Dodaj do ulubionych

Proszę o sprawdzenie loga z hijack.

IP: *.neoplus.adsl.tpnet.pl 30.08.05, 22:08
Logfile of HijackThis v1.99.1
Scan saved at 22:08:39, on 2005-08-30
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\update32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\KeyboardHlpr.exe
F:\Nikon\NkView6\NkvMon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\aa\Pulpit\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.neostrada.pl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} -
C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: FlashFXP Helper for Internet Explorer -
{E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
/autostart
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate
Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
-atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [KeyboardHlpr.exe] C:\WINDOWS\System32\KeyboardHlpr.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program
Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: NkvMon.exe.lnk = F:\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office\OSA9.EXE
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st
800-840\dslmon.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
software-dl.real.com/093c3c08ad15bb9df219/netzip/RdxIE601.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
67.15.101.3/g_bin/pl/snooker_2_0_0_22.cab
O17 -
HKLM\System\CCS\Services\Tcpip\..\{C176CAA2-4703-4EDD-811D-B92435320F69}:
NameServer = 194.204.152.34 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Microsoft Windows Service - Unknown owner - C:\WINDOWS\update32.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe

Obserwuj wątek
    • Gość: Kolobos Re: Proszę o sprawdzenie loga z hijack. IP: *.warszawa.sdi.tpnet.pl 30.08.05, 22:43
      Wywal aplikacje od neostrady:
      O4 - HKLM\..\Run: [KeyboardHlpr.exe] C:\WINDOWS\System32\KeyboardHlpr.exe <- to
      wyglada na jakis syf, wywal to i usun plik
      O23 - Service: Microsoft Windows Service - Unknown owner -
      C:\WINDOWS\update32.exe <- a tutaj mamy:
      uk.trendmicro-europe.com/consumer/vinfo/encyclopedia.php?
      LYstr=VMAINDATA&vNav=3&VName=WORM_SDBOT.CBJ (napraw to co masz tam opisane).
      Tez do kasacji, zatrzymaj usluge i usun plik.
      • Gość: Tomek Re: Proszę o sprawdzenie loga z hijack. IP: *.neoplus.adsl.tpnet.pl 31.08.05, 10:29
        No po usuwałem to co mi kazałeś tylko nie wiem co tam na tej stronce chodzi bo
        ona jest po angielsku.
        Mogę wiedzieć co to jest za plik : C\WINDOWS\system32\rdriv.sys


        Logfile of HijackThis v1.99.1
        Scan saved at 10:28:55, on 2005-08-31
        Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\SYSTEM32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\system32\LEXBCES.EXE
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\system32\LEXPPS.EXE
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\task.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\PROGRA~1\NEOSTR~1\CnxMon.exe
        C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
        C:\Program Files\QuickTime\qttask.exe
        C:\Program Files\Common Files\Real\Update_OB\realsched.exe
        C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
        C:\WINDOWS\System32\ctfmon.exe
        C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
        F:\Nikon\NkView6\NkvMon.exe
        C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
        C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
        C:\PROGRA~1\NEOSTR~1\ComComp.exe
        C:\PROGRA~1\NEOSTR~1\Watch.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\WINDOWS\System32\KeyboardHlpr.exe
        C:\WINDOWS\system32\notepad.exe
        C:\WINDOWS\system32\cmd.exe
        C:\Program Files\Microsoft Office\Office\WINWORD.EXE
        C:\WINDOWS\msagent\AgentSvr.exe
        C:\Documents and Settings\aa\Pulpit\hijackthis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.neostrada.pl
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.neostrada.pl
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} -
        C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
        C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx (file missing)
        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
        C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: FlashFXP Helper for Internet Explorer -
        {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
        C:\WINDOWS\System32\msdxm.ocx
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
        C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
        /autostart
        O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate
        Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
        O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
        O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
        -atboottime
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
        Files\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
        O4 - HKLM\..\Run: [KeyboardHlpr.exe] C:\WINDOWS\System32\KeyboardHlpr.exe
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
        O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program
        Files\InterVideo\Common\Bin\WinCinemaMgr.exe
        O4 - Global Startup: NkvMon.exe.lnk = F:\Nikon\NkView6\NkvMon.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
        Office\Office\OSA9.EXE
        O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st
        800-840\dslmon.exe
        O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
        O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
        software-dl.real.com/093c3c08ad15bb9df219/netzip/RdxIE601.cab
        O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
        67.15.101.3/g_bin/pl/snooker_2_0_0_22.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{C176CAA2-4703-4EDD-811D-B92435320F69}:
        NameServer = 194.204.152.34 217.98.63.164
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
        Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
        Software\Avast4\ashMaiSv.exe" /service (file missing)
        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
        Software\Avast4\ashWebSv.exe" /service (file missing)
        O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
        C:\WINDOWS\system32\LEXBCES.EXE
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
        C:\WINDOWS\System32\nvsvc32.exe
        O23 - Service: Windows Task Manager Service (tskman) - Unknown owner -
        C:\WINDOWS\task.exe


              • Gość: Tomek Re: Proszę o sprawdzenie loga z hijack. IP: *.neoplus.adsl.tpnet.pl 01.09.05, 10:53
                Powiec mi coś o pliku ktory mi się cały czas pojawia na dysku C(jak go usunę to
                on znowu powraca) a nazywa sie boot.exe. Slyszałem że to są skutki działania
                groźnego wira.


                Logfile of HijackThis v1.99.1
                Scan saved at 10:53:12, on 2005-09-01
                Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\SYSTEM32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\Explorer.EXE
                C:\WINDOWS\system32\LEXBCES.EXE
                C:\WINDOWS\system32\spoolsv.exe
                C:\WINDOWS\system32\LEXPPS.EXE
                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                C:\WINDOWS\System32\nvsvc32.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\task.exe
                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                C:\PROGRA~1\NEOSTR~1\CnxMon.exe
                C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
                C:\Program Files\QuickTime\qttask.exe
                C:\Program Files\Common Files\Real\Update_OB\realsched.exe
                C:\WINDOWS\System32\msupdate32.exe
                C:\WINDOWS\System32\ctfmon.exe
                C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                C:\WINDOWS\System32\KeyboardHlpr.exe
                F:\Nikon\NkView6\NkvMon.exe
                C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                C:\WINDOWS\System32\wuauclt.exe
                C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
                C:\PROGRA~1\NEOSTR~1\ComComp.exe
                C:\PROGRA~1\NEOSTR~1\Watch.exe
                C:\Program Files\Tlen.pl\tlen.exe
                C:\Program Files\Mozilla Firefox\firefox.exe
                C:\Documents and Settings\aa\Pulpit\hijackthis\HijackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
                www.neostrada.pl
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
                www.neostrada.pl
                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
                R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} -
                C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
                C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx (file missing)
                O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
                C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                O2 - BHO: FlashFXP Helper for Internet Explorer -
                {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
                O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
                C:\WINDOWS\System32\msdxm.ocx
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
                C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
                /autostart
                O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate
                Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
                O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
                O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
                -atboottime
                O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
                Files\Real\Update_OB\realsched.exe" -osboot
                O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
                O4 - HKLM\..\Run: [KeyboardHlpr.exe] C:\WINDOWS\System32\KeyboardHlpr.exe
                O4 - HKLM\..\Run: [microsft Updates] msupdate32.exe
                O4 - HKLM\..\RunServices: [microsft Updates] msupdate32.exe
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program
                Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                O4 - Global Startup: NkvMon.exe.lnk = F:\Nikon\NkView6\NkvMon.exe
                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
                Office\Office\OSA9.EXE
                O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st
                800-840\dslmon.exe
                O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
                software-dl.real.com/093c3c08ad15bb9df219/netzip/RdxIE601.cab
                O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
                67.15.101.3/g_bin/pl/snooker_2_0_0_22.cab
                O17 - HKLM\System\CCS\Services\Tcpip\..\{C176CAA2-4703-4EDD-811D-B92435320F69}:
                NameServer = 194.204.152.34 217.98.63.164
                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
                Software\Avast4\ashServ.exe
                O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
                Software\Avast4\ashMaiSv.exe" /service (file missing)
                O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
                Software\Avast4\ashWebSv.exe" /service (file missing)
                O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
                C:\WINDOWS\system32\LEXBCES.EXE
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
                C:\WINDOWS\System32\nvsvc32.exe
                O23 - Service: Windows Task Manager Service (tskman) - Unknown owner -
                C:\WINDOWS\task.exe

                • Gość: Kolobos Re: Proszę o sprawdzenie loga z hijack. IP: *.warszawa.sdi.tpnet.pl 01.09.05, 13:29
                  hm czy Ty w ogole czytasz to Ci wczesniej napisalem? Bo z tego co widze to nie
                  i ciagle masz taki sam syf!


                  R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} -
                  C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
                  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
                  C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx (file
                  missing)
                  O4 - HKLM\..\Run: [KeyboardHlpr.exe] C:\WINDOWS\System32\KeyboardHlpr.exe <-
                  usun plik
                  O4 - HKLM\..\Run: [microsft Updates] msupdate32.exe <- usun plik z dysku
                  O4 - HKLM\..\RunServices: [microsft Updates] msupdate32.exe
                  O23 - Service: Windows Task Manager Service (tskman) - Unknown owner -
                  C:\WINDOWS\task.exe <- wylacz usluge, usun plik i usun usluge w hijackthis
                  (delete nt service wpisz tskman)

                  Tutaj masz swoj boot.exe:
                  securityresponse.symantec.com/avcenter/venc/data/w32.elem.trojan.html
                  Jak juz wszystko usuniesz to wklej nowy log, jak nie usuniesz to nie wklejaj bo
                  i tak Ci nie pomoge.
                  • Gość: Tomek Re: Proszę o sprawdzenie loga z hijack. IP: *.neoplus.adsl.tpnet.pl 01.09.05, 21:58
                    Raczej powinno być ok. Zrobiłem co mi kazałeś.


                    Logfile of HijackThis v1.99.1
                    Scan saved at 21:58:32, on 2005-09-01
                    Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\SYSTEM32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\LEXBCES.EXE
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\WINDOWS\system32\LEXPPS.EXE
                    C:\WINDOWS\Explorer.EXE
                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    C:\WINDOWS\System32\nvsvc32.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    C:\PROGRA~1\NEOSTR~1\CnxMon.exe
                    C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
                    C:\Program Files\QuickTime\qttask.exe
                    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
                    C:\WINDOWS\System32\msupdate32.exe
                    C:\WINDOWS\System32\ctfmon.exe
                    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                    F:\Nikon\NkView6\NkvMon.exe
                    C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
                    C:\PROGRA~1\NEOSTR~1\ComComp.exe
                    C:\PROGRA~1\NEOSTR~1\Watch.exe
                    C:\Program Files\Mozilla Firefox\firefox.exe
                    C:\WINDOWS\system32\cmd.exe
                    C:\WINDOWS\SYSTEM32\ftp.exe
                    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
                    C:\Documents and Settings\aa\Pulpit\hijackthis\HijackThis.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
                    www.neostrada.pl
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
                    www.neostrada.pl
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
                    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
                    C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O2 - BHO: FlashFXP Helper for Internet Explorer -
                    {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
                    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
                    C:\WINDOWS\System32\msdxm.ocx
                    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
                    C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
                    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                    O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
                    /autostart
                    O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate
                    Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
                    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
                    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
                    -atboottime
                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
                    Files\Real\Update_OB\realsched.exe" -osboot
                    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
                    O4 - HKLM\..\Run: [microsft Updates] msupdate32.exe
                    O4 - HKLM\..\RunServices: [microsft Updates] msupdate32.exe
                    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program
                    Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                    O4 - Global Startup: NkvMon.exe.lnk = F:\Nikon\NkView6\NkvMon.exe
                    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
                    Office\Office\OSA9.EXE
                    O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st
                    800-840\dslmon.exe
                    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
                    software-dl.real.com/093c3c08ad15bb9df219/netzip/RdxIE601.cab
                    O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
                    67.15.101.3/g_bin/pl/snooker_2_0_0_23.cab
                    O17 - HKLM\System\CCS\Services\Tcpip\..\{C176CAA2-4703-4EDD-811D-B92435320F69}:
                    NameServer = 194.204.152.34 217.98.63.164
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
                    Software\Avast4\ashServ.exe
                    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
                    Software\Avast4\ashMaiSv.exe" /service (file missing)
                    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
                    Software\Avast4\ashWebSv.exe" /service (file missing)
                    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
                    C:\WINDOWS\system32\LEXBCES.EXE
                    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
                    C:\WINDOWS\System32\nvsvc32.exe

                      • Gość: Tomek Re: Proszę o sprawdzenie loga z hijack. IP: *.neoplus.adsl.tpnet.pl 04.09.05, 12:40
                        Logfile of HijackThis v1.99.1
                        Scan saved at 12:40:09, on 2005-09-04
                        Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\SYSTEM32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\WINDOWS\system32\LEXBCES.EXE
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\WINDOWS\system32\LEXPPS.EXE
                        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        C:\WINDOWS\System32\nvsvc32.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        C:\PROGRA~1\NEOSTR~1\CnxMon.exe
                        C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
                        C:\Program Files\QuickTime\qttask.exe
                        C:\Program Files\Common Files\Real\Update_OB\realsched.exe
                        C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
                        C:\WINDOWS\System32\ctfmon.exe
                        C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                        F:\Nikon\NkView6\NkvMon.exe
                        C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                        C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
                        C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
                        C:\PROGRA~1\NEOSTR~1\ComComp.exe
                        C:\PROGRA~1\NEOSTR~1\Watch.exe
                        C:\Program Files\Tlen.pl\tlen.exe
                        C:\Program Files\Mozilla Firefox\firefox.exe
                        C:\Documents and Settings\aa\Pulpit\hijackthis\HijackThis.exe

                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = szukaj.wp.pl
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
                        www.neostrada.pl
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
                        www.neostrada.pl
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
                        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
                        C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O2 - BHO: FlashFXP Helper for Internet Explorer -
                        {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
                        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
                        C:\WINDOWS\System32\msdxm.ocx
                        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
                        C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
                        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                        O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
                        /autostart
                        O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate
                        Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
                        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
                        O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
                        O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
                        -atboottime
                        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
                        Files\Real\Update_OB\realsched.exe" -osboot
                        O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
                        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                        O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program
                        Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                        O4 - Global Startup: NkvMon.exe.lnk = F:\Nikon\NkView6\NkvMon.exe
                        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
                        Office\Office\OSA9.EXE
                        O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st
                        800-840\dslmon.exe
                        O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                        O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
                        software-dl.real.com/093c3c08ad15bb9df219/netzip/RdxIE601.cab
                        O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
                        67.15.101.3/g_bin/pl/snooker_2_0_0_23.cab
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{C176CAA2-4703-4EDD-811D-B92435320F69}:
                        NameServer = 194.204.152.34 217.98.63.164
                        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
                        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
                        Software\Avast4\ashServ.exe
                        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
                        Software\Avast4\ashMaiSv.exe" /service (file missing)
                        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
                        Software\Avast4\ashWebSv.exe" /service (file missing)
                        O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
                        C:\WINDOWS\system32\LEXBCES.EXE
                        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
                        C:\WINDOWS\System32\nvsvc32.exe

                          • Gość: Tomek Re: Proszę o sprawdzenie loga z hijack. IP: *.neoplus.adsl.tpnet.pl 17.09.05, 15:15
                            Nie wywaliłem aplikacji od neostrady ale korzystam z tego swojego połączenia
                            (nie łącze się przez ten program od neostrady). I jeszcze jedno po jakimś czasie
                            od momętu włączenia komputera zaczyna mi się ciąć (jak wezmę Ctrl+Alt+Delete to
                            mi pokazuje 100% użycia procesora)

                            Logfile of HijackThis v1.99.1
                            Scan saved at 15:09:30, on 2005-09-17
                            Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\SYSTEM32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\LEXBCES.EXE
                            C:\WINDOWS\Explorer.EXE
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\WINDOWS\system32\LEXPPS.EXE
                            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashServ.exe
                            C:\WINDOWS\System32\nvsvc32.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                            C:\WINDOWS\System32\nbupd64.exe
                            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            C:\PROGRA~1\NEOSTR~1\CnxMon.exe
                            C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
                            C:\Program Files\QuickTime\qttask.exe
                            C:\Program Files\Common Files\Real\Update_OB\realsched.exe
                            C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
                            C:\WINDOWS\System32\CCUPD32.EXE
                            C:\WINDOWS\System32\ctfmon.exe
                            C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                            C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
                            F:\Nikon\NkView6\NkvMon.exe
                            C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                            C:\Program Files\Mozilla Firefox\firefox.exe
                            C:\Documents and Settings\aa\Pulpit\hijackthis\HijackThis.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
                            www.neostrada.pl
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
                            www.neostrada.pl
                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
                            O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
                            C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                            O2 - BHO: FlashFXP Helper for Internet Explorer -
                            {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
                            O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
                            C:\WINDOWS\System32\msdxm.ocx
                            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
                            C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
                            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                            O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
                            /autostart
                            O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate
                            Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
                            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
                            O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
                            O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
                            -atboottime
                            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
                            Files\Real\Update_OB\realsched.exe" -osboot
                            O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
                            O4 - HKLM\..\Run: [Windows Update 64] nbupd64.exe
                            O4 - HKLM\..\Run: [nortonav] C:\WINDOWS\System32\CCUPD32.EXE
                            O4 - HKLM\..\RunServices: [Windows Update 64] nbupd64.exe
                            O4 - HKLM\..\RunOnce: [Windows Update 64] nbupd64.exe
                            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                            O4 - HKCU\..\Run: [Windows Update 64] nbupd64.exe
                            O4 - HKCU\..\RunOnce: [Windows Update 64] nbupd64.exe
                            O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program
                            Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                            O4 - Global Startup: NkvMon.exe.lnk = F:\Nikon\NkView6\NkvMon.exe
                            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
                            Office\Office\OSA9.EXE
                            O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st
                            800-840\dslmon.exe
                            O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                            O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) -
                            www.cult3d.com/download/cult.cab
                            O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
                            software-dl.real.com/093c3c08ad15bb9df219/netzip/RdxIE601.cab
                            O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
                            67.15.101.3/g_bin/pl/snooker_2_0_0_23.cab
                            O17 - HKLM\System\CCS\Services\Tcpip\..\{C176CAA2-4703-4EDD-811D-B92435320F69}:
                            NameServer = 194.204.152.34 217.98.63.164
                            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
                            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
                            Software\Avast4\ashServ.exe
                            O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
                            Software\Avast4\ashMaiSv.exe" /service (file missing)
                            O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
                            Software\Avast4\ashWebSv.exe" /service (file missing)
                            O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
                            C:\WINDOWS\system32\LEXBCES.EXE
                            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
                            C:\WINDOWS\System32\nvsvc32.exe

                            • Gość: Kolobos Re: Proszę o sprawdzenie loga z hijack. IP: *.warszawa.sdi.tpnet.pl 17.09.05, 15:36
                              > I jeszcze jedno po jakimś czasie od momętu włączenia komputera
                              > zaczyna mi się ciąć (jak wezmę Ctrl+Alt+Delete to mi pokazuje
                              > 100% użycia procesora)

                              To super... ale po co to piszesz skoro nawet nie chce Ci sie podac jaki proces
                              wykorzystuje 100%? Zastanow sie troche...



                              Nic sie nie zmienilo, nie usunales tego co miales, aplikacje od neo odinstaluj
                              poniewaz ona sie uruchamia przy starcie komputera.

                              Zakoncz proces i usun plik:
                              C:\WINDOWS\System32\nbupd64.exe
                              C:\WINDOWS\System32\CCUPD32.EXE

                              I w hijackthis:

                              O4 - HKLM\..\Run: [Windows Update 64] nbupd64.exe
                              O4 - HKLM\..\Run: [nortonav] C:\WINDOWS\System32\CCUPD32.EXE
                              O4 - HKLM\..\RunServices: [Windows Update 64] nbupd64.exe
                              O4 - HKLM\..\RunOnce: [Windows Update 64] nbupd64.exe
                              O4 - HKCU\..\Run: [Windows Update 64] nbupd64.exe
                              O4 - HKCU\..\RunOnce: [Windows Update 64] nbupd64.exe

                              Nie bede Ci tego pisal jeszcze raz, wiec nie pisz nastepnych postow jezeli nie
                              zrobisz tego co napisalem.
                              • Gość: Tomek Re: Proszę o sprawdzenie loga z hijack. IP: *.neoplus.adsl.tpnet.pl 18.09.05, 12:24
                                Ten proces co zajmował 100% to był nbupd64.exe...ale go zamknełem i zrobiłem
                                jak kazałeś. Neostrade też odinstalowałem.
                                Tylko mam jeden problem, pojawia mi się cały czas na dysku C taki plik (i nie da
                                się go usunąć, pewnie jest używany) - gp.exe.

                                log...
                                Logfile of HijackThis v1.99.1
                                Scan saved at 12:23:50, on 2005-09-18
                                Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
                                MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                                Running processes:
                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\SYSTEM32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\WINDOWS\system32\LEXBCES.EXE
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\WINDOWS\system32\LEXPPS.EXE
                                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                C:\WINDOWS\System32\nvsvc32.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                C:\Program Files\QuickTime\qttask.exe
                                C:\Program Files\Common Files\Real\Update_OB\realsched.exe
                                C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
                                C:\WINDOWS\System32\ctfmon.exe
                                C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                                F:\Nikon\NkView6\NkvMon.exe
                                C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
                                C:\Program Files\Mozilla Firefox\firefox.exe
                                C:\Documents and Settings\aa\Pulpit\hijackthis\HijackThis.exe

                                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
                                www.wanadoo.fr
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
                                www.neostrada.pl
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
                                O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
                                C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                O2 - BHO: FlashFXP Helper for Internet Explorer -
                                {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
                                O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
                                C:\WINDOWS\System32\msdxm.ocx
                                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                                O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
                                C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
                                O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                                O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
                                /autostart
                                O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate
                                Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
                                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
                                -atboottime
                                O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
                                Files\Real\Update_OB\realsched.exe" -osboot
                                O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
                                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                                O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program
                                Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                                O4 - Global Startup: NkvMon.exe.lnk = F:\Nikon\NkView6\NkvMon.exe
                                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
                                Office\Office\OSA9.EXE
                                O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st
                                800-840\dslmon.exe
                                O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                                O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) -
                                www.cult3d.com/download/cult.cab
                                O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
                                software-dl.real.com/093c3c08ad15bb9df219/netzip/RdxIE601.cab
                                O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
                                67.15.101.3/g_bin/pl/snooker_2_0_0_23.cab
                                O17 - HKLM\System\CCS\Services\Tcpip\..\{C176CAA2-4703-4EDD-811D-B92435320F69}:
                                NameServer = 194.204.152.34 217.98.63.164
                                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
                                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
                                Software\Avast4\ashServ.exe
                                O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
                                Software\Avast4\ashMaiSv.exe" /service (file missing)
                                O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
                                Software\Avast4\ashWebSv.exe" /service (file missing)
                                O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
                                C:\WINDOWS\system32\LEXBCES.EXE
                                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
                                C:\WINDOWS\System32\nvsvc32.exe

                                      • Gość: Tomek Re: Proszę o sprawdzenie loga z hijack. IP: *.neoplus.adsl.tpnet.pl 18.09.05, 14:39
                                        "Silent Runners.vbs", revision 40.1, www.silentrunners.org/
                                        Operating System: Windows XP
                                        Output limited to non-default values, except where indicated by "{++}"


                                        Startup items buried in registry:
                                        ---------------------------------

                                        HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
                                        "CTFMON.EXE" = "C:\WINDOWS\System32\ctfmon.exe" [MS]

                                        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
                                        "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]
                                        "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
                                        "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS]
                                        "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
                                        "PowerDVD" = "C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart" [file
                                        not found]
                                        "CloneCDElbyCDFL" = ""C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L
                                        ElbyCDFL" ["Elaborate Bytes AG"]
                                        "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]
                                        "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple
                                        Computer, Inc."]
                                        "TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe"
                                        -osboot" ["RealNetworks, Inc."]
                                        "gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]

                                        HKLM\Software\Microsoft\Active Setup\Installed Components\
                                        {306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided)
                                        \StubPath =
                                        ""C:\WINDOWS\System32\rundll32.exe" "C:\Program
                                        Files\Messenger\msgsc.dll",ShowIconsUser" [MS]

                                        HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
                                        {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
                                        -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll"
                                        ["Safer Networking Limited"]
                                        {E5A1691B-D188-4419-AD02-90002030B8EE}\(Default) = "FlashFXP Helper for Internet
                                        Explorer" [from CLSID]
                                        -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\FlashFXP\IEFlash.dll"
                                        ["IniCom Networks, Inc."]

                                        HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
                                        "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania
                                        wyświetlania"
                                        -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
                                        "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll"
                                        ["Hilgraeve, Inc."]
                                        "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA
                                        Corporation"]
                                        "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\NVCPL.DLL" ["NVIDIA
                                        Corporation"]
                                        "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll"
                                        ["NVIDIA Corporation"]
                                        "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll"
                                        ["NVIDIA Corporation"]
                                        "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll"
                                        ["NVIDIA Corporation"]
                                        "{32A9D769-5B55-4a25-9A62-86B5683FE50A}" = "NikonView Drop Extension"
                                        -> {CLSID}\InProcServer32\(Default) = "F:\Nikon\NkView6\NkvDropExt.dll"
                                        ["Nikon Corporation"]
                                        "{0E6C58A9-F592-4862-B35F-CA45E24003B3}" = "CloneCD"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Elaborate
                                        Bytes\CloneCD\ElbyVCDShell.dll" ["Elaborate Bytes"]
                                        "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
                                        "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
                                        "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil
                                        Software\Avast4\ashShell.dll" ["ALWIL Software"]
                                        "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
                                        -> {CLSID}\InProcServer32\(Default) =
                                        "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
                                        "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\Program
                                        Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
                                        "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll"
                                        [null data]

                                        HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
                                        INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft
                                        AntiSpyware Service Hook"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft
                                        AntiSpyware\shellextension.dll" [MS]

                                        HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
                                        avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil
                                        Software\Avast4\ashShell.dll" ["ALWIL Software"]
                                        WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll"
                                        [null data]

                                        HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
                                        WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll"
                                        [null data]

                                        HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
                                        avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil
                                        Software\Avast4\ashShell.dll" ["ALWIL Software"]
                                        WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
                                        -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll"
                                        [null data]


                                        Active Desktop and Wallpaper:
                                        -----------------------------

                                        Active Desktop is disabled at this entry:
                                        HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

                                        HKCU\Control Panel\Desktop\
                                        "Wallpaper" = "C:\WINDOWS\Firefox Wallpaper.bmp"


                                        Enabled Screen Saver:
                                        ---------------------

                                        HKCU\Control Panel\Desktop\
                                        "SCRNSAVE.EXE" = "C:\WINDOWS\System32\AVASTSS.scr" ["ALWIL Software"]


                                        Startup items in "aa" & "All Users" startup folders:
                                        ----------------------------------------------------

                                        C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
                                        "InterVideo WinCinema Manager" -> shortcut to: "C:\Program
                                        Files\InterVideo\Common\Bin\WinCinemaMgr.exe" [empty string]
                                        "NkvMon.exe" -> shortcut to: "F:\Nikon\NkView6\NkvMon.exe" ["Nikon Corporation"]
                                        "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft
                                        Office\Office\OSA9.EXE -b -l" [MS]
                                        "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                                        /W" [empty string]


                                        Winsock2 Service Provider DLLs:
                                        -------------------------------

                                        Namespace Service Providers

                                        HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\
                                        {++}
                                        000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
                                        000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
                                        000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

                                        Transport Service Providers

                                        HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\
                                        {++}
                                        0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
                                        %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
                                        %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


                                        Running Services (Display Name, Service Name, Path {Service DLL}):
                                        ------------------------------------------------------------------

                                        avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil
                                        Software\A
                                          • Gość: Tomek Re: Proszę o sprawdzenie loga z hijack. IP: *.neoplus.adsl.tpnet.pl 19.09.05, 07:46
                                            Running Services (Display Name, Service Name, Path {Service DLL}):
                                            ------------------------------------------------------------------

                                            avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil
                                            Software\Avast4\ashServ.exe"" [null data]
                                            avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil
                                            Software\Avast4\aswUpdSv.exe"" [null data]
                                            avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil
                                            Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"]
                                            avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil
                                            Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
                                            LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark
                                            International, Inc."]
                                            NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA
                                            Corporation"]
                                            Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]


                                            ----------
                                            + This report excludes default entries except where indicated.
                                            + To see *everywhere* the script checks and *everything* it finds,
                                            launch it from a command prompt or a shortcut with the -all parameter.
                                            + To search all directories of local fixed drives for DESKTOP.INI
                                            DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
                                            use the -supp parameter or answer "No" at the first message box.
                                            --------

Nie pamiętasz hasła

lub ?

 

Nie masz jeszcze konta? Zarejestruj się

Nakarm Pajacyka