Moj log do sprawdzenia i pytanie
Jak mam zabezpieczyc komputer przed wirusami ?? ciagle,niemal codziennie wyskakuja mi nowe wirusy mimo iz mam FW i antywirusa...
A oto log:
Logfile of HijackThis v1.97.7
Scan saved at 13:36:53, on 2005–02–01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesWinampwinampa.exe
C:Program FilesJavaj2re1.4.2_05injusched.exe
C:Program FilesD–Toolsdaemon.exe
C:PROGRA~1MICROS~2GAMECO~1commonswtrayv4.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumAPVXDWIN.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesGadu–Gadugg.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesKalendarz XPKalendarz.exe
C:Program Filesone LabsoneAlarmzonealarm.exe
C:WINDOWSSystem32CTsvcCDA.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumFirewallPavFires.exe
C:Program FilesPanda SoftwarePanda Antivirus Platinumpavsrv51.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumAVENGINE.EXE
C:WINDOWSsystem32oneLabsvsmon.exe
C:WINDOWSSystem32MsPMSPSv.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumpavProxy.exe
C:WINDOWSsystem32wscntfy.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumIFACE.EXE
C:Program FilesPanda SoftwarePanda Antivirus PlatinumPAVJOBS.EXE
C:Documents and SettingsAdministrator.SERWERMoje dokumentyHijackThisHijackThis.exe
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.pl/
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R1 – HKCUSoftwareMicrosoftInternet Connection Wizard,Shellnext = http://www.sygate.com/swat/support/spf50_help.htm
O2 – BHO: (no name) – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_05injusched.exe
O4 – HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [DAEMON Tools–1033] "C:Program FilesD–Toolsdaemon.exe" –lang 1033
O4 – HKLM..Run: [NeroCheck] C:WINDOWSSystem32\NeroCheck.exe
O4 – HKLM..Run: [SideWinderTrayV4] C:PROGRA~1MICROS~2GAMECO~1commonswtrayv4.exe
O4 – HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 – HKLM..Run: [SCANINICIO] "C:Program FilesPanda SoftwarePanda Antivirus PlatinumInicio.exe"
O4 – HKLM..Run: [APVXDWIN] "C:Program FilesPanda SoftwarePanda Antivirus PlatinumAPVXDWIN.EXE" /s
O4 – HKLM..Run: [WINDVDPatch] CTHELPER.EXE
O4 – HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 – HKLM..Run: [Jet Detection] "C:Program FilesCreativeSBAudigyPROGRAMADGJDet.exe"
O4 – HKLM..Run: [Microsoft NT Update] winexec32.exe
O4 – HKLM..Run: [Servicio Local] svhost.exe
O4 – HKLM..RunServices: [Microsoft NT Update] winexec32.exe
O4 – HKLM..RunServices: [Servicio Local] svhost.exe
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 – HKCU..Run: [TaskTray] "C:Program FilesCreativeSBAudigyTaskBarCTLTray.exe"
O4 – HKCU..Run: [TaskBar] "C:Program FilesCreativeSBAudigyTaskBarCTLTask.exe"
O4 – Global Startup: Kalendarz XP.lnk = C:Program FilesKalendarz XPKalendarz.exe
O4 – Global Startup: ZoneAlarm.lnk = C:Program Filesone LabsoneAlarmzonealarm.exe
O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 – Extra button: Messenger (HKLM)
O9 – Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 – Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O16 – DPF: {02BF25D5–8C17–4B23–BC80–D3488ABDDC6B} – http://www.apple.com/qtactivex/qtplugin.cab
O16 – DPF: {166B1BCA–3F9C–11CF–8075–444553540000} (Shockwave ActiveX Control) – http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 – DPF: {D27CDB6E–0000–0000–0000–000000000000} – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
A oto log:
Logfile of HijackThis v1.97.7
Scan saved at 13:36:53, on 2005–02–01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesWinampwinampa.exe
C:Program FilesJavaj2re1.4.2_05injusched.exe
C:Program FilesD–Toolsdaemon.exe
C:PROGRA~1MICROS~2GAMECO~1commonswtrayv4.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumAPVXDWIN.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesGadu–Gadugg.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesKalendarz XPKalendarz.exe
C:Program Filesone LabsoneAlarmzonealarm.exe
C:WINDOWSSystem32CTsvcCDA.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumFirewallPavFires.exe
C:Program FilesPanda SoftwarePanda Antivirus Platinumpavsrv51.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumAVENGINE.EXE
C:WINDOWSsystem32oneLabsvsmon.exe
C:WINDOWSSystem32MsPMSPSv.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumpavProxy.exe
C:WINDOWSsystem32wscntfy.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumIFACE.EXE
C:Program FilesPanda SoftwarePanda Antivirus PlatinumPAVJOBS.EXE
C:Documents and SettingsAdministrator.SERWERMoje dokumentyHijackThisHijackThis.exe
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.pl/
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R1 – HKCUSoftwareMicrosoftInternet Connection Wizard,Shellnext = http://www.sygate.com/swat/support/spf50_help.htm
O2 – BHO: (no name) – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_05injusched.exe
O4 – HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [DAEMON Tools–1033] "C:Program FilesD–Toolsdaemon.exe" –lang 1033
O4 – HKLM..Run: [NeroCheck] C:WINDOWSSystem32\NeroCheck.exe
O4 – HKLM..Run: [SideWinderTrayV4] C:PROGRA~1MICROS~2GAMECO~1commonswtrayv4.exe
O4 – HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 – HKLM..Run: [SCANINICIO] "C:Program FilesPanda SoftwarePanda Antivirus PlatinumInicio.exe"
O4 – HKLM..Run: [APVXDWIN] "C:Program FilesPanda SoftwarePanda Antivirus PlatinumAPVXDWIN.EXE" /s
O4 – HKLM..Run: [WINDVDPatch] CTHELPER.EXE
O4 – HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 – HKLM..Run: [Jet Detection] "C:Program FilesCreativeSBAudigyPROGRAMADGJDet.exe"
O4 – HKLM..Run: [Microsoft NT Update] winexec32.exe
O4 – HKLM..Run: [Servicio Local] svhost.exe
O4 – HKLM..RunServices: [Microsoft NT Update] winexec32.exe
O4 – HKLM..RunServices: [Servicio Local] svhost.exe
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 – HKCU..Run: [TaskTray] "C:Program FilesCreativeSBAudigyTaskBarCTLTray.exe"
O4 – HKCU..Run: [TaskBar] "C:Program FilesCreativeSBAudigyTaskBarCTLTask.exe"
O4 – Global Startup: Kalendarz XP.lnk = C:Program FilesKalendarz XPKalendarz.exe
O4 – Global Startup: ZoneAlarm.lnk = C:Program Filesone LabsoneAlarmzonealarm.exe
O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 – Extra button: Messenger (HKLM)
O9 – Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 – Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O16 – DPF: {02BF25D5–8C17–4B23–BC80–D3488ABDDC6B} – http://www.apple.com/qtactivex/qtplugin.cab
O16 – DPF: {166B1BCA–3F9C–11CF–8075–444553540000} (Shockwave ActiveX Control) – http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 – DPF: {D27CDB6E–0000–0000–0000–000000000000} – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Odpowiedzi: 11
Tak juz zfixowlem 2 prgramami i teraz czekam czy znowu wyskoczy:]A te fixy to na co dokladnie sa? O juz wyskoczylo:(
To tylko sciezki do plikow z raportem
Chodzi o szczegoly błedu widoczne w podgladzie zdarzen
Stosowałes te fixy o ktorych pisałem wyzej ??
Chodzi o szczegoly błedu widoczne w podgladzie zdarzen
Stosowałes te fixy o ktorych pisałem wyzej ??
konkretniej jest tak ze Neo sobie moge wlaczac i wylaczac a net i tak nie bedzie dzial musi byc restart, a ten proces Generic host jest w jakims stopniu odpowiedzialny za neta:>
A z raportu to takie cos wyszlo:
C:DOCUME~1RAYANUSTAWI~1TempWER35.tmp.dir00svchost.exe.mdmp
C:DOCUME~1RAYANUSTAWI~1TempWER35.tmp.dir00appcompat.txt
A z raportu to takie cos wyszlo:
C:DOCUME~1RAYANUSTAWI~1TempWER35.tmp.dir00svchost.exe.mdmp
C:DOCUME~1RAYANUSTAWI~1TempWER35.tmp.dir00appcompat.txt
@rayan: Ok ale konkretniej
Szczegoły bledu
Co sie dziej z netem ??
Sprobuj Winsockxpfix, LSPfix
Szczegoły bledu
Co sie dziej z netem ??
Sprobuj Winsockxpfix, LSPfix
w sumie to niezainstalowane:] Ale w moim przypadku ten restart nie jest sam z siebie, tylko ja sammusze do zresowac bo net niedziala, takie cos:] Tylko niewiem co ten blad mozepowodowac:)
Podaj wiecej szczegołów jak napisał Marcin
Zainstalowane łaty na Sassera, Blastera ??
Zainstalowane łaty na Sassera, Blastera ??
Na podstawie tego screena nikt nie moźe powiedzieć niczego konkretnego.
Wejdź w właściwości tego błędu lub zobacz jego szczegóły w podglądzie zdarzeń.
Wejdź w właściwości tego błędu lub zobacz jego szczegóły w podglądzie zdarzeń.
wlasnie ze sie dzieje bobi tylko ze opisalem swoj problem w dziale Windows Xp i zero pomocy. o to i on: http://www.centrumxp.pl/forum/viewtopic.php?t=29331
Czysto, dzieje sie cos czy tylko zwykła zapobiegliwosc ??
a mojŁ:
Logfile of HijackThis v1.97.7
Scan saved at 16:00:03, on 2005–02–01
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesThomsonSpeedTouch USBDragdiag.exe
C:Program FilesWinampwinampa.exe
C:PROGRA~1NEOSTR~1CnxMon.exe
C:PROGRA~1NEOSTR~1TaskbarIcon.exe
C:WINDOWSSystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
D:GrySteamSteam.exe
C:WINDOWSSystem32devldr32.exe
C:WINDOWSSystem32 vsvc32.exe
C:Program FilesMicrosoft AntiSpywaregcasDtServ.exe
C:PROGRA~1NEOSTR~1NeostradaTP.exe
C:PROGRA~1NEOSTR~1ComComp.exe
C:PROGRA~1NEOSTR~1Watch.exe
C:Program FilesGadu–Gadugg.exe
C:Program FilesWinampwinamp.exe
C:Program FilesOperaopera.exe
C:DownloadshjtHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL
O2 – BHO: (no name) – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 – BHO: (no name) – {31FF080D–12A3–439A–A2EF–4BA95A3148E8} – C:Program FilesGetRightxx2gr.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O4 – HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe
O4 – HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe
O4 – HKLM..Run: [WOOTASKBARICON] C:PROGRA~1NEOSTR~1TaskbarIcon.exe
O4 – HKLM..Run: [gcasServ] "C:Program FilesMicrosoft AntiSpywaregcasServ.exe"
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [Steam] D:GrySteamSteam.exe –silent
O8 – Extra context menu item: Download with GetRight – C:Program FilesGetRightGRdownload.htm
O8 – Extra context menu item: Open with GetRight Browser – C:Program FilesGetRightGRbrowse.htm
O12 – Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O16 – DPF: {166B1BCA–3F9C–11CF–8075–444553540000} (Shockwave ActiveX Control) – http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 – DPF: {2BC66F54–93A8–11D3–BEB6–00105AA9B6AE} (Symantec AntiVirus scanner) – http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 – DPF: {644E432F–49D3–41A1–8DD5–E099162EEEC5} (Symantec RuFSI Utility Class) – http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 – DPF: {80DD2229–B8E4–4C77–B72F–F22972D723EA} (AvxScanOnline Control) – http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 – DPF: {9A9307A0–7DA4–4DAF–B042–5009F29E09E1} (ActiveScan Installer Class) – http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 – DPF: {A3009861–330C–4E10–822B–39D16EC8829D} (CRAVOnline Object) – http://www.ravantivirus.com/scan/ravonline.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab
O17 – HKLMSystemCCSServicesTcpip..{1F0DDA9F–8BFD–4030–A98F–67AB30FFFC44}: NameServer = 194.204.159.1,213.77.21.150
O17 – HKLMSystemCCSServicesTcpip..{DC61ADA4–2EC9–4F8F–9789–A8C7C25F4347}: NameServer = 194.204.152.34 217.98.63.164
Logfile of HijackThis v1.97.7
Scan saved at 16:00:03, on 2005–02–01
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesThomsonSpeedTouch USBDragdiag.exe
C:Program FilesWinampwinampa.exe
C:PROGRA~1NEOSTR~1CnxMon.exe
C:PROGRA~1NEOSTR~1TaskbarIcon.exe
C:WINDOWSSystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
D:GrySteamSteam.exe
C:WINDOWSSystem32devldr32.exe
C:WINDOWSSystem32 vsvc32.exe
C:Program FilesMicrosoft AntiSpywaregcasDtServ.exe
C:PROGRA~1NEOSTR~1NeostradaTP.exe
C:PROGRA~1NEOSTR~1ComComp.exe
C:PROGRA~1NEOSTR~1Watch.exe
C:Program FilesGadu–Gadugg.exe
C:Program FilesWinampwinamp.exe
C:Program FilesOperaopera.exe
C:DownloadshjtHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL
O2 – BHO: (no name) – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 – BHO: (no name) – {31FF080D–12A3–439A–A2EF–4BA95A3148E8} – C:Program FilesGetRightxx2gr.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O4 – HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe
O4 – HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe
O4 – HKLM..Run: [WOOTASKBARICON] C:PROGRA~1NEOSTR~1TaskbarIcon.exe
O4 – HKLM..Run: [gcasServ] "C:Program FilesMicrosoft AntiSpywaregcasServ.exe"
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [Steam] D:GrySteamSteam.exe –silent
O8 – Extra context menu item: Download with GetRight – C:Program FilesGetRightGRdownload.htm
O8 – Extra context menu item: Open with GetRight Browser – C:Program FilesGetRightGRbrowse.htm
O12 – Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O16 – DPF: {166B1BCA–3F9C–11CF–8075–444553540000} (Shockwave ActiveX Control) – http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 – DPF: {2BC66F54–93A8–11D3–BEB6–00105AA9B6AE} (Symantec AntiVirus scanner) – http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 – DPF: {644E432F–49D3–41A1–8DD5–E099162EEEC5} (Symantec RuFSI Utility Class) – http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 – DPF: {80DD2229–B8E4–4C77–B72F–F22972D723EA} (AvxScanOnline Control) – http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 – DPF: {9A9307A0–7DA4–4DAF–B042–5009F29E09E1} (ActiveScan Installer Class) – http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 – DPF: {A3009861–330C–4E10–822B–39D16EC8829D} (CRAVOnline Object) – http://www.ravantivirus.com/scan/ravonline.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab
O17 – HKLMSystemCCSServicesTcpip..{1F0DDA9F–8BFD–4030–A98F–67AB30FFFC44}: NameServer = 194.204.159.1,213.77.21.150
O17 – HKLMSystemCCSServicesTcpip..{DC61ADA4–2EC9–4F8F–9789–A8C7C25F4347}: NameServer = 194.204.152.34 217.98.63.164
Wylacz przywracanie
Usun z HDD:
winexec32.exe
svhost.exe (nie pomyl z svchost.exe)
Napraw (fix):
Usun z HDD:
winexec32.exe
svhost.exe (nie pomyl z svchost.exe)
Napraw (fix):
O4 – HKLM..Run: [Microsoft NT Update] winexec32.exe
O4 – HKLM..Run: [Servicio Local] svhost.exe
O4 – HKLM..RunServices: [Microsoft NT Update] winexec32.exe
O4 – HKLM..RunServices: [Servicio Local] svhost.exe
Strona 1 / 1