Log

[piotrwisian]

wsumie profilaktycznie(ale i dla sprawdzenia)chciłabym żeby ktoś sprawdził mi Log hijacka, b system ostatnio niestabilnie pracuje
Logfile of HijackThis v1.99.1
Scan saved at 13:51:02, on 2006-09-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1A4TechMouseAmoumain.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesSkypePhoneSkype.exe
C:Program FilesTuneUp Utilities 2006MemOptimizer.exe
C:Program FileseMuleemule.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSsystem32driversKodakCCS.exe
C:WINDOWSSystem32
vsvc32.exe
C:WINDOWSsystem32ScsiAccess.EXE
C:WINDOWSexplorer.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesAgnitumOutpost Firewalloutpost.exe
C:Program FilesMozilla Firefoxfirefox.exe
D:HijackthisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.pandasoftware.com.pl/
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O2 - BHO: Give4Free Plugin Installer - {208E7E77-507A-4649-B0C9-D39E9049C7A2} - C:Program FilesGive4Free Pluginibho1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.5.0_08inssv.dll
O4 - HKLM..Run: [SiSSoundMan] C:WINDOWSSystem32SoundMan.exe
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [WheelMouse] C:PROGRA~1A4TechMouseAmoumain.exe
O4 - HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [Outpost Firewall] C:Program FilesAgnitumOutpost Firewalloutpost.exe /waitservice
O4 - HKLM..Run: [OutpostFeedBack] C:Program FilesAgnitumOutpost Firewallfeedback.exe /dump:os_startup
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - HKCU..Run: [Gadu-Gadu] "C:Program FilesGadu-Gadugg.exe" /tray
O4 - HKCU..Run: [TuneUp MemOptimizer] "C:Program FilesTuneUp Utilities 2006MemOptimizer.exe" autostart
O4 - HKCU..Run: [eMuleAutoStart] C:Program FileseMuleemule.exe -AutoStart
O4 - Startup: XPizeReloader.lnk = C:WINDOWSXPizeXPizeReloader.exe
O4 - Global Startup: Kalendarz XP.lnk = C:Program FilesKalendarz XPKalendarz.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:Program FilesGetRightgetright.exe
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLMSystemCCSServicesTcpip..{41177427-D1B5-43D9-BFC3-D7A8BAB4DACA}: NameServer = 194.204.159.1,194.104.152.34
O17 - HKLMSystemCS1ServicesTcpip..{41177427-D1B5-43D9-BFC3-D7A8BAB4DACA}: NameServer = 194.204.159.1,194.104.152.34
O20 - AppInit_DLLs: C:PROGRA~1AgnitumOUTPOS~1wl_hook.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:WINDOWSsystem32driversKodakCCS.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:WINDOWSSystem32
vsvc32.exe
O23 - Service: O&O Defrag (OODefrag) - O&O Software GmbH - C:WINDOWSsystem32oodag.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:Program FilesAgnitumOutpost Firewalloutpost.exe
O23 - Service: ScsiAccess - Unknown owner - C:WINDOWSsystem32ScsiAccess.EXE
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:Program FilesTuneUp Utilities 2006WinStylerThemeSvc.exe


czekam na porady i sugestie

[pp3088]

O4 - Startup: XPizeReloader.lnk = C:WINDOWSXPizeXPizeReloader.exe

Znasz to??

1.No to jedziemy: O2 - BHO: Give4Free Plugin Installer - {208E7E77-507A-4649-B0C9-D39E9049C7A2} - C/Program FilesGive4Free Pluginibho1.dll - to jest do zafixowania (w awaryjnym)Jeśli znajdziesz na dysku to na czerwono, to wywal: C/Program Files/Give4Free/Pluginibho1.dll cały katalog.

2.Zrób loga z Silent Runners. Ściągasz go na kompa, uruchamiasz i dajesz no i czekasz na komunikat done. Wklejasz zawartośc na forum

http://www.silentrunners.org/Silent%20Runners.vbs

3.Ściągnij to i zrób scan

http://www.instalki.pl/programy/downloa ... pyware.php

4.Wklej logi z Hijacka i Silenta ;P

Tryb awaryjny robisz f8 podczas startu systemu. I prosże może opisz dokłądniejsze problem oraz błedy, czy komunikat jeśli takie są.

[piotrwisian]

Usunołem już 4plugin(niebył na czerwono,ale przypomniałem sobie,że dwa tyg temu miałme alarm z avasta z tego folderu to cały teraz wywaliłem), a co do wariacji systemu to dziś wyskoczył mi błąd OutPost firewal ???? Co było kąpletnym zdumieniem to teraz próbuje za każdym uruchomieniem wysłać mozolnie i bez efektów raport, to log z Silent Ruunes:


"Silent Runners.vbs", revision 47, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun {++}
"CTFMON.EXE" = "C:WINDOWSsystem32ctfmon.exe" [MS]
"NvMediaCenter" = "RUNDLL32.EXE C:WINDOWSSystem32NVMCTRAY.DLL,NvTaskbarInit" [MS]
"Skype" = ""C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized" ["Skype Technologies S.A."]
"Gadu-Gadu" = ""C:Program FilesGadu-Gadugg.exe" /tray" ["Gadu-Gadu Sp. z oo"]
"TuneUp MemOptimizer" = ""C:Program FilesTuneUp Utilities 2006MemOptimizer.exe" autostart" ["TuneUp Software GmbH"]
"eMuleAutoStart" = "C:Program FileseMuleemule.exe -AutoStart" ["http://www.emule-project.net"]

HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun {++}
"SiSSoundMan" = "C:WINDOWSSystem32SoundMan.exe" ["Avance Logic, Inc."]
"NvCplDaemon" = "RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"WheelMouse" = "C:PROGRA~1A4TechMouseAmoumain.exe" ["A4Tech Co.,Ltd."]
"NeroCheck" = "C:WINDOWSsystem32NeroCheck.exe" ["Ahead Software Gmbh"]
"avast!" = "C:PROGRA~1ALWILS~1Avast4ashDisp.exe" [null data]
"Outpost Firewall" = "C:Program FilesAgnitumOutpost Firewalloutpost.exe /waitservice" ["Agnitum Ltd."]
"OutpostFeedBack" = "C:Program FilesAgnitumOutpost Firewallfeedback.exe /dump:os_startup" ["Agnitum Ltd."]
"InCD" = "C:Program FilesAheadInCDInCD.exe" ["Nero AG"]

HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided)
{HKLM...CLSID} = "AcroIEHlprObj Class"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll" ["Adobe Systems Incorporated"]
{208E7E77-507A-4649-B0C9-D39E9049C7A2}(Default) = (no title provided)
{HKLM...CLSID} = "Give4Free Plugin Installer"
InProcServer32(Default) = "C:Program FilesGive4Free Pluginibho1.dll" [file not found]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided)
{HKLM...CLSID} = "SSVHelper Class"
InProcServer32(Default) = "C:Program FilesJavajre1.5.0_08inssv.dll" ["Sun Microsystems, Inc."]

HKLMSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
{HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
InProcServer32(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
{HKLM...CLSID} = "HyperTerminal Icon Ext"
InProcServer32(Default) = "C:WINDOWSSystem32hticons.dll" ["Hilgraeve, Inc."]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Eksplorator pulpitów"
{HKLM...CLSID} = "Eksplorator pulpitów"
InProcServer32(Default) = "C:WINDOWSSystem32
vshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
{HKLM...CLSID} = (no title provided)
InProcServer32(Default) = "C:WINDOWSSystem32
vshell.dll" ["NVIDIA Corporation"]
"{acb4a560-3606-11d3-aef4-00104bd0f92d}" = "KodakShellExtension"
{HKLM...CLSID} = "KodakShellExtension"
InProcServer32(Default) = "C:Program FilesCommon FilesKODAKIFSCorekodakshx.dll" ["Eastman Kodak Company"]
"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Unbind"
{HKLM...CLSID} = "Microsoft Office Binder Unbind"
InProcServer32(Default) = "C:PROGRA~1MICROS~2Office1045UNBIND.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
{HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
InProcServer32(Default) = "C:PROGRA~1MICROS~2OfficeOLKFSTUB.DLL" [MS]
"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"
{HKLM...CLSID} = (no title provided)
InProcServer32(Default) = ""C:Program FilesOpenOffice.ux.pl 2.0programshlxthdl.dll"" ["Sun Microsystems, Inc."]
"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"
{HKLM...CLSID} = (no title provided)
InProcServer32(Default) = ""C:Program FilesOpenOffice.ux.pl 2.0programshlxthdl.dll"" ["Sun Microsystems, Inc."]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"
{HKLM...CLSID} = (no title provided)
InProcServer32(Default) = ""C:Program FilesOpenOffice.ux.pl 2.0programshlxthdl.dll"" ["Sun Microsystems, Inc."]
"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"
{HKLM...CLSID} = (no title provided)
InProcServer32(Default) = ""C:Program FilesOpenOffice.ux.pl 2.0programshlxthdl.dll"" ["Sun Microsystems, Inc."]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
{HKLM...CLSID} = "avast"
InProcServer32(Default) = "C:Program FilesAlwil SoftwareAvast4ashShell.dll" ["ALWIL Software"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
{HKLM...CLSID} = "Portable Media Devices"
InProcServer32(Default) = "C:WINDOWSsystem32Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
{HKLM...CLSID} = "Portable Media Devices Menu"
InProcServer32(Default) = "C:WINDOWSsystem32Audiodev.dll" [MS]
"{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}" = "TuneUp Shredder Shell Context Menu Extension"
{HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
InProcServer32(Default) = ""C:Program FilesTuneUp Utilities 2006sdshelex.dll"" ["TuneUp Software GmbH"]
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References"
{HKLM...CLSID} = "ShellLink for Application References"
InProcServer32(Default) = "C:WINDOWSsystem32dfshim.dll" [MS]
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References"
{HKLM...CLSID} = "Shell Icon Handler for Application References"
InProcServer32(Default) = "C:WINDOWSsystem32dfshim.dll" [MS]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
{HKLM...CLSID} = "Shell Search Band"
InProcServer32(Default) = "C:WINDOWSsystem32rowseui.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
{HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]
"{950FF917-7A57-46BC-8017-59D9BF474000}" = "Shell Extension for CDRW"
{HKLM...CLSID} = "Shell Extension for CDRW"
InProcServer32(Default) = "C:Program FilesAheadInCDincdshx.dll" ["Nero AG"]

HKLMSOFTWAREMicrosoftCommand Processor
INFECTION WARNING! "AutoRun" = "title %username% @ %computername% - %date% &&color 1a &&prompt $s$p$b$s&& cd %WINDIR% &&cls &&ECHO. &&ECHO %time% - XPize" [file not found]

HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows
INFECTION WARNING! "AppInit_DLLs" = "C:PROGRA~1AgnitumOUTPOS~1wl_hook.dll" ["Agnitum Ltd."]

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options
INFECTION WARNING! taskmgr.exeDebugger = "C:Program FilesTuneUp Utilities 2006PMLauncher.exe" ["TuneUp Software GmbH"]

HKLMSoftwareClassesFoldershellexColumnHandlers
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}(Default) = "OpenOffice.org Column Handler"
{HKLM...CLSID} = (no title provided)
InProcServer32(Default) = ""C:Program FilesOpenOffice.ux.pl 2.0programshlxthdl.dll"" ["Sun Microsystems, Inc."]

HKLMSoftwareClasses*shellexContextMenuHandlers
ASW(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
{HKLM...CLSID} = "Outpost.ASWShellExt Component"
InProcServer32(Default) = "C:Program FilesAgnitumOutpost Firewallop_shell.dll" ["Agnitum Ltd."]
avast(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
{HKLM...CLSID} = "avast"
InProcServer32(Default) = "C:Program FilesAlwil SoftwareAvast4ashShell.dll" ["ALWIL Software"]
TuneUp Shredder(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"
{HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
InProcServer32(Default) = ""C:Program FilesTuneUp Utilities 2006sdshelex.dll"" ["TuneUp Software GmbH"]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
{HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]

HKLMSoftwareClassesDirectoryshellexContextMenuHandlers
ASW(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
{HKLM...CLSID} = "Outpost.ASWShellExt Component"
InProcServer32(Default) = "C:Program FilesAgnitumOutpost Firewallop_shell.dll" ["Agnitum Ltd."]
TuneUp Shredder(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"
{HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
InProcServer32(Default) = ""C:Program FilesTuneUp Utilities 2006sdshelex.dll"" ["TuneUp Software GmbH"]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
{HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]

HKLMSoftwareClassesFoldershellexContextMenuHandlers
ASW(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
{HKLM...CLSID} = "Outpost.ASWShellExt Component"
InProcServer32(Default) = "C:Program FilesAgnitumOutpost Firewallop_shell.dll" ["Agnitum Ltd."]
avast(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
{HKLM...CLSID} = "avast"
InProcServer32(Default) = "C:Program FilesAlwil SoftwareAvast4ashShell.dll" ["ALWIL Software"]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
{HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShellState

HKCUControl PanelDesktop
"Wallpaper" = "C:Documents and SettingsSYLWIADane aplikacjiIrfanViewIrfanView_Wallpaper.bmp"


Enabled Screen Saver:
---------------------

HKCUControl PanelDesktop
"SCRNSAVE.EXE" = "C:WINDOWSSystem32POLKOM~1.SCR" (PolKompWio.scr) [null data]


Startup items in "SYLWIA" & "All Users" startup folders:
--------------------------------------------------------

C:Documents and SettingsSYLWIAMenu StartProgramyAutostart
"XPizeReloader" shortcut to: "C:WINDOWSXPizeXPizeReloader.exe /S" [null data]

C:Documents and SettingsAll UsersMenu StartProgramyAutostart
"Kalendarz XP" shortcut to: "C:Program FilesKalendarz XPKalendarz.exe" [null data]


Enabled Scheduled Tasks:
------------------------

"1-Click Maintenance" launches: "C:Program FilesTuneUp Utilities 2006SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLMSystemCurrentControlSetServicesWinsock2ParametersNameSpace_Catalog5Catalog_Entries {++}
000000000001LibraryPath = "%SystemRoot%System32mswsock.dll" [MS]
000000000002LibraryPath = "%SystemRoot%System32winrnr.dll" [MS]
000000000003LibraryPath = "%SystemRoot%System32mswsock.dll" [MS]

Transport Service Providers

HKLMSystemCurrentControlSetServicesWinsock2ParametersProtocol_Catalog9Catalog_Entries {++}
0000000000##PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%system32mswsock.dll [MS], 01 - 03, 06 - 11
%SystemRoot%system32 svpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLMSoftwareClassesCLSID{208E7E77-507A-4649-B0C9-D39E9049C7A2}(Default) = "Give4Free Plugin Installer"
Implemented Categories{00021494-0000-0000-C000-000000000046} [horizontal bar]
InProcServer32(Default) = "C:Program FilesGive4Free Pluginibho1.dll" [file not found]


Miscellaneous IE Hijack Points
------------------------------

HKLMSoftwareMicrosoftInternet ExplorerAboutURLs

Missing lines (compared with English-language version):
HIJACK WARNING! "TuneUp" = "file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css" [file not found]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

avast! Antivirus, avast! Antivirus, ""C:Program FilesAlwil SoftwareAvast4ashServ.exe"" [null data]
avast! iAVS4 Control Service, aswUpdSv, ""C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe"" [null data]
avast! Mail Scanner, avast! Mail Scanner, ""C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe" /service" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""C:Program FilesAlwil SoftwareAvast4ashWebSv.exe" /service" ["ALWIL Software"]
InCD Helper, InCDsrv, "C:Program FilesAheadInCDInCDsrv.exe" ["Nero AG"]
Kodak Camera Connection Software, KodakCCS, "C:WINDOWSsystem32driversKodakCCS.exe" ["Eastman Kodak Company"]
NVIDIA Driver Helper Service, NVSvc, "C:WINDOWSSystem32
vsvc32.exe" ["NVIDIA Corporation"]
Outpost Firewall Service, OutpostFirewall, "C:Program FilesAgnitumOutpost Firewalloutpost.exe /service" ["Agnitum Ltd."]
ScsiAccess, ScsiAccess, "C:WINDOWSsystem32ScsiAccess.EXE" [null data]
Windows User Mode Driver Framework, UMWdf, "C:WINDOWSsystem32wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLMSystemCurrentControlSetControlPrintMonitors
hpzlnt04Driver = "hpzlnt04.dll" ["HP"]
PDF-XChangeDriver = "pxc25pm.dll" ["Tracker Software"]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 91 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 59 seconds.
---------- (total run time: 237 seconds)

Pozdrawiam.....

[pp3088]

Otwóz notatnik i wklej

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{208E7E77-507A-4649-B0C9-D39E9049C7A2}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftCommand Processor]
"AutoRun"=""

Zapisz jako fix.reg i uruchom. Możesz dać kontrolne logi.
Przeinstaluj może Ouposta.