Люсито83

той моя приятел не разбира от това което написа но както и да е благодаря за отговора

Зравйте имам проблем със скайпа .Понякога ми се отваря сам тоест той е затворен и излиза сам на десктопа и се минимизира сам и след няколко секунди пак изчезва. Пробвах да го деинсталирам и да инсталирам друг скайп но пак същата работа стана , а и с един абоната не мога да си пиша незнам защо той пише аз не получавам съобщения, а виждам че е на линия. Лек ден засега.

Благодаря много се радвам че няма никакви проблеми.Лек ден!

ComboFix 10-09-26.04 - Lyussy 09/27/2010 18:00:05.3.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2039.1503 [GMT 3:00] Running from: c:\documents and settings\Lyussy.USER.000\My Documents\Downloads\ComboFix.exe AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7} . ((((((((((((((((((((((((( Files Created from 2010-08-27 to 2010-09-27 ))))))))))))))))))))))))))))))) . 2010-09-26 17:21 . 2010-09-26 17:21 -------- d-----w- c:\program files\YouTube Downloader 2010-09-21 03:01 . 2010-09-21 03:01 -------- d-----w- c:\windows.0\system32\xircom 2010-09-21 03:01 . 2010-09-21 03:01 -------- d-----w- c:\windows.0\system32\wbem\snmp 2010-09-18 14:00 . 2010-09-18 14:00 -------- d-----w- c:\program files\CCleaner 2010-08-31 17:22 . 2010-08-31 17:22 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\TeamViewer 2010-08-31 16:18 . 2010-08-31 16:33 -------- d-----w- c:\program files\Unlocker 2010-08-29 18:13 . 2010-09-15 17:09 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\AIMP 2010-08-29 18:12 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\Yandex 2010-08-29 18:12 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Yandex 2010-08-29 18:12 . 2010-08-29 18:12 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\Opera 2010-08-29 18:12 . 2010-09-03 03:33 -------- d-----w- c:\program files\AIMP2 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-27 15:03 . 2010-07-22 18:30 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Skype 2010-09-26 11:12 . 2010-06-22 16:45 -------- d-----w- c:\program files\FlashGet 2010-09-26 10:13 . 2010-08-28 08:39 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\vlc 2010-09-22 05:52 . 2010-07-17 15:30 -------- d-----w- c:\documents and settings\Lyussy\Application Data\Skype 2010-09-22 05:46 . 2010-06-22 13:50 -------- d-----w- c:\program files\Windows Media Connect 2 2010-09-18 14:55 . 2010-06-22 16:45 -------- d-----w- c:\program files\Google 2010-09-16 17:43 . 2010-06-22 16:37 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Alwil Software 2010-09-15 17:49 . 2009-04-30 16:35 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-09-12 18:34 . 2010-08-25 19:13 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\uTorrent 2010-08-28 12:25 . 2010-08-28 08:44 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\dvdcss 2010-08-28 06:55 . 2010-08-28 06:55 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\TuneUp Software 2010-08-25 17:43 . 2010-06-22 17:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-25 17:35 . 2010-08-25 17:35 52224 ----a-w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-08-25 17:35 . 2010-08-25 17:35 117760 ----a-w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-08-25 17:34 . 2010-08-25 17:34 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\SUPERAntiSpyware.com 2010-08-25 17:33 . 2010-08-25 17:33 -------- d-----w- c:\program files\SUPERAntiSpyware 2010-08-25 17:33 . 2010-08-25 17:33 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com 2010-08-24 20:12 . 2010-08-24 20:12 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Avira 2010-08-24 20:07 . 2010-08-24 20:07 -------- d-----w- c:\program files\Avira 2010-08-24 20:07 . 2010-08-24 20:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Avira 2010-08-17 15:35 . 2010-07-01 09:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Bluetooth 2010-08-10 12:52 . 2010-08-10 12:52 -------- d-----w- c:\program files\Geist Software Labs 2010-08-06 03:58 . 2010-08-04 06:10 66192 ----a-w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-07-31 06:44 . 2010-07-22 18:59 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Winamp 2010-07-31 06:27 . 2010-06-22 17:46 -------- d-----w- c:\program files\Winamp . ------- Sigcheck ------- [-] 2009-01-08 . 5AE1C2695F6523AD98B948F2887D8C5E . 361600 . . [5.1.2600.5649] . . c:\windows.0\system32\drivers\tcpip.sys [-] 2009-01-08 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows.0\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-02-18 2012912] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows.0\system32\igfxtray.exe" [2008-02-28 141848] "HotKeysCmds"="c:\windows.0\system32\hkcmd.exe" [2008-02-28 166424] "Persistence"="c:\windows.0\system32\igfxpers.exe" [2008-02-28 137752] "RTHDCPL"="RTHDCPL.EXE" [2010-04-30 19523616] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "FixCamera"="c:\windows.0\FixCamera.exe" [2007-02-12 20480] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "tsnp325"="c:\windows.0\tsnp325.exe" [2006-10-10 270336] "snp325"="c:\windows.0\vsnp325.exe" [2006-10-10 827392] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "_nltide_2"="shell32" [X] "_nltide_3"="advpack.dll" [2009-03-08 128512] c:\documents and settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 24576] FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2010-6-22 95232] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoAutoUpdate"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil_.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 10:15 AM 66632] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/24/2010 11:08 PM 135336] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 10:15 AM 12872] R3 SNP325;USB PC Camera (SNPSTD325);c:\windows.0\system32\drivers\snp325.sys [7/10/2010 10:04 AM 10251904] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/22/2010 8:18 PM 135664] S3 Ambfilt;Ambfilt;c:\windows.0\system32\drivers\Ambfilt.sys [6/22/2010 7:54 PM 1691480] . Contents of the 'Scheduled Tasks' folder 2010-09-26 c:\windows.0\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 17:18] 2010-09-27 c:\windows.0\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 17:18] 2010-09-27 c:\windows.0\Tasks\User_Feed_Synchronization-{53741B5D-C7E8-4C03-9B2D-DB677FCE89AE}.job - c:\windows.0\system32\msfeedssync.exe [2009-01-08 01:31] . . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = https://shop.winamp.com/DRHM/servlet/ControllerServlet?Action=DisplayWaitDontLeavePopUpPage&SiteID=winamp&Locale=en_US&ThemeID=1279300&Env=BASE IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm IE: Add to Google Photos Screensa&ver - c:\windows.0\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html FF - ProfilePath - c:\documents and settings\Lyussy.USER.000\Application Data\Mozilla\Firefox\Profiles\ma6utpfq.default\ FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official FF - prefs.js: keyword.URL - hxxp://yandex.ru/yandsearch?clid=129479&yasoft=barff.en&text= FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll FF - plugin: c:\documents and settings\All Users.WINDOWS.0\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . - - - - ORPHANS REMOVED - - - - WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) ************************************************************************** scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="d:\\CCleaner\\ccleaner.exe" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}] @DACL=(02 0000) @="Wireless" "ProcessGroupPolicy"="ProcessWIRELESSPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0E28E245-9368-4853-AD84-6DA3BA35BB75}] @DACL=(02 0000) @="Group Policy Environment" "DisplayName"=expand:"@gpprefcl.dll,-1" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Environment,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyEnviron" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyEnviron" "ProcessGroupPolicyEx"="ProcessGroupPolicyExEnviron" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{17D89FEC-5C44-4972-B12D-241CAEF74509}] @DACL=(02 0000) @="Group Policy Local Users and Groups" "DisplayName"=expand:"@gpprefcl.dll,-2" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Local Users and Groups,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyLocUsAndGroups" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyLocUsAndGroups" "ProcessGroupPolicyEx"="ProcessGroupPolicyExLocUsAndGroups" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{1A6364EB-776B-4120-ADE1-B63A406A76B5}] @DACL=(02 0000) @="Group Policy Device Settings" "DisplayName"=expand:"@gpprefcl.dll,-3" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Device Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDevices" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDevices" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDevices" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}] @DACL=(02 0000) @="Folder Redirection" "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" "DllName"=expand:"fdeploy.dll" "NoMachinePolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "NoGPOListChanges"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "GenerateGroupPolicy"="GenerateGroupPolicy" "EventSources"=multi:"(Folder Redirection,Application)\00\00" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] @DACL=(02 0000) @="Microsoft Disk Quota" "NoMachinePolicy"=dword:00000000 "NoUserPolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "NoBackgroundPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "RequiresSuccessfulRegistry"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000000 "DllName"=expand:"dskquota.dll" "ProcessGroupPolicy"="ProcessGroupPolicy" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}] @DACL=(02 0000) @="Group Policy Network Options" "DisplayName"=expand:"@gpprefcl.dll,-4" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Network Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyNetworkOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyNetworkOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExNetworkOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}] @DACL=(02 0000) @="QoS Packet Scheduler" "ProcessGroupPolicy"="ProcessPSCHEDPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}] @DACL=(02 0000) @="Scripts" "ProcessGroupPolicy"="ProcessScriptsGroupPolicy" "ProcessGroupPolicyEx"="ProcessScriptsGroupPolicyEx" "GenerateGroupPolicy"="GenerateScriptsGroupPolicy" "DllName"=expand:"gptext.dll" "NoSlowLink"=dword:00000001 "NoGPOListChanges"=dword:00000001 "NotifyLinkTransition"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}] @DACL=(02 0000) @="Internet Explorer Zonemapping" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "ProcessGroupPolicy"="ProcessGroupPolicyForZoneMap" "NoGPOListChanges"=dword:00000001 "RequiresSucessfulRegistry"=dword:00000001 "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{5794DAFD-BE60-433f-88A2-1A31939AC01F}] @DACL=(02 0000) @="Group Policy Drive Maps" "DisplayName"=expand:"@gpprefcl.dll,-5" "DllName"=expand:"gpprefcl.dll" "EventSources"="(Group Policy Drive Maps,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDrives" "NoBackgroundPolicy"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDrives" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDrives" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6232C319-91AC-4931-9385-E70C2B099F0E}] @DACL=(02 0000) @="Group Policy Folders" "DisplayName"=expand:"@gpprefcl.dll,-6" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"="" "EventSources"="(Group Policy Folders,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFolders" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFolders" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFolders" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}] @DACL=(02 0000) @="Group Policy Network Shares" "DisplayName"=expand:"@gpprefcl.dll,-7" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Network Shares,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyNetShares" "NoUserPolicy"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyNetShares" "ProcessGroupPolicyEx"="ProcessGroupPolicyExNetShares" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}] @DACL=(02 0000) @="Group Policy Files" "DisplayName"=expand:"@gpprefcl.dll,-8" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Files,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFiles" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFiles" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFiles" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{728EE579-943C-4519-9EF7-AB56765798ED}] @DACL=(02 0000) @="Group Policy Data Sources" "DisplayName"=expand:"@gpprefcl.dll,-9" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Data Sources,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDataSources" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDataSources" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDataSources" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{74EE6C03-5363-4554-B161-627540339CAB}] @DACL=(02 0000) @="Group Policy Ini Files" "DisplayName"=expand:"@gpprefcl.dll,-10" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Ini Files,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyIniFile" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyIniFile" "ProcessGroupPolicyEx"="ProcessGroupPolicyExIniFile" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}] @DACL=(02 0000) @="Internet Explorer User Accelerators" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "NoGPOListChanges"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyForActivities" "ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}] @DACL=(02 0000) "ProcessGroupPolicy"="SceProcessSecurityPolicyGPO" "GenerateGroupPolicy"="SceGenerateGroupPolicy" "ExtensionRsopPlanningDebugLevel"=dword:00000001 "ProcessGroupPolicyEx"="SceProcessSecurityPolicyGPOEx" "ExtensionDebugLevel"=dword:00000001 "DllName"=expand:"scecli.dll" @="Security" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000001 "MaxNoGPOListChangesInterval"=dword:000003c0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{91FBB303-0CD5-4055-BF42-E512A681B325}] @DACL=(02 0000) @="Group Policy Services" "DisplayName"=expand:"@gpprefcl.dll,-11" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Services,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyServices" "ProcessGroupPolicy"="ProcessGroupPolicyServices" "ProcessGroupPolicyEx"="ProcessGroupPolicyExServices" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}] @DACL=(02 0000) @="Internet Explorer Branding" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3014" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "GenerateGroupPolicy"="GenerateGroupPolicy" "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000001 "NoMachinePolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicy" "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A3F3E39B-5D83-4940-B954-28315B82F0A8}] @DACL=(02 0000) @="Group Policy Folder Options" "DisplayName"=expand:"@gpprefcl.dll,-12" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Folder Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFolderOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFolderOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFolderOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{AADCED64-746C-4633-A97C-D61349046527}] @DACL=(02 0000) @="Group Policy Scheduled Tasks" "DisplayName"=expand:"@gpprefcl.dll,-13" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Scheduled Tasks,Application)" "GenerateGroupPolicy"="GenerateGroupPolicySchedTasks" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicySchedTasks" "ProcessGroupPolicyEx"="ProcessGroupPolicyExSchedTasks" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B087BE9D-ED37-454f-AF9C-04291E351182}] @DACL=(02 0000) @="Group Policy Registry" "DisplayName"=expand:"@gpprefcl.dll,-14" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Registry,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyRegistry" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyRegistry" "ProcessGroupPolicyEx"="ProcessGroupPolicyExRegistry" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}] @DACL=(02 0000) "ProcessGroupPolicy"="SceProcessEFSRecoveryGPO" "DllName"=expand:"scecli.dll" @="EFS recovery" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}] @DACL=(02 0000) @="802.3 Group Policy" "DisplayName"=expand:"@dot3gpclnt.dll,-100" "ProcessGroupPolicyEx"="ProcessLANPolicyEx" "GenerateGroupPolicy"="GenerateLANPolicy" "DllName"=expand:"dot3gpclnt.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}] @DACL=(02 0000) @="Group Policy Printers" "DisplayName"=expand:"@gpprefcl.dll,-16" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Printers,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyPrinters" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyPrinters" "ProcessGroupPolicyEx"="ProcessGroupPolicyExPrinters" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}] @DACL=(02 0000) @="Group Policy Shortcuts" "DisplayName"=expand:"@gpprefcl.dll,-17" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Shortcuts,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyShortcuts" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyShortcuts" "ProcessGroupPolicyEx"="ProcessGroupPolicyExShortcuts" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}] @DACL=(02 0000) @="Microsoft Offline Files" "DllName"=expand:"%SystemRoot%\\System32\\cscui.dll" "EnableAsynchronousProcessing"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000000 "NoMachinePolicy"=dword:00000000 "NoSlowLink"=dword:00000000 "NoUserPolicy"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "ProcessGroupPolicy"="ProcessGroupPolicy" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}] @DACL=(02 0000) @="Software Installation" "DllName"=expand:"appmgmts.dll" "ProcessGroupPolicyEx"="ProcessGroupPolicyObjectsEx" "GenerateGroupPolicy"="GenerateGroupPolicy" "NoBackgroundPolicy"=dword:00000000 "RequiresSucessfulRegistry"=dword:00000000 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "EventSources"=multi:"(Application Management,Application)\00(MsiInstaller,Application)\00\00" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}] @DACL=(02 0000) @="Internet Explorer Machine Accelerators" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "NoGPOListChanges"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyForActivities" "ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}] @DACL=(02 0000) @="IP Security" "ProcessGroupPolicy"="ProcessIPSECPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000000 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}] @DACL=(02 0000) @="Group Policy Internet Settings" "DisplayName"=expand:"@gpprefcl.dll,-18" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Internet Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyInternet" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyShortcuts" "ProcessGroupPolicyEx"="ProcessGroupPolicyExInternet" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}] @DACL=(02 0000) @="Group Policy Start Menu Settings" "DisplayName"=expand:"@gpprefcl.dll,-19" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Start Menu Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyStartMenu" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyStartMenu" "ProcessGroupPolicyEx"="ProcessGroupPolicyExStartMenu" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E5094040-C46C-4115-B030-04FB2E545B00}] @DACL=(02 0000) @="Group Policy Regional Options" "DisplayName"=expand:"@gpprefcl.dll,-20" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Regional Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyRegionOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyRegionOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExRegionOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}] @DACL=(02 0000) @="Group Policy Power Options" "DisplayName"=expand:"@gpprefcl.dll,-21" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Power Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyPowerOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyPowerOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExPowerOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{F9C77450-3A41-477E-9310-9ACD617BD9E3}] @DACL=(02 0000) @="Group Policy Applications" "DisplayName"=expand:"@gpprefcl.dll,-15" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Applications,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyApplications" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyApplications" "ProcessGroupPolicyEx"="ProcessGroupPolicyExApplications" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] @DACL=(02 0000) "DllName"="c:\\Program Files\\SUPERAntiSpyware\\SASWINLO.dll" "Logon"="SABWINLOLogon" "Logoff"="SABWINLOLogoff" "Startup"="SABWINLOStartup" "Shutdown"="SABWINLOShutdown" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] @DACL=(02 0000) "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=expand:"crypt32.dll" "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] @DACL=(02 0000) "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=expand:"cryptnet.dll" "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] @DACL=(02 0000) "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy] @DACL=(02 0000) "Asynchronous"=dword:00000001 "DllName"=expand:"%SystemRoot%\\System32\\dimsntfy.dll" "Startup"="WlDimsStartup" "Shutdown"="WlDimsShutdown" "Logon"="WlDimsLogon" "Logoff"="WlDimsLogoff" "StartShell"="WlDimsStartShell" "Lock"="WlDimsLock" "Unlock"="WlDimsUnlock" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @DACL=(02 0000) @="" "DLLName"="igfxdev.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] @DACL=(02 0000) "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] @DACL=(02 0000) "Asynchronous"=dword:00000000 "DllName"=expand:"wlnotify.dll" "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] @DACL=(02 0000) "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=expand:"sclgntfy.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] @DACL=(02 0000) "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] @DACL=(02 0000) "Asynchronous"=dword:00000000 "DllName"=expand:"wlnotify.dll" "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] @DACL=(02 0000) "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList] @DACL=(02 0000) "HelpAssistant"=dword:00000000 "TsInternetUser"=dword:00000000 "SQLAgentCmdExec"=dword:00000000 "NetShowServices"=dword:00000000 "IWAM_"=dword:00010000 "IUSR_"=dword:00010000 "VUSR_"=dword:00010000 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2908) c:\windows.0\system32\WININET.dll c:\windows.0\system32\msi.dll c:\windows.0\system32\ieframe.dll c:\windows.0\system32\webcheck.dll c:\windows.0\system32\wpdshserviceobj.dll c:\windows.0\system32\portabledevicetypes.dll c:\windows.0\system32\portabledeviceapi.dll . Completion time: 2010-09-27 18:04:22 ComboFix-quarantined-files.txt 2010-09-27 15:04 Pre-Run: 29,351,968,768 bytes free Post-Run: 29,362,110,464 bytes free - - End Of File - - 4871F3C44535331D1740895E44BC381D Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Версия на базата от данни: 4699 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 9/27/2010 6:12:46 PM mbam-log-2010-09-27 (18-12-46).txt Тип сканиране: Бързо сканиране Сканирани обекти: 195191 Изминало време: 4 минута(и), 23 секунда(и) Заразени процеси в паметта: 0 Заразени модули в паметта: 0 Заразени ключове в регистратурата: 0 Заразени стойности в регистратурата: 0 Заразени информационни обекти в регистратурата: 0 Заразени папки: 0 Заразени файлове: 0 Заразени процеси в паметта: (Не бяха открити зловредни обекти) Заразени модули в паметта: (Не бяха открити зловредни обекти) Заразени ключове в регистратурата: (Не бяха открити зловредни обекти) Заразени стойности в регистратурата: (Не бяха открити зловредни обекти) Заразени информационни обекти в регистратурата: (Не бяха открити зловредни обекти) Заразени папки: (Не бяха открити зловредни обекти) Заразени файлове: (Не бяха открити зловредни обекти)

Ники се опитва да ми пише на моя скайп но не получавам никакви негови съобщения да само от него не получавам съобщения но ползвам скайп лаунчер двоен скайп и от друг мой скайп си пиша с него. Ники каза да ви кажа че откакто ми прати две антивирусни програми не може да ми пише на скайпа не получавам никакви негови съобщения и от втория ми скайп вече не мога да получавам негови съобщения .

в момента да само от него не получавам съобщения и използвам скайп лаунчер с друг скайп мой с него става да му пиша тоест ползвам два скайпа само за да мога да си пиша с Ники.

здравейте аз деинсталирах аск тоолбар но трябва ли да ползвам този аск толбар който ми писахте и да попитам защо не получавам съобщения в скайпа от Ники имам ли още недоизчистени вируси или е нещо друго.

Здравейте може ли да ми кажете как да премахна Аск Тоолбар от контрол панела.

мисля че вече нямам проблеми с компютъра така че благодаря за всичко ако има нещо или друг проблем ще ви питам пак лека вечер Ви пожелавам.

без да искам два пъти го пратих

Ето го лога ComboFix 10-09-20.01 - Lyussy 09/20/2010 21:05:22.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2039.1111 [GMT 3:00] Running from: c:\documents and settings\Lyussy.USER.000\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Lyussy.USER.000\Desktop\CFScript.txt.txt AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} . ((((((((((((((((((((((((( Files Created from 2010-08-20 to 2010-09-20 ))))))))))))))))))))))))))))))) . 2010-09-18 14:00 . 2010-09-18 14:00 -------- d-----w- c:\program files\CCleaner 2010-08-31 17:22 . 2010-08-31 17:22 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\TeamViewer 2010-08-31 16:18 . 2010-08-31 16:33 -------- d-----w- c:\program files\Unlocker 2010-08-29 18:13 . 2010-09-15 17:09 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\AIMP 2010-08-29 18:12 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\Yandex 2010-08-29 18:12 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Yandex 2010-08-29 18:12 . 2010-08-29 18:12 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\Opera 2010-08-29 18:12 . 2010-09-03 03:33 -------- d-----w- c:\program files\AIMP2 2010-08-28 08:44 . 2010-08-28 12:25 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\dvdcss 2010-08-28 08:39 . 2010-08-28 11:52 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\vlc 2010-08-28 06:55 . 2010-08-28 06:55 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\TuneUp Software 2010-08-27 14:56 . 2010-08-27 14:56 -------- d-sh--w- c:\documents and settings\Lyussy.USER.000\IECompatCache 2010-08-25 19:18 . 2010-09-20 16:57 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\AskToolbar 2010-08-25 19:14 . 2010-08-25 19:14 -------- d-----w- c:\program files\Ask.com 2010-08-25 19:13 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\uTorrent 2010-08-25 17:35 . 2010-08-25 17:35 52224 ----a-w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-08-25 17:35 . 2010-08-25 17:35 117760 ----a-w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-08-25 17:34 . 2010-08-25 17:34 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\SUPERAntiSpyware.com 2010-08-25 17:33 . 2010-08-25 17:33 -------- d-----w- c:\program files\SUPERAntiSpyware 2010-08-25 17:33 . 2010-08-25 17:33 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com 2010-08-24 20:13 . 2010-09-20 15:54 -------- d-----w- c:\windows.0\system32\NtmsData 2010-08-24 20:12 . 2010-08-24 20:12 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Avira 2010-08-24 20:08 . 2010-03-01 07:05 124784 ----a-w- c:\windows.0\system32\drivers\avipbb.sys 2010-08-24 20:08 . 2010-02-16 11:24 60936 ----a-w- c:\windows.0\system32\drivers\avgntflt.sys 2010-08-24 20:08 . 2009-05-11 09:49 45416 ----a-w- c:\windows.0\system32\drivers\avgntdd.sys 2010-08-24 20:08 . 2009-05-11 09:49 22360 ----a-w- c:\windows.0\system32\drivers\avgntmgr.sys 2010-08-24 20:07 . 2010-08-24 20:07 -------- d-----w- c:\program files\Avira 2010-08-24 20:07 . 2010-08-24 20:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Avira . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-20 18:04 . 2010-07-22 18:30 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Skype 2010-09-18 14:55 . 2010-06-22 16:45 -------- d-----w- c:\program files\Google 2010-09-16 17:43 . 2010-06-22 16:37 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Alwil Software 2010-09-15 17:49 . 2009-04-30 16:35 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-08-25 17:43 . 2010-06-22 17:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-17 15:35 . 2010-07-01 09:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Bluetooth 2010-08-10 12:52 . 2010-08-10 12:52 -------- d-----w- c:\program files\Geist Software Labs 2010-08-06 03:58 . 2010-08-04 06:10 66192 ----a-w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-07-31 06:44 . 2010-07-22 18:59 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Winamp 2010-07-31 06:27 . 2010-06-22 17:46 -------- d-----w- c:\program files\Winamp 2010-07-22 18:36 . 2010-07-22 18:36 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Malwarebytes 2010-07-22 18:25 . 2010-07-17 15:30 -------- d-----w- c:\documents and settings\Lyussy\Application Data\Skype 2010-07-22 18:25 . 2010-07-17 15:34 -------- d-----w- c:\documents and settings\Lyussy\Application Data\Winamp 2010-07-22 18:25 . 2010-07-18 13:02 -------- d-----w- c:\program files\Microsoft Silverlight 2010-07-01 18:16 . 2010-06-22 16:11 66192 ----a-w- c:\documents and settings\Administrator.USER\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-06-23 09:19 . 2010-06-23 09:19 56 ---ha-w- c:\windows.0\system32\ezsidmv.dat . ------- Sigcheck ------- [-] 2009-01-08 . 5AE1C2695F6523AD98B948F2887D8C5E . 361600 . . [5.1.2600.5649] . . c:\windows.0\system32\drivers\tcpip.sys [-] 2009-01-08 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows.0\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-05-26 12:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-02-18 2012912] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows.0\system32\igfxtray.exe" [2008-02-28 141848] "HotKeysCmds"="c:\windows.0\system32\hkcmd.exe" [2008-02-28 166424] "Persistence"="c:\windows.0\system32\igfxpers.exe" [2008-02-28 137752] "RTHDCPL"="RTHDCPL.EXE" [2010-04-30 19523616] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "FixCamera"="c:\windows.0\FixCamera.exe" [2007-02-12 20480] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "tsnp325"="c:\windows.0\tsnp325.exe" [2006-10-10 270336] "snp325"="c:\windows.0\vsnp325.exe" [2006-10-10 827392] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "_nltide_2"="shell32" [X] "_nltide_3"="advpack.dll" [2009-03-08 128512] c:\documents and settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 24576] FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2010-6-22 95232] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoAutoUpdate"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil_.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 10:15 AM 66632] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/24/2010 11:08 PM 135336] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 10:15 AM 12872] R3 SNP325;USB PC Camera (SNPSTD325);c:\windows.0\system32\drivers\snp325.sys [7/10/2010 10:04 AM 10251904] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/22/2010 8:18 PM 135664] S3 Ambfilt;Ambfilt;c:\windows.0\system32\drivers\Ambfilt.sys [6/22/2010 7:54 PM 1691480] . Contents of the 'Scheduled Tasks' folder 2010-09-20 c:\windows.0\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 17:18] 2010-09-20 c:\windows.0\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 17:18] 2010-09-20 c:\windows.0\Tasks\Scheduled Update for Ask Toolbar.job - c:\program files\Ask.com\UpdateTask.exe [2010-05-26 12:23] 2010-09-20 c:\windows.0\Tasks\User_Feed_Synchronization-{53741B5D-C7E8-4C03-9B2D-DB677FCE89AE}.job - c:\windows.0\system32\msfeedssync.exe [2009-01-08 01:31] . . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = https://shop.winamp.com/DRHM/servlet/ControllerServlet?Action=DisplayWaitDontLeavePopUpPage&SiteID=winamp&Locale=en_US&ThemeID=1279300&Env=BASE IE: Add to Google Photos Screensa&ver - c:\windows.0\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html FF - ProfilePath - c:\documents and settings\Lyussy.USER.000\Application Data\Mozilla\Firefox\Profiles\ma6utpfq.default\ FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official FF - prefs.js: keyword.URL - hxxp://yandex.ru/yandsearch?clid=129479&yasoft=barff.en&text= FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll FF - plugin: c:\documents and settings\All Users.WINDOWS.0\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . ************************************************************************** scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="d:\\CCleaner\\ccleaner.exe" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}] @DACL=(02 0000) @="Wireless" "ProcessGroupPolicy"="ProcessWIRELESSPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0E28E245-9368-4853-AD84-6DA3BA35BB75}] @DACL=(02 0000) @="Group Policy Environment" "DisplayName"=expand:"@gpprefcl.dll,-1" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Environment,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyEnviron" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyEnviron" "ProcessGroupPolicyEx"="ProcessGroupPolicyExEnviron" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{17D89FEC-5C44-4972-B12D-241CAEF74509}] @DACL=(02 0000) @="Group Policy Local Users and Groups" "DisplayName"=expand:"@gpprefcl.dll,-2" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Local Users and Groups,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyLocUsAndGroups" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyLocUsAndGroups" "ProcessGroupPolicyEx"="ProcessGroupPolicyExLocUsAndGroups" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{1A6364EB-776B-4120-ADE1-B63A406A76B5}] @DACL=(02 0000) @="Group Policy Device Settings" "DisplayName"=expand:"@gpprefcl.dll,-3" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Device Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDevices" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDevices" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDevices" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}] @DACL=(02 0000) @="Folder Redirection" "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" "DllName"=expand:"fdeploy.dll" "NoMachinePolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "NoGPOListChanges"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "GenerateGroupPolicy"="GenerateGroupPolicy" "EventSources"=multi:"(Folder Redirection,Application)\00\00" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] @DACL=(02 0000) @="Microsoft Disk Quota" "NoMachinePolicy"=dword:00000000 "NoUserPolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "NoBackgroundPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "RequiresSuccessfulRegistry"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000000 "DllName"=expand:"dskquota.dll" "ProcessGroupPolicy"="ProcessGroupPolicy" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}] @DACL=(02 0000) @="Group Policy Network Options" "DisplayName"=expand:"@gpprefcl.dll,-4" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Network Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyNetworkOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyNetworkOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExNetworkOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}] @DACL=(02 0000) @="QoS Packet Scheduler" "ProcessGroupPolicy"="ProcessPSCHEDPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}] @DACL=(02 0000) @="Scripts" "ProcessGroupPolicy"="ProcessScriptsGroupPolicy" "ProcessGroupPolicyEx"="ProcessScriptsGroupPolicyEx" "GenerateGroupPolicy"="GenerateScriptsGroupPolicy" "DllName"=expand:"gptext.dll" "NoSlowLink"=dword:00000001 "NoGPOListChanges"=dword:00000001 "NotifyLinkTransition"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}] @DACL=(02 0000) @="Internet Explorer Zonemapping" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "ProcessGroupPolicy"="ProcessGroupPolicyForZoneMap" "NoGPOListChanges"=dword:00000001 "RequiresSucessfulRegistry"=dword:00000001 "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{5794DAFD-BE60-433f-88A2-1A31939AC01F}] @DACL=(02 0000) @="Group Policy Drive Maps" "DisplayName"=expand:"@gpprefcl.dll,-5" "DllName"=expand:"gpprefcl.dll" "EventSources"="(Group Policy Drive Maps,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDrives" "NoBackgroundPolicy"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDrives" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDrives" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6232C319-91AC-4931-9385-E70C2B099F0E}] @DACL=(02 0000) @="Group Policy Folders" "DisplayName"=expand:"@gpprefcl.dll,-6" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"="" "EventSources"="(Group Policy Folders,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFolders" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFolders" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFolders" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}] @DACL=(02 0000) @="Group Policy Network Shares" "DisplayName"=expand:"@gpprefcl.dll,-7" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Network Shares,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyNetShares" "NoUserPolicy"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyNetShares" "ProcessGroupPolicyEx"="ProcessGroupPolicyExNetShares" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}] @DACL=(02 0000) @="Group Policy Files" "DisplayName"=expand:"@gpprefcl.dll,-8" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Files,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFiles" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFiles" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFiles" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{728EE579-943C-4519-9EF7-AB56765798ED}] @DACL=(02 0000) @="Group Policy Data Sources" "DisplayName"=expand:"@gpprefcl.dll,-9" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Data Sources,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDataSources" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDataSources" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDataSources" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{74EE6C03-5363-4554-B161-627540339CAB}] @DACL=(02 0000) @="Group Policy Ini Files" "DisplayName"=expand:"@gpprefcl.dll,-10" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Ini Files,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyIniFile" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyIniFile" "ProcessGroupPolicyEx"="ProcessGroupPolicyExIniFile" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}] @DACL=(02 0000) @="Internet Explorer User Accelerators" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "NoGPOListChanges"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyForActivities" "ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}] @DACL=(02 0000) "ProcessGroupPolicy"="SceProcessSecurityPolicyGPO" "GenerateGroupPolicy"="SceGenerateGroupPolicy" "ExtensionRsopPlanningDebugLevel"=dword:00000001 "ProcessGroupPolicyEx"="SceProcessSecurityPolicyGPOEx" "ExtensionDebugLevel"=dword:00000001 "DllName"=expand:"scecli.dll" @="Security" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000001 "MaxNoGPOListChangesInterval"=dword:000003c0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{91FBB303-0CD5-4055-BF42-E512A681B325}] @DACL=(02 0000) @="Group Policy Services" "DisplayName"=expand:"@gpprefcl.dll,-11" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Services,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyServices" "ProcessGroupPolicy"="ProcessGroupPolicyServices" "ProcessGroupPolicyEx"="ProcessGroupPolicyExServices" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}] @DACL=(02 0000) @="Internet Explorer Branding" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3014" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "GenerateGroupPolicy"="GenerateGroupPolicy" "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000001 "NoMachinePolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicy" "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A3F3E39B-5D83-4940-B954-28315B82F0A8}] @DACL=(02 0000) @="Group Policy Folder Options" "DisplayName"=expand:"@gpprefcl.dll,-12" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Folder Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFolderOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFolderOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFolderOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{AADCED64-746C-4633-A97C-D61349046527}] @DACL=(02 0000) @="Group Policy Scheduled Tasks" "DisplayName"=expand:"@gpprefcl.dll,-13" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Scheduled Tasks,Application)" "GenerateGroupPolicy"="GenerateGroupPolicySchedTasks" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicySchedTasks" "ProcessGroupPolicyEx"="ProcessGroupPolicyExSchedTasks" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B087BE9D-ED37-454f-AF9C-04291E351182}] @DACL=(02 0000) @="Group Policy Registry" "DisplayName"=expand:"@gpprefcl.dll,-14" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Registry,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyRegistry" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyRegistry" "ProcessGroupPolicyEx"="ProcessGroupPolicyExRegistry" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}] @DACL=(02 0000) "ProcessGroupPolicy"="SceProcessEFSRecoveryGPO" "DllName"=expand:"scecli.dll" @="EFS recovery" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}] @DACL=(02 0000) @="802.3 Group Policy" "DisplayName"=expand:"@dot3gpclnt.dll,-100" "ProcessGroupPolicyEx"="ProcessLANPolicyEx" "GenerateGroupPolicy"="GenerateLANPolicy" "DllName"=expand:"dot3gpclnt.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}] @DACL=(02 0000) @="Group Policy Printers" "DisplayName"=expand:"@gpprefcl.dll,-16" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Printers,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyPrinters" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyPrinters" "ProcessGroupPolicyEx"="ProcessGroupPolicyExPrinters" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}] @DACL=(02 0000) @="Group Policy Shortcuts" "DisplayName"=expand:"@gpprefcl.dll,-17" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Shortcuts,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyShortcuts" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyShortcuts" "ProcessGroupPolicyEx"="ProcessGroupPolicyExShortcuts" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}] @DACL=(02 0000) @="Microsoft Offline Files" "DllName"=expand:"%SystemRoot%\\System32\\cscui.dll" "EnableAsynchronousProcessing"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000000 "NoMachinePolicy"=dword:00000000 "NoSlowLink"=dword:00000000 "NoUserPolicy"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "ProcessGroupPolicy"="ProcessGroupPolicy" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}] @DACL=(02 0000) @="Software Installation" "DllName"=expand:"appmgmts.dll" "ProcessGroupPolicyEx"="ProcessGroupPolicyObjectsEx" "GenerateGroupPolicy"="GenerateGroupPolicy" "NoBackgroundPolicy"=dword:00000000 "RequiresSucessfulRegistry"=dword:00000000 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "EventSources"=multi:"(Application Management,Application)\00(MsiInstaller,Application)\00\00" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}] @DACL=(02 0000) @="Internet Explorer Machine Accelerators" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "NoGPOListChanges"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyForActivities" "ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}] @DACL=(02 0000) @="IP Security" "ProcessGroupPolicy"="ProcessIPSECPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000000 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}] @DACL=(02 0000) @="Group Policy Internet Settings" "DisplayName"=expand:"@gpprefcl.dll,-18" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Internet Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyInternet" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyShortcuts" "ProcessGroupPolicyEx"="ProcessGroupPolicyExInternet" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}] @DACL=(02 0000) @="Group Policy Start Menu Settings" "DisplayName"=expand:"@gpprefcl.dll,-19" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Start Menu Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyStartMenu" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyStartMenu" "ProcessGroupPolicyEx"="ProcessGroupPolicyExStartMenu" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E5094040-C46C-4115-B030-04FB2E545B00}] @DACL=(02 0000) @="Group Policy Regional Options" "DisplayName"=expand:"@gpprefcl.dll,-20" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Regional Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyRegionOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyRegionOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExRegionOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}] @DACL=(02 0000) @="Group Policy Power Options" "DisplayName"=expand:"@gpprefcl.dll,-21" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Power Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyPowerOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyPowerOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExPowerOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{F9C77450-3A41-477E-9310-9ACD617BD9E3}] @DACL=(02 0000) @="Group Policy Applications" "DisplayName"=expand:"@gpprefcl.dll,-15" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Applications,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyApplications" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyApplications" "ProcessGroupPolicyEx"="ProcessGroupPolicyExApplications" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] @DACL=(02 0000) "DllName"="c:\\Program Files\\SUPERAntiSpyware\\SASWINLO.dll" "Logon"="SABWINLOLogon" "Logoff"="SABWINLOLogoff" "Startup"="SABWINLOStartup" "Shutdown"="SABWINLOShutdown" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] @DACL=(02 0000) "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=expand:"crypt32.dll" "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] @DACL=(02 0000) "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=expand:"cryptnet.dll" "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] @DACL=(02 0000) "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy] @DACL=(02 0000) "Asynchronous"=dword:00000001 "DllName"=expand:"%SystemRoot%\\System32\\dimsntfy.dll" "Startup"="WlDimsStartup" "Shutdown"="WlDimsShutdown" "Logon"="WlDimsLogon" "Logoff"="WlDimsLogoff" "StartShell"="WlDimsStartShell" "Lock"="WlDimsLock" "Unlock"="WlDimsUnlock" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @DACL=(02 0000) @="" "DLLName"="igfxdev.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] @DACL=(02 0000) "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] @DACL=(02 0000) "Asynchronous"=dword:00000000 "DllName"=expand:"wlnotify.dll" "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] @DACL=(02 0000) "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=expand:"sclgntfy.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] @DACL=(02 0000) "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] @DACL=(02 0000) "Asynchronous"=dword:00000000 "DllName"=expand:"wlnotify.dll" "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] @DACL=(02 0000) "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList] @DACL=(02 0000) "HelpAssistant"=dword:00000000 "TsInternetUser"=dword:00000000 "SQLAgentCmdExec"=dword:00000000 "NetShowServices"=dword:00000000 "IWAM_"=dword:00010000 "IUSR_"=dword:00010000 "VUSR_"=dword:00010000 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(596) c:\windows.0\system32\WININET.dll c:\windows.0\system32\ieframe.dll c:\windows.0\system32\msi.dll c:\windows.0\system32\webcheck.dll c:\windows.0\system32\wpdshserviceobj.dll c:\windows.0\system32\portabledevicetypes.dll c:\windows.0\system32\portabledeviceapi.dll . Completion time: 2010-09-20 21:09:10 ComboFix-quarantined-files.txt 2010-09-20 18:09 ComboFix2.txt 2010-09-20 14:56 Pre-Run: 33,916,284,928 bytes free Post-Run: 33,927,639,040 bytes free - - End Of File - - C36934DC0B6DCCEA12E1DF75873E7F9F ComboFix 10-09-20.01 - Lyussy 09/20/2010 21:05:22.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2039.1111 [GMT 3:00] Running from: c:\documents and settings\Lyussy.USER.000\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Lyussy.USER.000\Desktop\CFScript.txt.txt AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} . ((((((((((((((((((((((((( Files Created from 2010-08-20 to 2010-09-20 ))))))))))))))))))))))))))))))) . 2010-09-18 14:00 . 2010-09-18 14:00 -------- d-----w- c:\program files\CCleaner 2010-08-31 17:22 . 2010-08-31 17:22 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\TeamViewer 2010-08-31 16:18 . 2010-08-31 16:33 -------- d-----w- c:\program files\Unlocker 2010-08-29 18:13 . 2010-09-15 17:09 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\AIMP 2010-08-29 18:12 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\Yandex 2010-08-29 18:12 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Yandex 2010-08-29 18:12 . 2010-08-29 18:12 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\Opera 2010-08-29 18:12 . 2010-09-03 03:33 -------- d-----w- c:\program files\AIMP2 2010-08-28 08:44 . 2010-08-28 12:25 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\dvdcss 2010-08-28 08:39 . 2010-08-28 11:52 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\vlc 2010-08-28 06:55 . 2010-08-28 06:55 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\TuneUp Software 2010-08-27 14:56 . 2010-08-27 14:56 -------- d-sh--w- c:\documents and settings\Lyussy.USER.000\IECompatCache 2010-08-25 19:18 . 2010-09-20 16:57 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\AskToolbar 2010-08-25 19:14 . 2010-08-25 19:14 -------- d-----w- c:\program files\Ask.com 2010-08-25 19:13 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\uTorrent 2010-08-25 17:35 . 2010-08-25 17:35 52224 ----a-w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-08-25 17:35 . 2010-08-25 17:35 117760 ----a-w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-08-25 17:34 . 2010-08-25 17:34 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\SUPERAntiSpyware.com 2010-08-25 17:33 . 2010-08-25 17:33 -------- d-----w- c:\program files\SUPERAntiSpyware 2010-08-25 17:33 . 2010-08-25 17:33 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com 2010-08-24 20:13 . 2010-09-20 15:54 -------- d-----w- c:\windows.0\system32\NtmsData 2010-08-24 20:12 . 2010-08-24 20:12 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Avira 2010-08-24 20:08 . 2010-03-01 07:05 124784 ----a-w- c:\windows.0\system32\drivers\avipbb.sys 2010-08-24 20:08 . 2010-02-16 11:24 60936 ----a-w- c:\windows.0\system32\drivers\avgntflt.sys 2010-08-24 20:08 . 2009-05-11 09:49 45416 ----a-w- c:\windows.0\system32\drivers\avgntdd.sys 2010-08-24 20:08 . 2009-05-11 09:49 22360 ----a-w- c:\windows.0\system32\drivers\avgntmgr.sys 2010-08-24 20:07 . 2010-08-24 20:07 -------- d-----w- c:\program files\Avira 2010-08-24 20:07 . 2010-08-24 20:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Avira . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-20 18:04 . 2010-07-22 18:30 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Skype 2010-09-18 14:55 . 2010-06-22 16:45 -------- d-----w- c:\program files\Google 2010-09-16 17:43 . 2010-06-22 16:37 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Alwil Software 2010-09-15 17:49 . 2009-04-30 16:35 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-08-25 17:43 . 2010-06-22 17:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-17 15:35 . 2010-07-01 09:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Bluetooth 2010-08-10 12:52 . 2010-08-10 12:52 -------- d-----w- c:\program files\Geist Software Labs 2010-08-06 03:58 . 2010-08-04 06:10 66192 ----a-w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-07-31 06:44 . 2010-07-22 18:59 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Winamp 2010-07-31 06:27 . 2010-06-22 17:46 -------- d-----w- c:\program files\Winamp 2010-07-22 18:36 . 2010-07-22 18:36 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Malwarebytes 2010-07-22 18:25 . 2010-07-17 15:30 -------- d-----w- c:\documents and settings\Lyussy\Application Data\Skype 2010-07-22 18:25 . 2010-07-17 15:34 -------- d-----w- c:\documents and settings\Lyussy\Application Data\Winamp 2010-07-22 18:25 . 2010-07-18 13:02 -------- d-----w- c:\program files\Microsoft Silverlight 2010-07-01 18:16 . 2010-06-22 16:11 66192 ----a-w- c:\documents and settings\Administrator.USER\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-06-23 09:19 . 2010-06-23 09:19 56 ---ha-w- c:\windows.0\system32\ezsidmv.dat . ------- Sigcheck ------- [-] 2009-01-08 . 5AE1C2695F6523AD98B948F2887D8C5E . 361600 . . [5.1.2600.5649] . . c:\windows.0\system32\drivers\tcpip.sys [-] 2009-01-08 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows.0\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-05-26 12:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-02-18 2012912] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows.0\system32\igfxtray.exe" [2008-02-28 141848] "HotKeysCmds"="c:\windows.0\system32\hkcmd.exe" [2008-02-28 166424] "Persistence"="c:\windows.0\system32\igfxpers.exe" [2008-02-28 137752] "RTHDCPL"="RTHDCPL.EXE" [2010-04-30 19523616] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "FixCamera"="c:\windows.0\FixCamera.exe" [2007-02-12 20480] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "tsnp325"="c:\windows.0\tsnp325.exe" [2006-10-10 270336] "snp325"="c:\windows.0\vsnp325.exe" [2006-10-10 827392] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "_nltide_2"="shell32" [X] "_nltide_3"="advpack.dll" [2009-03-08 128512] c:\documents and settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 24576] FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2010-6-22 95232] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoAutoUpdate"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil_.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 10:15 AM 66632] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/24/2010 11:08 PM 135336] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 10:15 AM 12872] R3 SNP325;USB PC Camera (SNPSTD325);c:\windows.0\system32\drivers\snp325.sys [7/10/2010 10:04 AM 10251904] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/22/2010 8:18 PM 135664] S3 Ambfilt;Ambfilt;c:\windows.0\system32\drivers\Ambfilt.sys [6/22/2010 7:54 PM 1691480] . Contents of the 'Scheduled Tasks' folder 2010-09-20 c:\windows.0\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 17:18] 2010-09-20 c:\windows.0\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 17:18] 2010-09-20 c:\windows.0\Tasks\Scheduled Update for Ask Toolbar.job - c:\program files\Ask.com\UpdateTask.exe [2010-05-26 12:23] 2010-09-20 c:\windows.0\Tasks\User_Feed_Synchronization-{53741B5D-C7E8-4C03-9B2D-DB677FCE89AE}.job - c:\windows.0\system32\msfeedssync.exe [2009-01-08 01:31] . . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = https://shop.winamp.com/DRHM/servlet/ControllerServlet?Action=DisplayWaitDontLeavePopUpPage&SiteID=winamp&Locale=en_US&ThemeID=1279300&Env=BASE IE: Add to Google Photos Screensa&ver - c:\windows.0\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html FF - ProfilePath - c:\documents and settings\Lyussy.USER.000\Application Data\Mozilla\Firefox\Profiles\ma6utpfq.default\ FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official FF - prefs.js: keyword.URL - hxxp://yandex.ru/yandsearch?clid=129479&yasoft=barff.en&text= FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll FF - plugin: c:\documents and settings\All Users.WINDOWS.0\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . ************************************************************************** scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="d:\\CCleaner\\ccleaner.exe" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}] @DACL=(02 0000) @="Wireless" "ProcessGroupPolicy"="ProcessWIRELESSPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0E28E245-9368-4853-AD84-6DA3BA35BB75}] @DACL=(02 0000) @="Group Policy Environment" "DisplayName"=expand:"@gpprefcl.dll,-1" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Environment,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyEnviron" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyEnviron" "ProcessGroupPolicyEx"="ProcessGroupPolicyExEnviron" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{17D89FEC-5C44-4972-B12D-241CAEF74509}] @DACL=(02 0000) @="Group Policy Local Users and Groups" "DisplayName"=expand:"@gpprefcl.dll,-2" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Local Users and Groups,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyLocUsAndGroups" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyLocUsAndGroups" "ProcessGroupPolicyEx"="ProcessGroupPolicyExLocUsAndGroups" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{1A6364EB-776B-4120-ADE1-B63A406A76B5}] @DACL=(02 0000) @="Group Policy Device Settings" "DisplayName"=expand:"@gpprefcl.dll,-3" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Device Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDevices" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDevices" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDevices" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}] @DACL=(02 0000) @="Folder Redirection" "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" "DllName"=expand:"fdeploy.dll" "NoMachinePolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "NoGPOListChanges"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "GenerateGroupPolicy"="GenerateGroupPolicy" "EventSources"=multi:"(Folder Redirection,Application)\00\00" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] @DACL=(02 0000) @="Microsoft Disk Quota" "NoMachinePolicy"=dword:00000000 "NoUserPolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "NoBackgroundPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "RequiresSuccessfulRegistry"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000000 "DllName"=expand:"dskquota.dll" "ProcessGroupPolicy"="ProcessGroupPolicy" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}] @DACL=(02 0000) @="Group Policy Network Options" "DisplayName"=expand:"@gpprefcl.dll,-4" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Network Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyNetworkOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyNetworkOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExNetworkOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}] @DACL=(02 0000) @="QoS Packet Scheduler" "ProcessGroupPolicy"="ProcessPSCHEDPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}] @DACL=(02 0000) @="Scripts" "ProcessGroupPolicy"="ProcessScriptsGroupPolicy" "ProcessGroupPolicyEx"="ProcessScriptsGroupPolicyEx" "GenerateGroupPolicy"="GenerateScriptsGroupPolicy" "DllName"=expand:"gptext.dll" "NoSlowLink"=dword:00000001 "NoGPOListChanges"=dword:00000001 "NotifyLinkTransition"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}] @DACL=(02 0000) @="Internet Explorer Zonemapping" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "ProcessGroupPolicy"="ProcessGroupPolicyForZoneMap" "NoGPOListChanges"=dword:00000001 "RequiresSucessfulRegistry"=dword:00000001 "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{5794DAFD-BE60-433f-88A2-1A31939AC01F}] @DACL=(02 0000) @="Group Policy Drive Maps" "DisplayName"=expand:"@gpprefcl.dll,-5" "DllName"=expand:"gpprefcl.dll" "EventSources"="(Group Policy Drive Maps,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDrives" "NoBackgroundPolicy"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDrives" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDrives" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6232C319-91AC-4931-9385-E70C2B099F0E}] @DACL=(02 0000) @="Group Policy Folders" "DisplayName"=expand:"@gpprefcl.dll,-6" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"="" "EventSources"="(Group Policy Folders,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFolders" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFolders" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFolders" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}] @DACL=(02 0000) @="Group Policy Network Shares" "DisplayName"=expand:"@gpprefcl.dll,-7" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Network Shares,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyNetShares" "NoUserPolicy"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyNetShares" "ProcessGroupPolicyEx"="ProcessGroupPolicyExNetShares" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}] @DACL=(02 0000) @="Group Policy Files" "DisplayName"=expand:"@gpprefcl.dll,-8" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Files,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFiles" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFiles" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFiles" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{728EE579-943C-4519-9EF7-AB56765798ED}] @DACL=(02 0000) @="Group Policy Data Sources" "DisplayName"=expand:"@gpprefcl.dll,-9" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Data Sources,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDataSources" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDataSources" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDataSources" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{74EE6C03-5363-4554-B161-627540339CAB}] @DACL=(02 0000) @="Group Policy Ini Files" "DisplayName"=expand:"@gpprefcl.dll,-10" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Ini Files,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyIniFile" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyIniFile" "ProcessGroupPolicyEx"="ProcessGroupPolicyExIniFile" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}] @DACL=(02 0000) @="Internet Explorer User Accelerators" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "NoGPOListChanges"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyForActivities" "ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}] @DACL=(02 0000) "ProcessGroupPolicy"="SceProcessSecurityPolicyGPO" "GenerateGroupPolicy"="SceGenerateGroupPolicy" "ExtensionRsopPlanningDebugLevel"=dword:00000001 "ProcessGroupPolicyEx"="SceProcessSecurityPolicyGPOEx" "ExtensionDebugLevel"=dword:00000001 "DllName"=expand:"scecli.dll" @="Security" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000001 "MaxNoGPOListChangesInterval"=dword:000003c0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{91FBB303-0CD5-4055-BF42-E512A681B325}] @DACL=(02 0000) @="Group Policy Services" "DisplayName"=expand:"@gpprefcl.dll,-11" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Services,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyServices" "ProcessGroupPolicy"="ProcessGroupPolicyServices" "ProcessGroupPolicyEx"="ProcessGroupPolicyExServices" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}] @DACL=(02 0000) @="Internet Explorer Branding" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3014" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "GenerateGroupPolicy"="GenerateGroupPolicy" "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000001 "NoMachinePolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicy" "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A3F3E39B-5D83-4940-B954-28315B82F0A8}] @DACL=(02 0000) @="Group Policy Folder Options" "DisplayName"=expand:"@gpprefcl.dll,-12" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Folder Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFolderOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFolderOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFolderOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{AADCED64-746C-4633-A97C-D61349046527}] @DACL=(02 0000) @="Group Policy Scheduled Tasks" "DisplayName"=expand:"@gpprefcl.dll,-13" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Scheduled Tasks,Application)" "GenerateGroupPolicy"="GenerateGroupPolicySchedTasks" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicySchedTasks" "ProcessGroupPolicyEx"="ProcessGroupPolicyExSchedTasks" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B087BE9D-ED37-454f-AF9C-04291E351182}] @DACL=(02 0000) @="Group Policy Registry" "DisplayName"=expand:"@gpprefcl.dll,-14" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Registry,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyRegistry" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyRegistry" "ProcessGroupPolicyEx"="ProcessGroupPolicyExRegistry" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}] @DACL=(02 0000) "ProcessGroupPolicy"="SceProcessEFSRecoveryGPO" "DllName"=expand:"scecli.dll" @="EFS recovery" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}] @DACL=(02 0000) @="802.3 Group Policy" "DisplayName"=expand:"@dot3gpclnt.dll,-100" "ProcessGroupPolicyEx"="ProcessLANPolicyEx" "GenerateGroupPolicy"="GenerateLANPolicy" "DllName"=expand:"dot3gpclnt.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}] @DACL=(02 0000) @="Group Policy Printers" "DisplayName"=expand:"@gpprefcl.dll,-16" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Printers,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyPrinters" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyPrinters" "ProcessGroupPolicyEx"="ProcessGroupPolicyExPrinters" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}] @DACL=(02 0000) @="Group Policy Shortcuts" "DisplayName"=expand:"@gpprefcl.dll,-17" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Shortcuts,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyShortcuts" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyShortcuts" "ProcessGroupPolicyEx"="ProcessGroupPolicyExShortcuts" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}] @DACL=(02 0000) @="Microsoft Offline Files" "DllName"=expand:"%SystemRoot%\\System32\\cscui.dll" "EnableAsynchronousProcessing"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000000 "NoMachinePolicy"=dword:00000000 "NoSlowLink"=dword:00000000 "NoUserPolicy"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "ProcessGroupPolicy"="ProcessGroupPolicy" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}] @DACL=(02 0000) @="Software Installation" "DllName"=expand:"appmgmts.dll" "ProcessGroupPolicyEx"="ProcessGroupPolicyObjectsEx" "GenerateGroupPolicy"="GenerateGroupPolicy" "NoBackgroundPolicy"=dword:00000000 "RequiresSucessfulRegistry"=dword:00000000 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "EventSources"=multi:"(Application Management,Application)\00(MsiInstaller,Application)\00\00" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}] @DACL=(02 0000) @="Internet Explorer Machine Accelerators" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "NoGPOListChanges"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyForActivities" "ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}] @DACL=(02 0000) @="IP Security" "ProcessGroupPolicy"="ProcessIPSECPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000000 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}] @DACL=(02 0000) @="Group Policy Internet Settings" "DisplayName"=expand:"@gpprefcl.dll,-18" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Internet Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyInternet" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyShortcuts" "ProcessGroupPolicyEx"="ProcessGroupPolicyExInternet" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}] @DACL=(02 0000) @="Group Policy Start Menu Settings" "DisplayName"=expand:"@gpprefcl.dll,-19" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Start Menu Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyStartMenu" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyStartMenu" "ProcessGroupPolicyEx"="ProcessGroupPolicyExStartMenu" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E5094040-C46C-4115-B030-04FB2E545B00}] @DACL=(02 0000) @="Group Policy Regional Options" "DisplayName"=expand:"@gpprefcl.dll,-20" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Regional Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyRegionOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyRegionOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExRegionOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}] @DACL=(02 0000) @="Group Policy Power Options" "DisplayName"=expand:"@gpprefcl.dll,-21" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Power Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyPowerOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyPowerOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExPowerOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{F9C77450-3A41-477E-9310-9ACD617BD9E3}] @DACL=(02 0000) @="Group Policy Applications" "DisplayName"=expand:"@gpprefcl.dll,-15" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Applications,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyApplications" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyApplications" "ProcessGroupPolicyEx"="ProcessGroupPolicyExApplications" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] @DACL=(02 0000) "DllName"="c:\\Program Files\\SUPERAntiSpyware\\SASWINLO.dll" "Logon"="SABWINLOLogon" "Logoff"="SABWINLOLogoff" "Startup"="SABWINLOStartup" "Shutdown"="SABWINLOShutdown" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] @DACL=(02 0000) "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=expand:"crypt32.dll" "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] @DACL=(02 0000) "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=expand:"cryptnet.dll" "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] @DACL=(02 0000) "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy] @DACL=(02 0000) "Asynchronous"=dword:00000001 "DllName"=expand:"%SystemRoot%\\System32\\dimsntfy.dll" "Startup"="WlDimsStartup" "Shutdown"="WlDimsShutdown" "Logon"="WlDimsLogon" "Logoff"="WlDimsLogoff" "StartShell"="WlDimsStartShell" "Lock"="WlDimsLock" "Unlock"="WlDimsUnlock" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @DACL=(02 0000) @="" "DLLName"="igfxdev.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] @DACL=(02 0000) "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] @DACL=(02 0000) "Asynchronous"=dword:00000000 "DllName"=expand:"wlnotify.dll" "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] @DACL=(02 0000) "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=expand:"sclgntfy.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] @DACL=(02 0000) "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] @DACL=(02 0000) "Asynchronous"=dword:00000000 "DllName"=expand:"wlnotify.dll" "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] @DACL=(02 0000) "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList] @DACL=(02 0000) "HelpAssistant"=dword:00000000 "TsInternetUser"=dword:00000000 "SQLAgentCmdExec"=dword:00000000 "NetShowServices"=dword:00000000 "IWAM_"=dword:00010000 "IUSR_"=dword:00010000 "VUSR_"=dword:00010000 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(596) c:\windows.0\system32\WININET.dll c:\windows.0\system32\ieframe.dll c:\windows.0\system32\msi.dll c:\windows.0\system32\webcheck.dll c:\windows.0\system32\wpdshserviceobj.dll c:\windows.0\system32\portabledevicetypes.dll c:\windows.0\system32\portabledeviceapi.dll . Completion time: 2010-09-20 21:09:10 ComboFix-quarantined-files.txt 2010-09-20 18:09 ComboFix2.txt 2010-09-20 14:56 Pre-Run: 33,916,284,928 bytes free Post-Run: 33,927,639,040 bytes free - - End Of File - - C36934DC0B6DCCEA12E1DF75873E7F9F

Здравейте Ицо ето лога който ми поискахте ComboFix 10-09-19.04 - Lyussy 09/20/2010 17:52:47.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2039.1408 [GMT 3:00] Running from: c:\documents and settings\Lyussy.USER.000\Desktop\ComboFix.exe AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} . ((((((((((((((((((((((((( Files Created from 2010-08-20 to 2010-09-20 ))))))))))))))))))))))))))))))) . 2010-09-18 14:00 . 2010-09-18 14:00 -------- d-----w- c:\program files\CCleaner 2010-08-31 17:22 . 2010-08-31 17:22 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\TeamViewer 2010-08-31 16:18 . 2010-08-31 16:33 -------- d-----w- c:\program files\Unlocker 2010-08-29 18:13 . 2010-09-15 17:09 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\AIMP 2010-08-29 18:12 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\Yandex 2010-08-29 18:12 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Yandex 2010-08-29 18:12 . 2010-08-29 18:12 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\Opera 2010-08-29 18:12 . 2010-09-03 03:33 -------- d-----w- c:\program files\AIMP2 2010-08-28 08:44 . 2010-08-28 12:25 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\dvdcss 2010-08-28 08:39 . 2010-08-28 11:52 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\vlc 2010-08-28 06:55 . 2010-08-28 06:55 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\TuneUp Software 2010-08-27 14:56 . 2010-08-27 14:56 -------- d-sh--w- c:\documents and settings\Lyussy.USER.000\IECompatCache 2010-08-25 19:18 . 2010-09-18 14:11 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\AskToolbar 2010-08-25 19:14 . 2010-08-25 19:14 -------- d-----w- c:\program files\Ask.com 2010-08-25 19:13 . 2010-09-12 18:34 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\uTorrent 2010-08-25 17:35 . 2010-08-25 17:35 52224 ----a-w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-08-25 17:35 . 2010-08-25 17:35 117760 ----a-w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-08-25 17:34 . 2010-08-25 17:34 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\SUPERAntiSpyware.com 2010-08-25 17:33 . 2010-08-25 17:33 -------- d-----w- c:\program files\SUPERAntiSpyware 2010-08-25 17:33 . 2010-08-25 17:33 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\SUPERAntiSpyware.com 2010-08-24 20:13 . 2010-09-19 03:28 -------- d-----w- c:\windows.0\system32\NtmsData 2010-08-24 20:12 . 2010-08-24 20:12 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Avira 2010-08-24 20:08 . 2010-03-01 07:05 124784 ----a-w- c:\windows.0\system32\drivers\avipbb.sys 2010-08-24 20:08 . 2010-02-16 11:24 60936 ----a-w- c:\windows.0\system32\drivers\avgntflt.sys 2010-08-24 20:08 . 2009-05-11 09:49 45416 ----a-w- c:\windows.0\system32\drivers\avgntdd.sys 2010-08-24 20:08 . 2009-05-11 09:49 22360 ----a-w- c:\windows.0\system32\drivers\avgntmgr.sys 2010-08-24 20:07 . 2010-08-24 20:07 -------- d-----w- c:\program files\Avira 2010-08-24 20:07 . 2010-08-24 20:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Avira . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-20 14:39 . 2010-07-22 18:30 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Skype 2010-09-18 14:55 . 2010-06-22 16:45 -------- d-----w- c:\program files\Google 2010-09-16 17:43 . 2010-06-22 16:37 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Alwil Software 2010-09-15 17:49 . 2009-04-30 16:35 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-08-25 17:43 . 2010-06-22 17:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-17 15:35 . 2010-07-01 09:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Bluetooth 2010-08-10 12:52 . 2010-08-10 12:52 -------- d-----w- c:\program files\Geist Software Labs 2010-08-06 03:58 . 2010-08-04 06:10 66192 ----a-w- c:\documents and settings\Lyussy.USER.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-07-31 06:44 . 2010-07-22 18:59 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Winamp 2010-07-31 06:27 . 2010-06-22 17:46 -------- d-----w- c:\program files\Winamp 2010-07-22 18:36 . 2010-07-22 18:36 -------- d-----w- c:\documents and settings\Lyussy.USER.000\Application Data\Malwarebytes 2010-07-22 18:25 . 2010-07-17 15:30 -------- d-----w- c:\documents and settings\Lyussy\Application Data\Skype 2010-07-22 18:25 . 2010-07-17 15:34 -------- d-----w- c:\documents and settings\Lyussy\Application Data\Winamp 2010-07-22 18:25 . 2010-07-18 13:02 -------- d-----w- c:\program files\Microsoft Silverlight 2010-07-01 18:16 . 2010-06-22 16:11 66192 ----a-w- c:\documents and settings\Administrator.USER\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-06-23 09:19 . 2010-06-23 09:19 56 ---ha-w- c:\windows.0\system32\ezsidmv.dat 2010-06-22 17:57 . 2010-06-22 17:57 0 ----a-w- c:\windows.0\nsreg.dat . ------- Sigcheck ------- [-] 2009-01-08 . 5AE1C2695F6523AD98B948F2887D8C5E . 361600 . . [5.1.2600.5649] . . c:\windows.0\system32\drivers\tcpip.sys [-] 2009-01-08 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows.0\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-05-26 12:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-02-18 2012912] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows.0\system32\igfxtray.exe" [2008-02-28 141848] "HotKeysCmds"="c:\windows.0\system32\hkcmd.exe" [2008-02-28 166424] "Persistence"="c:\windows.0\system32\igfxpers.exe" [2008-02-28 137752] "RTHDCPL"="RTHDCPL.EXE" [2010-04-30 19523616] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "FixCamera"="c:\windows.0\FixCamera.exe" [2007-02-12 20480] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "tsnp325"="c:\windows.0\tsnp325.exe" [2006-10-10 270336] "snp325"="c:\windows.0\vsnp325.exe" [2006-10-10 827392] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "_nltide_2"="shell32" [X] "_nltide_3"="advpack.dll" [2009-03-08 128512] c:\documents and settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 24576] FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2010-6-22 95232] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoAutoUpdate"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil_.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 10:15 AM 66632] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/24/2010 11:08 PM 135336] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 10:15 AM 12872] R3 SNP325;USB PC Camera (SNPSTD325);c:\windows.0\system32\drivers\snp325.sys [7/10/2010 10:04 AM 10251904] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/22/2010 8:18 PM 135664] S3 Ambfilt;Ambfilt;c:\windows.0\system32\drivers\Ambfilt.sys [6/22/2010 7:54 PM 1691480] . Contents of the 'Scheduled Tasks' folder 2010-09-19 c:\windows.0\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 17:18] 2010-09-20 c:\windows.0\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 17:18] 2010-09-20 c:\windows.0\Tasks\Scheduled Update for Ask Toolbar.job - c:\program files\Ask.com\UpdateTask.exe [2010-05-26 12:23] 2010-09-20 c:\windows.0\Tasks\User_Feed_Synchronization-{53741B5D-C7E8-4C03-9B2D-DB677FCE89AE}.job - c:\windows.0\system32\msfeedssync.exe [2009-01-08 01:31] . . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = https://shop.winamp.com/DRHM/servlet/ControllerServlet?Action=DisplayWaitDontLeavePopUpPage&SiteID=winamp&Locale=en_US&ThemeID=1279300&Env=BASE IE: Add to Google Photos Screensa&ver - c:\windows.0\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html FF - ProfilePath - c:\documents and settings\Lyussy.USER.000\Application Data\Mozilla\Firefox\Profiles\ma6utpfq.default\ FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official FF - prefs.js: keyword.URL - hxxp://yandex.ru/yandsearch?clid=129479&yasoft=barff.en&text= FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll FF - plugin: c:\documents and settings\All Users.WINDOWS.0\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-09-20 17:55 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="d:\\CCleaner\\ccleaner.exe" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}] @DACL=(02 0000) @="Wireless" "ProcessGroupPolicy"="ProcessWIRELESSPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0E28E245-9368-4853-AD84-6DA3BA35BB75}] @DACL=(02 0000) @="Group Policy Environment" "DisplayName"=expand:"@gpprefcl.dll,-1" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Environment,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyEnviron" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyEnviron" "ProcessGroupPolicyEx"="ProcessGroupPolicyExEnviron" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{17D89FEC-5C44-4972-B12D-241CAEF74509}] @DACL=(02 0000) @="Group Policy Local Users and Groups" "DisplayName"=expand:"@gpprefcl.dll,-2" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Local Users and Groups,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyLocUsAndGroups" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyLocUsAndGroups" "ProcessGroupPolicyEx"="ProcessGroupPolicyExLocUsAndGroups" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{1A6364EB-776B-4120-ADE1-B63A406A76B5}] @DACL=(02 0000) @="Group Policy Device Settings" "DisplayName"=expand:"@gpprefcl.dll,-3" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Device Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDevices" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDevices" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDevices" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}] @DACL=(02 0000) @="Folder Redirection" "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" "DllName"=expand:"fdeploy.dll" "NoMachinePolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "NoGPOListChanges"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "GenerateGroupPolicy"="GenerateGroupPolicy" "EventSources"=multi:"(Folder Redirection,Application)\00\00" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] @DACL=(02 0000) @="Microsoft Disk Quota" "NoMachinePolicy"=dword:00000000 "NoUserPolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "NoBackgroundPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "RequiresSuccessfulRegistry"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000000 "DllName"=expand:"dskquota.dll" "ProcessGroupPolicy"="ProcessGroupPolicy" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}] @DACL=(02 0000) @="Group Policy Network Options" "DisplayName"=expand:"@gpprefcl.dll,-4" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Network Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyNetworkOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyNetworkOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExNetworkOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}] @DACL=(02 0000) @="QoS Packet Scheduler" "ProcessGroupPolicy"="ProcessPSCHEDPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}] @DACL=(02 0000) @="Scripts" "ProcessGroupPolicy"="ProcessScriptsGroupPolicy" "ProcessGroupPolicyEx"="ProcessScriptsGroupPolicyEx" "GenerateGroupPolicy"="GenerateScriptsGroupPolicy" "DllName"=expand:"gptext.dll" "NoSlowLink"=dword:00000001 "NoGPOListChanges"=dword:00000001 "NotifyLinkTransition"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}] @DACL=(02 0000) @="Internet Explorer Zonemapping" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "ProcessGroupPolicy"="ProcessGroupPolicyForZoneMap" "NoGPOListChanges"=dword:00000001 "RequiresSucessfulRegistry"=dword:00000001 "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{5794DAFD-BE60-433f-88A2-1A31939AC01F}] @DACL=(02 0000) @="Group Policy Drive Maps" "DisplayName"=expand:"@gpprefcl.dll,-5" "DllName"=expand:"gpprefcl.dll" "EventSources"="(Group Policy Drive Maps,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDrives" "NoBackgroundPolicy"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDrives" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDrives" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6232C319-91AC-4931-9385-E70C2B099F0E}] @DACL=(02 0000) @="Group Policy Folders" "DisplayName"=expand:"@gpprefcl.dll,-6" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"="" "EventSources"="(Group Policy Folders,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFolders" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFolders" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFolders" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}] @DACL=(02 0000) @="Group Policy Network Shares" "DisplayName"=expand:"@gpprefcl.dll,-7" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Network Shares,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyNetShares" "NoUserPolicy"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyNetShares" "ProcessGroupPolicyEx"="ProcessGroupPolicyExNetShares" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}] @DACL=(02 0000) @="Group Policy Files" "DisplayName"=expand:"@gpprefcl.dll,-8" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Files,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFiles" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFiles" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFiles" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{728EE579-943C-4519-9EF7-AB56765798ED}] @DACL=(02 0000) @="Group Policy Data Sources" "DisplayName"=expand:"@gpprefcl.dll,-9" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Data Sources,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyDataSources" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyDataSources" "ProcessGroupPolicyEx"="ProcessGroupPolicyExDataSources" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{74EE6C03-5363-4554-B161-627540339CAB}] @DACL=(02 0000) @="Group Policy Ini Files" "DisplayName"=expand:"@gpprefcl.dll,-10" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Ini Files,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyIniFile" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyIniFile" "ProcessGroupPolicyEx"="ProcessGroupPolicyExIniFile" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}] @DACL=(02 0000) @="Internet Explorer User Accelerators" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "NoGPOListChanges"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyForActivities" "ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}] @DACL=(02 0000) "ProcessGroupPolicy"="SceProcessSecurityPolicyGPO" "GenerateGroupPolicy"="SceGenerateGroupPolicy" "ExtensionRsopPlanningDebugLevel"=dword:00000001 "ProcessGroupPolicyEx"="SceProcessSecurityPolicyGPOEx" "ExtensionDebugLevel"=dword:00000001 "DllName"=expand:"scecli.dll" @="Security" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000001 "MaxNoGPOListChangesInterval"=dword:000003c0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{91FBB303-0CD5-4055-BF42-E512A681B325}] @DACL=(02 0000) @="Group Policy Services" "DisplayName"=expand:"@gpprefcl.dll,-11" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Services,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyServices" "ProcessGroupPolicy"="ProcessGroupPolicyServices" "ProcessGroupPolicyEx"="ProcessGroupPolicyExServices" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}] @DACL=(02 0000) @="Internet Explorer Branding" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3014" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "GenerateGroupPolicy"="GenerateGroupPolicy" "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000001 "NoMachinePolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicy" "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A3F3E39B-5D83-4940-B954-28315B82F0A8}] @DACL=(02 0000) @="Group Policy Folder Options" "DisplayName"=expand:"@gpprefcl.dll,-12" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Folder Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyFolderOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyFolderOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExFolderOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{AADCED64-746C-4633-A97C-D61349046527}] @DACL=(02 0000) @="Group Policy Scheduled Tasks" "DisplayName"=expand:"@gpprefcl.dll,-13" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Scheduled Tasks,Application)" "GenerateGroupPolicy"="GenerateGroupPolicySchedTasks" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicySchedTasks" "ProcessGroupPolicyEx"="ProcessGroupPolicyExSchedTasks" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B087BE9D-ED37-454f-AF9C-04291E351182}] @DACL=(02 0000) @="Group Policy Registry" "DisplayName"=expand:"@gpprefcl.dll,-14" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Registry,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyRegistry" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyRegistry" "ProcessGroupPolicyEx"="ProcessGroupPolicyExRegistry" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}] @DACL=(02 0000) "ProcessGroupPolicy"="SceProcessEFSRecoveryGPO" "DllName"=expand:"scecli.dll" @="EFS recovery" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}] @DACL=(02 0000) @="802.3 Group Policy" "DisplayName"=expand:"@dot3gpclnt.dll,-100" "ProcessGroupPolicyEx"="ProcessLANPolicyEx" "GenerateGroupPolicy"="GenerateLANPolicy" "DllName"=expand:"dot3gpclnt.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}] @DACL=(02 0000) @="Group Policy Printers" "DisplayName"=expand:"@gpprefcl.dll,-16" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Printers,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyPrinters" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyPrinters" "ProcessGroupPolicyEx"="ProcessGroupPolicyExPrinters" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}] @DACL=(02 0000) @="Group Policy Shortcuts" "DisplayName"=expand:"@gpprefcl.dll,-17" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Shortcuts,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyShortcuts" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyShortcuts" "ProcessGroupPolicyEx"="ProcessGroupPolicyExShortcuts" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}] @DACL=(02 0000) @="Microsoft Offline Files" "DllName"=expand:"%SystemRoot%\\System32\\cscui.dll" "EnableAsynchronousProcessing"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000000 "NoMachinePolicy"=dword:00000000 "NoSlowLink"=dword:00000000 "NoUserPolicy"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "ProcessGroupPolicy"="ProcessGroupPolicy" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}] @DACL=(02 0000) @="Software Installation" "DllName"=expand:"appmgmts.dll" "ProcessGroupPolicyEx"="ProcessGroupPolicyObjectsEx" "GenerateGroupPolicy"="GenerateGroupPolicy" "NoBackgroundPolicy"=dword:00000000 "RequiresSucessfulRegistry"=dword:00000000 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "EventSources"=multi:"(Application Management,Application)\00(MsiInstaller,Application)\00\00" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}] @DACL=(02 0000) @="Internet Explorer Machine Accelerators" "DisplayName"="@c:\\WINDOWS.0\\system32\\iedkcs32.dll.mui,-3051" "DllName"="c:\\WINDOWS.0\\system32\\iedkcs32.dll" "NoGPOListChanges"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyForActivities" "ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}] @DACL=(02 0000) @="IP Security" "ProcessGroupPolicy"="ProcessIPSECPolicy" "DllName"=expand:"gptext.dll" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000000 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}] @DACL=(02 0000) @="Group Policy Internet Settings" "DisplayName"=expand:"@gpprefcl.dll,-18" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Internet Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyInternet" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyShortcuts" "ProcessGroupPolicyEx"="ProcessGroupPolicyExInternet" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}] @DACL=(02 0000) @="Group Policy Start Menu Settings" "DisplayName"=expand:"@gpprefcl.dll,-19" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Start Menu Settings,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyStartMenu" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyStartMenu" "ProcessGroupPolicyEx"="ProcessGroupPolicyExStartMenu" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E5094040-C46C-4115-B030-04FB2E545B00}] @DACL=(02 0000) @="Group Policy Regional Options" "DisplayName"=expand:"@gpprefcl.dll,-20" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Regional Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyRegionOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyRegionOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExRegionOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}] @DACL=(02 0000) @="Group Policy Power Options" "DisplayName"=expand:"@gpprefcl.dll,-21" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Power Options,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyPowerOptions" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyPowerOptions" "ProcessGroupPolicyEx"="ProcessGroupPolicyExPowerOptions" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{F9C77450-3A41-477E-9310-9ACD617BD9E3}] @DACL=(02 0000) @="Group Policy Applications" "DisplayName"=expand:"@gpprefcl.dll,-15" "DllName"=expand:"gpprefcl.dll" "EnableAsynchronousProcessing"=dword:00000001 "EventSources"="(Group Policy Applications,Application)" "GenerateGroupPolicy"="GenerateGroupPolicyApplications" "PerUserLocalSettings"=dword:00000001 "ProcessGroupPolicy"="ProcessGroupPolicyApplications" "ProcessGroupPolicyEx"="ProcessGroupPolicyExApplications" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] @DACL=(02 0000) "DllName"="c:\\Program Files\\SUPERAntiSpyware\\SASWINLO.dll" "Logon"="SABWINLOLogon" "Logoff"="SABWINLOLogoff" "Startup"="SABWINLOStartup" "Shutdown"="SABWINLOShutdown" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] @DACL=(02 0000) "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=expand:"crypt32.dll" "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] @DACL=(02 0000) "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=expand:"cryptnet.dll" "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] @DACL=(02 0000) "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy] @DACL=(02 0000) "Asynchronous"=dword:00000001 "DllName"=expand:"%SystemRoot%\\System32\\dimsntfy.dll" "Startup"="WlDimsStartup" "Shutdown"="WlDimsShutdown" "Logon"="WlDimsLogon" "Logoff"="WlDimsLogoff" "StartShell"="WlDimsStartShell" "Lock"="WlDimsLock" "Unlock"="WlDimsUnlock" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @DACL=(02 0000) @="" "DLLName"="igfxdev.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] @DACL=(02 0000) "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] @DACL=(02 0000) "Asynchronous"=dword:00000000 "DllName"=expand:"wlnotify.dll" "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] @DACL=(02 0000) "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=expand:"sclgntfy.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] @DACL=(02 0000) "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] @DACL=(02 0000) "Asynchronous"=dword:00000000 "DllName"=expand:"wlnotify.dll" "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] @DACL=(02 0000) "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList] @DACL=(02 0000) "HelpAssistant"=dword:00000000 "TsInternetUser"=dword:00000000 "SQLAgentCmdExec"=dword:00000000 "NetShowServices"=dword:00000000 "IWAM_"=dword:00010000 "IUSR_"=dword:00010000 "VUSR_"=dword:00010000 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2572) c:\windows.0\system32\WININET.dll c:\windows.0\system32\msi.dll c:\windows.0\system32\ieframe.dll c:\windows.0\system32\webcheck.dll c:\windows.0\system32\wpdshserviceobj.dll c:\windows.0\system32\portabledevicetypes.dll c:\windows.0\system32\portabledeviceapi.dll . Completion time: 2010-09-20 17:56:48 ComboFix-quarantined-files.txt 2010-09-20 14:56 Pre-Run: 33,853,874,176 bytes free Post-Run: 33,930,027,008 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0 [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 0D7F33494AB607AD6E1C2E49784926E9

Здравейте не намерих логове освен папка BASE= Какво да правя сега.

Здравейте Ицо аз се опитах да направя това но не намерих двата лога изписани по долу , затова ако има някоя друга програма да ми съдействате да я намеря . Благодаря!

Здравейте! Имам проблем с този вирус и поради това ми прекъсва интернета и скайпа. www.malwarebytes.org Версия на базата от данни: 4638 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 9/17/2010 2:54:33 PM mbam-log-2010-09-17 (14-54-33).txt Тип сканиране: Бързо сканиране Сканирани обекти: 196500 Изминало време: 4 минута(и), 51 секунда(и) Заразени процеси в паметта: 0 Заразени модули в паметта: 0 Заразени ключове в регистратурата: 0 Заразени стойности в регистратурата: 0 Заразени информационни обекти в регистратурата: 0 Заразени папки: 0 Заразени файлове: 0 Заразени процеси в паметта: (Не бяха открити зловредни обекти) Заразени модули в паметта: (Не бяха открити зловредни обекти) Заразени ключове в регистратурата: (Не бяха открити зловредни обекти) Заразени стойности в регистратурата: (Не бяха открити зловредни обекти) Заразени информационни обекти в регистратурата: (Не бяха открити зловредни обекти) Заразени папки: (Не бяха открити зловредни обекти) Заразени файлове: (Не бяха открити зловредни обекти) мам проблем с този вирус и поради това ми прекъсва интернета и скайпа. Attach.txt DDS.txt