użycie procesora

**Posty:** 36 · przez **Ygit** 23 Sty 2006, 17:34

Mam problem od ubiegłego tygodnia użycie procesora wskakuje na 100% jeśli coś włanczam lu odtważam . Poprostu co bym nie robił to procesor śmiga na 100%

przez **jeff** 23 Sty 2006, 17:35

poczytaj

http://forum.programosy.pl/hijackthis-gtobsuga-i-umieszczanie-loga-vt9452.html

i zobacz jak sie umieszcza log-a w tagach i wrzuć loga

**Posty:** 36 · przez **Ygit** 23 Sty 2006, 18:01

Logfile of HijackThis v1.99.1
Scan saved at 15:56:35, on 2006-01-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\qttask.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\paytime.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\pobrane\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5DB22CF5-5F9E-4A05-9C99-9459C74524D8}: NameServer = 194.204.152.34 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{5DB22CF5-5F9E-4A05-9C99-9459C74524D8}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

**Posty:** 36 · przez **Ygit** 23 Sty 2006, 20:23

użycie procesora skacze do 100%

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:16:00, on 2006-01-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\qttask.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Program Files\D-Tools\daemon.exe C:\WINDOWS\system32\paytime.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\ToniArts\EasyCleaner\EasyClea.exe D:\pobrane\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe" O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe" O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5DB22CF5-5F9E-4A05-9C99-9459C74524D8}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{5DB22CF5-5F9E-4A05-9C99-9459C74524D8}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

**Posty:** 8694 · przez **Red** 23 Sty 2006, 20:35

usuwasz z wylaczonym przywracaniem systemu w xp i w trybie awaryjnym f8

C:\WINDOWS\system32\paytime.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe

wpisy usuwasz hijackiem ,a pogrubione pliki recznie i dajesz log do kontroli po usuwaniu

**Posty:** 36 · przez **Ygit** 23 Sty 2006, 21:08

Usunołem te pliki

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:05:02, on 2006-01-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\qttask.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Program Files\D-Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\taskmgr.exe D:\pobrane\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe" O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5DB22CF5-5F9E-4A05-9C99-9459C74524D8}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{5DB22CF5-5F9E-4A05-9C99-9459C74524D8}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

[ Dodano: Dzisiaj o 19:10 ]

Ygit napisał(a):Usunołem te pliki

Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1 Scan saved at 19:05:02, on 2006-01-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\qttask.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Program Files\D-Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\taskmgr.exe D:\pobrane\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe" O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5DB22CF5-5F9E-4A05-9C99-9459C74524D8}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{5DB22CF5-5F9E-4A05-9C99-9459C74524D8}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

ale użycie procka nadal skacze do 100%

**Posty:** 8694 · przez **Red** 23 Sty 2006, 21:14

siedzi jeszcze tutaj:

O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"

Prosze usunac

**Posty:** 36 · przez **Ygit** 24 Sty 2006, 00:32

A teraz wszystko wpożądku ???? Bo użycie procesora nadal skacze aż pod 100%

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:24:38, on 2006-01-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\qttask.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Program Files\D-Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wuauclt.exe D:\pobrane\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

przez **jeff** 24 Sty 2006, 00:36

ten log ok - dla pewnosci daj loga z Silent Runners

Ściągnij ten program na dysk i odpal

http://www.silentrunners.org/Silent%20Runners.zip

Pojawi się okienko i klikasz na "Nie ", dzięki czemu otrzymamy pełen log. Poczekaj chwile aż dostaniesz info że log już gotowy i wklej zawartość txt na forum

**Posty:** 36 · przez **Ygit** 24 Sty 2006, 00:43

prosze bardzo

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 43, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."] "QuickTime Task" = ""C:\WINDOWS\System32\qttask.exe" -atboottime" ["Apple Computer, Inc."] "WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string] "WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] "DAEMON Tools-1033" = ""D:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock" ["DAEMON'S HOME"] "MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS

[ Dodano: Dzisiaj o 23:27 ]
:evil:

Prosze o szybkom odpowiedz

przez **jeff** 24 Sty 2006, 07:18

Ygit

log niepełny - poczekaj jak dostaniesz info ze został wygenerowany po czym wklej na forum

Ygit napisał(a): Prosze o szybkom odpowiedz

w piekarni nie jesteś :!:

**Posty:** 36 · przez **Ygit** 24 Sty 2006, 13:13

Dzięki. To jest ten log z silent runners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 43, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."] "QuickTime Task" = ""C:\WINDOWS\System32\qttask.exe" -atboottime" ["Apple Computer, Inc."] "WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string] "WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] "DAEMON Tools-1033" = ""D:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock" ["DAEMON'S HOME"] "MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device ContextMenuHandler" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens SX1 PropertySheetHandler" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\DES\DESShellExt.dll" ["Siemens AG"] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"] "{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Wolanski" & "All Users" startup folders: ---------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\ {21569614-B795-46B1-85F4-E737A8DC09AD}\ = "Shell Search Band" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\ = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\ = "ToolBand Class" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\ = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ Missing lines (compared with English-language version): "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = "Search Class" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."] avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor i350\Driver = "CNMLM53.DLL" ["CANON INC."] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 93 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 85 seconds. ---------- (total run time: 312 seconds)

**Posty:** 8694 · przez **Red** 24 Sty 2006, 13:16

ten log jest czysty

sciagnij na pulpit :
http://bilder.informationsarchiv.net/Nikitas_Tools/pv.zip

wypakuj i uruchom to z folderu runme.bat i daj log z opcji 1 i 4

Autor postu otrzymał pochwałę

**Posty:** 36 · przez **Ygit** 24 Sty 2006, 13:21

To jest log z 1 opcji

Kod: Zaznacz wszystko: Module information for 'Explorer.EXE' MODULE BASE SIZE PATH Explorer.EXE 1000000 1044480 C:\WINDOWS\Explorer.EXE 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Eksplorator Windows ntdll.dll 7c900000 729088 C:\WINDOWS\system32\ntdll.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka NT Layer DLL kernel32.dll 7c800000 1028096 C:\WINDOWS\system32\kernel32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL klienta Windows NT BASE API msvcrt.dll 77c00000 360448 C:\WINDOWS\system32\msvcrt.dll 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows NT CRT DLL ADVAPI32.dll 77dc0000 704512 C:\WINDOWS\system32\ADVAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Advanced Windows 32 Base API RPCRT4.dll 77e70000 593920 C:\WINDOWS\system32\RPCRT4.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Procedure Call Runtime GDI32.dll 77f10000 290816 C:\WINDOWS\system32\GDI32.dll 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427) GDI Client DLL USER32.dll 77d30000 589824 C:\WINDOWS\system32\USER32.dll 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519) Biblioteka DLL klienta Windows XP USER API SHLWAPI.dll 77f60000 483328 C:\WINDOWS\system32\SHLWAPI.dll 6.00.2900.2781 (xpsp_sp2_gdr.051020-1730) Biblioteka dodatkowych narzędzi powłoki SHELL32.dll 7c9c0000 8503296 C:\WINDOWS\system32\SHELL32.dll 6.00.2900.2763 (xpsp_sp2_gdr.050922-1642) Wspólna biblioteka DLL Powłoki systemu Windows ole32.dll 774d0000 1298432 C:\WINDOWS\system32\ole32.dll 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528) Microsoft OLE for Windows OLEAUT32.dll 77110000 573440 C:\WINDOWS\system32\OLEAUT32.dll 5.1.2600.2180 BROWSEUI.dll 75f50000 1036288 C:\WINDOWS\system32\BROWSEUI.dll 6.00.2900.2802 (xpsp_sp2_gdr.051123-1230) Biblioteka UI powłoki przeglądarki SHDOCVW.dll 77750000 1499136 C:\WINDOWS\system32\SHDOCVW.dll 6.00.2900.2805 (xpsp_sp2_gdr.051130-1554) Biblioteka powłoki obiektów DocObject i formantów CRYPT32.dll 77a70000 610304 C:\WINDOWS\system32\CRYPT32.dll 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) Crypto API32 MSASN1.dll 77b10000 73728 C:\WINDOWS\system32\MSASN1.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ASN.1 Runtime APIs CRYPTUI.dll 768b0000 532480 C:\WINDOWS\system32\CRYPTUI.dll 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) Dostawca interfejsu zaufania Microsoft WINTRUST.dll 76c20000 188416 C:\WINDOWS\system32\WINTRUST.dll 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejsy API potwierdzania zaufania firmy Microsoft IMAGEHLP.dll 76c80000 163840 C:\WINDOWS\system32\IMAGEHLP.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows NT Image Helper NETAPI32.dll 6ff40000 344064 C:\WINDOWS\system32\NETAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Net Win32 API DLL WININET.dll 771a0000 684032 C:\WINDOWS\system32\WININET.dll 6.00.2900.2781 (xpsp_sp2_gdr.051020-1730) Rozszerzenia internetowe Win32 WLDAP32.dll 76f50000 184320 C:\WINDOWS\system32\WLDAP32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Win32 LDAP API DLL VERSION.dll 77bf0000 32768 C:\WINDOWS\system32\VERSION.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Version Checking and File Installation Libraries UxTheme.dll 5b1d0000 229376 C:\WINDOWS\system32\UxTheme.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka Microsoft UxTheme ShimEng.dll 5cfe0000 155648 C:\WINDOWS\system32\ShimEng.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Shim Engine DLL AcGenral.DLL 59410000 1875968 C:\WINDOWS\AppPatch\AcGenral.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Compatibility DLL WINMM.dll 76b20000 188416 C:\WINDOWS\system32\WINMM.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) MCI API DLL MSACM32.dll 77bd0000 86016 C:\WINDOWS\system32\MSACM32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Filtr audio ACM Microsoft USERENV.dll 769a0000 737280 C:\WINDOWS\system32\USERENV.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Userenv comctl32.dll 773c0000 1056768 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll 6.0 (xpsp_sp2_rtm.040803-2158) User Experience Controls Library comctl32.dll 5d520000 618496 C:\WINDOWS\system32\comctl32.dll 5.82 (xpsp_sp2_rtm.040803-2158) Common Controls Library appHelp.dll 77b30000 139264 C:\WINDOWS\system32\appHelp.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Application Compatibility Client Library CLBCATQ.DLL 76fc0000 520192 C:\WINDOWS\system32\CLBCATQ.DLL 2001.12.4414.308 COMRes.dll 77040000 839680 C:\WINDOWS\system32\COMRes.dll 2001.12.4414.258 cscui.dll 77a10000 348160 C:\WINDOWS\System32\cscui.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs użytkownika buforowania z strony klienta CSCDLL.dll 765d0000 118784 C:\WINDOWS\System32\CSCDLL.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Agent sieci w trybie offline themeui.dll 5ba90000 466944 C:\WINDOWS\System32\themeui.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Interfejs API kompozycji systemu Windows Secur32.dll 77fe0000 69632 C:\WINDOWS\System32\Secur32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Security Support Provider Interface MSIMG32.dll 76350000 20480 C:\WINDOWS\System32\MSIMG32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) GDIEXT Client DLL xpsp2res.dll 20000000 2957312 C:\WINDOWS\system32\xpsp2res.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Komunikaty pakietu Service Pack 2 msutb.dll 600a0000 208896 C:\WINDOWS\System32\msutb.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL serwera MSUTB MSCTF.dll 746d0000 307200 C:\WINDOWS\System32\MSCTF.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL serwera MSCTF wmpband.dll 4c4f0000 98304 C:\PROGRA~1\WINDOW~2\wmpband.dll 9.00.00.3250 Windows Media Player MPR.dll 71ac0000 73728 C:\WINDOWS\system32\MPR.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Multiple Provider Router DLL SAMLIB.dll 71ba0000 77824 C:\WINDOWS\system32\SAMLIB.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) SAM Library DLL SETUPAPI.dll 77910000 1007616 C:\WINDOWS\system32\SETUPAPI.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs API Instalatora systemu Windows LINKINFO.dll 76960000 32768 C:\WINDOWS\system32\LINKINFO.dll 5.1.2600.2751 (xpsp_sp2_gdr.050831-1520) Windows Volume Tracking ntshrui.dll 76970000 155648 C:\WINDOWS\system32\ntshrui.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Rozszerzenia powłoki dla udostępniania zasobów ATL.DLL 76b00000 69632 C:\WINDOWS\system32\ATL.DLL 3.05.2284 ATL Module for Windows XP (Unicode) urlmon.dll 77250000 647168 C:\WINDOWS\system32\urlmon.dll 6.00.2900.2790 (xpsp_sp2_gdr.051104-1529) Rozszerzenia OLE32 dla Win32 NETSHELL.dll 763d0000 1736704 C:\WINDOWS\system32\NETSHELL.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Powłoka połączeń sieciowych rtutils.dll 76e70000 57344 C:\WINDOWS\system32\rtutils.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Routing Utilities credui.dll 76bf0000 188416 C:\WINDOWS\system32\credui.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs użytkownika menedżera poświadczeń WS2_32.dll 71a50000 94208 C:\WINDOWS\system32\WS2_32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Socket 2.0 32-Bit DLL WS2HELP.dll 71a40000 32768 C:\WINDOWS\system32\WS2HELP.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Socket 2.0 Helper dla Windows NT iphlpapi.dll 76d50000 102400 C:\WINDOWS\system32\iphlpapi.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs API Pomocnika IP msi.dll 1790000 2908160 C:\WINDOWS\system32\msi.dll 3.1.4000.2435 Windows Installer rsaenh.dll ffd0000 163840 C:\WINDOWS\system32\rsaenh.dll 5.1.2600.2161 (xpsp.040706-1629) Microsoft Enhanced Cryptographic Provider WINSTA.dll 76330000 65536 C:\WINDOWS\system32\WINSTA.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Winstation Library webcheck.dll 74ae0000 290816 C:\WINDOWS\System32\webcheck.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Monitor witryn sieci Web WSOCK32.dll 71a70000 40960 C:\WINDOWS\System32\WSOCK32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) 32-bitowa biblioteka Windows Socket stobject.dll 76580000 135168 C:\WINDOWS\System32\stobject.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Obiekt powłoki usługi Systray BatMeter.dll 74aa0000 40960 C:\WINDOWS\System32\BatMeter.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Pomocnicza biblioteka DLL miernika baterii POWRPROF.dll 74a80000 32768 C:\WINDOWS\System32\POWRPROF.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Power Profile Helper DLL WTSAPI32.dll 76f40000 32768 C:\WINDOWS\System32\WTSAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Terminal Server SDK APIs wdmaud.drv 72cb0000 36864 C:\WINDOWS\system32\wdmaud.drv 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WDM Audio driver mapper msacm32.drv 72ca0000 32768 C:\WINDOWS\system32\msacm32.drv 5.1.2600.0 (xpclient.010817-1148) Mapowanie dźwięku Microsoft midimap.dll 77bc0000 28672 C:\WINDOWS\system32\midimap.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Mapowanie MIDI rarext.dll 1d30000 180224 C:\Program Files\WinRAR\rarext.dll ashShell.dll 64f00000 24576 C:\Program Files\Alwil Software\Avast4\ashShell.dll 4, 6, 739, 0 avast! Shell Extension MSVCP71.dll 7c3a0000 503808 C:\WINDOWS\system32\MSVCP71.dll 7.10.3077.0 Microsoft® C++ Runtime Library MSVCR71.dll 7c340000 352256 C:\WINDOWS\system32\MSVCR71.dll 7.10.3052.4 Microsoft® C Runtime Library CmdLineExt.dll 10000000 102400 C:\WINDOWS\System32\CmdLineExt.dll 1,0,201,0 SecuROM Context-Menu for Explorer. drprov.dll 75f30000 28672 C:\WINDOWS\System32\drprov.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Terminal Server Network Provider ntlanman.dll 71bc0000 57344 C:\WINDOWS\System32\ntlanman.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft® Lan Manager NETUI0.dll 71c80000 94208 C:\WINDOWS\System32\NETUI0.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Kod wspólny interfejsu UI NT LM - Klasy GUI NETUI1.dll 71c40000 262144 C:\WINDOWS\System32\NETUI1.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) NT LM UI Common Code - Networking classes NETRAP.dll 71c30000 28672 C:\WINDOWS\System32\NETRAP.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Net Remote Admin Protocol DLL davclnt.dll 75f40000 36864 C:\WINDOWS\System32\davclnt.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL klienta DAV w sieci Web RASAPI32.dll 76ed0000 245760 C:\WINDOWS\system32\RASAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs API usługi Dostęp zdalny rasman.dll 76e80000 73728 C:\WINDOWS\system32\rasman.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Access Connection Manager TAPI32.dll 76ea0000 192512 C:\WINDOWS\system32\TAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL klienta interfejsu API usługi Telefonii dla systemu Microsoft® Windows(TM) msv1_0.dll 77c60000 143360 C:\WINDOWS\system32\msv1_0.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Authentication Package v1.0 SXS.DLL 75e60000 720896 C:\WINDOWS\system32\SXS.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Fusion 2.5 shdoclc.dll 1db0000 573440 C:\WINDOWS\system32\shdoclc.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka powłoki obiektów DocObject i formantów browselc.dll 1e80000 77824 C:\WINDOWS\system32\browselc.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka UI powłoki przeglądarki AcroIEHelper.dll 1a90000 49152 C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll 6.0.1.2003110300 Adobe Acrobat IE Helper Version 6.0 for ActivieX DUSER.dll 6c6d0000 315392 C:\WINDOWS\system32\DUSER.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows DirectUser Engine MSGINA.dll 75940000 1015808 C:\WINDOWS\system32\MSGINA.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL GINA logowania systemu Windows NT ODBC32.dll 74600000 249856 C:\WINDOWS\system32\ODBC32.dll 3.525.1117.0 (xpsp_sp2_rtm.040803-2158) Microsoft Data Access - ODBC Driver Manager comdlg32.dll 76380000 299008 C:\WINDOWS\system32\comdlg32.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Plik DLL wspólnych okien dialogowych odbcint.dll 1f10000 98304 C:\WINDOWS\system32\odbcint.dll 3.525.1117.0 built by: (_sqlbld) Microsoft Data Access - Zasoby ODBC MLANG.dll 75d70000 593920 C:\WINDOWS\system32\MLANG.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Multi Language Support DLL shmedia.dll 5cf40000 163840 C:\WINDOWS\System32\shmedia.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Rozszerzenie jądra modułu wyodrębniającego właściwości plików multimedialnych MSVFW32.dll 75b80000 135168 C:\WINDOWS\System32\MSVFW32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) DLL Microsoft Video for Windows AVIFIL32.dll 73ae0000 94208 C:\WINDOWS\System32\AVIFIL32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka plików Microsoft AVI wmvcore.dll 7d790000 2138112 C:\WINDOWS\system32\wmvcore.dll 9.00.00.3250 (xpsp_sp2_rtm.040803-2158) Windows Media Playback/Authoring DLL wmidx.dll 4b360000 167936 C:\WINDOWS\system32\wmidx.dll 9.00.00.3250 Windows Media Indexer DLL WMASF.DLL 59b70000 245760 C:\WINDOWS\system32\WMASF.DLL 9.00.00.3250 (xpsp_sp2_rtm.040803-2158) Windows Media ASF DLL msdmo.dll 73640000 28672 C:\WINDOWS\system32\msdmo.dll DRMClien.DLL 2ed0000 323584 C:\WINDOWS\system32\DRMClien.DLL 9.00.00.3250 DRM Client DLL lameACM.acm 3860000 1261568 C:\WINDOWS\system32\lameACM.acm 0.9.0 Lame MP3 codec engine URL.dll 71d40000 53248 C:\WINDOWS\system32\URL.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL rozszerzenia powłoki skrótów internetowych gdiplus.dll 4ebc0000 1716224 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158) Microsoft GDI+ mscms.dll 73ac0000 86016 C:\WINDOWS\system32\mscms.dll 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518) Microsoft Color Matching System DLL WINSPOOL.DRV 72f90000 155648 C:\WINDOWS\system32\WINSPOOL.DRV 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Spooler Driver actxprxy.dll 71cf0000 114688 C:\WINDOWS\System32\actxprxy.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ActiveX Interface Marshaling Library NTMARTA.DLL 77680000 135168 C:\WINDOWS\system32\NTMARTA.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows NT - dostawca MARTA MSISIP.DLL 60980000 28672 C:\WINDOWS\system32\MSISIP.DLL 3.1.4000.1823 MSI Signature SIP Provider wshext.dll 74e50000 65536 C:\WINDOWS\System32\wshext.dll 5.6.0.8820 Microsoft (r) Shell Extension for Windows Script Host MFC42.DLL 73d60000 1040384 C:\WINDOWS\system32\MFC42.DLL 6.02.4131.0 MFCDLL Shared Library - Retail Version MFC42LOC.DLL 61e30000 53248 C:\WINDOWS\system32\MFC42LOC.DLL 6.00.8665.0 MFC - Zasoby specyficzne dla języka wshPL.DLL 58e50000 57344 C:\WINDOWS\System32\wshPL.DLL 5.6.0.6626 Zasoby międzynarodowe Hosta skryptów systemu Windows firmy Microsoft (r)

A to jest log z opcji 4

Kod: Zaznacz wszystko: Module information for 'svchost.exe' MODULE BASE SIZE PATH svchost.exe 1000000 24576 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Generic Host Process for Win32 Services ntdll.dll 7c900000 729088 C:\WINDOWS\system32\ntdll.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka NT Layer DLL kernel32.dll 7c800000 1028096 C:\WINDOWS\system32\kernel32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL klienta Windows NT BASE API ADVAPI32.dll 77dc0000 704512 C:\WINDOWS\system32\ADVAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Advanced Windows 32 Base API RPCRT4.dll 77e70000 593920 C:\WINDOWS\system32\RPCRT4.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Procedure Call Runtime ShimEng.dll 5cfe0000 155648 C:\WINDOWS\system32\ShimEng.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Shim Engine DLL AcGenral.DLL 59410000 1875968 C:\WINDOWS\AppPatch\AcGenral.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Compatibility DLL USER32.dll 77d30000 589824 C:\WINDOWS\system32\USER32.dll 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519) Biblioteka DLL klienta Windows XP USER API GDI32.dll 77f10000 290816 C:\WINDOWS\system32\GDI32.dll 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427) GDI Client DLL WINMM.dll 76b20000 188416 C:\WINDOWS\system32\WINMM.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) MCI API DLL ole32.dll 774d0000 1298432 C:\WINDOWS\system32\ole32.dll 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528) Microsoft OLE for Windows msvcrt.dll 77c00000 360448 C:\WINDOWS\system32\msvcrt.dll 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows NT CRT DLL OLEAUT32.dll 77110000 573440 C:\WINDOWS\system32\OLEAUT32.dll 5.1.2600.2180 MSACM32.dll 77bd0000 86016 C:\WINDOWS\system32\MSACM32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Filtr audio ACM Microsoft VERSION.dll 77bf0000 32768 C:\WINDOWS\system32\VERSION.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Version Checking and File Installation Libraries SHELL32.dll 7c9c0000 8503296 C:\WINDOWS\system32\SHELL32.dll 6.00.2900.2763 (xpsp_sp2_gdr.050922-1642) Wspólna biblioteka DLL Powłoki systemu Windows SHLWAPI.dll 77f60000 483328 C:\WINDOWS\system32\SHLWAPI.dll 6.00.2900.2781 (xpsp_sp2_gdr.051020-1730) Biblioteka dodatkowych narzędzi powłoki USERENV.dll 769a0000 737280 C:\WINDOWS\system32\USERENV.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Userenv UxTheme.dll 5b1d0000 229376 C:\WINDOWS\system32\UxTheme.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka Microsoft UxTheme comctl32.dll 773c0000 1056768 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll 6.0 (xpsp_sp2_rtm.040803-2158) User Experience Controls Library comctl32.dll 5d520000 618496 C:\WINDOWS\system32\comctl32.dll 5.82 (xpsp_sp2_rtm.040803-2158) Common Controls Library NTMARTA.DLL 77680000 135168 C:\WINDOWS\system32\NTMARTA.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows NT - dostawca MARTA WLDAP32.dll 76f50000 184320 C:\WINDOWS\system32\WLDAP32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Win32 LDAP API DLL SAMLIB.dll 71ba0000 77824 C:\WINDOWS\system32\SAMLIB.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) SAM Library DLL rpcss.dll 76a60000 405504 c:\windows\system32\rpcss.dll 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528) Distributed COM Services Secur32.dll 77fe0000 69632 c:\windows\system32\Secur32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Security Support Provider Interface WS2_32.dll 71a50000 94208 c:\windows\system32\WS2_32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Socket 2.0 32-Bit DLL WS2HELP.dll 71a40000 32768 c:\windows\system32\WS2HELP.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Socket 2.0 Helper dla Windows NT xpsp2res.dll 20000000 2957312 C:\WINDOWS\system32\xpsp2res.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Komunikaty pakietu Service Pack 2 termsrv.dll 766e0000 344064 c:\windows\system32\termsrv.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Usługa serwera terminali ICAAPI.dll 74f20000 24576 c:\windows\system32\ICAAPI.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) DLL Interface to TermDD Device Driver SETUPAPI.dll 77910000 1007616 c:\windows\system32\SETUPAPI.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs API Instalatora systemu Windows WINTRUST.dll 76c20000 188416 C:\WINDOWS\system32\WINTRUST.dll 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejsy API potwierdzania zaufania firmy Microsoft CRYPT32.dll 77a70000 610304 C:\WINDOWS\system32\CRYPT32.dll 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) Crypto API32 MSASN1.dll 77b10000 73728 C:\WINDOWS\system32\MSASN1.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ASN.1 Runtime APIs IMAGEHLP.dll 76c80000 163840 C:\WINDOWS\system32\IMAGEHLP.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows NT Image Helper AUTHZ.dll 776b0000 69632 c:\windows\system32\AUTHZ.dll 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519) Authorization Framework mstlsapi.dll 750c0000 126976 c:\windows\system32\mstlsapi.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft® Terminal Server Licensing ACTIVEDS.dll 77cb0000 204800 c:\windows\system32\ACTIVEDS.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ADs Router Layer DLL adsldpc.dll 76e00000 151552 c:\windows\system32\adsldpc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ADs LDAP Provider C DLL NETAPI32.dll 6ff40000 344064 C:\WINDOWS\system32\NETAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Net Win32 API DLL ATL.DLL 76b00000 69632 c:\windows\system32\ATL.DLL 3.05.2284 ATL Module for Windows XP (Unicode) REGAPI.dll 76ba0000 61440 C:\WINDOWS\system32\REGAPI.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Registry Configuration APIs CLBCATQ.DLL 76fc0000 520192 C:\WINDOWS\system32\CLBCATQ.DLL 2001.12.4414.308 COMRes.dll 77040000 839680 C:\WINDOWS\system32\COMRes.dll 2001.12.4414.258 rsaenh.dll ffd0000 163840 C:\WINDOWS\system32\rsaenh.dll 5.1.2600.2161 (xpsp.040706-1629) Microsoft Enhanced Cryptographic Provider Apphelp.dll 77b30000 139264 C:\WINDOWS\system32\Apphelp.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Application Compatibility Client Library msv1_0.dll 77c60000 143360 C:\WINDOWS\system32\msv1_0.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Authentication Package v1.0 iphlpapi.dll 76d50000 102400 C:\WINDOWS\system32\iphlpapi.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs API Pomocnika IP WTSAPI32.dll 76f40000 32768 C:\WINDOWS\system32\WTSAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Terminal Server SDK APIs WINSTA.dll 76330000 65536 C:\WINDOWS\system32\WINSTA.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Winstation Library Module information for 'svchost.exe' MODULE BASE SIZE PATH svchost.exe 1000000 24576 C:\WINDOWS\System32\svchost.exe 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Generic Host Process for Win32 Services ntdll.dll 7c900000 729088 C:\WINDOWS\system32\ntdll.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka NT Layer DLL kernel32.dll 7c800000 1028096 C:\WINDOWS\system32\kernel32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL klienta Windows NT BASE API ADVAPI32.dll 77dc0000 704512 C:\WINDOWS\system32\ADVAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Advanced Windows 32 Base API RPCRT4.dll 77e70000 593920 C:\WINDOWS\system32\RPCRT4.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Procedure Call Runtime ShimEng.dll 5cfe0000 155648 C:\WINDOWS\System32\ShimEng.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Shim Engine DLL AcGenral.DLL 59410000 1875968 C:\WINDOWS\AppPatch\AcGenral.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Compatibility DLL USER32.dll 77d30000 589824 C:\WINDOWS\system32\USER32.dll 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519) Biblioteka DLL klienta Windows XP USER API GDI32.dll 77f10000 290816 C:\WINDOWS\system32\GDI32.dll 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427) GDI Client DLL WINMM.dll 76b20000 188416 C:\WINDOWS\System32\WINMM.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) MCI API DLL ole32.dll 774d0000 1298432 C:\WINDOWS\system32\ole32.dll 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528) Microsoft OLE for Windows msvcrt.dll 77c00000 360448 C:\WINDOWS\system32\msvcrt.dll 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows NT CRT DLL OLEAUT32.dll 77110000 573440 C:\WINDOWS\system32\OLEAUT32.dll 5.1.2600.2180 MSACM32.dll 77bd0000 86016 C:\WINDOWS\System32\MSACM32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Filtr audio ACM Microsoft VERSION.dll 77bf0000 32768 C:\WINDOWS\system32\VERSION.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Version Checking and File Installation Libraries SHELL32.dll 7c9c0000 8503296 C:\WINDOWS\system32\SHELL32.dll 6.00.2900.2763 (xpsp_sp2_gdr.050922-1642) Wspólna biblioteka DLL Powłoki systemu Windows SHLWAPI.dll 77f60000 483328 C:\WINDOWS\system32\SHLWAPI.dll 6.00.2900.2781 (xpsp_sp2_gdr.051020-1730) Biblioteka dodatkowych narzędzi powłoki USERENV.dll 769a0000 737280 C:\WINDOWS\system32\USERENV.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Userenv UxTheme.dll 5b1d0000 229376 C:\WINDOWS\System32\UxTheme.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka Microsoft UxTheme comctl32.dll 773c0000 1056768 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll 6.0 (xpsp_sp2_rtm.040803-2158) User Experience Controls Library comctl32.dll 5d520000 618496 C:\WINDOWS\system32\comctl32.dll 5.82 (xpsp_sp2_rtm.040803-2158) Common Controls Library NTMARTA.DLL 77680000 135168 C:\WINDOWS\System32\NTMARTA.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows NT - dostawca MARTA WLDAP32.dll 76f50000 184320 C:\WINDOWS\system32\WLDAP32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Win32 LDAP API DLL SAMLIB.dll 71ba0000 77824 C:\WINDOWS\System32\SAMLIB.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) SAM Library DLL xpsp2res.dll 20000000 2957312 C:\WINDOWS\System32\xpsp2res.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Komunikaty pakietu Service Pack 2 shsvcs.dll 776d0000 147456 c:\windows\system32\shsvcs.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL usług powłoki systemu Windows WINSTA.dll 76330000 65536 C:\WINDOWS\System32\WINSTA.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Winstation Library NETAPI32.dll 6ff40000 344064 C:\WINDOWS\system32\NETAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Net Win32 API DLL dhcpcsvc.dll 76d70000 122880 c:\windows\system32\dhcpcsvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Usługa klienta DHCP DNSAPI.dll 76f10000 159744 c:\windows\system32\DNSAPI.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) DNS Client API DLL WS2_32.dll 71a50000 94208 c:\windows\system32\WS2_32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Socket 2.0 32-Bit DLL WS2HELP.dll 71a40000 32768 c:\windows\system32\WS2HELP.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Socket 2.0 Helper dla Windows NT iphlpapi.dll 76d50000 102400 c:\windows\system32\iphlpapi.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs API Pomocnika IP Secur32.dll 77fe0000 69632 c:\windows\system32\Secur32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Security Support Provider Interface rsaenh.dll ffd0000 163840 C:\WINDOWS\System32\rsaenh.dll 5.1.2600.2161 (xpsp.040706-1629) Microsoft Enhanced Cryptographic Provider wzcsvc.dll 77610000 450560 c:\windows\system32\wzcsvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Usługa konfiguracji zerowej sieci bezprzewodowej rtutils.dll 76e70000 57344 c:\windows\system32\rtutils.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Routing Utilities WMI.dll 76d20000 16384 c:\windows\system32\WMI.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI DC and DP functionality CRYPT32.dll 77a70000 610304 C:\WINDOWS\system32\CRYPT32.dll 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) Crypto API32 MSASN1.dll 77b10000 73728 C:\WINDOWS\system32\MSASN1.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ASN.1 Runtime APIs WTSAPI32.dll 76f40000 32768 c:\windows\system32\WTSAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Terminal Server SDK APIs ESENT.dll 6f8f0000 1114112 c:\windows\system32\ESENT.dll 5.1.2468.0 (Lab03_N(jliem).010306-1456) Server Database Storage Engine ATL.DLL 76b00000 69632 c:\windows\system32\ATL.DLL 3.05.2284 ATL Module for Windows XP (Unicode) SETUPAPI.DLL 77910000 1007616 C:\WINDOWS\System32\SETUPAPI.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs API Instalatora systemu Windows rastls.dll 76bb0000 126976 C:\WINDOWS\System32\rastls.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Access PPP EAP-TLS CRYPTUI.dll 768b0000 532480 C:\WINDOWS\system32\CRYPTUI.dll 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) Dostawca interfejsu zaufania Microsoft WINTRUST.dll 76c20000 188416 C:\WINDOWS\system32\WINTRUST.dll 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejsy API potwierdzania zaufania firmy Microsoft IMAGEHLP.dll 76c80000 163840 C:\WINDOWS\system32\IMAGEHLP.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows NT Image Helper WININET.dll 771a0000 684032 C:\WINDOWS\system32\WININET.dll 6.00.2900.2781 (xpsp_sp2_gdr.051020-1730) Rozszerzenia internetowe Win32 MPRAPI.dll 76d30000 98304 C:\WINDOWS\System32\MPRAPI.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows NT MP Router Administration DLL ACTIVEDS.dll 77cb0000 204800 C:\WINDOWS\System32\ACTIVEDS.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ADs Router Layer DLL adsldpc.dll 76e00000 151552 C:\WINDOWS\System32\adsldpc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ADs LDAP Provider C DLL RASAPI32.dll 76ed0000 245760 C:\WINDOWS\System32\RASAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs API usługi Dostęp zdalny rasman.dll 76e80000 73728 C:\WINDOWS\System32\rasman.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Access Connection Manager TAPI32.dll 76ea0000 192512 C:\WINDOWS\System32\TAPI32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL klienta interfejsu API usługi Telefonii dla systemu Microsoft® Windows(TM) SCHANNEL.dll 767d0000 159744 C:\WINDOWS\System32\SCHANNEL.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) TLS / SSL Security Provider WinSCard.dll 72380000 114688 C:\WINDOWS\System32\WinSCard.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Smart Card API raschap.dll 76cd0000 81920 C:\WINDOWS\System32\raschap.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Access PPP CHAP msv1_0.dll 77c60000 143360 C:\WINDOWS\system32\msv1_0.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Authentication Package v1.0 CLBCATQ.DLL 76fc0000 520192 C:\WINDOWS\System32\CLBCATQ.DLL 2001.12.4414.308 COMRes.dll 77040000 839680 C:\WINDOWS\System32\COMRes.dll 2001.12.4414.258 schedsvc.dll 76b50000 208896 c:\windows\system32\schedsvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Aparat Harmonogramu zadań NTDSAPI.dll 76780000 77824 c:\windows\system32\NTDSAPI.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) NT5DS MSIDLE.DLL 74f00000 20480 C:\WINDOWS\System32\MSIDLE.DLL 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) User Idle Monitor audiosrv.dll 70e00000 53248 c:\windows\system32\audiosrv.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Audio Service wkssvc.dll 76e30000 143360 c:\windows\system32\wkssvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Workstation Service DLL cryptsvc.dll 76d00000 73728 c:\windows\system32\cryptsvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Cryptographic Services certcli.dll 75300000 208896 c:\windows\system32\certcli.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Klient usług certyfikatów Microsoft® dmserver.dll 74f40000 36864 c:\windows\system32\dmserver.dll 2600.2180.503.0 Biblioteka DLL usługi Menedżera dysków logicznych ersvc.dll 74f30000 36864 c:\windows\system32\ersvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Error Reporting Service es.dll 77700000 266240 c:\windows\system32\es.dll 2001.12.4414.308 pchsvc.dll 74ef0000 49152 c:\windows\pchealth\helpctr\binaries\pchsvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft PCHealth Service Holder srvsvc.dll 75040000 106496 c:\windows\system32\srvsvc.dll 5.1.2600.2577 (xpsp_sp2_gdr.041130-1729) Server Service DLL netman.dll 77cf0000 208896 c:\windows\system32\netman.dll 5.1.2600.2743 (xpsp_sp2_gdr.050819-1525) Menedżer połączeń sieciowych netshell.dll 763d0000 1736704 c:\windows\system32\netshell.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Powłoka połączeń sieciowych credui.dll 76bf0000 188416 c:\windows\system32\credui.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs użytkownika menedżera poświadczeń WZCSAPI.DLL 72fc0000 65536 c:\windows\system32\WZCSAPI.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Wireless Zero Configuration service API HNETCFG.DLL 66780000 360448 C:\WINDOWS\System32\HNETCFG.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Menedżer konfiguracji sieci domowej seclogon.dll 73cb0000 32768 c:\windows\system32\seclogon.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Biblioteka DLL dla pomocniczej usługi logowania sens.dll 72280000 53248 c:\windows\system32\sens.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) System Event Notification Service (SENS) srsvc.dll 75150000 188416 c:\windows\system32\srsvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Usługa przywracania systemu POWRPROF.dll 74a80000 32768 c:\windows\system32\POWRPROF.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Power Profile Helper DLL trkwks.dll 75020000 102400 c:\windows\system32\trkwks.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Distributed Link Tracking Client w32time.dll 767a0000 184320 c:\windows\system32\w32time.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Usługa Czas systemu Windows MSVCP60.dll 76050000 413696 c:\windows\system32\MSVCP60.dll 6.02.3104.0 Microsoft (R) C++ Runtime Library wmisvc.dll 5a840000 163840 c:\windows\system32\wbem\wmisvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI VSSAPI.DLL 75390000 446464 C:\WINDOWS\system32\VSSAPI.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft® Volume Shadow Copy Requestor/Writer Services API DLL wuauserv.dll 50000000 20480 c:\windows\system32\wuauserv.dll 5.4.3790.2180 (xpsp_sp2_rtm.040803-2158) Windows Update AutoUpdate Service browser.dll 77310000 86016 c:\windows\system32\browser.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Computer Browser Service DLL wuaueng.dll 50040000 1351680 C:\WINDOWS\system32\wuaueng.dll 5.8.0.2469 built by: lab01_n(wmbla) Windows Update AutoUpdate Engine ADVPACK.dll 75210000 167936 C:\WINDOWS\System32\ADVPACK.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ADVPACK SHFOLDER.dll 76760000 36864 C:\WINDOWS\System32\SHFOLDER.dll 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Shell Folder Service WINSPOOL.DRV 72f90000 155648 C:\WINDOWS\System32\WINSPOOL.DRV 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Spooler Driver WINHTTP.dll 4d530000 360448 C:\WINDOWS\System32\WINHTTP.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows HTTP Services Cabinet.dll 75100000 81920 C:\WINDOWS\System32\Cabinet.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft® Cabinet File API mspatcha.dll 60530000 45056 C:\WINDOWS\System32\mspatcha.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft(R) Patch Engine sfc.dll 76b90000 20480 C:\WINDOWS\System32\sfc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows File Protection sfc_os.dll 76c50000 172032 C:\WINDOWS\System32\sfc_os.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Ochrona plików systemu Windows mswsock.dll 719f0000 262144 C:\WINDOWS\system32\mswsock.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Windows Sockets 2.0 Dostawca usługi wshtcpip.dll 71a30000 32768 C:\WINDOWS\System32\wshtcpip.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Sockets Helper DLL wscsvc.dll 4c0e0000 94208 c:\windows\system32\wscsvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows Security Center Service msi.dll 745e0000 2908160 c:\windows\system32\msi.dll 3.1.4000.2435 Windows Installer wbemcomn.dll 75240000 225280 C:\WINDOWS\System32\wbem\wbemcomn.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI wbemcore.dll 76650000 544768 C:\WINDOWS\SYSTEM32\WBEM\wbemcore.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI esscli.dll 752c0000 258048 C:\WINDOWS\SYSTEM32\WBEM\esscli.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI FastProx.dll 75650000 483328 C:\WINDOWS\SYSTEM32\WBEM\FastProx.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI wmiutils.dll 74fd0000 114688 C:\WINDOWS\System32\wbem\wmiutils.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI repdrvfs.dll 751b0000 188416 C:\WINDOWS\System32\wbem\repdrvfs.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI wmiprvsd.dll 59930000 446464 C:\WINDOWS\System32\wbem\wmiprvsd.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI NCObjAPI.DLL 5fc00000 49152 C:\WINDOWS\system32\NCObjAPI.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) wbemess.dll 75340000 286720 C:\WINDOWS\System32\wbem\wbemess.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI SXS.DLL 75e60000 720896 C:\WINDOWS\System32\SXS.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Fusion 2.5 comsvcs.dll 760c0000 1294336 C:\WINDOWS\system32\comsvcs.dll 2001.12.4414.308 colbact.DLL 750e0000 81920 C:\WINDOWS\system32\colbact.DLL 2001.12.4414.308 MTXCLU.DLL 750a0000 77824 C:\WINDOWS\system32\MTXCLU.DLL 2001.12.4414.308 MS DTC amd MTS clustering support DLL WSOCK32.dll 71a70000 40960 C:\WINDOWS\system32\WSOCK32.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) 32-bitowa biblioteka Windows Socket CLUSAPI.DLL 76d90000 69632 C:\WINDOWS\System32\CLUSAPI.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Cluster API Library RESUTILS.DLL 75060000 73728 C:\WINDOWS\System32\RESUTILS.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Cluster Resource Utility DLL ncprov.dll 5fbd0000 57344 C:\WINDOWS\System32\wbem\ncprov.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Non-COM WMI Event Provision APIs ipnathlp.dll 66940000 348160 c:\windows\system32\ipnathlp.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Składniki Pomocnika Microsoft NAT AUTHZ.dll 776b0000 69632 c:\windows\system32\AUTHZ.dll 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519) Authorization Framework upnp.dll 76dd0000 143360 C:\WINDOWS\System32\upnp.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Universal Plug and Play API SSDPAPI.dll 74eb0000 49152 C:\WINDOWS\System32\SSDPAPI.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) SSDP Client API DLL rasadhlp.dll 76fb0000 24576 C:\WINDOWS\System32\rasadhlp.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Access AutoDial Helper rasmans.dll 72410000 196608 C:\WINDOWS\System32\rasmans.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Access Connection Manager WINIPSEC.DLL 74310000 45056 C:\WINDOWS\System32\WINIPSEC.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Windows IPSec SPD Client DLL netcfgx.dll 755b0000 638976 C:\WINDOWS\System32\netcfgx.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Obiekty konfiguracji sieci tapisrv.dll 73370000 262144 c:\windows\system32\tapisrv.dll 5.1.2600.2716 (xpsp_sp2_gdr.050707-1657) Serwer Telefonii Microsoft® Windows(TM) PSAPI.DLL 76be0000 45056 c:\windows\system32\PSAPI.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Process Status Helper rastapi.dll 75f10000 69632 C:\WINDOWS\System32\rastapi.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Access TAPI Compliance Layer unimdm.tsp 57de0000 221184 C:\WINDOWS\System32\unimdm.tsp 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Dostawca usług Unimodem 5 uniplat.dll 71fb0000 28672 C:\WINDOWS\System32\uniplat.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Unimodem AT Mini Driver Platform Driver for Windows NT kmddsp.tsp 57e60000 45056 C:\WINDOWS\System32\kmddsp.tsp 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Dostawca usług trybu jądra TAPI ndptsp.tsp 57e40000 65536 C:\WINDOWS\System32\ndptsp.tsp 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Dostawca usług NDIS Proxy TAPI ipconf.tsp 57e70000 32768 C:\WINDOWS\System32\ipconf.tsp 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Dostawca usług Microsoft Multicast Conference TAPI h323.tsp 57e90000 286720 C:\WINDOWS\System32\h323.tsp 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Dostawca usługi telefonii Microsoft H.323 hidphone.tsp 57e80000 40960 C:\WINDOWS\System32\hidphone.tsp 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft HID Phone TSP HID.DLL 68df0000 36864 C:\WINDOWS\System32\HID.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Hid User Library rasppp.dll 721f0000 217088 C:\WINDOWS\System32\rasppp.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Remote Access PPP ntlsapi.dll 72440000 24576 C:\WINDOWS\System32\ntlsapi.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft® License Server Interface DLL kerberos.dll 71ca0000 307200 C:\WINDOWS\system32\kerberos.dll 5.1.2600.2698 (xpsp_sp2_gdr.050614-1522) Kerberos Security Package cryptdll.dll 76770000 49152 C:\WINDOWS\System32\cryptdll.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Cryptography Manager RASDLG.dll 75500000 688128 C:\WINDOWS\System32\RASDLG.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Interfejs API dla wspólnych okien dialogowych usługi Dostęp zdalny MSXML3.DLL 74930000 1245184 C:\WINDOWS\System32\MSXML3.DLL 8.50.2162.0 MSXML 3.0 SP 5 Apphelp.dll 77b30000 139264 C:\WINDOWS\system32\Apphelp.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Application Compatibility Client Library winrnr.dll 76fa0000 32768 C:\WINDOWS\System32\winrnr.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) LDAP RnR Provider DLL wbemsvc.dll 74e80000 57344 C:\WINDOWS\System32\wbem\wbemsvc.dll 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) WMI dssenh.dll 68100000 147456 C:\WINDOWS\System32\dssenh.dll 5.1.2600.2133 (xpsp.040514-1639) Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider

**Posty:** 8694 · przez **Red** 24 Sty 2006, 14:00

i tu tez czysto jest...
Prosze wykonac jeszcze jeden scan i podesłac log z :
http://www.sysinternals.com/Files/RootkitRevealer.zip

**Posty:** 36 · przez **Ygit** 24 Sty 2006, 15:03

Wykonałem ten skan a to jest log

Kod: Zaznacz wszystko: HKLM\SOFTWARE\Classes\BDATuner.Sk 2006-01-20 09:54 0 bytes Key name contains embedded nulls (*) HKLM\SOFTWARE\Classes\BDATuner.Sk 2006-01-20 09:54 0 bytes Key name contains embedded nulls (*) HKLM\SYSTEM\ControlSet001\Services\d347prt\Cfg\0Jf40 2006-01-24 09:13 0 bytes Hidden from Windows API. HKLM\SYSTEM\ControlSet001\Services\Eventlog\System\Mened 2006-01-13 19:37 0 bytes Key name contains embedded nulls (*) HKLM\SYSTEM\ControlSet001\Services\Eventlog\System\Us 2006-01-13 19:40 0 bytes Key name contains embedded nulls (*) HKLM\SYSTEM\ControlSet003\Services\Eventlog\System\Mened 2006-01-13 19:37 0 bytes Key name contains embedded nulls (*) HKLM\SYSTEM\ControlSet003\Services\Eventlog\System\Us 2006-01-13 19:40 0 bytes Key name contains embedded nulls (*) C:\Documents and Settings\Wolanski\Cookies\wolanski@forum.programosy[1].txt 2006-01-24 12:54 224 bytes Hidden from Windows API. C:\Documents and Settings\Wolanski\Cookies\wolanski@forum.programosy[2].txt 2006-01-24 12:08 225 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Wolanski\Ustawienia lokalne\Temporary Internet Files\Content.IE5\13IN4KAZ\CAPOUX1Z.html&cc=1983&u_h=768&u_w=1024&u_ah=738&u_aw=1024&u_cd=32&u_tz=60&u_his=6&u_java=true 2006-01-24 12:50 1.73 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Wolanski\Ustawienia lokalne\Temporary Internet Files\Content.IE5\13IN4KAZ\plusminus[1].htm 2006-01-24 12:54 60.68 KB Hidden from Windows API. C:\Documents and Settings\Wolanski\Ustawienia lokalne\Temporary Internet Files\Content.IE5\13IN4KAZ\plusminus[1].php 2006-01-24 12:54 12.41 KB Hidden from Windows API. C:\Documents and Settings\Wolanski\Ustawienia lokalne\Temporary Internet Files\Content.IE5\V1DGSV4P\plusminus[1].php 2006-01-24 12:54 12.41 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Wolanski\Ustawienia lokalne\Temporary Internet Files\Content.IE5\V1DGSV4P\plusminus[2].htm 2006-01-24 12:54 60.68 KB Hidden from Windows API. C:\Documents and Settings\Wolanski\Ustawienia lokalne\Temporary Internet Files\Content.IE5\XAEUAQCJ\2-vt30276[1].html 2006-01-24 12:50 19.35 KB Visible in Windows API, but not in MFT or directory index.

**Posty:** 8694 · przez **Red** 24 Sty 2006, 15:10

nic nie widac

zrob oststnie działanie :

Ctrl+Alt+ Delete w Menu>Widok>Wybierz kolumny i zaznacz PID (idenfikator procesu)
Nastepnie>> Start>>Uruchom i wklej:
cmd /c tasklist /svc > Pulpit\tasklist.txt
Nastepnie klikasz OK

pojawi ci sie dokument tekstowy tasklist.txt otwórz ten dokument i wklej jego zawartosc na forum

**Posty:** 36 · przez **Ygit** 24 Sty 2006, 15:25

Oto zawartość tego dokumentu

Kod: Zaznacz wszystko: Nazwa obrazu PID Usugi ========================= ====== ============================================= System Idle Process 0 Brak System 4 Brak smss.exe 416 Brak csrss.exe 472 Brak winlogon.exe 496 Brak services.exe 540 Eventlog, PlugPlay lsass.exe 552 PolicyAgent, ProtectedStorage, SamSs svchost.exe 700 DcomLaunch, TermService svchost.exe 788 RpcSs svchost.exe 828 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasMan, Schedule, seclogon, SENS, SharedAccess, ShellHWDetection, TapiSrv, Themes, TrkWks, W32Time, winmgmt, wscsvc, wuauserv, WZCSVC svchost.exe 868 Dnscache svchost.exe 920 LmHosts, RemoteRegistry, SSDPSRV, WebClient explorer.exe 1120 Brak spoolsv.exe 1204 Spooler aswUpdSv.exe 1324 aswUpdSv ati2evxx.exe 1348 Ati HotKey Poller ashServ.exe 1380 avast! Antivirus atiptaxx.exe 1872 Brak qttask.exe 1880 Brak TaskBarIcon.exe 1924 Brak ashDisp.exe 1932 Brak daemon.exe 1940 Brak ctfmon.exe 1956 Brak dslmon.exe 1992 Brak ashMaiSv.exe 244 avast! Mail Scanner ashWebSv.exe 364 avast! Web Scanner alg.exe 556 ALG taskmgr.exe 1064 Brak NeostradaTP.exe 2256 Brak ComComp.exe 2268 Brak Watch.exe 2356 Brak gg.exe 2468 Brak iexplore.exe 3440 Brak iexplore.exe 396 Brak cmd.exe 3796 Brak tasklist.exe 184 Brak wmiprvse.exe 3940 Brak

**Posty:** 8694 · przez **Red** 24 Sty 2006, 15:58

sciagnij obowiazkowo :
http://www.firewallleaktester.com/tools/wwdc.exe
pozamykaj wszystkie porty na enable

wmiprvse.exe

wyglada ze to jest powodem twojego skaczacego procesora.Wyłacz ten proces i po zamontowaniu wwdc zobacz czy cos sie zmieniło

**Posty:** 36 · przez **Ygit** 24 Sty 2006, 16:40

wgrałem ten program i pozemykałem te porty na enable i usunołem ten proces . Procesor ciągle podskakuje do 100% :shock:

użycie procesora

użycie procesora

Kto jest na forum