Logi - hijack this

[asterisk]

Na pewno zaraz pojawią się specjaliści od logów

Takie info na PW proszę - kasacja

[Shark (Dragonlnx)]

Masz trojanka CWS - xpsystem

Usuń z Loga: ( W Trybie Awaryjnym! ) + Wyłącz “Przywracanie Systemu”

F1 - win.ini: run=C:\WINDOWS\inetdata\services.exe

O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inetdata\1.00.03.dll

O4 - HKLM…\Run: [xp_system] C:\WINDOWS\inetdata\services.exe

O4 - HKCU…\Run: [xp_system] C:\WINDOWS\inetdata\services.exe

_________________________

Lejdi Później te skanery:

CWShredder 2.0

Spybot - Search & Destroy

Ad-Aware Se Personal

Windows Worms Doors Cleaner v1.4.1 - zamykasz wszystkie porty w tym programie

PestPatrol

Opis Konfiguracji

I jeszcze raz log HijackThis

____________

Update

[Lejdi]

Generalnie jestem w takim szoku ze zbieram szczeke z podlogi… PODZIWIAM ZA WIEDZE! :o

na razie idzie ok. Moje pytanie. czy przed skanowaniem mam wylaczyc nortona antivira i firewalla (symantec)? czy moze sobie dzialac i nic sie nie zakloci czy jakkolwiek to sie zwie?

[boczi]

Ciekawostka:

http://hijackthis.de/

Wklejasz loga i zostaje on automatycznie sprawdzany.

Czasem zawodne.

Nie ma to, jak pomoc żywego człowieka 8)

A te śmieci, które macie w systemie, najczęstszym ich powodem jest IE.

[neeo (Wieho1)]

Logfile of HijackThis v1.98.2

Scan saved at 20:37:24, on 2004-12-14

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\devldr32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Creative\ShareDLL\CtNotify.exe

C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE

C:\Program Files\Creative\ShareDLL\MediaDet.Exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\PROGRA~1\WINZIP\winzip32.exe

C:\unzipped\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll

O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime

O4 - HKLM…\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe

O4 - HKLM…\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe

O4 - HKLM…\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE

O4 - HKLM…\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_all.htm

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe

O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe

O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab

[Lejdi]

I jeszcze raz log HijackThis

Wszystko zgodnie z instrukcją (mam nadzieję). Oto log po dotychczasowych zabiegach:

Logfile of HijackThis v1.98.2

Scan saved at 20:49:29, on 2004-12-14

Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Norton Personal Firewall\NISUM.EXE

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Norton Personal Firewall\ccPxySvc.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\autoclk.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\System32\devldr32.exe

C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe

C:\PROGRA~1\PESTPA~1\PPControl.exe

C:\PROGRA~1\PESTPA~1\PPMemCheck.exe

C:\PROGRA~1\PESTPA~1\CookiePatrol.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Tlen.pl\tlen.exe

C:\Program Files\Norton AntiVirus\SAVScan.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Documents and Settings\Lejdi\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM…\Run: [autoclk] autoclk.exe

O4 - HKLM…\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe

O4 - HKLM…\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE “REBOOT”

O4 - HKLM…\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE

O4 - HKLM…\Run: [system Update] C:\WINDOWS\System32\zgsib.exe

O4 - HKLM…\Run: [Microsoft DirectX] PDSched.exe

O4 - HKLM…\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe

O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime

O4 - HKLM…\Run: [RegisterDropHandler] C:\Program Files\ScannerU\TBRIDGE\BIN\RegisterDropHandler.exe

O4 - HKLM…\Run: [sSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe

O4 - HKLM…\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe

O4 - HKLM…\Run: [PestPatrol Control Center] c:\PROGRA~1\PESTPA~1\PPControl.exe

O4 - HKLM…\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe

O4 - HKLM…\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe

O4 - HKLM…\RunServices: [Microsoft DirectX] PDSched.exe

O4 - HKLM…\RunServices: [RegisterDropHandler] C:\Program Files\ScannerU\TBRIDGE\BIN\RegisterDropHandler.exe

O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU…\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Action Manager 32.lnk = C:\Program Files\ScannerU\AM32.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra ‘Tools’ menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/21cb1fc920b … xIE601.cab

pozdr

[Phylby (Adarek)]

neeo

W trybie awaryjnym usuń:

O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE

Lejdi Wyłącz przywracanie sytemu Start kompa do trybu awaryjnego. Usuń :

O4 - HKLM\..\Run: [autoclk] autoclk.exe 

O4 - HKLM\..\Run: [System Update] C:\WINDOWS\System32\zgsib.exe 

O4 - HKLM\..\Run: [Microsoft DirectX] PDSched.exe 

O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7.cab

W szukaj wpisz pokolei autoclk , zgsib , PDSched. Zaznacz aby szukał w ukrytych. Nacisnij enter. Usuń co znajdzie.

Restart kompa .

Jeszcze raz scan systemu Pest Patrolem ale już z najnowszymi bazami banych. (Kliknij Update)

Użyj jeszcze :

Ewido Free Security Suite

oraz

ETD Security Scanner 3.0

http://www.download.com/ETD-Security-Sc … 29424.html

Zainstaluj im najnowsze bazy.

W uruchom wpisz msconfig >>>> nacisnij Enter>>> na zakladce uruchamianie ,odhacz>> realsched , TBRIDGE\BIN\RegisterDropHandler,

QuickTime\qttask. To są pożeracze zasobów kompa. Przypomnienia o rejestracji i próby uaktualnienia programów . Same w sobie nie grożne.

Restartuj kompa.

Możesz ewentualnie jeszcze raz dać nowego loga do sprawdzenia.

[fiesta]

Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE C:\Program Files\Creative\ShareDLL\MediaDet.Exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Gadu-Gadu\gg.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\unzipped\hijackthis\HijackThis.exe

Z uporem maniaka powtarzam:

A gdzie działający w tle antyvirus ??

Ludzie podziwiam Was za waszą niefrasobliwość :o :o :o , a potem się dziwicie że system sie sypie

[neeo (Wieho1)]

Dziękuje za pomoc.

[Laser (Maroj)]

Mam prośbę zobaczcie na mój log

P.S. Pierwszy raz z tym się bawiłem :lol:

Logfile of HijackThis v1.98.2

Scan saved at 12:34:42, on 2004-12-15

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Executive Software\Diskeeper\DkService.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Wanadoo\TaskbarIcon.exe

C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe

C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Wanadoo\EspaceWanadoo.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Wanadoo\ComComp.exe

C:\Program Files\Wanadoo\Watch.exe

C:\Program Files\Internet Explorer\iexplore.exe

D:\Programy27.10.2004\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada Plus wita Cie w Internecie

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe

O4 - HKLM…\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice

O4 - HKLM…\Run: [AWMON] “C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe”

O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

O4 - HKLM…\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize

O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [EspaceWanadoo.exe] C:\Program Files\Wanadoo\EspaceWanadoo.exe

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - C:\PROGRA~1\FlashGet\jc_link.htm

O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - C:\PROGRA~1\FlashGet\jc_all.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRA~1\Agnitum\OUTPOS~1\TRASH.EXE (HKCU)

O9 - Extra ‘Tools’ menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRA~1\Agnitum\OUTPOS~1\TRASH.EXE (HKCU)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v … 9263911120

O17 - HKLM\System\CCS\Services\Tcpip…{6714642D-616F-455A-B1A7-CF7931A50981}: NameServer = 194.204.152.34 217.98.63.164

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

Z góry wielkie dzięki :lol:

[Shark (Dragonlnx)]

Wywal:

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

–KOSMETYKA–

Start/Uruchom/msconfig/uruchamianie- wyłącz:

jusched

CTFMON.EXE

[Phylby (Adarek)]

Laser

Log czysty.

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

To jest prawidłowy wpis javy. Zostawiasz.

[Laser (Maroj)]

Mam takie pytanko do czego właściwie służy ten proces CTFMON.EXE, bo go miałem odkąd zainstalowałem Win XP i się automatycznie uruchamia przy ładowaniu systemu??

Dzięki za skontrolowanie log’a

[Shark (Dragonlnx)]

Proces Microsoft Office -

ctfmon.exe is a part of the Microsoft Office suite. It activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office XP Language Bar. This program is a non-essential system process, but should not be terminated unless suspected to be causing problems.

Author: Microsoft Corp.

Jeżeli nie możesz go wyłączyć - to z nim nie walcz,

Nie obciąża on systemu :lol:

[Phylby (Adarek)]

Nic nie wyłączaj bo sie kiedys zdziwisz że coś nie działa!

Log masz czyst!

I to powinno wystarczyć!

Spokojnie to możesz wyłaczuć tylko aktualizacje javy - czyli jusched

[piterosbayeros]

Proszę o sprawdzenie mojego logfile

Logfile of HijackThis v1.99.0

Scan saved at 12:37:02, on 2004-12-18

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:

C:/WINDOWS/System32/smss.exe

C:/WINDOWS/system32/winlogon.exe

C:/WINDOWS/system32/services.exe

C:/WINDOWS/system32/lsass.exe

C:/WINDOWS/system32/svchost.exe

C:/WINDOWS/System32/svchost.exe

C:/WINDOWS/system32/spoolsv.exe

C:/WINDOWS/Explorer.EXE

C:/Program Files/Adaptec/Easy CD Creator 5/DirectCD/DirectCD.exe

C:/WINDOWS/AGRSMMSG.exe

C:/docume~1/piotrek/daneap~1/msbb.exe

C:/Program Files/Hewlett-Packard/HP Software Update/HPWuSchd.exe

C:/Program Files/Hewlett-Packard/Digital Imaging/bin/hpotdd01.exe

C:/Program Files/Java/j2re1.4.2_04/bin/jusched.exe

C:/PROGRA~1/COMMON~1/PCSuite/DATALA~1/DATALA~1.EXE

C:/PROGRA~1/Nokia/NOKIAP~1/TRAYAP~1.EXE

C:/Program Files/Kaspersky Lab/Kaspersky Anti-Virus Personal Pro 5/kav.exe

C:/WINDOWS/System32/ctfmon.exe

C:/Program Files/22M WLAN Adapter/WLANMON.exe

C:/Program Files/WIDCOMM/Bluetooth Software/BTTray.exe

C:/Program Files/AVPersonal/AVGUARD.EXE

C:/Program Files/AVPersonal/AVWUPSRV.EXE

C:/Program Files/WIDCOMM/Bluetooth Software/bin/btwdins.exe

C:/Program Files/Kaspersky Lab/Kaspersky Anti-Virus Personal Pro 5/kavmm.exe

C:/PROGRA~1/COMMON~1/PCSuite/Services/SERVIC~1.EXE

C:/Program Files/Common Files/Microsoft Shared/VS7Debug/mdm.exe

C:/WINDOWS/System32/nvsvc32.exe

C:/WINDOWS/System32/svchost.exe

C:/WINDOWS/System32/wuauclt.exe

C:/Program Files/Gadu-Gadu/gg.exe

C:/Program Files/GetRight/GETRIGHT.EXE

C:/Program Files/GetRight/GETRIGHT.EXE

C:/Program Files/Opera/Opera.exe

C:/Documents and Settings/piotrek/Ustawienia lokalne/Temp/HijackThis.exe

R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://red.clientapps.yahoo.com/customi … ch/ie.html

R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://red.clientapps.yahoo.com/customi … .yahoo.com

R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://www.onet.pl/

R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Bar = http://tefs.com/searchbar.html

R1 - HKCU/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://tefs.com/searchbar.html

R1 - HKCU/Software/Microsoft/Internet Explorer/SearchURL,(Default) = http://red.clientapps.yahoo.com/customi … .yahoo.com

R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Łącza

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:/Program Files/Yahoo!/Companion/Installs/cpn/ycomp5_5_5_0.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Program Files/Adobe/Acrobat 5.0/Reader/ActiveX/AcroIEHelper.ocx

O2 - BHO: (no name) - {212ebaeb-01ee-4eae-a368-bd78ad15ad00} - (no file)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx

O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:/Program Files/Yahoo!/Companion/Installs/cpn/ycomp5_5_5_0.dll

O4 - HKLM/…/Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM/…/Run: [WinampAgent] “C:/Program Files/Winamp3/winampa.exe”

O4 - HKLM/…/Run: [NeroCheck] C:/WINDOWS/system32/NeroCheck.exe

O4 - HKLM/…/Run: [AdaptecDirectCD] “C:/Program Files/Adaptec/Easy CD Creator 5/DirectCD/DirectCD.exe”

O4 - HKLM/…/Run: [Agent] C:/Program Files/CyberLink/PowerVCRII/Agent.exe

O4 - HKLM/…/Run: [Remote_Agent] C:/Program Files/CyberLink/PowerVCRII/RemoteAgent.exe

O4 - HKLM/…/Run: [intense Registry Service] IntEdReg.exe /CHECK

O4 - HKLM/…/Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup

O4 - HKLM/…/Run: [nwiz] nwiz.exe /install

O4 - HKLM/…/Run: [CloneCDElbyCDFL] “C:/Program Files/Elaborate Bytes/CloneCD/ElbyCheck.exe” /L ElbyCDFL

O4 - HKLM/…/Run: [CloneCDTray] “C:/Program Files/Elaborate Bytes/CloneCD/CloneCDTray.exe”

O4 - HKLM/…/Run: [MicrocomAutorun] D:/Autorun.exe 1

O4 - HKLM/…/Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM/…/Run: [msbb] c:/docume~1/piotrek/daneap~1/msbb.exe

O4 - HKLM/…/Run: [QuickTime Task] “C:/program files/quicktime/qttask.exe” -atboottime

O4 - HKLM/…/Run: [LWBMOUSE] C:/Program Files/Trust/AMI MOUSE 250SP WIRELESS OPTICAL/lwbwheel.exe

O4 - HKLM/…/Run: [HP Software Update] C:/Program Files/Hewlett-Packard/HP Software Update/HPWuSchd.exe

O4 - HKLM/…/Run: [HPDJ Taskbar Utility] C:/WINDOWS/System32/spool/drivers/w32x86/3/hpztsb08.exe

O4 - HKLM/…/Run: [DeviceDiscovery] C:/Program Files/Hewlett-Packard/Digital Imaging/bin/hpotdd01.exe

O4 - HKLM/…/Run: [XTNDConnect PC - ErPhn2] C:/PROGRA~1/COMMON~1/XCPCSync/TRANSL~1/ErPhn2/ErTray.exe

O4 - HKLM/…/Run: [sunJavaUpdateSched] C:/Program Files/Java/j2re1.4.2_04/bin/jusched.exe

O4 - HKLM/…/Run: [DataLayer] C:/PROGRA~1/COMMON~1/PCSuite/DATALA~1/DATALA~1.EXE

O4 - HKLM/…/Run: [PCSuiteTrayApplication] C:/PROGRA~1/Nokia/NOKIAP~1/TRAYAP~1.EXE

O4 - HKLM/…/Run: [AVGCtrl] C:/Program Files/AVPersonal/AVGNT.EXE /min

O4 - HKLM/…/Run: [KAV50] “C:/Program Files/Kaspersky Lab/Kaspersky Anti-Virus Personal Pro 5/kav.exe” -run -n PersonalPro -v 5.0.0.0

O4 - HKLM/…/Run: [ytuvmz] C:/WINDOWS/ytuvmz.exe

O4 - HKCU/…/Run: [CTFMON.EXE] C:/WINDOWS/System32/ctfmon.exe

O4 - HKCU/…/Run: [WITaj!] C:/Program Files/WITaj!/WIT2000.EXE /jeden /ikona

O4 - Global Startup: 22M WLAN Adapter.lnk = ?

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:/Program Files/Common Files/Adobe/Calibration/Adobe Gamma Loader.exe

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:/Program Files/Microsoft Office/Office10/OSA.EXE

O8 - Extra context menu item: Download with GetRight - C:/Program Files/GetRight/GRdownload.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:/PROGRA~1/MICROS~2/Office10/EXCEL.EXE/3000

O8 - Extra context menu item: Open with GetRight Browser - C:/Program Files/GetRight/GRbrowse.htm

O8 - Extra context menu item: Send To &Bluetooth - C:/Program Files/WIDCOMM/Bluetooth Software/btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/WINDOWS/System32/msjava.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/WINDOWS/System32/msjava.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm

O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:/Program Files/WIDCOMM/Bluetooth Software/btsendto_ie.htm

O9 - Extra ‘Tools’ menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:/Program Files/WIDCOMM/Bluetooth Software/btsendto_ie.htm

O12 - Plugin for .spop: C:/Program Files/Internet Explorer/Plugins/NPDocBox.dll

O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} (Loader Class) - http://connect.online-dialer.com/MaConnect.cab

O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://www.cerials.net/download_serial.exe

O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://xbs.mtree.com/mt/dialers/fc/UniDist.CAB

O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://216.65.38.226/crack.CAB

O17 - HKLM/System/CCS/Services/Tcpip/…/{81418020-A98E-44A5-8639-A4C02E11AC64}: NameServer = 192.168.1.1,194.204.159.1

O18 - Protocol: ayb - (no CLSID) - (no file)

O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:/Program Files/AVPersonal/AVGUARD.EXE

O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:/Program Files/AVPersonal/AVWUPSRV.EXE

O23 - Service: Bluetooth Service - WIDCOMM, Inc. - C:/Program Files/WIDCOMM/Bluetooth Software/bin/btwdins.exe

O23 - Service: Kaspersky Anti-Virus Service - Kaspersky Lab - C:/Program Files/Kaspersky Lab/Kaspersky Anti-Virus Personal Pro 5/kavmm.exe

O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:/WINDOWS/System32/nvsvc32.exe

[Shark (Dragonlnx)]

Nieźle zawalony komputer … Początkowo usuń to:

R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://red.clientapps.yahoo.com/customi … ch/ie.html R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://red.clientapps.yahoo.com/customi … .yahoo.com R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://www.onet.pl/ R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Bar = http://tefs.com/searchbar.html R1 - HKCU/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://tefs.com/searchbar.html R1 - HKCU/Software/Microsoft/Internet Explorer/SearchURL,(Default) = http://red.clientapps.yahoo.com/customi … .yahoo.com R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Łącza

O2 - BHO: (no name) - {212ebaeb-01ee-4eae-a368-bd78ad15ad00} - (no file)

O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} (Loader Class) - http://connect.online-dialer.com/MaConnect.cab O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://www.cerials.net/download_serial.exe O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://xbs.mtree.com/mt/dialers/fc/UniDist.CAB O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://216.65.38.226/crack.CAB

To na początek -

Usuń Yahho Toolbar (uważam za zbędny)

Start >>> Uruchom >>> msconfig >>> uruchamianie >>> odznacz:

winampa

nerocheck

DirectCD.exe (uważam za zbędne)

nwiz

ElbyCheck.exe

CloneCDTray

ctfmon.exe

Później :

Szpiedzy (i inne świństwa) …::Webroot:… http://www.webroot.com/services/spyaudit_03.htm …::X-Scan::… http://www.spywareinfo.com/xscan.php Skanery Antywirusowe: …::mks_vir::… http://skaner.mks.com.pl …::GeCAD (RAV)::… http://www.ravantivirus.com/scan/ …::F-Secure::… http://support.f-secure.com/enu/home/ols.shtml …::BitDefender::… http://www.bitdefender.com/scan/licence.php …::Symantec {Norton}::… http://security.symantec.com …::HouseCall::… http://pl.trendmicro-europe.com/consume … ll_pre.php …:: Do czyszczenia JV 16::… http://dobreprogramy.com/index.php?dz=2 … d=509&t=29

Zrób wszystkie ! skany programami skanerami itp.

PestPatrol

Opis Konfiguracji

Ad-Aware Se Personal

CWShredder 2.0

Spybot - Search & Destroy

ETD Security Scanner 3.0 - Antyszpieg

CCleaner

EasyCleaner (nie czepiaj się duplikatów plików)

I daj jeszcze raz log !

Zainstaluj SP2 !

[piterosbayeros]

Usunąłem conieco, ale chyba ciągle nie wygląda to najlepiej. SP2 nie mogę zainstalować bo mi wyskakuje coś o kluczu w rejestrze.usunąłem 2 trojany trochę cookies, dialerów itp. Nie wim co dalej. Nie siedzę wtym zbytnio, więc nie łatwo mi idzie.A więc jak to teraz wygląda?

Logfile of HijackThis v1.99.0

Scan saved at 22:37:29, on 2004-12-18

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:

C:/WINDOWS/System32/smss.exe

C:/WINDOWS/system32/winlogon.exe

C:/WINDOWS/system32/services.exe

C:/WINDOWS/system32/lsass.exe

C:/WINDOWS/system32/svchost.exe

C:/WINDOWS/System32/svchost.exe

C:/WINDOWS/system32/spoolsv.exe

C:/WINDOWS/Explorer.EXE

C:/Program Files/AVPersonal/AVGUARD.EXE

C:/WINDOWS/AGRSMMSG.exe

C:/Program Files/Hewlett-Packard/HP Software Update/HPWuSchd.exe

C:/Program Files/AVPersonal/AVWUPSRV.EXE

C:/Program Files/Hewlett-Packard/Digital Imaging/bin/hpotdd01.exe

C:/Program Files/Java/j2re1.4.2_04/bin/jusched.exe

C:/PROGRA~1/COMMON~1/PCSuite/DATALA~1/DATALA~1.EXE

C:/PROGRA~1/Nokia/NOKIAP~1/TRAYAP~1.EXE

C:/Program Files/WIDCOMM/Bluetooth Software/bin/btwdins.exe

C:/Program Files/Kaspersky Lab/Kaspersky Anti-Virus Personal Pro 5/kav.exe

C:/Program Files/Kaspersky Lab/Kaspersky Anti-Virus Personal Pro 5/kavmm.exe

C:/PROGRA~1/PESTPA~1/PPControl.exe

C:/PROGRA~1/PESTPA~1/PPMemCheck.exe

C:/PROGRA~1/PESTPA~1/CookiePatrol.exe

C:/Program Files/22M WLAN Adapter/WLANMON.exe

C:/Program Files/WIDCOMM/Bluetooth Software/BTTray.exe

C:/Program Files/Common Files/Microsoft Shared/VS7Debug/mdm.exe

C:/WINDOWS/System32/nvsvc32.exe

C:/WINDOWS/System32/svchost.exe

C:/PROGRA~1/COMMON~1/PCSuite/Services/SERVIC~1.EXE

C:/Program Files/Opera/Opera.exe

C:/Program Files/GetRight/GETRIGHT.EXE

C:/Program Files/GetRight/GETRIGHT.EXE

C:/WINDOWS/System32/wuauclt.exe

C:/WINDOWS/System32/wuauclt.exe

C:/Documents and Settings/piotrek/Pulpit/HijackThis.exe

C:/WINDOWS/SoftwareDistribution/Download/S-1-5-18/f14cbfa294456e54248d17250f3ac3e3/update/update.exe

R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Local Page =

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Program Files/Adobe/Acrobat 5.0/Reader/ActiveX/AcroIEHelper.ocx

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx

O4 - HKLM/…/Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM/…/Run: [Agent] C:/Program Files/CyberLink/PowerVCRII/Agent.exe

O4 - HKLM/…/Run: [Remote_Agent] C:/Program Files/CyberLink/PowerVCRII/RemoteAgent.exe

O4 - HKLM/…/Run: [intense Registry Service] IntEdReg.exe /CHECK

O4 - HKLM/…/Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup

O4 - HKLM/…/Run: [MicrocomAutorun] D:/Autorun.exe 1

O4 - HKLM/…/Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM/…/Run: [QuickTime Task] “C:/program files/quicktime/qttask.exe” -atboottime

O4 - HKLM/…/Run: [LWBMOUSE] C:/Program Files/Trust/AMI MOUSE 250SP WIRELESS OPTICAL/lwbwheel.exe

O4 - HKLM/…/Run: [HP Software Update] C:/Program Files/Hewlett-Packard/HP Software Update/HPWuSchd.exe

O4 - HKLM/…/Run: [HPDJ Taskbar Utility] C:/WINDOWS/System32/spool/drivers/w32x86/3/hpztsb08.exe

O4 - HKLM/…/Run: [DeviceDiscovery] C:/Program Files/Hewlett-Packard/Digital Imaging/bin/hpotdd01.exe

O4 - HKLM/…/Run: [XTNDConnect PC - ErPhn2] C:/PROGRA~1/COMMON~1/XCPCSync/TRANSL~1/ErPhn2/ErTray.exe

O4 - HKLM/…/Run: [sunJavaUpdateSched] C:/Program Files/Java/j2re1.4.2_04/bin/jusched.exe

O4 - HKLM/…/Run: [DataLayer] C:/PROGRA~1/COMMON~1/PCSuite/DATALA~1/DATALA~1.EXE

O4 - HKLM/…/Run: [PCSuiteTrayApplication] C:/PROGRA~1/Nokia/NOKIAP~1/TRAYAP~1.EXE

O4 - HKLM/…/Run: [AVGCtrl] C:/Program Files/AVPersonal/AVGNT.EXE /min

O4 - HKLM/…/Run: [KAV50] “C:/Program Files/Kaspersky Lab/Kaspersky Anti-Virus Personal Pro 5/kav.exe” -run -n PersonalPro -v 5.0.0.0

O4 - HKLM/…/Run: [md] C:/WINDOWS/md.img5157.exe s

O4 - HKLM/…/Run: [PestPatrol Control Center] C:/PROGRA~1/PESTPA~1/PPControl.exe

O4 - HKLM/…/Run: [PPMemCheck] C:/PROGRA~1/PESTPA~1/PPMemCheck.exe

O4 - HKLM/…/Run: [CookiePatrol] C:/PROGRA~1/PESTPA~1/CookiePatrol.exe

O4 - HKCU/…/Run: [WITaj!] C:/Program Files/WITaj!/WIT2000.EXE /jeden /ikona

O4 - Global Startup: 22M WLAN Adapter.lnk = ?

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:/Program Files/Common Files/Adobe/Calibration/Adobe Gamma Loader.exe

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:/Program Files/Microsoft Office/Office10/OSA.EXE

O8 - Extra context menu item: Download with GetRight - C:/Program Files/GetRight/GRdownload.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:/PROGRA~1/MICROS~2/Office10/EXCEL.EXE/3000

O8 - Extra context menu item: Open with GetRight Browser - C:/Program Files/GetRight/GRbrowse.htm

O8 - Extra context menu item: Send To &Bluetooth - C:/Program Files/WIDCOMM/Bluetooth Software/btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/WINDOWS/System32/msjava.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/WINDOWS/System32/msjava.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm

O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:/Program Files/WIDCOMM/Bluetooth Software/btsendto_ie.htm

O9 - Extra ‘Tools’ menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:/Program Files/WIDCOMM/Bluetooth Software/btsendto_ie.htm

O12 - Plugin for .spop: C:/Program Files/Internet Explorer/Plugins/NPDocBox.dll

O17 - HKLM/System/CCS/Services/Tcpip/…/{81418020-A98E-44A5-8639-A4C02E11AC64}: NameServer = 192.168.1.1,194.204.159.1

O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:/Program Files/AVPersonal/AVGUARD.EXE

O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:/Program Files/AVPersonal/AVWUPSRV.EXE

O23 - Service: Bluetooth Service - WIDCOMM, Inc. - C:/Program Files/WIDCOMM/Bluetooth Software/bin/btwdins.exe

O23 - Service: Kaspersky Anti-Virus Service - Kaspersky Lab - C:/Program Files/Kaspersky Lab/Kaspersky Anti-Virus Personal Pro 5/kavmm.exe

O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:/WINDOWS/System32/nvsvc32.exe

[Shark (Dragonlnx)]

Znasz takie coś ?? Znasz zostawiasz /nie/ usuwasz

O4 - HKLM/…/Run: [md] C:/WINDOWS/md.img5157.exe s

Potrzebne Ci są te agenty ? >>> Nie - Wywal (wyłącz z msconfig)

O4 - HKLM/…/Run: [Agent] C:/Program Files/CyberLink/PowerVCRII/Agent.exe

O4 - HKLM/…/Run: [Remote_Agent] C:/Program Files/CyberLink/PowerVCRII/RemoteAgent.exe

[piterosbayeros]

Spyware po skanowaniu wykrywa mi jeszcze Visual Log- System monitor, oraz AdlogiX, CWS_NS3, Gator(GAIN). Jak się tego pozbyć?