prosze o sprawdzenie loga z hijacka
Logfile of HijackThis v1.97.7
Scan saved at 21:16:48, on 2005–04–17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\programy\myszalol\MouseWare\system\em_exec.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
D:\programy\myszalol\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\gry\steam\Steam.exe
D:\programy\teamspeak2_RC2\TeamSpeak.exe
d:\gry\steam\steamapps\fobos666@interia.pl\counter–strike\hl.exe
C:\Documents and Settings\G&J\Pulpit\HijackThis.exe
R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 – Default URLSearchHook is missing
O1 – Hosts: 159.148.70.6 gg.muchina.com
O1 – Hosts: 159.148.70.6 ogg.muchina.com
O2 – BHO: (no name) – {57E91B41–F40A–11D1–B792–444553540000} – D:\programy\NetAnts\NetAnts\AntAPI.dll
O4 – HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 – HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 – HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 –k
O4 – HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 – HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe –startgui
O4 – HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 – HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 – HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 – HKCU\..\Run: [Gadu–Gadu] "C:\Program Files\Gadu–Gadu\gg.exe" /tray
O4 – HKCU\..\Run: [LDM] D:\programy\myszalol\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 – HKCU\..\Run: [Skype] "D:\programy\Phone\Skype.exe" /nosplash /minimized
O4 – HKCU\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 – HKCU\..\Run: [eMuleAutoStart] D:\programy\eMule\emule.exe –AutoStart
O4 – Global Startup: Logitech Desktop Messenger.lnk = D:\programy\myszalol\Desktop Messenger\8876480\Program\LDMConf.exe
O4 – Global Startup: Microsoft Office.lnk = D:\programy\ficek\Office\OSA9.EXE
O8 – Extra context menu item: &Download by NetAnts – D:\programy\NetAnts\NetAnts\NAGet.htm
O8 – Extra context menu item: Download &All by NetAnts – D:\programy\NetAnts\NetAnts\NAGetAll.htm
O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 – Extra button: NetAnts (HKLM)
O9 – Extra 'Tools' menuitem: &NetAnts (HKLM)
O9 – Extra button: Messenger (HKLM)
O9 – Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 – DPF: {0A5FD7C5–A45C–49FC–ADB5–9952547D5715} (Creative Software AutoUpdate) – http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 – DPF: {39B0684F–D7BF–4743–B050–FDC3F48F7E3B} (FilePlanet Download Control Class) – http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1060554951366
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab
O16 – DPF: {F6ACF75C–C32C–447B–9BEF–46B766368D29} (Creative Software AutoUpdate Support Package) – http://www.creative.com/su/ocx/15009/CTPID.cab
O18 – Protocol: bwh0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwh0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwi0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwi0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwj0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwj0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwk0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwk0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwl0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwl0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwm0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwm0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwn0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwn0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwo0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwo0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwp0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwp0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwq0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwq0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwr0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwr0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bws0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bws0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwt0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwt0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwu0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwu0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwv0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwv0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bww0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bww0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwx0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwx0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwy0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwy0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwz0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwz0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: offline–8876480 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
edit :
komp sie tnie i zawiesza jakos dziwnie – sugeruje to jakiegos trojana czy robala
Scan saved at 21:16:48, on 2005–04–17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\programy\myszalol\MouseWare\system\em_exec.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
D:\programy\myszalol\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\gry\steam\Steam.exe
D:\programy\teamspeak2_RC2\TeamSpeak.exe
d:\gry\steam\steamapps\fobos666@interia.pl\counter–strike\hl.exe
C:\Documents and Settings\G&J\Pulpit\HijackThis.exe
R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 – Default URLSearchHook is missing
O1 – Hosts: 159.148.70.6 gg.muchina.com
O1 – Hosts: 159.148.70.6 ogg.muchina.com
O2 – BHO: (no name) – {57E91B41–F40A–11D1–B792–444553540000} – D:\programy\NetAnts\NetAnts\AntAPI.dll
O4 – HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 – HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 – HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 –k
O4 – HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 – HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe –startgui
O4 – HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 – HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 – HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 – HKCU\..\Run: [Gadu–Gadu] "C:\Program Files\Gadu–Gadu\gg.exe" /tray
O4 – HKCU\..\Run: [LDM] D:\programy\myszalol\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 – HKCU\..\Run: [Skype] "D:\programy\Phone\Skype.exe" /nosplash /minimized
O4 – HKCU\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 – HKCU\..\Run: [eMuleAutoStart] D:\programy\eMule\emule.exe –AutoStart
O4 – Global Startup: Logitech Desktop Messenger.lnk = D:\programy\myszalol\Desktop Messenger\8876480\Program\LDMConf.exe
O4 – Global Startup: Microsoft Office.lnk = D:\programy\ficek\Office\OSA9.EXE
O8 – Extra context menu item: &Download by NetAnts – D:\programy\NetAnts\NetAnts\NAGet.htm
O8 – Extra context menu item: Download &All by NetAnts – D:\programy\NetAnts\NetAnts\NAGetAll.htm
O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 – Extra button: NetAnts (HKLM)
O9 – Extra 'Tools' menuitem: &NetAnts (HKLM)
O9 – Extra button: Messenger (HKLM)
O9 – Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 – DPF: {0A5FD7C5–A45C–49FC–ADB5–9952547D5715} (Creative Software AutoUpdate) – http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 – DPF: {39B0684F–D7BF–4743–B050–FDC3F48F7E3B} (FilePlanet Download Control Class) – http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1060554951366
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab
O16 – DPF: {F6ACF75C–C32C–447B–9BEF–46B766368D29} (Creative Software AutoUpdate Support Package) – http://www.creative.com/su/ocx/15009/CTPID.cab
O18 – Protocol: bwh0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwh0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwi0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwi0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwj0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwj0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwk0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwk0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwl0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwl0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwm0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwm0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwn0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwn0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwo0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwo0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwp0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwp0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwq0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwq0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwr0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwr0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bws0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bws0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwt0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwt0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwu0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwu0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwv0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwv0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bww0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bww0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwx0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwx0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwy0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwy0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwz0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwz0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: offline–8876480 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
edit :
komp sie tnie i zawiesza jakos dziwnie – sugeruje to jakiegos trojana czy robala
Odpowiedzi: 3
Odinstaluj i usun foldery z Program files:
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Media Access\MediaAccess.exe
W HiJacku usun:
O4 – HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O16 – DPF: {15AD6789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://static.windupdates.com/cab/MusicAccess/ie/bridge–c5.cab
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Media Access\MediaAccess.exe
W HiJacku usun:
O4 – HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O16 – DPF: {15AD6789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://static.windupdates.com/cab/MusicAccess/ie/bridge–c5.cab
Prośba o sprawdzenie log–a :)
Logfile of HijackThis v1.99.1
Scan saved at 21:27:57, on 2005–04–19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Kalendarz XP\Kalendarz.exe
C:\Program Files\Avant Browser\avant.exe
C:\Documents and Settings\Tomasz\Pulpit\HijackThis.exe
R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl
R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.satfilm.net.pl:8080
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 – HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 – HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 – HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 – HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 – HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 – HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 – HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 – HKCU\..\Run: [Gadu–Gadu] "C:\Program Files\Gadu–Gadu\gg.exe" /tray
O4 – Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Start.exe
O8 – Extra context menu item: Blokuj wszystkie obrazy z tego serwera – C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 – Extra context menu item: Dodaj do listy blokowanych reklam – C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 – Extra context menu item: Otwórz wszystkie adresy z tej strony... – C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 – Extra context menu item: Podświetl – C:\Program Files\Avant Browser\Highlight.htm
O8 – Extra context menu item: Szukaj – C:\Program Files\Avant Browser\Search.htm
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 – Extra button: Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra 'Tools' menuitem: Windows Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O16 – DPF: {15AD6789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://static.windupdates.com/cab/MusicAccess/ie/bridge–c5.cab
O18 – Protocol: wpmsg – {2E0AC5A0–3597–11D6–B3ED–0001021DC1C3} – C:\Program Files\Wirtualna Polska\wpkontakt\url_wpmsg.dll
O23 – Service: Symantec Event Manager (ccEvtMgr) – Unknown owner – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 – Service: Symantec Password Validation Service (ccPwdSvc) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 – Service: LexBce Server (LexBceS) – Lexmark International, Inc. – C:\WINDOWS\system32\LEXBCES.EXE
O23 – Service: Norton AntiVirus Auto Protect Service (navapsvc) – Symantec Corporation – C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 – Service: Norton Unerase Protection (NProtectService) – Symantec Corporation – C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:\WINDOWS\system32\nvsvc32.exe
O23 – Service: ScriptBlocking Service (SBService) – Symantec Corporation – C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 – Service: Symantec Network Drivers Service (SNDSrvc) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Logfile of HijackThis v1.99.1
Scan saved at 21:27:57, on 2005–04–19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Kalendarz XP\Kalendarz.exe
C:\Program Files\Avant Browser\avant.exe
C:\Documents and Settings\Tomasz\Pulpit\HijackThis.exe
R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl
R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.satfilm.net.pl:8080
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 – HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 – HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 – HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 – HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 – HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 – HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 – HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 – HKCU\..\Run: [Gadu–Gadu] "C:\Program Files\Gadu–Gadu\gg.exe" /tray
O4 – Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Start.exe
O8 – Extra context menu item: Blokuj wszystkie obrazy z tego serwera – C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 – Extra context menu item: Dodaj do listy blokowanych reklam – C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 – Extra context menu item: Otwórz wszystkie adresy z tej strony... – C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 – Extra context menu item: Podświetl – C:\Program Files\Avant Browser\Highlight.htm
O8 – Extra context menu item: Szukaj – C:\Program Files\Avant Browser\Search.htm
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 – Extra button: Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra 'Tools' menuitem: Windows Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O16 – DPF: {15AD6789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://static.windupdates.com/cab/MusicAccess/ie/bridge–c5.cab
O18 – Protocol: wpmsg – {2E0AC5A0–3597–11D6–B3ED–0001021DC1C3} – C:\Program Files\Wirtualna Polska\wpkontakt\url_wpmsg.dll
O23 – Service: Symantec Event Manager (ccEvtMgr) – Unknown owner – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 – Service: Symantec Password Validation Service (ccPwdSvc) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 – Service: LexBce Server (LexBceS) – Lexmark International, Inc. – C:\WINDOWS\system32\LEXBCES.EXE
O23 – Service: Norton AntiVirus Auto Protect Service (navapsvc) – Symantec Corporation – C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 – Service: Norton Unerase Protection (NProtectService) – Symantec Corporation – C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:\WINDOWS\system32\nvsvc32.exe
O23 – Service: ScriptBlocking Service (SBService) – Symantec Corporation – C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 – Service: Symantec Network Drivers Service (SNDSrvc) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
A nagłowek loga ucieło ??
Update: Nagłowek i procesy juz są i co sie okazuje
Wersja programu stara jak swiat, sciagnij nową i pokaz nowy log
Zakoncz proces:
LogitechDesktopMessenger.exe
FIX:
Odinstaluj Desktop Messengera i dobij:
Update: Nagłowek i procesy juz są i co sie okazuje
Wersja programu stara jak swiat, sciagnij nową i pokaz nowy log
Zakoncz proces:
LogitechDesktopMessenger.exe
FIX:
R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 – Default URLSearchHook is missing
O1 – Hosts: 159.148.70.6 gg.muchina.com
O1 – Hosts: 159.148.70.6 ogg.muchina.com
O4 – HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 –k
O18 – Protocol: bwh0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwh0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwi0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwi0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwj0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwj0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwk0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwk0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwl0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwl0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwm0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwm0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwn0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwn0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwo0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwo0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwp0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwp0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwq0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwq0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwr0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwr0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bws0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bws0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwt0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwt0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwu0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwu0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwv0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwv0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bww0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bww0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwx0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwx0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwy0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwy0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwz0 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: bwz0s – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
O18 – Protocol: offline–8876480 – {8C50541C–6B98–47B0–AC27–D86189FF58B5} – D:\programy\myszalol\Desktop Messenger\8876480\Program\BWPlugProtocol–8876480.dll
Odinstaluj Desktop Messengera i dobij:
O4 – HKCU\..\Run: [LDM] D:\programy\myszalol\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 – Global Startup: Logitech Desktop Messenger.lnk = D:\programy\myszalol\Desktop Messenger\8876480\Program\LDMConf.exe
Strona 1 / 1