Pomocy.Co to za wirus??
#1
Najprawopodobniejposiadam na komputerze wirusa lub coś co spowalnia system (również internet).Ostatnio antivir zanalazł tego wirusa.Pozatym Antivir nic nie wykrywa.Proszę o pomoc w wykryciu "sprawcy".


[Aby zobaczyć linki, zarejestruj się tutaj]

Odpowiedz
#2
Wyrzuć ten plik. Poza tym pokaż logi HijackThis+Silent Runners
Odpowiedz
#3
Co to są logi?? :oops:i gdzie je znaleźć? Wybaczcie ale w tym jestem zielony :oops: Dopiero raczkuje;p
Odpowiedz
#4
Hjt - Przyklejony:wink:
Sr - Np. tu -

[Aby zobaczyć linki, zarejestruj się tutaj]

Odpowiedz
#5
Kod:
Logfile of HijackThis v1.99.1
Scan saved at 18:40:02, on 2006-12-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesApache GroupApacheApache.exe
C:WINDOWSsystem32lvhidsvc.exe
C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
C:PROGRA~1NORTON~1SPEEDD~1nopdb.exe
C:Program FilesApache GroupApacheApache.exe
C:Program FilesAntiVir PersonalEdition Classicavguard.exe
C:Program FilesAntiVir PersonalEdition Classicsched.exe
C:WINDOWSExplorer.EXE
C:Program FilesAntiVir PersonalEdition Classicavgnt.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
C:PROGRA~1PESTPA~1PPControl.exe
C:WINDOWSsystem32wuauclt.exe
C:PROGRA~1PESTPA~1PPMemCheck.exe
C:PROGRA~1PESTPA~1CookiePatrol.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesProgram sieciowy dla SAGEM Wi-Fi 11g USB adapterWLANUTL.exe
C:Program FileswincmdWINCMD32.EXE
C:Program FilesInternet Exploreriexplore.exe
D:Wojtekfashijackthis.com

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://google.icq.com
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.gazeta.pl/
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatActiveXAcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:PROGRA~1MEGAUP~1MEGAUP~1.DLL
O2 - BHO: (no name) - {9527D42F-D666-11D3-B8DD-00600838CD5F} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll
O2 - BHO: AlxTB BHO - {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:PROGRA~1MEGAUP~1MEGAUP~1.DLL
O4 - HKLM..Run: [avgnt] "C:Program FilesAntiVir PersonalEdition Classicavgnt.exe" /min
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OBrealsched.exe"-osboot
O4 - HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
O4 - HKLM..Run: [PestPatrol Control Center] C:PROGRA~1PESTPA~1PPControl.exe
O4 - HKLM..Run: [PPMemCheck] C:PROGRA~1PESTPA~1PPMemCheck.exe
O4 - HKLM..Run: [CookiePatrol] C:PROGRA~1PESTPA~1CookiePatrol.exe
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.0.720.3640GoogleToolbarNotifier.exe
O4 - HKCU..Run: [AutoConnect] D:WojtekinstalkiIIIAutoConnectAutoConnect.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:WojtekinstalkiICQICQToolbartoolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Mail to a Friend... - http://client.alexa.com/holiday/script/actions/mailto.htm
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm (file missing)
O9 - Extra ''Tools'' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra ''Tools'' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O12 - Plugin for .pdf: C:Program FilesInternet ExplorerPLUGINSnppdf32.dll
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158693921632
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165780329653
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:Program FilesAntiVir PersonalEdition Classicsched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:Program FilesAntiVir PersonalEdition Classicavguard.exe
O23 - Service: Apache - Unknown owner - C:Program FilesApache GroupApacheApache.exe" --ntservice (file missing)
O23 - Service: Remote HID Service (LvHidSvc) - Animation Technologies Inc. - C:WINDOWSsystem32lvhidsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:PROGRA~1NORTON~1SPEEDD~1nopdb.exe
Odpowiedz
#6
Odpalasz Hijacka -> Do a system scan only i zaznaczasz wpisy:
Cytat: R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: (no name) - {9527D42F-D666-11D3-B8DD-00600838CD5F} - (no file)
O2 - BHO: AlxTB BHO - {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - (no file)

O8 - Extra context menu item: Mail to a Friend... -

[Aby zobaczyć linki, zarejestruj się tutaj]


O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm (file missing)
O9 - Extra ''Tools'' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm (file missing)

I klikasz na dole Fix CheckedSmile

Po zabiegach nowy log z Hijacka + log z

[Aby zobaczyć linki, zarejestruj się tutaj]

Odpowiedz
#7
log z Hijacka
Kod:
Logfile of HijackThis v1.99.1
Scan saved at 20:44:31, on 2006-12-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesApache GroupApacheApache.exe
C:WINDOWSsystem32lvhidsvc.exe
C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
C:PROGRA~1NORTON~1SPEEDD~1nopdb.exe
C:Program FilesApache GroupApacheApache.exe
C:Program FilesAntiVir PersonalEdition Classicavguard.exe
C:Program FilesAntiVir PersonalEdition Classicsched.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32wuauclt.exe
C:Program FilesAntiVir PersonalEdition Classicavgnt.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
C:PROGRA~1PESTPA~1PPControl.exe
C:PROGRA~1PESTPA~1PPMemCheck.exe
C:PROGRA~1PESTPA~1CookiePatrol.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesProgram sieciowy dla SAGEM Wi-Fi 11g USB adapterWLANUTL.exe
C:Program FileswincmdWINCMD32.EXE
D:Wojtekfashijackthis.com

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://google.icq.com
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.gazeta.pl/
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatActiveXAcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:PROGRA~1MEGAUP~1MEGAUP~1.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:PROGRA~1MEGAUP~1MEGAUP~1.DLL
O4 - HKLM..Run: [avgnt] "C:Program FilesAntiVir PersonalEdition Classicavgnt.exe" /min
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OBrealsched.exe"-osboot
O4 - HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
O4 - HKLM..Run: [PestPatrol Control Center] C:PROGRA~1PESTPA~1PPControl.exe
O4 - HKLM..Run: [PPMemCheck] C:PROGRA~1PESTPA~1PPMemCheck.exe
O4 - HKLM..Run: [CookiePatrol] C:PROGRA~1PESTPA~1CookiePatrol.exe
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.0.720.3640GoogleToolbarNotifier.exe
O4 - HKCU..Run: [AutoConnect] D:WojtekinstalkiIIIAutoConnectAutoConnect.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:WojtekinstalkiICQICQToolbartoolbaru.dll/SEARCH.HTML
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra ''Tools'' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O12 - Plugin for .pdf: C:Program FilesInternet ExplorerPLUGINSnppdf32.dll
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158693921632
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165780329653
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:Program FilesAntiVir PersonalEdition Classicsched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:Program FilesAntiVir PersonalEdition Classicavguard.exe
O23 - Service: Apache - Unknown owner - C:Program FilesApache GroupApacheApache.exe" --ntservice (file missing)
O23 - Service: Remote HID Service (LvHidSvc) - Animation Technologies Inc. - C:WINDOWSsystem32lvhidsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:PROGRA~1NORTON~1SPEEDD~1nopdb.exe



log z Silent Runners:
Kod:
"Silent Runners.vbs", revision 49, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCUSoftwareMicrosoftWindowsCurrentVersionRun {++}
"CTFMON.EXE" = "C:WINDOWSsystem32ctfmon.exe" [MS]
"swg" = "C:Program FilesGoogleGoogleToolbarNotifier1.0.720.3640GoogleToolbarNotifier.exe" [file not found]
"AutoConnect" = "D:WojtekinstalkiIIIAutoConnectAutoConnect.exe" [file not found]

HKLMSoftwareMicrosoftWindowsCurrentVersionRun {++}
"avgnt" = ""C:Program FilesAntiVir PersonalEdition Classicavgnt.exe" /min" ["Avira GmbH"]
"TkBellExe" = ""C:Program FilesCommon FilesRealUpdate_OBrealsched.exe"-osboot" ["RealNetworks, Inc."]
"HPDJ Taskbar Utility" = "C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe" ["HP"]
"PestPatrol Control Center" = "C:PROGRA~1PESTPA~1PPControl.exe" ["Computer Associates International"]
"PestPatrolCL" = "(empty string)" [file not found]
"PPMemCheck" = "C:PROGRA~1PESTPA~1PPMemCheck.exe" [null data]
"CookiePatrol" = "C:PROGRA~1PESTPA~1CookiePatrol.exe" ["Computer Associates International"]

HKLMSoftwareMicrosoftActive SetupInstalled Components
>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}(Default) = "Outlook Express"
StubPath = "C:WINDOWSsystem32shmgrate.exe OCInstallUserConfigOE" [MS]

HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 6.0 CEAcrobatActiveXAcroIEHelper.dll" ["Adobe Systems Incorporated"]
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}(Default) = (no title provided)
-> {HKLM...CLSID} = "Megaupload Toolbar"
InProcServer32(Default) = "C:PROGRA~1MEGAUP~1MEGAUP~1.DLL" ["MegaUpload"]
{AE7CD045-E861-484f-8273-0445EE161910}(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEToolbarHelper Class"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll" [null data]

HKLMSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
InProcServer32(Default) = "C:WINDOWSsystem32hticons.dll" ["Hilgraeve, Inc."]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
InProcServer32(Default) = "C:Program FilesMicrosoft OfficeOFFICE11msohev.dll" [MS]
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 6.0 CEAcrobat ElementsContextMenu.dll" ["Adobe Systems Inc."]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
InProcServer32(Default) = "C:Program FilesAntiVir PersonalEdition Classicshlext.dll" ["H+BEDV Datentechnik GmbH"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
InProcServer32(Default) = "D:CORrpshell.dll" ["RealNetworks, Inc."]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
InProcServer32(Default) = "D:ProgramsCorelDrawprogramsCMFFld80.dll" [empty string]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
InProcServer32(Default) = "D:ProgramsCorelDrawprogramsCMFFld80.dll" [empty string]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
InProcServer32(Default) = "D:ProgramsCorelDrawprogramsCMFFld80.dll" [empty string]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
InProcServer32(Default) = "D:ProgramsCorelDrawprogramsCMFFld80.dll" [empty string]
"{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder"
-> {HKLM...CLSID} = "Corel Media Find Folder"
InProcServer32(Default) = "D:ProgramsCorelDrawprogramsCMFFld80.dll" [empty string]
"{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler"
-> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler"
InProcServer32(Default) = "D:ProgramsCorelDrawprogramsCMFFld80.dll" [empty string]
"{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory"
-> {HKLM...CLSID} = (no title provided)
InProcServer32(Default) = "D:ProgramsCorelDrawprogramsCNSFlt80.dll" ["Corel Corporation"]
"{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom"
-> {HKLM...CLSID} = (no title provided)
InProcServer32(Default) = "D:ProgramsCorelDrawprogramsCNSFlt80.dll" ["Corel Corporation"]
"{B63FCD5A-2396-11D1-B762-00A0C90646A4}" = "*n" (unwritable string)
-> {HKLM...CLSID} = (no title provided)
InProcServer32(Default) = "D:ProgramsCorelDrawprogramsCMFFnd80.dll" ["Corel Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRARrarext.dll" [null data]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
InProcServer32(Default) = "C:WINDOWSsystem32Audiodev.dll" [MS]

HKLMSoftwareClassesPROTOCOLSFilter
<<!>> text/xmlCLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
InProcServer32(Default) = "C:Program FilesCommon FilesMicrosoft SharedOFFICE11MSOXMLMF.DLL" [MS]

HKLMSoftwareClasses*shellexContextMenuHandlers
Adobe.Acrobat.ContextMenu(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 6.0 CEAcrobat ElementsContextMenu.dll" ["Adobe Systems Inc."]
Shell Extension for Malware scanning(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
InProcServer32(Default) = "C:Program FilesAntiVir PersonalEdition Classicshlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRARrarext.dll" [null data]

HKLMSoftwareClassesDirectoryshellexContextMenuHandlers
FolderToCorelMediaFolder(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
InProcServer32(Default) = "D:ProgramsCorelDrawprogramsCMFFld80.dll" [empty string]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRARrarext.dll" [null data]

HKLMSoftwareClassesFoldershellexContextMenuHandlers
Shell Extension for Malware scanning(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
InProcServer32(Default) = "C:Program FilesAntiVir PersonalEdition Classicshlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRARrarext.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShellState


Enabled Screen Saver:
---------------------

HKCUControl PanelDesktop
"SCRNSAVE.EXE" = "C:WINDOWSsystem32logon.scr" [MS]


Startup items in "Wojtek" & "All Users" startup folders:
--------------------------------------------------------

C:Documents and SettingsAll UsersMenu StartProgramyAutostart
"Program sieciowy dla SAGEM Wi-Fi 11g USB adapter" -> shortcut to: "C:Program FilesProgram sieciowy dla SAGEM Wi-Fi 11g USB adapterWLANUTL.exe" [" "]


Enabled Scheduled Tasks:
------------------------

"Norton SystemWorks One Button Checkup" -> launches: "C:Program FilesNorton SystemWorksOBC.exe/CUSTOM /SCHEDULE" ["Symantec Corporation"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLMSystemCurrentControlSetServicesWinsock2ParametersNameSpace_Catalog5Catalog_Entries {++}
000000000001LibraryPath = "%SystemRoot%System32mswsock.dll" [MS]
000000000002LibraryPath = "%SystemRoot%System32winrnr.dll" [MS]
000000000003LibraryPath = "%SystemRoot%System32mswsock.dll" [MS]

Transport Service Providers

HKLMSystemCurrentControlSetServicesWinsock2ParametersProtocol_Catalog9Catalog_Entries {++}
0000000000##PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%system32mswsock.dll [MS], 01 - 03, 06 - 21
%SystemRoot%system32rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCUSoftwareMicrosoftInternet ExplorerToolbarWebBrowser
"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}"
-> {HKLM...CLSID} = "Megaupload Toolbar"
InProcServer32(Default) = "C:PROGRA~1MEGAUP~1MEGAUP~1.DLL" ["MegaUpload"]
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"
-> {HKLM...CLSID} = "Adobe PDF"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll" [null data]
"{4D5C8C2A-D075-11D0-B416-00C04FB90376}"
-> {HKLM...CLSID} = "Pasek poleceń Microsoft"
InProcServer32(Default) = "C:WINDOWSsystem32browseui.dll" [MS]

HKLMSoftwareMicrosoftInternet ExplorerToolbar
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll" [null data]
"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided)
-> {HKLM...CLSID} = "Megaupload Toolbar"
InProcServer32(Default) = "C:PROGRA~1MEGAUP~1MEGAUP~1.DLL" ["MegaUpload"]

Explorer Bars

HKLMSoftwareMicrosoftInternet ExplorerExplorer Bars
{182EC0BE-5110-49C8-A062-BEB1D02A220B}(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll" [null data]

HKLMSoftwareClassesCLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = "&Badanie"
Implemented Categories{00021493-0000-0000-C000-000000000046} [vertical bar]
InProcServer32(Default) = "C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLMSoftwareMicrosoftInternet ExplorerExtensions
{92780B25-18CC-41C8-B9BE-3C9C571A8263}
"ButtonText" = "Badanie"

{FB5F1910-F110-11D2-BB9E-00C04F795683}
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:Program FilesMessengermsmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir PersonalEdition Classic Guard, AntiVirService, "C:Program FilesAntiVir PersonalEdition Classicavguard.exe" ["AVIRA GmbH"]
AntiVir PersonalEdition Classic Scheduler, AntiVirScheduler, "C:Program FilesAntiVir PersonalEdition Classicsched.exe" ["Avira GmbH"]
Apache, Apache, ""C:Program FilesApache GroupApacheApache.exe" --ntservice" [null data]
Norton Unerase Protection, NProtectService, "C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE" ["Symantec Corporation"]
Remote HID Service, LvHidSvc, "C:WINDOWSsystem32lvhidsvc.exe" ["Animation Technologies Inc."]
Speed Disk service, Speed Disk service, "C:PROGRA~1NORTON~1SPEEDD~1nopdb.exe" ["Symantec Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:WINDOWSsystem32wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLMSystemCurrentControlSetControlPrintMonitors
Adobe PDF PortDriver = "C:WINDOWSsystem32AdobePDF.dll" ["Adobe Systems Incorporated."]
hpzlnt04Driver = "hpzlnt04.dll" ["HP"]


----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 133 seconds.
---------- (total run time: 252 seconds)
Odpowiedz
#8
Kod:
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =


Fix w Hjt.
Odpowiedz
#9
Mam pewne wątpliwośći.Wybacz Maćku 13 ale nie masz zbyt duzej liczby postów na forum a ja sprawdzałemw szkodliwych logach i nie ma czegoś takiego.Może sie myle ale prosiłbym o potwierdzenie czynnosci przez kogos kto ma juz jakas renome na forum.
Odpowiedz
#10
Cytat: O4 - HKCU..Run: [swg]CTonguerogram FilesGoogleGoogleToolbarNotifier1.0.720.3640GoogleToolbarNotifier.exe
O4 - HKCU..Run: [AutoConnect]D:WojtekinstalkiIIIAutoConnectAutoConnect.exe

Zafixować w HJT bo progsów już nie ma, wpis podany przez Macieja13możesz usunać kosmetycznie.

Logi czyste.

Przeczyść rejestr – użyj do tego

[Aby zobaczyć linki, zarejestruj się tutaj]


Wejdź: Start > uruchom > msconfig i w zakładce „Uruchamianie” odznacz, niepotrzebne według Ciebie, programy w autostarcie. Smile
Odpowiedz
#11
Mam jeszcze takie pytanie. Posiadam Windowsa XP z podziałem na użytkowników. Zauważyłem , że w zależności na którym koncie sprawdzam logi to róznią się one między sobą :shock:Np. Na koncie Brata istnieją logi które miałem usunąć a na moim już nie wykrywa ich.Dlaczego tak sie dzieje??I czy w taki wypadku musze sprawdzać logi u wszystkich użytkowników?? Moge uzyc innego programu do czyszczenia rejestru a nie tego jaki został podany.Obecnie używam RegCleaner.

Dodaje logi mojego Brata i swoje.Usunołem to co powinienem.Przeczyściłem rejestr.

Log 1 hjt:

Kod:
Logfile of HijackThis v1.99.1
Scan saved at 14:23:21, on 2006-12-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesApache GroupApacheApache.exe
C:WINDOWSsystem32lvhidsvc.exe
C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
C:PROGRA~1NORTON~1SPEEDD~1nopdb.exe
C:Program FilesApache GroupApacheApache.exe
C:Program FilesAntiVir PersonalEdition Classicavguard.exe
C:Program FilesAntiVir PersonalEdition Classicsched.exe
C:WINDOWSExplorer.EXE
C:Program FilesAntiVir PersonalEdition Classicavgnt.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
C:PROGRA~1PESTPA~1PPControl.exe
C:PROGRA~1PESTPA~1PPMemCheck.exe
C:PROGRA~1PESTPA~1CookiePatrol.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesProgram sieciowy dla SAGEM Wi-Fi 11g USB adapterWLANUTL.exe
C:Program FileswincmdWINCMD32.EXE
D:WojtekGGGadu-Gadugg.exe
C:Program FilesInternet Exploreriexplore.exe
D:Wojtekfashijackthis.com

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://google.icq.com
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.gazeta.pl/
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatActiveXAcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:PROGRA~1MEGAUP~1MEGAUP~1.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:PROGRA~1MEGAUP~1MEGAUP~1.DLL
O4 - HKLM..Run: [avgnt] "C:Program FilesAntiVir PersonalEdition Classicavgnt.exe" /min
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OBrealsched.exe"-osboot
O4 - HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
O4 - HKLM..Run: [PestPatrol Control Center] C:PROGRA~1PESTPA~1PPControl.exe
O4 - HKLM..Run: [PPMemCheck] C:PROGRA~1PESTPA~1PPMemCheck.exe
O4 - HKLM..Run: [CookiePatrol] C:PROGRA~1PESTPA~1CookiePatrol.exe
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:WojtekinstalkiICQICQToolbartoolbaru.dll/SEARCH.HTML
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra ''Tools'' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O12 - Plugin for .pdf: C:Program FilesInternet ExplorerPLUGINSnppdf32.dll
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158693921632
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165780329653
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:Program FilesAntiVir PersonalEdition Classicsched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:Program FilesAntiVir PersonalEdition Classicavguard.exe
O23 - Service: Apache - Unknown owner - C:Program FilesApache GroupApacheApache.exe" --ntservice (file missing)
O23 - Service: Remote HID Service (LvHidSvc) - Animation Technologies Inc. - C:WINDOWSsystem32lvhidsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:PROGRA~1NORTON~1SPEEDD~1nopdb.exe


Log 2 hjt:

Kod:
C:Program FilesApache GroupApacheApache.exe
C:Program FilesAntiVir PersonalEdition Classicavguard.exe
C:Program FilesAntiVir PersonalEdition Classicsched.exe
C:WINDOWSExplorer.EXE
C:Program FilesAntiVir PersonalEdition Classicavgnt.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
C:PROGRA~1PESTPA~1PPControl.exe
C:PROGRA~1PESTPA~1PPMemCheck.exe
C:PROGRA~1PESTPA~1CookiePatrol.exe
C:WINDOWSsystem32ctfmon.exe
D:MaciekpogaduszkiGaduGadu-Gadugg.exe
C:Program FilesProgram sieciowy dla SAGEM Wi-Fi 11g USB adapterWLANUTL.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FileswincmdWINCMD32.EXE
D:Wojtekfashijackthis.com

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.onet.pl/
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatActiveXAcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:PROGRA~1MEGAUP~1MEGAUP~1.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:PROGRA~1MEGAUP~1MEGAUP~1.DLL
O4 - HKLM..Run: [avgnt] "C:Program FilesAntiVir PersonalEdition Classicavgnt.exe" /min
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OBrealsched.exe"-osboot
O4 - HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
O4 - HKLM..Run: [PestPatrol Control Center] C:PROGRA~1PESTPA~1PPControl.exe
O4 - HKLM..Run: [PPMemCheck] C:PROGRA~1PESTPA~1PPMemCheck.exe
O4 - HKLM..Run: [CookiePatrol] C:PROGRA~1PESTPA~1CookiePatrol.exe
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [Gadu-Gadu] "D:MaciekpogaduszkiGaduGadu-Gadugg.exe" /tray
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra ''Tools'' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O12 - Plugin for .pdf: C:Program FilesInternet ExplorerPLUGINSnppdf32.dll
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158693921632
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165780329653
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:Program FilesAntiVir PersonalEdition Classicsched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:Program FilesAntiVir PersonalEdition Classicavguard.exe
O23 - Service: Apache - Unknown owner - C:Program FilesApache GroupApacheApache.exe" --ntservice (file missing)
O23 - Service: Remote HID Service (LvHidSvc) - Animation Technologies Inc. - C:WINDOWSsystem32lvhidsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:PROGRA~1NORTON~1SPEEDD~1nopdb.exe
Odpowiedz
#12
To normalne, gdyż każdy user ma w swoich ustawieniach co innego. W logach nic nie ma. Oczywiście możesz używać dowolnego programu, my tylko sugerujemy Smile
Odpowiedz
#13
Czyli jeden user moze miec błędy w logach a reszta ich nie bedzie miec?Moze sie tak zdarzyc??
Odpowiedz
#14
phancy napisał(a):każdy user ma w swoich ustawieniach co innego.


:wink:
"Nie jestem konsumentem mieszczącym się w standardzie
Nie jestem gatunkiem skazanym na wymarcie
Nie jestem obiektem medialnego hałasu
Jestem nielegalnym zabójcą czasu"
Odpowiedz
#15
Takie pytanko.Rzecz dzieje sie na kompie u mojego kumpla. Ma jak pamietam zainstalowany Windows XP. Nie może otworzyć zadnej strony internetowej a komunikować sie z innymi ludźmi przez GG juz może. Podobno ma jakiegoś wirusa jednak program antywirusowy nic nie wykrywa :?Facet który jest dostawcą internetu powiedzial "format".Tylko mnie uczono , że to jest ostateczność. Czy podanie logów do sprawdzenia na forum pomoże jakoś rozwiązać ten problem??
Odpowiedz
#16
Oczywiście że tak, nie słuchać pajaców od providera. Jeśli coś siedzi na kompie, to będzie widać w logach Wink
Odpowiedz
#17
To bym prosił jeszcze raz o spradzenie :wink:
Kod:
Logfile of HijackThis v1.99.1
Scan saved at 16:43:31, on 2006-12-14
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesAntiVir PersonalEdition Classicsched.exe
C:Program FilesAntiVir PersonalEdition Classicavguard.exe
C:Program FilesApache GroupApacheApache.exe
C:WINDOWSsystem32lvhidsvc.exe
C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
C:PROGRA~1NORTON~1SPEEDD~1nopdb.exe
C:Program FilesApache GroupApacheApache.exe
C:WINDOWSExplorer.EXE
C:Program FilesAntiVir PersonalEdition Classicavgnt.exe
C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
C:PROGRA~1PESTPA~1PPControl.exe
C:PROGRA~1PESTPA~1PPMemCheck.exe
C:PROGRA~1PESTPA~1CookiePatrol.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesProgram sieciowy dla SAGEM Wi-Fi 11g USB adapterWLANUTL.exe
C:WINDOWSsystem32WISPTIS.EXE
D:WojtekGGGadu-Gadugg.exe
C:Program FileswincmdWINCMD32.EXE
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
D:Wojtekfashijackthis.com

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.gazeta.pl/
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatActiveXAcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:Program FilesAdobeAcrobat 6.0 CEAcrobatAcroIEFavClient.dll
O4 - HKLM..Run: [avgnt] "C:Program FilesAntiVir PersonalEdition Classicavgnt.exe" /min
O4 - HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
O4 - HKLM..Run: [PestPatrol Control Center] C:PROGRA~1PESTPA~1PPControl.exe
O4 - HKLM..Run: [PPMemCheck] C:PROGRA~1PESTPA~1PPMemCheck.exe
O4 - HKLM..Run: [CookiePatrol] C:PROGRA~1PESTPA~1CookiePatrol.exe
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OBrealsched.exe"-osboot
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:WojtekinstalkiICQICQToolbartoolbaru.dll/SEARCH.HTML
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra ''Tools'' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O12 - Plugin for .pdf: C:Program FilesInternet ExplorerPLUGINSnppdf32.dll
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158693921632
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165780329653
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:Program FilesAntiVir PersonalEdition Classicsched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:Program FilesAntiVir PersonalEdition Classicavguard.exe
O23 - Service: Apache - Unknown owner - C:Program FilesApache GroupApacheApache.exe" --ntservice (file missing)
O23 - Service: Remote HID Service (LvHidSvc) - Animation Technologies Inc. - C:WINDOWSsystem32lvhidsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:PROGRA~1NORTON~1SPEEDD~1nopdb.exe
Odpowiedz
#18
Czysto.
Odpowiedz


Skocz do:


Użytkownicy przeglądający ten wątek: 1 gości