kalp >> Her kommer den ønskede log:
"Silent Runners.vbs", revision 33,
http://www.silentrunners.org/Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"MSMSGS" = ""C:\Programmer\Messenger\msmsgs.exe" /background" [MS]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Soltek" = "C:\WINDOWS\system32\autorun.exe" [null data]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"IgfxTray" = "C:\WINDOWS\system32\igfxtray.exe" ["Intel Corporation"]
"HotKeysCmds" = "C:\WINDOWS\system32\hkcmd.exe" ["Intel Corporation"]
"PE2CKFNT SE" = "C:\Programmer\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe" [null data]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]
"HPHmon04" = "C:\WINDOWS\system32\hphmon04.exe" ["Hewlett-Packard"]
"HPHUPD04" = ""C:\Programmer\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"" ["Hewlett-Packard"]
"Share-to-Web Namespace Daemon" = "C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"SunJavaUpdateSched" = "C:\Programmer\Java\jre1.5.0\bin\jusched.exe" ["Sun Microsystems, Inc."]
"Norman ZANDA" = "C:\Norman\bin\ZLH.EXE /LOAD /SPLASH" [null data]
"RemoteControl" = "C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe" ["Cyberlink Corp."]
"NeroCheck" = "C:\WINDOWS\system32\\NeroCheck.exe" ["Ahead Software Gmbh"]
"Accelerate" = "C:\Programmer\Webroot\Accelerate\accelerate.exe /S" ["Webroot Software, Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{1201333E-BAD9-481C-BCF5-6904498CF85B}\(Default) = "IE Privacy Keeper - Last IE Window Detector"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmer\UnH Solutions\IE Privacy Keeper\IEPKbho.dll" ["UnH Solutions"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Kontrolpanel-udvidelse til skærmpanorering"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal-ikon"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Mappen Share-to-Web-overførsel"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmer\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{62998FFD-B0A8-4019-8B86-CF0785539EC5}" = "IE Privacy Keeper Secure Delete Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmer\UnH Solutions\IE Privacy Keeper\SecureDelete.dll" ["UnH Solutions"]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]
Enabled Wallpaper and Active Desktop:
-------------------------------------
Active Desktop is disabled.
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Ole Jensen\Billeder\Ali Landry.bmp"
Startup items in "Ole Jensen" & "All Users" startup folders:
------------------------------------------------------------
C:\Documents and Settings\All Users\Menuen Start\Programmer\Start
"Adobe Gamma Loader.exe" -> shortcut to: "C:\Programmer\Fælles filer\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"Microsoft Office" -> shortcut to: "C:\Programmer\Microsoft Office\Office\OSA9.EXE -b -l" [MS]
"Photo Express Calendar Checker SE" -> shortcut to: "C:\Programmer\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe" ["Ulead Systems, Inc."]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}
Norman API-hooking helper, NipSvc, "C:\NORMAN\Nvc\BIN\nipsvc.exe" [null data]
Norman NJeeves, Norman NJeeves, "C:\Norman\bin\NJEEVES.EXE" [null data]
Norman Type-R, Norman Type-R, "C:\NORMAN\Nvc\BIN\NPFSVICE.EXE" [null data]
Norman Virus Control on-access component, nvcoas, "C:\NORMAN\Nvc\BIN\nvcoas.exe" ["Norman ASA"]
Norman Virus Control Scheduler, NVCScheduler, "C:\NORMAN\Nvc\BIN\NVCSCHED.EXE" ["Norman Data Defense Systems"]
Norman ZANDA, Norman ZANDA, ""C:\Norman\bin\ZANDA.EXE"" [null data]
Pml Driver HPH11, Pml Driver HPH11, "C:\WINDOWS\system32\HPHipm11.exe" ["HP"]
----------
This report excludes default entries except where indicated.
To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
----------
Slettet bruger
Ny bruger
Nybegynder
Opret
Preview
