = "FlashGet GetFlash Class"

\InProcServer32\(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"

-> {HKLM...CLSID} = "HyperTerminal Icon Ext"

\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

"{0E6C58A9-F592-4862-B35F-CA45E24003B3}" = "CloneCD"

-> {HKLM...CLSID} = "CloneCD Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Elaborate Bytes\CloneCD\ElbyVCDShell.dll" ["Elaborate Bytes"]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"

-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"

\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]

"{A4D78B20-6E05-1069-8758-4E73FD83DEAD}" = "QCopy"

-> {HKLM...CLSID} = "QCopy"

\InProcServer32\(Default) = "dropcpyr.dll" [null data]

"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"

-> {HKLM...CLSID} = "DesktopContext Class"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"

-> {HKLM...CLSID} = "NVIDIA CPL Extension"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"

-> {HKLM...CLSID} = "Desktop Explorer"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"

-> {HKLM...CLSID} = "nView Desktop Context Menu"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess"

-> {HKLM...CLSID} = "DriveLetterAccess"

\InProcServer32\(Default) = "C:\WINDOWS\System32\DLA\DLASHX_W.DLL" ["Sonic Solutions"]

"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"

-> {HKLM...CLSID} = "avast"

\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\

<<!>> "BootExecute" = "autocheck autochk *"|"lsdelete" [null data]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\

avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"

-> {HKLM...CLSID} = "avast"

\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\

avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"

-> {HKLM...CLSID} = "avast"

\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Default executables:

--------------------

<<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile"

Group Policies {GPedit.msc branch and setting}:

-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoDrives" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoCDBurning" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

"NoDrives" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

"HideLogoffScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

"HideStartupScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

"RunLogonScriptSync" = (REG_DWORD) dword:0x00000001

{unrecognized setting}

"RunStartupScriptSync" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001

{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|

Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001

{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|

Devices: Allow undock without having to log on}

"DisableRegistryTools" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

"HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

"HideLogoffScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

"RunLogonScriptSync" = (REG_DWORD) dword:0x00000001

{unrecognized setting}

"RunStartupScriptSync" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

"HideStartupScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}

Active Desktop and Wallpaper:

-----------------------------

Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:

HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\Documents and Settings\Tomek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Windows Portable Device AutoPlay Handlers

-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

NeroAutoPlay2AudioToNeroDigital\

"Provider" = "Nero Burning ROM"