prosze o pomoc przy sprawdzaniu loga.

[Smilodon]

Witam,
mam problem z komputerem i sprawdzeniem loga do niego (hijackthis) otóż znalażłem stronke która sprawdza automatycznie logi: http://www.hijackthis.de/index.php#anl no i wkleilem swojego loga i pokazala pare unknown i unnecessarily...wszystko ladnie pieknie ale problem w tym ze nie wiem czy wszystko mi wykryla i dobrze.
Ale nie wklejam bezsensownego loga bo ostatnio komputer stracil troche na szybkosci, czasem kiedy jestem na necie komp zaczyna swirowac i i wszystko lata na stronkach, takze pare razy w tygodniu sam mi sie restartuje
I te drażniące okienka z firewalla (o ktorych kiedys juz pisalem)

Ostatnio moj komputer coś zwolnił a na dodatek ciagle ten komunikat z firewalla:


Kiedy wciskam nie, a musze to zrobic co najmniej ze 20 razy nic sie nie wyswietla alke gdy nacisne tak otrzymuje to okienko:

Czy ktos wie za co odpowiada ten program ze screenow i skad ten problem mogl sie wziac?

Oto log:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 21:41:14, on 2006-01-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAMY\Ochrona\Anti-virus\aswUpdSv.exe
C:\PROGRAMY\Ochrona\Anti-virus\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRAMY\Ochrona\Firewall\Keiro Firewall\persfw.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\PowerS.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRAMY\Ochrona\ANTI-V~1\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\MULTIMEDIA\Płyty\Nowy folder (2)\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\MULTIMEDIA\Internetowe\Skype\Phone\Skype.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\PROGRA~1\MESSEN~1\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\PROGRAMY\Ochrona\Anti-virus\ashMaiSv.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
C:\PROGRAMY\Internetowe\UD Agent\UD.EXE
C:\PROGRAMY\Internetowe\UD Agent\ud_7657531.exe
C:\PROGRAMY\Internetowe\UD Agent\ud_7657531_0.dir\WCGrid_Rosetta.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\MULTIMEDIA\Internetowe\Gadu-Gadu\gg.exe
C:\PROGRAMY\Internetowe\Opera\Opera.exe
C:\PROGRAMY\Ochrona\Anti-virus\ashSimpl.exe
C:\Documents and Settings\PSmillodon\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.amnezja.org/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMY\Grafika\Adobe Reader 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRAMY\Ochrona\ANTYSP~1\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: wb - {55BE9F0D-6CAF-4c3e-B125-5A13A8C9D0EC} - C:\WINDOWS\system32\nsfE.dll
O2 - BHO: (no name) - {8036D4D7-AAD3-4793-AB49-329E437155A8} - (no file)
O2 - BHO: IRiras Class - {95C60327-8E17-44D6-98EB-7EB70CC606DD} - C:\WINDOWS\system32\irasttae.dll
O2 - BHO: (no name) - {C43F8D28-1057-FEB9-C1AE-DF8D11E73332} - C:\DOCUME~1\PSMILL~1\DANEAP~1\GRIDDA~1\size defy.exe
O3 - Toolbar: (no name) - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRAMY\Ochrona\ANTI-V~1\ashDisp.exe
O4 - HKLM\..\Run: [WOOKIT] C:\Program Files\Neostrada TP\NeostradaTP.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [32 gpl way first] C:\Documents and Settings\All Users\Dane aplikacji\Media Kind 32 Gpl\Idle the.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\MULTIMEDIA\Płyty\Nowy folder (2)\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [meow seek] C:\DOCUME~1\PSMILL~1\DANEAP~1\CAKEFA~1\REF DEAD SURF.exe
O4 - HKCU\..\Run: [Skype] "C:\MULTIMEDIA\Internetowe\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
O4 - HKCU\..\Run: [irassync] C:\WINDOWS\system32\irasyncd.exe
O4 - Startup: UD Agent.lnk = C:\PROGRAMY\Internetowe\UD Agent\UD.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\PROGRAMY\Grafika\Adobe Reader 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz używając Download &Express'a - C:\MULTIMEDIA\Internetowe\Download Express\Add_Url.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.amnezja.org/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121553044804
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C8D2A53-C8BF-44C7-9E8A-56FAA66623FC}: NameServer = 194.204.152.34 217.98.63.164
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C8D2A53-C8BF-44C7-9E8A-56FAA66623FC}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\PROGRAMY\Ochrona\Firewall\Keiro Firewall\persfw.exe

Jesli moglibyscie wrzucic to na ta stronke co sprawdza logi i zobaczyc czy dobrze sprawdza bylbym wdzieczny bo moglbym sam to robic i wam czasu nie zabierac.
Dzieki.

[Red]

ja tam nie polecam automatu ,ale kazdy robi co tam mu sie podoba

co do loga:- to są smieci:

O2 - BHO: wb - {55BE9F0D-6CAF-4c3e-B125-5A13A8C9D0EC} - C:\WINDOWS\system32\nsfE.dll
O2 - BHO: (no name) - {8036D4D7-AAD3-4793-AB49-329E437155A8} - (no file)
O2 - BHO: IRiras Class - {95C60327-8E17-44D6-98EB-7EB70CC606DD} - C:\WINDOWS\system32\irasttae.dll
O3 - Toolbar: (no name) - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - (no file)
O4 - HKCU\..\Run: [irassync] C:\WINDOWS\system32\irasyncd.exe

a to znasz:

O4 - HKCU\..\Run: [meow seek] C:\DOCUME~1\PSMILL~1\DANEAP~1\CAKEFA~1\REF DEAD SURF.exe
O4 - HKLM\..\Run: [32 gpl way first] C:\Documents and Settings\All Users\Dane aplikacji\Media Kind 32 Gpl\Idle the.exe

Autor postu otrzymał pochwałę

[Smilodon]

Dzieki red sorry ze tak pozno ale nie mialem czasu ostatnio....
No wyczyscilem tak jak napisales a tamtych wpisow nie pamietam nawet nie wiem do czego one sa ale usunalem je Fix checkted a gdy chcialem z dysku to pisze ze nie mozna bo jest chroniony albo uzywany.

Daje loga kontrolnego:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 15:35:42, on 2006-01-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAMY\Ochrona\Anti-virus\aswUpdSv.exe
C:\PROGRAMY\Ochrona\Anti-virus\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRAMY\Ochrona\Firewall\Keiro Firewall\persfw.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\PowerS.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRAMY\Ochrona\ANTI-V~1\ashDisp.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\MULTIMEDIA\Płyty\Nowy folder (2)\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\MULTIMEDIA\Internetowe\Skype\Phone\Skype.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\PROGRA~1\MESSEN~1\msmsgs.exe
C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRAMY\Internetowe\UD Agent\UD.EXE
C:\PROGRAMY\Ochrona\Anti-virus\ashMaiSv.exe
C:\PROGRAMY\Internetowe\UD Agent\ud_7657531.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\PROGRAMY\Internetowe\UD Agent\ud_7657531_0.dir\WCGrid_Rosetta.exe
C:\PROGRAMY\Internetowe\Opera\Opera.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Documents and Settings\PSmillodon\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.amnezja.org/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMY\Grafika\Adobe Reader 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRAMY\Ochrona\ANTYSP~1\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {C43F8D28-1057-FEB9-C1AE-DF8D11E73332} - C:\DOCUME~1\PSMILL~1\DANEAP~1\GRIDDA~1\size defy.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRAMY\Ochrona\ANTI-V~1\ashDisp.exe
O4 - HKLM\..\Run: [WOOKIT] C:\Program Files\Neostrada TP\NeostradaTP.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\MULTIMEDIA\Płyty\Nowy folder (2)\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\MULTIMEDIA\Internetowe\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
O4 - Startup: UD Agent.lnk = C:\PROGRAMY\Internetowe\UD Agent\UD.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\PROGRAMY\Grafika\Adobe Reader 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz używając Download &Express'a - C:\MULTIMEDIA\Internetowe\Download Express\Add_Url.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.amnezja.org/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121553044804
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C8D2A53-C8BF-44C7-9E8A-56FAA66623FC}: NameServer = 194.204.152.34 217.98.63.164
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C8D2A53-C8BF-44C7-9E8A-56FAA66623FC}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\PROGRAMY\Ochrona\Firewall\Keiro Firewall\persfw.exe

A czy te wpsiy sa porawne?:

Kod: Zaznacz wszystko

C:\DOCUME~1\PSMILL~1\DANEAP~1\GRIDDA~1\size defy.exe

Jeszcze raz dziex i prosze o sprawdzenie tego.

[ Dodano: Dzisiaj o 18:11 ]
Nie dopominam sie ale moj temat prawie juz spadl na druga strone to go odkopuje...sprawdzcie mi loga jka bedziecie mieli czas dzieki.

[Red]

a gdy chcialem z dysku to pisze ze nie mozna bo jest chroniony albo uzywany.

zrob to w trybie awaryjnym

A czy te wpsiy sa porawne?:
Kod:
C:\DOCUME~1\PSMILL~1\DANEAP~1\GRIDDA~1\size defy.exe

usuwasz to rowniez ....

Autor postu otrzymał pochwałę

[Smilodon]

Sorry ze znowu po czasie ale myslalem ze mi nikt wtedy nie odpisal.
No usunalaem to wszystko ladnie pieknie w awaryjnym bez przywracania systemu i z dyskow i z hijacka ale ma kolejny problem.
Otoż czytając forum znalazłem taki problem:

Mam taki problem. Znikajace okno menadzera zadan, zapychanie neta, zwalnianie kompa, plik na C:\apace.exe ktory chce sie laczyc. Mam Avasta! ale on nie daje rady tego usunac. Co chwile wyskakuje takie okienko z napisem: "Czas oczekiwania na polaczenie internetowe uplynal. Czekac dalej? (apace.exe-> 174.004.dsl.syd.iprimus.net.au:25)"
w nawiasie sa rozne adresy np 'mc3.fra.server.colt.net:25'. Co robic?

Wlasnie przypomnialem sobie jak moj kolega dzisiaj ze mna rozmawial ze to ma no i postanowilem o tym poczytac gdzies no i co znalazlem...

Yaha.J jest kolejnym robakiem z licznej rodziny Yaha. Jego działanie polega na rozsyłaniu własnych kopii za pomocą poczty elektronicznej oraz wyłączaniu niektórych programów antywirusowych...

...Na koniec robak rozsyła własne kopie z pomocą poczty elektronicznej do wszystkich adresatów znajdujących się w książce adresowej systemu Windows oraz programów ICQ i MSN Messenger, a także w plikach z rozszerzeniami htm i html. Do wysyłania kopii robak używa własnego silnika SMTP

Objawy idealnie pasuja do moich i kolegi najwidoczniej zarazil mnie tym tak jak tam pisze a jeszcze wczoraj przesylal mi pliki na konto.

Komp mi nie zwolnil ale ciagle z poczty wyskakuje prosba o haslo nic nie mogew odebrac tylko wysylac ciagle zpchane linia poczty jakby cos ialo przyjsc a po paru minutach takie cus:
"Czas oczekiwania na połączenie miną czekac dalej"...
Na poczte zaimportowana na Opere moge wejsc a na ta na koncie noestrada nie bo pisze nie prawidlowe dane...

Oto mój log:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 18:31:44, on 2006-01-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAMY\Ochrona\Anti-virus\aswUpdSv.exe
C:\PROGRAMY\Ochrona\Anti-virus\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRAMY\Ochrona\Firewall\Keiro Firewall\persfw.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\PowerS.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRAMY\Ochrona\ANTI-V~1\ashDisp.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\MULTIMEDIA\Płyty\Nowy folder (2)\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\MULTIMEDIA\Internetowe\Skype\Phone\Skype.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\PROGRA~1\MESSEN~1\msmsgs.exe
C:\PROGRAMY\Ochrona\Anti-virus\ashMaiSv.exe
C:\PROGRAMY\Grafika\Adobe Reader 7.0\Reader\reader_sl.exe
C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
C:\PROGRAMY\Internetowe\UD Agent\UD.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\PROGRAMY\Internetowe\UD Agent\ud_7657531.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRAMY\Internetowe\Opera\Opera.exe
C:\PROGRAMY\Internetowe\UD Agent\ud_7657531_0.dir\WCGrid_Rosetta.exe
C:\MULTIMEDIA\Internetowe\Gadu-Gadu\gg.exe
C:\PROGRAMY\Muzyka\Foobar\foobar2000\foobar2000.exe
C:\Documents and Settings\PSmillodon\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.amnezja.org/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMY\Grafika\Adobe Reader 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRAMY\Ochrona\ANTYSP~1\Spybot\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRAMY\Ochrona\ANTI-V~1\ashDisp.exe
O4 - HKLM\..\Run: [WOOKIT] C:\Program Files\Neostrada TP\NeostradaTP.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\MULTIMEDIA\Płyty\Nowy folder (2)\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\MULTIMEDIA\Internetowe\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
O4 - Startup: UD Agent.lnk = C:\PROGRAMY\Internetowe\UD Agent\UD.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\PROGRAMY\Grafika\Adobe Reader 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz używając Download &Express'a - C:\MULTIMEDIA\Internetowe\Download Express\Add_Url.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.amnezja.org/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121553044804
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C8D2A53-C8BF-44C7-9E8A-56FAA66623FC}: NameServer = 194.204.152.34 217.98.63.164
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C8D2A53-C8BF-44C7-9E8A-56FAA66623FC}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\PROGRAMY\Ochrona\Anti-virus\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\PROGRAMY\Ochrona\Firewall\Keiro Firewall\persfw.exe

Przepraszam za tyle textu ale mysle ze poomoze wam on mi pomoc...
PS.Dwa wielki plusy dla Reda tylko tak moge ci sie odwdzieczyc.
PS.2 Moglbym wkleic tu loga od kumpla bo jemu nie otwiera sie rzaden wiersz polecen i zerejstrowac sie nigdzie nie moze takze tu?

[Red]

Jedyna rzecz ktora moze dziwic w tym logu to:

C:\PROGRAMY\Internetowe\UD Agent\ud_7657531_0.dir\WCGrid_Rosetta.exe

Czy znasz to co pogrubiłem

I jeszcze masz program szpiegujący ,ale legalny tj:

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

Ten pogrubiony mozesz usunąć....

Nic wiecej nie widac

[Smilodon]

C:\PROGRAMY\Internetowe\UD Agent\ud_7657531_0.dir\WCGrid_Rosetta.exe

To mam od lipca to jest program (akcja na caly swiat) pomagajacy w odnalezieniu lekarstwa na raka wykorzystuje niewielka moc obliczeniowa komputera.To to na bank nie.

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

A to jest z oprogramowania kamerki to tez nie.

Komp czysty dzieki tobie mistrzu ale o co biega z tymi ciaglymi okienkami ze czas oczekiwania minal ten sam problem ma koles spd tego linku
http://www.forum.programosy.pl/problem-z-wirusem-vt28775.html?highlight=apace+exe

Pisalem wyzej co mi dolega.

[prog]

I jeszcze masz program szpiegujący ,ale legalny tj:


Cytat:
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

Ten pogrubiony mozesz usunąć....

Nic wiecej nie widac

to sie unstaluje ze sterami Logitecha, ja mam takie cos w sterach do myszki.

To nic nie robi


Co do tego Znikajace Okna manedzaera...

Daj loga z SilentRunners:

Sciagnij:
http://www.silentrunners.org/Silent%20Runners.vbs (prawy klik >> zapisz jako)

Ściągamy linkowany wyżej plik na dysk. Plik podwójnie klikamy. Jeśli uruchomienie się powiedzie otrzymamy takie tajemnicze pytanko które jest nieco podchwytliwe:



Klikasz na "No"
po czym cierpliwie czekasz na log (dostaniesz info kiedy skonczy)

PZDR

[Red]

co do loga kumpla>>musi usunać:

C:\WINDOWS\Abel.exe
O23 - Service: Abel - oxid.it - C:\WINDOWS\Abel.exe

Wiesz jak usuwac....

[jeff]

to sie unstaluje ze sterami Logitecha, ja mam takie cos w sterach do myszki.

To nic nie robi

to jest spyware - nie zamierzam sie tłumaczyc

wiecej na SE

[Red]

progmaniak anders ci napisał co to jest ...myslałem ,ze wiesz o czym rozmawiamy.....

[Smilodon]

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision 43, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Skype" = ""C:\MULTIMEDIA\Internetowe\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."]
"LDM" = "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" ["Logitech"]
"LogitechSoftwareUpdate" = ""C:\Program Files\Logitech\Video\ManifestEngine.exe" boot" ["Logitech Inc."]
"MSMSGS" = ""C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"PowerS" = "C:\WINDOWS\PowerS.exe" ["prolink"]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe" ["Sun Microsystems, Inc."]
"NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot" ["RealNetworks, Inc."]
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string]
"WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"]
"avast!" = "C:\PROGRAMY\Ochrona\ANTI-V~1\ashDisp.exe" [null data]
"WOOKIT" = "C:\Program Files\Neostrada TP\NeostradaTP.exe" ["France Télécom R&D"]
"LVCOMSX" = "C:\WINDOWS\system32\LVCOMSX.EXE" ["Logitech Inc."]
"LogitechVideoRepair" = "C:\Program Files\Logitech\Video\ISStart.exe " ["Logitech Inc."]
"LogitechVideoTray" = "C:\Program Files\Logitech\Video\LogiTray.exe" ["Logitech Inc."]
"DAEMON Tools-1033" = ""C:\MULTIMEDIA\Płyty\Nowy folder (2)\daemon.exe"  -lang 1033" ["DAEMON'S HOME"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRAMY\Grafika\Adobe Reader 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRAMY\Ochrona\ANTYSP~1\Spybot\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Eksplorator pulpitów"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRAMY\Ochrona\Anti-virus\ashShell.dll" ["ALWIL Software"]
"{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}" = "My Logitech Pictures"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Logitech\Video\Namespc2.dll" ["Logitech Inc."]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{0561EC90-CE54-4f0c-9C55-E226110A740C}" = "Haali Column Provider"
  -> {CLSID}\InProcServer32\(Default) = "E:\Programy\Avi2DVD\Programs\Filters\Haali media splitter\mmfinfo.dll" [null data]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
  -> {CLSID}\InProcServer32\(Default) = "C:\MULTIM~1\PYTY~1\NOWYFO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRAMY\Packing\7-ZIP\7-zipn.dll" ["Igor Pavlov"]
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRAMY\Ochrona\Anti-virus\ashShell.dll" ["ALWIL Software"]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRAMY\Packing\7-ZIP\7-zipn.dll" ["Igor Pavlov"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRAMY\Packing\7-ZIP\7-zipn.dll" ["Igor Pavlov"]
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRAMY\Ochrona\Anti-virus\ashShell.dll" ["ALWIL Software"]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\PSmillodon\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Startup items in "PSmillodon" & "All Users" startup folders:
------------------------------------------------------------

C:\Documents and Settings\PSmillodon\Menu Start\Programy\Autostart
"UD Agent" -> shortcut to: "C:\PROGRAMY\Internetowe\UD Agent\UD.EXE" ["United Devices, Inc."]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"Adobe Reader Speed Launch" -> shortcut to: "C:\PROGRAMY\Grafika\Adobe Reader 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"Logitech Desktop Messenger" -> shortcut to: "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe /start" ["Logitech"]
"Remote Controller" -> shortcut to: "C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE" ["TelSignal Co., Ltd."]


Enabled Scheduled Tasks:
------------------------

"B5A316A391648313" -> launches: "c:\docume~1\psmill~1\daneap~1\cakefa~1\OneEqTrans.exe" [file not found]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\ = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\ = "ToolBand Class"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\ = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\ = "&Badanie"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll" ["Sun Microsystems, Inc."]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"


Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=http://www.amnezja.org/

Missing lines (compared with English-language version):
[Strings]: 1 line


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

avast! Antivirus, avast! Antivirus, ""C:\PROGRAMY\Ochrona\Anti-virus\ashServ.exe"" [null data]
avast! iAVS4 Control Service, aswUpdSv, ""C:\PROGRAMY\Ochrona\Anti-virus\aswUpdSv.exe"" [null data]
avast! Mail Scanner, avast! Mail Scanner, ""C:\PROGRAMY\Ochrona\Anti-virus\ashMaiSv.exe" /service" ["ALWIL Software"]
Kerio Personal Firewall, PersFw, ""C:\PROGRAMY\Ochrona\Firewall\Keiro Firewall\persfw.exe"" ["Kerio Technologies"]
Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS]
NVIDIA Driver Helper Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 185 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
  took 77 seconds.
---------- (total run time: 373 seconds)


Nie jestem pewien czy to to jak nie to sorka usune.

[Red]

Smilodon mieszasz z tymi logami ,raz dajesz kolegi a raz swój......
Napisz czytelnie co cie jeszcze gnebi ,bo twoj log jest czysty,a co do loga kolegi to napisałem co ma usunac....

Autor postu otrzymał pochwałę

[Smilodon]

Juz jest wszystko ok dzieki kolega tez tego Abla usuna dzieki jeszcze raz ale przeciez progmaniak mi kazal walnac tego loga no to nie wiem juz to wrzucilem...

[Red]

progmaniak mi kazal walnac tego loga no to nie wiem juz to wrzucilem...

log jest ok ...czysty