Gość: magda
IP: *.48.115.32.ltv.pl
25.05.10, 23:36
Przepraszam,że się podpięłam ale jestem tu nowa i nie bardzo umiem
się tu odnaleźć.
Prosiłabym o sprawdzenie logów z hikacka i combofixa.
Moim problemem jest straszne spowolnienie internetu i ogólnie
kompa,poza tym co jakiś czas rozłacza mi połączenie sieciowe,nie
mogę np zmienić ustawienia ,żeby pliki ukryte stały się widoczne
albo chociaż wejść w opcje internetowe przeglądarki.
Miałam kilka wirusów i trojanów,np backdoor.trojan ale ponoć zostały
usunięte,niestety to nie rozwiązało problemu.
Proszę o pomoc.
Dziękuję
Logfile of Trend Micro HijackThis v2.0.2Scan saved at 16:36:23, on
2010-05-25Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)MSIE:
Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning
processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32
\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32
\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32
\svchost.exeC:\Program Files\Alwil Software\Avast4
\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4
\ashServ.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program
Files\Common Files\Java\Java Update\jusched.exeC:\Program Files\Gadu-
Gadu\gg.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32
\spoolsv.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Java\jre6
\bin\jqs.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32
\svchost.exeC:\WINDOWS\system32
\svchost.exeC:\WINDOWS\explorer.exeC:\Program Files\internet
explorer\iexplore.exeC:\Program Files\internet
explorer\iexplore.exeC:\Documents and Settings\Magda\Moje
dokumenty\HiJackThis.exeR0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page = http://www.gamedesire.com/R1 -
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 -
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 -
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 -
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R0 -
HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
ŁączaO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0
\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: Java(tm) Plug-In 2 SSV
Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program
Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl -
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6
\lib\deploy\jqs\ie\jqs_plugin.dllO2 - BHO: IEPluginBHO - {F5CC7F02-
6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Magda\Dane
aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dllO4 - HKLM\..\Run:
[avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run:
[SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java
Update\jusched.exe"O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program
Files\Gadu-Gadu\gg.exe" /trayO4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE]
C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')O4 -
HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
(User 'Default user')O8 - Extra context menu item: Add to Google
Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200O9 -
Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} -
C:\WINDOWS\bdoscandel.exeO9 - Extra 'Tools' menuitem: Uninstall
BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} -
C:\WINDOWS\bdoscandel.exeO9 - Extra button: (no name) - {e2e2dd38-
d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network
Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-
20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network
Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-
F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows
Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exeO12 - Plugin for .spop: C:\Program
Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: {3D8700FB-
86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) -
slimak.onet.pl/_m/wirusy/ArcaOnline.cabO16 - DPF: {5D86DDB5-
BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
download.bitdefender.com/resources/scanner/sources/en/scan8/os
can8.cabO16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55}
(MksSkanerOnline Class) -
www.mks.com.pl/skaner/SkanerOnline.cabO16 - DPF: {6E32070A-
766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/
client/muweb_site.cab?1262946746593O16 - DPF: {8100D56A-5661-482C-
BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) -
upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhoto
Uploader55.cabO16 - DPF: {83AFB5CA-11D4-ED35-A452-0080C8D85045}
(GameDesire Poker Games) -
cached.gamedesire.com/g_bin/pl/poker_2_0_0_53.cabO16 - DPF:
{CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) -
asp.photoprintit.de/microsite/222222/defaults/activex/ips/IPS
Uploader4.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{6A38BE68-C37A-
49C6-BBDA-1DE196017B08}: NameServer = 80.48.115.2 80.48.115.4O17 -
HKLM\System\CCS\Services\Tcpip\..\{BF4F1C9A-57A1-402B-B107-
F3A3515B90BF}: NameServer = 194.204.159.1O23 - Service: avast! iAVS4
Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil
Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - ALWIL
Software - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 -
Service: avast! Mail Scanner - ALWIL Software - C:\Program
Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: avast! Web
Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4
\ashWebSv.exeO23 - Service: Google Updater Service (gusvc) - Google -
C:\Program Files\Google\Common\Google
Updater\GoogleUpdaterService.exeO23 - Service: Java Quick Starter
(JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program
Files\Java\jre6\bin\jqs.exe--End of file - 5611 bytesComboFix 10-05-
24.07 - Magda 2010-05-25 16:25:11.1.2 - x86Microsoft Windows XP
Home Edition 5.1.2600.3.1250.48.1045.18.1014.454 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Magda\Moje
dokumenty\ComboFix.exeAV: avast! antivirus 4.8.1368 [VPS 100525-1]
*On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-
1A293FD8233D}.(((((((((((((((((((((((((((((((((((((((
Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))).c:\progr
am files\Internet Explorer\SET4481.tmpc:\program files\Internet
Explorer\SET4482.tmpc:\windows\irunin.bmpc:\windows\irunin.datc:\wind
ows\irunin.inic:\windows\irunin.lngc:\windows\system32
\AbaleZip.dllc:\windows\system32\AutoRun.inf.
((((((((((((((((((((((((( Pliki utworzone od 2010-04-25 do 2010-05-
25 ))))))))))))))))))))))))))))))).2010-05-24 17:44 . 2010-05-24
17:44 503808 ----a-w- c:\documents and
settings\Magda\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\46
\f84c6ae-1938bd1f-n\msvcp71.dll2010-05-24 17:44 . 2010-05-24
17:44 499712 ----a-w- c:\documents and
settings\Magda\Dane ap
