Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    please: sprawdzenie loga

    IP: *.neoplus.adsl.tpnet.pl 21.04.05, 11:22
    Logfile of HijackThis v1.99.1
    Scan saved at 11:20:20, on 2005-04-21
    Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\PROGRA~1\WANADOO\TaskbarIcon.exe
    C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Winamp\Winamp.exe
    C:\WINDOWS\system32\SNDVOL32.EXE
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    C:\Program Files\Wanadoo\EspaceWanadoo.exe
    C:\Program Files\Wanadoo\ComComp.exe
    C:\Program Files\Wanadoo\Watch.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    D:\Programy instalacyjne\Diagnostyka\szczepionki.exe
    D:\Programy instalacyjne\Diagnostyka\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.onet.pl/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada
    Plus wita Cie w Internecie
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    F2 - REG:system.ini: Shell=explorer.exe
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1
    \SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
    \NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky
    Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
    O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-
    Virus Personal Pro\avpcc.exe" /wait
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05
    \bin\jusched.exe
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program
    Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash
    Screen\CTEaxSpl.EXE /run
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program
    Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\TaskbarIcon.exe
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [loaddll] loaddll.exe
    O4 - Global Startup: Kaspersky Anti-Hacker.lnk = ?
    O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
    \dslmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
    Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
    res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
    C:\WINDOWS\system32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
    00401C608501} - C:\WINDOWS\system32\msjava.dll
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} -
    C:\Program Files\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} -
    C:\Program Files\ICQ\ICQ.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
    C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
    00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: komentator - sport.onet.pl/komentator.cab
    O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} -
    downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus
    scanner) - security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
    v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099409426165
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility
    Class) - security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) -
    www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer
    Class) - www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
    skaner.mks.com.pl/SkanerOnline.cab
    O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GINSOCCER Class) -
    67.15.101.3/g_bin/pl/soccer_2_0_0_7.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
    download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4432/mcfscan.cab
    O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) -
    67.15.101.3/g_bin/pl/billard8_2_0_0_21.cab
    O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
    67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9AF18BF6-BAFD-4468-80DE-
    2C1498279045}: NameServer = 194.204.152.34 217.98.63.164
    O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner -
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal
    Pro\avpcc.exe" /service (file missing)
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
    C:\WINDOWS\System32\CTsvcCDA.exe
    O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner -
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal
    Pro\avpm.exe" /service (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
    C:\WINDOWS\System32\nvsvc32.exe

    Obserwuj wątek
      • Gość: Kolobos Re: please: sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 21.04.05, 12:18
        Na twoim miejscy wywalil bym aplikacje tpsa do neostrady i zainstalowal sam
        modem, opis jak to zrobic masz tutaj www.neostrada.info (w skrocie to
        instalujesz same sterowniki z plyty i recznie ustawiasz polaczenie)

        Z log'a usun te wpisy:
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
        C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm <- zbedne
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada
        Plus wita Cie w Internecie <- zbedne
        O4 - HKLM\..\Run: [loaddll] loaddll.exe <- to spyware

        W Start->Uruchom-Msconfig->Uruchamianie mozesz odznaczyc to:
        Jet Detection
        UpdReg
        • Gość: andrew Re: please: sprawdzenie loga IP: *.neoplus.adsl.tpnet.pl 21.04.05, 14:50
          Dzieki , jak zwykle mozna liczyc nz Kolobosa(w czym przeszkadza ta aplikacja od
          tepsy?)
          • Gość: Kolobos Re: please: sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 21.04.05, 14:54
            W zyciu przeszkadza ;-) Zabiera miejsce na pasku, zasoby, ram i jest
            denerwujaca do tego instaluje ze soba mase zbednych rzeczy.Ale jak Ci to nie
            przeszkadza to ja zostaw :-)
            • Gość: andrew Re: please: sprawdzenie loga IP: *.neoplus.adsl.tpnet.pl 21.04.05, 15:01
              Poslucham fachowca:)
          • neder Re: please: sprawdzenie loga 21.04.05, 15:03
            Gość portalu: andrew napisał(a):

            > Dzieki , jak zwykle mozna liczyc nz Kolobosa(w czym przeszkadza ta aplikacja
            od
            >
            > tepsy?)

            a ja jednak polecam odinstalowanie. Jak to zrobić masz w FAQ forum komputery,
            czyli tu
            forum.gazeta.pl/forum/72,2.html?f=34&w=15679891&a=15680440
            oprogramowanie od nesostrady jest zbędne - chyba, że korzystasz z takich opcji
            jak Moje programy i inne czy jakkolwiek to sie inaczej nazywa... po prostu do
            działania netu wystarczą same sterowniki do modemu (masz je już zgrane z
            płytki) i nic więcej - no oprócz skonfigurowania połączenia tak jak jest podane
            w linku. Ja to ostatnio zrobiłam i samo połączenie z internetem trwa co
            najmniej dwa razy szybciej. Nie jest to nic "niebezpiecznego" bo nawet na
            infolinii nestrady powiedzą Ci jak to można zrobić.
            • Gość: andrew Re: please: sprawdzenie loga(czym usunac spyware?) IP: *.neoplus.adsl.tpnet.pl 21.04.05, 15:55
              Logfile of HijackThis v1.99.1
              Scan saved at 15:54:58, on 2005-04-21
              Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\WINDOWS\explorer.exe
              C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
              C:\WINDOWS\System32\CTsvcCDA.exe
              C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
              C:\WINDOWS\System32\nvsvc32.exe
              C:\WINDOWS\System32\MsPMSPSv.exe
              C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
              C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
              C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
              C:\PROGRA~1\WANADOO\TaskbarIcon.exe
              C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
              C:\Program Files\Winamp\winampa.exe
              C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
              C:\Program Files\Wanadoo\EspaceWanadoo.exe
              C:\Program Files\Wanadoo\ComComp.exe
              C:\Program Files\Wanadoo\Watch.exe
              C:\Program Files\Internet Explorer\iexplore.exe
              C:\Program Files\Winamp\winamp.exe
              C:\Program Files\Tlen.pl\tlen.exe
              D:\Programy instalacyjne\Diagnostyka\HijackThis.exe
              C:\Program Files\Internet Explorer\iexplore.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
              www.onet.pl/
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
              F2 - REG:system.ini: Shell=explorer.exe
              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
              C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
              O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1
              \SPYBOT~1\SDHelper.dll
              O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
              \NvCpl.dll,NvStartup
              O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
              O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky
              Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
              O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus
              Personal Pro\avpcc.exe" /wait
              O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05
              \bin\jusched.exe
              O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash
              Screen\CTEaxSpl.EXE /run
              O4 - HKLM\..\Run: [RemoteControl] "C:\Program
              Files\CyberLink\PowerDVD\PDVDServ.exe"
              O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\TaskbarIcon.exe
              O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
              O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
              O4 - HKLM\..\Run: [MSConfig]
              C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
              O4 - HKLM\..\Run: [loaddll] loaddll.exe
              O4 - Global Startup: Kaspersky Anti-Hacker.lnk = ?
              O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
              \dslmon.exe
              O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
              Office\Office10\OSA.EXE
              O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
              res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
              C:\WINDOWS\system32\msjava.dll
              O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
              00401C608501} - C:\WINDOWS\system32\msjava.dll
              O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} -
              C:\Program Files\ICQ\ICQ.exe
              O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} -
              C:\Program Files\ICQ\ICQ.exe
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
              C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
              00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O16 - DPF: komentator - sport.onet.pl/komentator.cab
              O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} -
              downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
              O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
              security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
              O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
              v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099409426165
              O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility
              Class) - security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
              O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) -
              www.bitdefender.com/scan/Msie/bitdefender.cab
              O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
              www.pandasoftware.com/activescan/as5/asinst.cab
              O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
              skaner.mks.com.pl/SkanerOnline.cab
              O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GINSOCCER Class) -
              67.15.101.3/g_bin/pl/soccer_2_0_0_7.cab
              O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
              download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4432/mcfscan.cab
              O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) -
              67.15.101.3/g_bin/pl/billard8_2_0_0_21.cab
              O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
              67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{9AF18BF6-BAFD-4468-80DE-2C1498279045}:
              NameServer = 194.204.152.34 217.98.63.164
              O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program
              Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service (file
              missing)
              O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
              C:\WINDOWS\System32\CTsvcCDA.exe
              O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner -
              C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal
              Pro\avpm.exe" /service (file missing)
              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
              C:\WINDOWS\System32\nvsvc32.exe

              • Gość: Kolobos Re: please: sprawdzenie loga(czym usunac spyware? IP: *.warszawa.sdi.tpnet.pl 21.04.05, 17:00
                Z tego co widze to masz tylko to o czym pisalem wczesniej:
                O4 - HKLM\..\Run: [loaddll] loaddll.exe
                Fix Checked w hijackthis, nastepnie odszukaj ten plik i go usun jakby nie
                chcial sie skasowac to w hijackthis wejdz w Misc Tools i tam delete file on
                reboot wybierz ten plik i ok, po resecie juz go nie powinno byc.
                • Gość: andrew Re: please: sprawdzenie loga(czym usunac spyware? IP: *.neoplus.adsl.tpnet.pl 23.04.05, 19:47
                  Logfile of HijackThis v1.99.1
                  Scan saved at 19:45:41, on 2005-04-23
                  Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\WINDOWS\explorer.exe
                  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
                  C:\WINDOWS\System32\CTsvcCDA.exe
                  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
                  C:\WINDOWS\System32\nvsvc32.exe
                  C:\WINDOWS\System32\MsPMSPSv.exe
                  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
                  C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
                  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
                  C:\PROGRA~1\WANADOO\TaskbarIcon.exe
                  C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
                  C:\Program Files\Wanadoo\EspaceWanadoo.exe
                  C:\Program Files\Wanadoo\ComComp.exe
                  C:\WINDOWS\system32\wuauclt.exe
                  C:\Program Files\Wanadoo\Watch.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  D:\Programy instalacyjne\Diagnostyka\HijackThis.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
                  www.onet.pl/
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                  C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
                  F2 - REG:system.ini: Shell=explorer.exe
                  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
                  C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
                  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1
                  \SPYBOT~1\SDHelper.dll
                  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
                  \NvCpl.dll,NvStartup
                  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                  O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky
                  Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
                  O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus
                  Personal Pro\avpcc.exe" /wait
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05
                  \bin\jusched.exe
                  O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash
                  Screen\CTEaxSpl.EXE /run
                  O4 - HKLM\..\Run: [RemoteControl] "C:\Program
                  Files\CyberLink\PowerDVD\PDVDServ.exe"
                  O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\TaskbarIcon.exe
                  O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
                  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                  O4 - HKLM\..\Run: [MSConfig]
                  C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
                  O4 - HKLM\..\Run: [loaddll] loaddll.exe
                  O4 - Global Startup: Kaspersky Anti-Hacker.lnk = ?
                  O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
                  \dslmon.exe
                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
                  Office\Office10\OSA.EXE
                  O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
                  res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
                  C:\WINDOWS\system32\msjava.dll
                  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
                  00401C608501} - C:\WINDOWS\system32\msjava.dll
                  O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} -
                  C:\Program Files\ICQ\ICQ.exe
                  O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} -
                  C:\Program Files\ICQ\ICQ.exe
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
                  C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
                  00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O16 - DPF: komentator - sport.onet.pl/komentator.cab
                  O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} -
                  downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
                  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
                  security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
                  v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099409426165
                  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility
                  Class) - security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                  O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) -
                  www.bitdefender.com/scan/Msie/bitdefender.cab
                  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
                  www.pandasoftware.com/activescan/as5/asinst.cab
                  O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
                  skaner.mks.com.pl/SkanerOnline.cab
                  O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GINSOCCER Class) -
                  67.15.101.3/g_bin/pl/soccer_2_0_0_7.cab
                  O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
                  download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4432/mcfscan.cab
                  O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) -
                  67.15.101.3/g_bin/pl/billard8_2_0_0_21.cab
                  O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
                  67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{9AF18BF6-BAFD-4468-80DE-2C1498279045}:
                  NameServer = 194.204.152.34 217.98.63.164
                  O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program
                  Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service (file
                  missing)
                  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
                  C:\WINDOWS\System32\CTsvcCDA.exe
                  O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner -
                  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal
                  Pro\avpm.exe" /service (file missing)
                  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
                  C:\WINDOWS\System32\nvsvc32.exe

                  ZROBILEM WSZYSTKO CO MOWILES KOLOBOS ;I WIDZE ZE DALEJ JEST load exe :(
                  • Gość: Kolobos Re: please: sprawdzenie loga(czym usunac spyware? IP: *.warszawa.sdi.tpnet.pl 23.04.05, 20:24
                    No wiec zabierz sie za to inaczej:
                    securityresponse.symantec.com/avcenter/venc/data/spyware.winvest.html
                    Przeczytaj cale, usun wszystkie pliki i wpisy w rejestrze, ktore sa wymienione.
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin