What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] wifes comp ---log

37 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
i accessed my comp using my wifes, when i went into the slave on my comp kaspersky went nuts and all that is on my slave is installers which has been scanned numerous times and nothing malicious found.




Logfile of HijackThis v1.99.1
Scan saved at 5:37:59 PM, on 11/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Config\lsass.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\lsass.exe
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {3960FED7-8129-46AA-8DD4-ABCB0F74AE05} (FFChocoMotion Class) - http://www.monolith-prime.co.jp/morph/smart_morph_ax.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1173996369734
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: Hexecdb - {A1FA2B51-23FB-4BF8-A923-EE9F1A6581FF} - C:\WINDOWS\system32\conubexp.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Windows Installer (MSIServer) - Unknown owner - C:\WINDOWS\system32\msiexec.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe







as of about 9:30 my wifes computer is not letting me log on at all it seems to boot up ok then it goes to the desktop but icons dont load then it goes to the log off screen the anti-virus pops up with notifications of virus- Win-32. IE is gone and for the most part its kind of russian roulette as to which programs will load or not. i dont really want to reformat her comp again.
Post #2
now the computer boots up , displays the wallpaper(no icons) and then logs itself off and stays at the user accounts screen until i reboot it again. ive tried to do it in safe mode with the same results. does any one know what is causing this?
Post #3
Maybe unplugging the internet connection will let it boot.

This one is one of the bad ones you have.
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\lsass.exe

C:\Windows\Config IS NOT A VALID LOCATION for lsass.exe … the genuine version lives in C:\Windows\System32

If you can get it to boot:


Click Start > Run , type in regedit

(can also get run by going Ctrl+Alt+Del>file>NewTask (run))


Go to the following in the registry editor:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.


In Winlogon, on the right side, there should be a value called "Shell".
Double click this value. Make sure only 'Explorer.exe' is the value of Shell, if anything else is there , simply delete it and leave 'Explorer.exe' .

Close out the window and restart….

Let me know if that worked.
Post #4
nope thats not working it just logs on then in like 3 seconds it logs off . ive tried booting it in every safe mode available to me as well as other boot options. id hate to have to reformat her pc (she has a lot of music on there). are there any other options?
Post #11
ok this is weird and i dont know if you can help me……i was using the recovery console and typed MAP and my partitioned drives are "swapped" ???? it should be: C: NTFS 33045MB \Device\Harddisk0\Partition1 D: FAT32 5146MB \Device\Harddisk0\Partition2 A: \Device\Floppy0 E: \Device\CdRom0 But this is how it looks now C: FAT32 5146MB \Device\Harddisk0\Partition1 D: NTFS 33045MB \Device\Harddisk0\Partition2 A: \Device\Floppy0 E: \Device\CdRom0 still cant get past the "WELCOME" screen though
Post #13
sorry i havent responded sooner…..whatever was in my wifes computer decided to reinfect mine. hers wouldnt even let me log on even after doing a repair install…..i had to completely reinstall windows xp on mine with minimal data loss. i currently have her hard drive set up on mine as a slave so i can fix it so it logs on properly but the virus or whatever seems to be jumping all around the place. reformatting her drive is not an option at this time.

here is what Superantispyware found:

Trojan.Duncan

here is what nnod32 logged

11/19/2007 8:05:27 PM Real-time file system protection file C:\WINDOWS\TEMP\VRT37B9.tmp Win32/Poebot trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: \??\C:\WINDOWS\system32\winlogon.exe.
11/19/2007 8:05:23 PM HTTP filter file http://www.nadsam0.info/advproxy.exe Win32/Poebot trojan connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: c:\windows\system32\winlogon.exe.
11/19/2007 6:54:36 PM HTTP filter file http://www.nadsam0.info/advproxy.exe Win32/Poebot trojan connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: c:\windows\system32\winlogon.exe.
11/19/2007 6:42:52 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\WINDOWS\system32\taskmgr.exe.
11/19/2007 6:41:44 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\WINDOWS\system32\taskmgr.exe.
11/19/2007 6:40:32 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:37:11 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:37:03 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:36:40 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\WINDOWS\system32\taskmgr.exe.
11/19/2007 6:36:33 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:36:15 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:35:40 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:33:53 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:32:09 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:29:13 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:29:12 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:27:47 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:25:27 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:20:04 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:18:56 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:17:41 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:15:13 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:14:38 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:14:23 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:13:25 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:13:12 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:11:18 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:11:18 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:11:01 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:10:39 PM Real-time file system protection file C:\WINDOWS\system32\actcfg.dll probably a variant of Win32/Adware.Agent application cleaned by deleting (after the next restart) - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to run the file by the application: C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe.
11/19/2007 6:04:16 PM Real-time file system protection file C:\WINDOWS\TEMP\removalfile.bat Win32/Adware.Virtumonde application cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\TEMP\kfyqhrw.exe.
11/19/2007 6:03:43 PM HTTP filter file http://nadsam0.info/bugsy.exe probably unknown NewHeur_PE virus connection terminated - quarantined NT AUTHORITY\SYSTEM
11/19/2007 6:03:39 PM HTTP filter file http://nadsam0.info/is.exe a variant of Win32/TrojanDownloader.Agent.ANM trojan connection terminated - quarantined NT AUTHORITY\SYSTEM
11/19/2007 6:03:36 PM HTTP filter file http://nadsam0.info/is2.exe Win32/VB.NDX trojan connection terminated - quarantined NT AUTHORITY\SYSTEM
11/19/2007 6:01:07 PM Real-time file system protection file C:\WINDOWS\TEMP\VRT63C1.tmp Win32/Poebot trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: \??\C:\WINDOWS\system32\winlogon.exe.



i dont know if this would make any sense to anyone but it also detected something called Win32/PoeBot and a couple of others.
so what are my chances of survival and how would i be able to fix my wifes harddrive so it boots up properly?
Post #14
It looks like all the ones it found were quarantined :thumbup:

Can you post a HijackThis log..

you can get a complete installer that installs HijackThis to C:\Program Files\HijackThis, making an entry in the start menu and also providing a desktop shortcut from http://downloads.malwareremoval.com/HJTsetup.exe.

Click on the link and select Save, save it to your desktop and double click HJTsetup.exe.

Open HijackThis and select: Do a system scan and save a log file.

When the scan is finished, Click Edit> Select All> Edit> Copy> and paste its contents here please use the [Add Reply] button below.
Post #15
not much here freshly reformatted system but my av still keeps popping up with virus warnings i thought it might be because of other avprogs that had quarintined items so i removed the progs and deleted what was left over

Logfile of HijackThis v1.99.1
Scan saved at 9:17:41 PM, on 11/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvGraphicsInterface] C:\WINDOWS\TEMP\bvvws.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\Eset\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI