Hijack – mam Trojana i nie wiem co zrobić POMOCY !!!!
wykryłem Trojana, załączam log Hijack–a
Logfile of HijackThis v1.97.7
Scan saved at 14:01:46, on 2004–08–20
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSSystem32 vsvc32.exe
C:WINDOWSsystem32sdknn.exe
C:WINDOWS tsx.exe
C:WINDOWSSystem32wuauclt.exe
C:Program FilesPCI Audio ApplicationsMixer.exe
C:Program FilesJavaj2re1.4.2_03injusched.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesWinampWinampa.exe
C:WINDOWSsystem32d3bc32.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
C:Program FilesTlen.pl len.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesClockSyncSync.exe
C:Program FilesGadu–Gadugg.exe
C:WINDOWSSystem32fuaffci.exe
C:Documents and SettingskomputerekPulpitIEXPLORE.EXE
C:Program FilesWinampWinamp.exe
C: otalcmdTOTALCMD.EXE
c:HijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://www.008i.com/search.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = res://ctsii.dll/index.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = res://ctsii.dll/index.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = res://ctsii.dll/index.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://yoursearcher.com/index.htm
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = res://bdapy.dll/index.html#37049
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R1 – HKCUSoftwareMicrosoftInternet Explorer,SearchAssistant = http://www.008i.com/search.html
R1 – HKCUSoftwareMicrosoftInternet Explorer,CustomizeSearch = http://www.008i.com/search.html
O2 – BHO: (no name) – {4574EC09–FC66–92F0–4F9B–EE57CF1967DC} – C:WINDOWScrdt.dll
O2 – BHO: (no name) – {77915096–204D–E2F0–F041–8CEDC66033AE} – C:WINDOWSsystem32javafd32.dll
O2 – BHO: (no name) – {791E9324–130C–DB07–16B3–102D31B10114} – C:WINDOWSsystem32 twu32.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O3 – Toolbar: ISTbar – {5F1ABCDB–A875–46c1–8345–B72A4567E486} – C:Program FilesISTbaristbar.dll (file missing)
O4 – HKLM..Run: [C–Media Mixer] C:Program FilesPCI Audio ApplicationsMixer.exe /startup
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_03injusched.exe
O4 – HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" –atboottime
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 – HKLM..Run: [windows auto update] msblast.exe
O4 – HKLM..Run: [WinampAgent] "C:Program FilesWinampWinampa.exe"
O4 – HKLM..Run: [BearShare] "C:Program FilesBearShareBearShare.exe" /pause
O4 – HKLM..Run: [javawj.exe] C:WINDOWSsystem32javawj.exe
O4 – HKLM..Run: [IST Service] C:Program FilesISTsvcistsvc.exe
O4 – HKLM..Run: [pdvvoebruthvk] C:WINDOWSSystem32xghnrihp.exe
O4 – HKLM..Run: [d3bc32.exe] C:WINDOWSsystem32d3bc32.exe
O4 – HKLM..Run: [addhm32.exe] C:WINDOWSsystem32addhm32.exe
O4 – HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 – HKLM..Run: [ashMaiSv] C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
O4 – HKCU..Run: [Komunikator] C:Program FilesTlen.pl len.exe
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [IEengine] C:Program FilesInternet ExplorerIEeng.exe
O4 – HKCU..Run: [ClockSync] "C:Program FilesClockSyncSync.exe" /q
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [Lnbr] C:Documents and SettingskomputerekDane aplikacjiartl.exe
O4 – HKCU..Run: [Jrubuihu] C:WINDOWSSystem32fuaffci.exe
O4 – HKLM..RunOnce: [adday32.exe] C:WINDOWSsystem32adday32.exe
O4 – HKLM..RunOnce: [mfcpe.exe] C:WINDOWSsystem32mfcpe.exe
O4 – HKLM..RunOnce: [winnb32.exe] C:WINDOWSsystem32winnb32.exe
O4 – HKLM..RunOnce: [apias32.exe] C:WINDOWSapias32.exe
O4 – HKLM..RunOnce: [mfcef32.exe] C:WINDOWSsystem32mfcef32.exe
O4 – HKLM..RunOnce: [ntlk32.exe] C:WINDOWSsystem32 tlk32.exe
O4 – HKLM..RunOnce: [msxs.exe] C:WINDOWSsystem32msxs.exe
O4 – HKLM..RunOnce: [netsh.exe] C:WINDOWS etsh.exe
O4 – HKLM..RunOnce: [msxh.exe] C:WINDOWSmsxh.exe
O4 – HKLM..RunOnce: [sdkyb32.exe] C:WINDOWSsdkyb32.exe
O4 – HKLM..RunOnce: [mswn32.exe] C:WINDOWSsystem32mswn32.exe
O4 – HKLM..RunOnce: [mfcyr.exe] C:WINDOWSmfcyr.exe
O4 – HKLM..RunOnce: [sysxg32.exe] C:WINDOWSsystem32sysxg32.exe
O4 – HKLM..RunOnce: [javaoo.exe] C:WINDOWSjavaoo.exe
O4 – HKLM..RunOnce: [netje32.exe] C:WINDOWS etje32.exe
O4 – HKLM..RunOnce: [sdksq.exe] C:WINDOWSsdksq.exe
O4 – HKLM..RunOnce: [cror.exe] C:WINDOWScror.exe
O4 – HKLM..RunOnce: [addol.exe] C:WINDOWSaddol.exe
O4 – HKLM..RunOnce: [crre32.exe] C:WINDOWSsystem32crre32.exe
O4 – HKLM..RunOnce: [winwg32.exe] C:WINDOWSwinwg32.exe
O4 – HKLM..RunOnce: [ntda32.exe] C:WINDOWS tda32.exe
O4 – HKLM..RunOnce: [addrk.exe] C:WINDOWSsystem32addrk.exe
O4 – HKLM..RunOnce: [nter32.exe] C:WINDOWS ter32.exe
O4 – HKLM..RunOnce: [crma.exe] C:WINDOWSsystem32crma.exe
O4 – HKLM..RunOnce: [windx.exe] C:WINDOWSsystem32windx.exe
O4 – HKLM..RunOnce: [apija.exe] C:WINDOWSapija.exe
O4 – HKLM..RunOnce: [atllh.exe] C:WINDOWSatllh.exe
O4 – HKLM..RunOnce: [winpg32.exe] C:WINDOWSsystem32winpg32.exe
O4 – HKLM..RunOnce: [msil32.exe] C:WINDOWSsystem32msil32.exe
O4 – HKLM..RunOnce: [netuc.exe] C:WINDOWS etuc.exe
O4 – HKLM..RunOnce: [mswj.exe] C:WINDOWSsystem32mswj.exe
O4 – HKLM..RunOnce: [appfl.exe] C:WINDOWSsystem32appfl.exe
O4 – HKLM..RunOnce: [netbj32.exe] C:WINDOWS etbj32.exe
O4 – HKLM..RunOnce: [apiqo.exe] C:WINDOWSapiqo.exe
O4 – HKLM..RunOnce: [javauq.exe] C:WINDOWSjavauq.exe
O4 – HKLM..RunOnce: [d3gm32.exe] C:WINDOWSsystem32d3gm32.exe
O4 – HKLM..RunOnce: [javazo.exe] C:WINDOWSjavazo.exe
O4 – HKLM..RunOnce: [sdkso.exe] C:WINDOWSsdkso.exe
O4 – HKLM..RunOnce: [crhy.exe] C:WINDOWScrhy.exe
O4 – HKLM..RunOnce: [javanm32.exe] C:WINDOWSsystem32javanm32.exe
O4 – HKLM..RunOnce: [msvs.exe] C:WINDOWSmsvs.exe
O4 – HKLM..RunOnce: [mskk32.exe] C:WINDOWSsystem32mskk32.exe
O4 – HKLM..RunOnce: [addrw32.exe] C:WINDOWSaddrw32.exe
O4 – HKLM..RunOnce: [addpm.exe] C:WINDOWSaddpm.exe
O4 – HKLM..RunOnce: [addpo.exe] C:WINDOWSaddpo.exe
O4 – HKLM..RunOnce: [ipoy.exe] C:WINDOWSipoy.exe
O4 – HKLM..RunOnce: [ntpb32.exe] C:WINDOWSsystem32 tpb32.exe
O4 – HKLM..RunOnce: [msnh.exe] C:WINDOWSmsnh.exe
O4 – HKLM..RunOnce: [javaoh.exe] C:WINDOWSjavaoh.exe
O4 – HKLM..RunOnce: [apino.exe] C:WINDOWSapino.exe
O4 – HKLM..RunOnce: [sdktr.exe] C:WINDOWSsystem32sdktr.exe
O4 – HKLM..RunOnce: [netge.exe] C:WINDOWS etge.exe
O4 – HKLM..RunOnce: [ntvc32.exe] C:WINDOWSsystem32 tvc32.exe
O4 – HKLM..RunOnce: [d3nn32.exe] C:WINDOWSsystem32d3nn32.exe
O4 – HKLM..RunOnce: [mfcix.exe] C:WINDOWSmfcix.exe
O4 – HKLM..RunOnce: [appjx32.exe] C:WINDOWSappjx32.exe
O4 – HKLM..RunOnce: [ipsg.exe] C:WINDOWSsystem32ipsg.exe
O4 – HKLM..RunOnce: [netri32.exe] C:WINDOWSsystem32 etri32.exe
O4 – HKLM..RunOnce: [atlwn32.exe] C:WINDOWSsystem32atlwn32.exe
O4 – HKLM..RunOnce: [ieag.exe] C:WINDOWSieag.exe
O4 – HKLM..RunOnce: [javacj32.exe] C:WINDOWSsystem32javacj32.exe
O4 – HKLM..RunOnce: [appws32.exe] C:WINDOWSappws32.exe
O4 – HKLM..RunOnce: [ievd.exe] C:WINDOWSsystem32ievd.exe
O4 – HKLM..RunOnce: [mssi.exe] C:WINDOWSmssi.exe
O4 – HKLM..RunOnce: [msvq.exe] C:WINDOWSsystem32msvq.exe
O4 – HKLM..RunOnce: [mfcup.exe] C:WINDOWSmfcup.exe
O4 – HKLM..RunOnce: [netyp.exe] C:WINDOWS etyp.exe
O4 – HKLM..RunOnce: [adddt.exe] C:WINDOWSadddt.exe
O4 – HKLM..RunOnce: [addhh32.exe] C:WINDOWSsystem32addhh32.exe
O4 – HKLM..RunOnce: [nethl32.exe] C:WINDOWS ethl32.exe
O4 – HKLM..RunOnce: [sysrs.exe] C:WINDOWSsystem32sysrs.exe
O4 – HKLM..RunOnce: [crtm.exe] C:WINDOWScrtm.exe
O4 – HKLM..RunOnce: [sdkza32.exe] C:WINDOWSsystem32sdkza32.exe
O4 – HKLM..RunOnce: [crnx32.exe] C:WINDOWScrnx32.exe
O4 – HKLM..RunOnce: [netwe32.exe] C:WINDOWS etwe32.exe
O4 – HKLM..RunOnce: [sdkgr.exe] C:WINDOWSsdkgr.exe
O4 – HKLM..RunOnce: [netyq.exe] C:WINDOWSsystem32 etyq.exe
O4 – HKLM..RunOnce: [syswr.exe] C:WINDOWSsyswr.exe
O4 – HKLM..RunOnce: [sysyu32.exe] C:WINDOWSsysyu32.exe
O4 – HKLM..RunOnce: [winwv.exe] C:WINDOWSwinwv.exe
O4 – HKLM..RunOnce: [apptg32.exe] C:WINDOWSapptg32.exe
O4 – HKLM..RunOnce: [netvp.exe] C:WINDOWS etvp.exe
O4 – HKLM..RunOnce: [d3kz.exe] C:WINDOWSsystem32d3kz.exe
O4 – HKLM..RunOnce: [appwz.exe] C:WINDOWSappwz.exe
O4 – HKLM..RunOnce: [ieib32.exe] C:WINDOWSieib32.exe
O4 – HKLM..RunOnce: [sdkbs32.exe] C:WINDOWSsystem32sdkbs32.exe
O4 – HKLM..RunOnce: [netaq.exe] C:WINDOWS etaq.exe
O4 – HKLM..RunOnce: [crko32.exe] C:WINDOWSsystem32crko32.exe
O4 – HKLM..RunOnce: [iegm.exe] C:WINDOWSiegm.exe
O4 – HKLM..RunOnce: [apixk32.exe] C:WINDOWSsystem32apixk32.exe
O4 – HKLM..RunOnce: [crjm32.exe] C:WINDOWSsystem32crjm32.exe
O4 – HKLM..RunOnce: [ieeo32.exe] C:WINDOWSieeo32.exe
O4 – HKLM..RunOnce: [atlvn32.exe] C:WINDOWSatlvn32.exe
O4 – HKLM..RunOnce: [addqn32.exe] C:WINDOWSaddqn32.exe
O4 – HKLM..RunOnce: [mfcsm.exe] C:WINDOWSmfcsm.exe
O4 – HKLM..RunOnce: [d3zh.exe] C:WINDOWSd3zh.exe
O4 – HKLM..RunOnce: [netgj32.exe] C:WINDOWSsystem32 etgj32.exe
O4 – HKLM..RunOnce: [javauc32.exe] C:WINDOWSjavauc32.exe
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 – Extra context menu item: &iSearch The Web – res://C:WINDOWSSystem32 oolbar.dll/SEARCH.HTML
O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 – Extra button: SideFind (HKLM)
O13 – DefaultPrefix: http://www.microsoit.com/direct.php?url=
O13 – WWW Prefix: http://www.microsoit.com/direct.php?url=
O16 – DPF: {10000000–1000–0000–1000–000000000000} – ms–its:mhtml:file://C:MAIN.MHT!http://d.dialer2004.com//paxan/main.chm::/load.exe
O16 – DPF: {11010101–1001–1111–1000–110164567732} – ms–its:mhtml:file://C:MAIN.MHT!http://www.008i.com//x//f//10213//inst.chm::/f10213.exe
O16 – DPF: {12398DD6–40AA–4C40–A4EC–A42CFC0DE797} (Installer Class) – http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 – DPF: {1C78AB3F–A857–482E–80C0–3A1E5238A565} – file://C:install.cab
O16 – DPF: {386A771C–E96A–421F–8BA7–32F1B706892F} (Installer Class) – http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 – DPF: {5F874A6F–8B34–433D–BA4B–47AC91C0567F} (MailCfg Control) – https://poczta.wp.pl/autoryzacja/mailcfg2.ocx
O16 – DPF: {9EB320CE–BE1D–4304–A081–4B4665414BEF} (MediaTicketsInstaller Control) – http://www.mt–download.com/MediaTicketsInstaller.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Pomóźcie :( :( :(
Logfile of HijackThis v1.97.7
Scan saved at 14:01:46, on 2004–08–20
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSSystem32 vsvc32.exe
C:WINDOWSsystem32sdknn.exe
C:WINDOWS tsx.exe
C:WINDOWSSystem32wuauclt.exe
C:Program FilesPCI Audio ApplicationsMixer.exe
C:Program FilesJavaj2re1.4.2_03injusched.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesWinampWinampa.exe
C:WINDOWSsystem32d3bc32.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
C:Program FilesTlen.pl len.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesClockSyncSync.exe
C:Program FilesGadu–Gadugg.exe
C:WINDOWSSystem32fuaffci.exe
C:Documents and SettingskomputerekPulpitIEXPLORE.EXE
C:Program FilesWinampWinamp.exe
C: otalcmdTOTALCMD.EXE
c:HijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://www.008i.com/search.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = res://ctsii.dll/index.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = res://ctsii.dll/index.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = res://ctsii.dll/index.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://yoursearcher.com/index.htm
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = res://bdapy.dll/index.html#37049
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R1 – HKCUSoftwareMicrosoftInternet Explorer,SearchAssistant = http://www.008i.com/search.html
R1 – HKCUSoftwareMicrosoftInternet Explorer,CustomizeSearch = http://www.008i.com/search.html
O2 – BHO: (no name) – {4574EC09–FC66–92F0–4F9B–EE57CF1967DC} – C:WINDOWScrdt.dll
O2 – BHO: (no name) – {77915096–204D–E2F0–F041–8CEDC66033AE} – C:WINDOWSsystem32javafd32.dll
O2 – BHO: (no name) – {791E9324–130C–DB07–16B3–102D31B10114} – C:WINDOWSsystem32 twu32.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O3 – Toolbar: ISTbar – {5F1ABCDB–A875–46c1–8345–B72A4567E486} – C:Program FilesISTbaristbar.dll (file missing)
O4 – HKLM..Run: [C–Media Mixer] C:Program FilesPCI Audio ApplicationsMixer.exe /startup
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_03injusched.exe
O4 – HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" –atboottime
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 – HKLM..Run: [windows auto update] msblast.exe
O4 – HKLM..Run: [WinampAgent] "C:Program FilesWinampWinampa.exe"
O4 – HKLM..Run: [BearShare] "C:Program FilesBearShareBearShare.exe" /pause
O4 – HKLM..Run: [javawj.exe] C:WINDOWSsystem32javawj.exe
O4 – HKLM..Run: [IST Service] C:Program FilesISTsvcistsvc.exe
O4 – HKLM..Run: [pdvvoebruthvk] C:WINDOWSSystem32xghnrihp.exe
O4 – HKLM..Run: [d3bc32.exe] C:WINDOWSsystem32d3bc32.exe
O4 – HKLM..Run: [addhm32.exe] C:WINDOWSsystem32addhm32.exe
O4 – HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 – HKLM..Run: [ashMaiSv] C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
O4 – HKCU..Run: [Komunikator] C:Program FilesTlen.pl len.exe
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [IEengine] C:Program FilesInternet ExplorerIEeng.exe
O4 – HKCU..Run: [ClockSync] "C:Program FilesClockSyncSync.exe" /q
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [Lnbr] C:Documents and SettingskomputerekDane aplikacjiartl.exe
O4 – HKCU..Run: [Jrubuihu] C:WINDOWSSystem32fuaffci.exe
O4 – HKLM..RunOnce: [adday32.exe] C:WINDOWSsystem32adday32.exe
O4 – HKLM..RunOnce: [mfcpe.exe] C:WINDOWSsystem32mfcpe.exe
O4 – HKLM..RunOnce: [winnb32.exe] C:WINDOWSsystem32winnb32.exe
O4 – HKLM..RunOnce: [apias32.exe] C:WINDOWSapias32.exe
O4 – HKLM..RunOnce: [mfcef32.exe] C:WINDOWSsystem32mfcef32.exe
O4 – HKLM..RunOnce: [ntlk32.exe] C:WINDOWSsystem32 tlk32.exe
O4 – HKLM..RunOnce: [msxs.exe] C:WINDOWSsystem32msxs.exe
O4 – HKLM..RunOnce: [netsh.exe] C:WINDOWS etsh.exe
O4 – HKLM..RunOnce: [msxh.exe] C:WINDOWSmsxh.exe
O4 – HKLM..RunOnce: [sdkyb32.exe] C:WINDOWSsdkyb32.exe
O4 – HKLM..RunOnce: [mswn32.exe] C:WINDOWSsystem32mswn32.exe
O4 – HKLM..RunOnce: [mfcyr.exe] C:WINDOWSmfcyr.exe
O4 – HKLM..RunOnce: [sysxg32.exe] C:WINDOWSsystem32sysxg32.exe
O4 – HKLM..RunOnce: [javaoo.exe] C:WINDOWSjavaoo.exe
O4 – HKLM..RunOnce: [netje32.exe] C:WINDOWS etje32.exe
O4 – HKLM..RunOnce: [sdksq.exe] C:WINDOWSsdksq.exe
O4 – HKLM..RunOnce: [cror.exe] C:WINDOWScror.exe
O4 – HKLM..RunOnce: [addol.exe] C:WINDOWSaddol.exe
O4 – HKLM..RunOnce: [crre32.exe] C:WINDOWSsystem32crre32.exe
O4 – HKLM..RunOnce: [winwg32.exe] C:WINDOWSwinwg32.exe
O4 – HKLM..RunOnce: [ntda32.exe] C:WINDOWS tda32.exe
O4 – HKLM..RunOnce: [addrk.exe] C:WINDOWSsystem32addrk.exe
O4 – HKLM..RunOnce: [nter32.exe] C:WINDOWS ter32.exe
O4 – HKLM..RunOnce: [crma.exe] C:WINDOWSsystem32crma.exe
O4 – HKLM..RunOnce: [windx.exe] C:WINDOWSsystem32windx.exe
O4 – HKLM..RunOnce: [apija.exe] C:WINDOWSapija.exe
O4 – HKLM..RunOnce: [atllh.exe] C:WINDOWSatllh.exe
O4 – HKLM..RunOnce: [winpg32.exe] C:WINDOWSsystem32winpg32.exe
O4 – HKLM..RunOnce: [msil32.exe] C:WINDOWSsystem32msil32.exe
O4 – HKLM..RunOnce: [netuc.exe] C:WINDOWS etuc.exe
O4 – HKLM..RunOnce: [mswj.exe] C:WINDOWSsystem32mswj.exe
O4 – HKLM..RunOnce: [appfl.exe] C:WINDOWSsystem32appfl.exe
O4 – HKLM..RunOnce: [netbj32.exe] C:WINDOWS etbj32.exe
O4 – HKLM..RunOnce: [apiqo.exe] C:WINDOWSapiqo.exe
O4 – HKLM..RunOnce: [javauq.exe] C:WINDOWSjavauq.exe
O4 – HKLM..RunOnce: [d3gm32.exe] C:WINDOWSsystem32d3gm32.exe
O4 – HKLM..RunOnce: [javazo.exe] C:WINDOWSjavazo.exe
O4 – HKLM..RunOnce: [sdkso.exe] C:WINDOWSsdkso.exe
O4 – HKLM..RunOnce: [crhy.exe] C:WINDOWScrhy.exe
O4 – HKLM..RunOnce: [javanm32.exe] C:WINDOWSsystem32javanm32.exe
O4 – HKLM..RunOnce: [msvs.exe] C:WINDOWSmsvs.exe
O4 – HKLM..RunOnce: [mskk32.exe] C:WINDOWSsystem32mskk32.exe
O4 – HKLM..RunOnce: [addrw32.exe] C:WINDOWSaddrw32.exe
O4 – HKLM..RunOnce: [addpm.exe] C:WINDOWSaddpm.exe
O4 – HKLM..RunOnce: [addpo.exe] C:WINDOWSaddpo.exe
O4 – HKLM..RunOnce: [ipoy.exe] C:WINDOWSipoy.exe
O4 – HKLM..RunOnce: [ntpb32.exe] C:WINDOWSsystem32 tpb32.exe
O4 – HKLM..RunOnce: [msnh.exe] C:WINDOWSmsnh.exe
O4 – HKLM..RunOnce: [javaoh.exe] C:WINDOWSjavaoh.exe
O4 – HKLM..RunOnce: [apino.exe] C:WINDOWSapino.exe
O4 – HKLM..RunOnce: [sdktr.exe] C:WINDOWSsystem32sdktr.exe
O4 – HKLM..RunOnce: [netge.exe] C:WINDOWS etge.exe
O4 – HKLM..RunOnce: [ntvc32.exe] C:WINDOWSsystem32 tvc32.exe
O4 – HKLM..RunOnce: [d3nn32.exe] C:WINDOWSsystem32d3nn32.exe
O4 – HKLM..RunOnce: [mfcix.exe] C:WINDOWSmfcix.exe
O4 – HKLM..RunOnce: [appjx32.exe] C:WINDOWSappjx32.exe
O4 – HKLM..RunOnce: [ipsg.exe] C:WINDOWSsystem32ipsg.exe
O4 – HKLM..RunOnce: [netri32.exe] C:WINDOWSsystem32 etri32.exe
O4 – HKLM..RunOnce: [atlwn32.exe] C:WINDOWSsystem32atlwn32.exe
O4 – HKLM..RunOnce: [ieag.exe] C:WINDOWSieag.exe
O4 – HKLM..RunOnce: [javacj32.exe] C:WINDOWSsystem32javacj32.exe
O4 – HKLM..RunOnce: [appws32.exe] C:WINDOWSappws32.exe
O4 – HKLM..RunOnce: [ievd.exe] C:WINDOWSsystem32ievd.exe
O4 – HKLM..RunOnce: [mssi.exe] C:WINDOWSmssi.exe
O4 – HKLM..RunOnce: [msvq.exe] C:WINDOWSsystem32msvq.exe
O4 – HKLM..RunOnce: [mfcup.exe] C:WINDOWSmfcup.exe
O4 – HKLM..RunOnce: [netyp.exe] C:WINDOWS etyp.exe
O4 – HKLM..RunOnce: [adddt.exe] C:WINDOWSadddt.exe
O4 – HKLM..RunOnce: [addhh32.exe] C:WINDOWSsystem32addhh32.exe
O4 – HKLM..RunOnce: [nethl32.exe] C:WINDOWS ethl32.exe
O4 – HKLM..RunOnce: [sysrs.exe] C:WINDOWSsystem32sysrs.exe
O4 – HKLM..RunOnce: [crtm.exe] C:WINDOWScrtm.exe
O4 – HKLM..RunOnce: [sdkza32.exe] C:WINDOWSsystem32sdkza32.exe
O4 – HKLM..RunOnce: [crnx32.exe] C:WINDOWScrnx32.exe
O4 – HKLM..RunOnce: [netwe32.exe] C:WINDOWS etwe32.exe
O4 – HKLM..RunOnce: [sdkgr.exe] C:WINDOWSsdkgr.exe
O4 – HKLM..RunOnce: [netyq.exe] C:WINDOWSsystem32 etyq.exe
O4 – HKLM..RunOnce: [syswr.exe] C:WINDOWSsyswr.exe
O4 – HKLM..RunOnce: [sysyu32.exe] C:WINDOWSsysyu32.exe
O4 – HKLM..RunOnce: [winwv.exe] C:WINDOWSwinwv.exe
O4 – HKLM..RunOnce: [apptg32.exe] C:WINDOWSapptg32.exe
O4 – HKLM..RunOnce: [netvp.exe] C:WINDOWS etvp.exe
O4 – HKLM..RunOnce: [d3kz.exe] C:WINDOWSsystem32d3kz.exe
O4 – HKLM..RunOnce: [appwz.exe] C:WINDOWSappwz.exe
O4 – HKLM..RunOnce: [ieib32.exe] C:WINDOWSieib32.exe
O4 – HKLM..RunOnce: [sdkbs32.exe] C:WINDOWSsystem32sdkbs32.exe
O4 – HKLM..RunOnce: [netaq.exe] C:WINDOWS etaq.exe
O4 – HKLM..RunOnce: [crko32.exe] C:WINDOWSsystem32crko32.exe
O4 – HKLM..RunOnce: [iegm.exe] C:WINDOWSiegm.exe
O4 – HKLM..RunOnce: [apixk32.exe] C:WINDOWSsystem32apixk32.exe
O4 – HKLM..RunOnce: [crjm32.exe] C:WINDOWSsystem32crjm32.exe
O4 – HKLM..RunOnce: [ieeo32.exe] C:WINDOWSieeo32.exe
O4 – HKLM..RunOnce: [atlvn32.exe] C:WINDOWSatlvn32.exe
O4 – HKLM..RunOnce: [addqn32.exe] C:WINDOWSaddqn32.exe
O4 – HKLM..RunOnce: [mfcsm.exe] C:WINDOWSmfcsm.exe
O4 – HKLM..RunOnce: [d3zh.exe] C:WINDOWSd3zh.exe
O4 – HKLM..RunOnce: [netgj32.exe] C:WINDOWSsystem32 etgj32.exe
O4 – HKLM..RunOnce: [javauc32.exe] C:WINDOWSjavauc32.exe
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 – Extra context menu item: &iSearch The Web – res://C:WINDOWSSystem32 oolbar.dll/SEARCH.HTML
O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 – Extra button: SideFind (HKLM)
O13 – DefaultPrefix: http://www.microsoit.com/direct.php?url=
O13 – WWW Prefix: http://www.microsoit.com/direct.php?url=
O16 – DPF: {10000000–1000–0000–1000–000000000000} – ms–its:mhtml:file://C:MAIN.MHT!http://d.dialer2004.com//paxan/main.chm::/load.exe
O16 – DPF: {11010101–1001–1111–1000–110164567732} – ms–its:mhtml:file://C:MAIN.MHT!http://www.008i.com//x//f//10213//inst.chm::/f10213.exe
O16 – DPF: {12398DD6–40AA–4C40–A4EC–A42CFC0DE797} (Installer Class) – http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 – DPF: {1C78AB3F–A857–482E–80C0–3A1E5238A565} – file://C:install.cab
O16 – DPF: {386A771C–E96A–421F–8BA7–32F1B706892F} (Installer Class) – http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 – DPF: {5F874A6F–8B34–433D–BA4B–47AC91C0567F} (MailCfg Control) – https://poczta.wp.pl/autoryzacja/mailcfg2.ocx
O16 – DPF: {9EB320CE–BE1D–4304–A081–4B4665414BEF} (MediaTicketsInstaller Control) – http://www.mt–download.com/MediaTicketsInstaller.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Pomóźcie :( :( :(
Odpowiedzi: 2
Zmieniłem login, ten mi bardziej pasuje. Co do stwierdzenia, źe komputer jest zasyfiały całkowicie się zgadzam. Nie jest on moją własnościa, staram się tylko pomóc właścicielowi. Przede wszystkim poradzę mu uwaźać podczas serfowania po stronach xxx, oraz uźywania Kazza, E–mule i innych tego typu wynalazków. Serdeczne dzięki za pomoc. Mam nadzieję, źe się uda. W najgorszym razie format c: :lol:
Skoro wykryles to go usun. Jaki masz problem ? Poza tym jest chyba dzial ktory nazywa sie "Bezpieczenstwo" ?
Dlaczego iexplorer jest na pulpicie ? Dlaczego w Program files masz ieeng.exe ? Co to jest artl.exe ? Uzywasz BearShare do P2P ? Ale syf.
C:Documents and SettingskomputerekPulpitIEXPLORE.EXE
O4 – HKCU..Run: [IEengine] C:Program FilesInternet ExplorerIEeng.exe
O4 – HKCU..Run: [Lnbr] C:Documents and SettingskomputerekDane aplikacjiartl.exe
BearShare.exe
Reszte usuwaj:
Dlaczego iexplorer jest na pulpicie ? Dlaczego w Program files masz ieeng.exe ? Co to jest artl.exe ? Uzywasz BearShare do P2P ? Ale syf.
C:Documents and SettingskomputerekPulpitIEXPLORE.EXE
O4 – HKCU..Run: [IEengine] C:Program FilesInternet ExplorerIEeng.exe
O4 – HKCU..Run: [Lnbr] C:Documents and SettingskomputerekDane aplikacjiartl.exe
BearShare.exe
Reszte usuwaj:
C:WINDOWSsystem32sdknn.exe
C:WINDOWS tsx.exe
C:WINDOWSsystem32d3bc32.exe
C:WINDOWSSystem32fuaffci.exe
R1 – HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://www.008i.com/search.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = res://ctsii.dll/index.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = res://ctsii.dll/index.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = res://ctsii.dll/index.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32ctsii.dll/sp.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://yoursearcher.com/index.htm
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = res://bdapy.dll/index.html#37049
R1 – HKCUSoftwareMicrosoftInternet Explorer,SearchAssistant = http://www.008i.com/search.html
R1 – HKCUSoftwareMicrosoftInternet Explorer,CustomizeSearch = http://www.008i.com/search.html
O2 – BHO: (no name) – {4574EC09–FC66–92F0–4F9B–EE57CF1967DC} – C:WINDOWScrdt.dll
O2 – BHO: (no name) – {77915096–204D–E2F0–F041–8CEDC66033AE} – C:WINDOWSsystem32javafd32.dll
O2 – BHO: (no name) – {791E9324–130C–DB07–16B3–102D31B10114} – C:WINDOWSsystem32 twu32.dll
O3 – Toolbar: ISTbar – {5F1ABCDB–A875–46c1–8345–B72A4567E486} – C:Program FilesISTbaristbar.dll (file missing)
O4 – HKLM..Run: [windows auto update] msblast.exe
O4 – HKLM..Run: [javawj.exe] C:WINDOWSsystem32javawj.exe
O4 – HKLM..Run: [IST Service] C:Program FilesISTsvcistsvc.exe
O4 – HKLM..Run: [pdvvoebruthvk] C:WINDOWSSystem32xghnrihp.exe
O4 – HKLM..Run: [d3bc32.exe] C:WINDOWSsystem32d3bc32.exe
O4 – HKLM..Run: [addhm32.exe] C:WINDOWSsystem32addhm32.exe
O4 – HKCU..Run: [Jrubuihu] C:WINDOWSSystem32fuaffci.exe
O4 – HKLM..RunOnce: [adday32.exe] C:WINDOWSsystem32adday32.exe
O4 – HKLM..RunOnce: [mfcpe.exe] C:WINDOWSsystem32mfcpe.exe
O4 – HKLM..RunOnce: [winnb32.exe] C:WINDOWSsystem32winnb32.exe
O4 – HKLM..RunOnce: [apias32.exe] C:WINDOWSapias32.exe
O4 – HKLM..RunOnce: [mfcef32.exe] C:WINDOWSsystem32mfcef32.exe
O4 – HKLM..RunOnce: [ntlk32.exe] C:WINDOWSsystem32 tlk32.exe
O4 – HKLM..RunOnce: [msxs.exe] C:WINDOWSsystem32msxs.exe
O4 – HKLM..RunOnce: [netsh.exe] C:WINDOWS etsh.exe
O4 – HKLM..RunOnce: [msxh.exe] C:WINDOWSmsxh.exe
O4 – HKLM..RunOnce: [sdkyb32.exe] C:WINDOWSsdkyb32.exe
O4 – HKLM..RunOnce: [mswn32.exe] C:WINDOWSsystem32mswn32.exe
O4 – HKLM..RunOnce: [mfcyr.exe] C:WINDOWSmfcyr.exe
O4 – HKLM..RunOnce: [sysxg32.exe] C:WINDOWSsystem32sysxg32.exe
O4 – HKLM..RunOnce: [javaoo.exe] C:WINDOWSjavaoo.exe
O4 – HKLM..RunOnce: [netje32.exe] C:WINDOWS etje32.exe
O4 – HKLM..RunOnce: [sdksq.exe] C:WINDOWSsdksq.exe
O4 – HKLM..RunOnce: [cror.exe] C:WINDOWScror.exe
O4 – HKLM..RunOnce: [addol.exe] C:WINDOWSaddol.exe
O4 – HKLM..RunOnce: [crre32.exe] C:WINDOWSsystem32crre32.exe
O4 – HKLM..RunOnce: [winwg32.exe] C:WINDOWSwinwg32.exe
O4 – HKLM..RunOnce: [ntda32.exe] C:WINDOWS tda32.exe
O4 – HKLM..RunOnce: [addrk.exe] C:WINDOWSsystem32addrk.exe
O4 – HKLM..RunOnce: [nter32.exe] C:WINDOWS ter32.exe
O4 – HKLM..RunOnce: [crma.exe] C:WINDOWSsystem32crma.exe
O4 – HKLM..RunOnce: [windx.exe] C:WINDOWSsystem32windx.exe
O4 – HKLM..RunOnce: [apija.exe] C:WINDOWSapija.exe
O4 – HKLM..RunOnce: [atllh.exe] C:WINDOWSatllh.exe
O4 – HKLM..RunOnce: [winpg32.exe] C:WINDOWSsystem32winpg32.exe
O4 – HKLM..RunOnce: [msil32.exe] C:WINDOWSsystem32msil32.exe
O4 – HKLM..RunOnce: [netuc.exe] C:WINDOWS etuc.exe
O4 – HKLM..RunOnce: [mswj.exe] C:WINDOWSsystem32mswj.exe
O4 – HKLM..RunOnce: [appfl.exe] C:WINDOWSsystem32appfl.exe
O4 – HKLM..RunOnce: [netbj32.exe] C:WINDOWS etbj32.exe
O4 – HKLM..RunOnce: [apiqo.exe] C:WINDOWSapiqo.exe
O4 – HKLM..RunOnce: [javauq.exe] C:WINDOWSjavauq.exe
O4 – HKLM..RunOnce: [d3gm32.exe] C:WINDOWSsystem32d3gm32.exe
O4 – HKLM..RunOnce: [javazo.exe] C:WINDOWSjavazo.exe
O4 – HKLM..RunOnce: [sdkso.exe] C:WINDOWSsdkso.exe
O4 – HKLM..RunOnce: [crhy.exe] C:WINDOWScrhy.exe
O4 – HKLM..RunOnce: [javanm32.exe] C:WINDOWSsystem32javanm32.exe
O4 – HKLM..RunOnce: [msvs.exe] C:WINDOWSmsvs.exe
O4 – HKLM..RunOnce: [mskk32.exe] C:WINDOWSsystem32mskk32.exe
O4 – HKLM..RunOnce: [addrw32.exe] C:WINDOWSaddrw32.exe
O4 – HKLM..RunOnce: [addpm.exe] C:WINDOWSaddpm.exe
O4 – HKLM..RunOnce: [addpo.exe] C:WINDOWSaddpo.exe
O4 – HKLM..RunOnce: [ipoy.exe] C:WINDOWSipoy.exe
O4 – HKLM..RunOnce: [ntpb32.exe] C:WINDOWSsystem32 tpb32.exe
O4 – HKLM..RunOnce: [msnh.exe] C:WINDOWSmsnh.exe
O4 – HKLM..RunOnce: [javaoh.exe] C:WINDOWSjavaoh.exe
O4 – HKLM..RunOnce: [apino.exe] C:WINDOWSapino.exe
O4 – HKLM..RunOnce: [sdktr.exe] C:WINDOWSsystem32sdktr.exe
O4 – HKLM..RunOnce: [netge.exe] C:WINDOWS etge.exe
O4 – HKLM..RunOnce: [ntvc32.exe] C:WINDOWSsystem32 tvc32.exe
O4 – HKLM..RunOnce: [d3nn32.exe] C:WINDOWSsystem32d3nn32.exe
O4 – HKLM..RunOnce: [mfcix.exe] C:WINDOWSmfcix.exe
O4 – HKLM..RunOnce: [appjx32.exe] C:WINDOWSappjx32.exe
O4 – HKLM..RunOnce: [ipsg.exe] C:WINDOWSsystem32ipsg.exe
O4 – HKLM..RunOnce: [netri32.exe] C:WINDOWSsystem32 etri32.exe
O4 – HKLM..RunOnce: [atlwn32.exe] C:WINDOWSsystem32atlwn32.exe
O4 – HKLM..RunOnce: [ieag.exe] C:WINDOWSieag.exe
O4 – HKLM..RunOnce: [javacj32.exe] C:WINDOWSsystem32javacj32.exe
O4 – HKLM..RunOnce: [appws32.exe] C:WINDOWSappws32.exe
O4 – HKLM..RunOnce: [ievd.exe] C:WINDOWSsystem32ievd.exe
O4 – HKLM..RunOnce: [mssi.exe] C:WINDOWSmssi.exe
O4 – HKLM..RunOnce: [msvq.exe] C:WINDOWSsystem32msvq.exe
O4 – HKLM..RunOnce: [mfcup.exe] C:WINDOWSmfcup.exe
O4 – HKLM..RunOnce: [netyp.exe] C:WINDOWS etyp.exe
O4 – HKLM..RunOnce: [adddt.exe] C:WINDOWSadddt.exe
O4 – HKLM..RunOnce: [addhh32.exe] C:WINDOWSsystem32addhh32.exe
O4 – HKLM..RunOnce: [nethl32.exe] C:WINDOWS ethl32.exe
O4 – HKLM..RunOnce: [sysrs.exe] C:WINDOWSsystem32sysrs.exe
O4 – HKLM..RunOnce: [crtm.exe] C:WINDOWScrtm.exe
O4 – HKLM..RunOnce: [sdkza32.exe] C:WINDOWSsystem32sdkza32.exe
O4 – HKLM..RunOnce: [crnx32.exe] C:WINDOWScrnx32.exe
O4 – HKLM..RunOnce: [netwe32.exe] C:WINDOWS etwe32.exe
O4 – HKLM..RunOnce: [sdkgr.exe] C:WINDOWSsdkgr.exe
O4 – HKLM..RunOnce: [netyq.exe] C:WINDOWSsystem32 etyq.exe
O4 – HKLM..RunOnce: [syswr.exe] C:WINDOWSsyswr.exe
O4 – HKLM..RunOnce: [sysyu32.exe] C:WINDOWSsysyu32.exe
O4 – HKLM..RunOnce: [winwv.exe] C:WINDOWSwinwv.exe
O4 – HKLM..RunOnce: [apptg32.exe] C:WINDOWSapptg32.exe
O4 – HKLM..RunOnce: [netvp.exe] C:WINDOWS etvp.exe
O4 – HKLM..RunOnce: [d3kz.exe] C:WINDOWSsystem32d3kz.exe
O4 – HKLM..RunOnce: [appwz.exe] C:WINDOWSappwz.exe
O4 – HKLM..RunOnce: [ieib32.exe] C:WINDOWSieib32.exe
O4 – HKLM..RunOnce: [sdkbs32.exe] C:WINDOWSsystem32sdkbs32.exe
O4 – HKLM..RunOnce: [netaq.exe] C:WINDOWS etaq.exe
O4 – HKLM..RunOnce: [crko32.exe] C:WINDOWSsystem32crko32.exe
O4 – HKLM..RunOnce: [iegm.exe] C:WINDOWSiegm.exe
O4 – HKLM..RunOnce: [apixk32.exe] C:WINDOWSsystem32apixk32.exe
O4 – HKLM..RunOnce: [crjm32.exe] C:WINDOWSsystem32crjm32.exe
O4 – HKLM..RunOnce: [ieeo32.exe] C:WINDOWSieeo32.exe
O4 – HKLM..RunOnce: [atlvn32.exe] C:WINDOWSatlvn32.exe
O4 – HKLM..RunOnce: [addqn32.exe] C:WINDOWSaddqn32.exe
O4 – HKLM..RunOnce: [mfcsm.exe] C:WINDOWSmfcsm.exe
O4 – HKLM..RunOnce: [d3zh.exe] C:WINDOWSd3zh.exe
O4 – HKLM..RunOnce: [netgj32.exe] C:WINDOWSsystem32 etgj32.exe
O4 – HKLM..RunOnce: [javauc32.exe] C:WINDOWSjavauc32.exe
O8 – Extra context menu item: &iSearch The Web – res://C:WINDOWSSystem32 oolbar.dll/SEARCH.HTML
O9 – Extra button: SideFind (HKLM)
O16 – DPF: {10000000–1000–0000–1000–000000000000} – ms–its:mhtml:file://C:MAIN.MHT!http://d.dialer2004.com//paxan/main.chm::/load.exe
O16 – DPF: {11010101–1001–1111–1000–110164567732} – ms–its:mhtml:file://C:MAIN.MHT!http://www.008i.com//x//f//10213//inst.chm::/f10213.exe
O16 – DPF: {12398DD6–40AA–4C40–A4EC–A42CFC0DE797} (Installer Class) – http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 – DPF: {1C78AB3F–A857–482E–80C0–3A1E5238A565} – file://C:install.cab
O16 – DPF: {386A771C–E96A–421F–8BA7–32F1B706892F} (Installer Class) – http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
Strona 1 / 1