Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    log HijackThis v1.97.7

    IP: *.d.pppool.de 18.05.04, 22:02
    nie moge wlaczyc strony www.onet.pl ale inne podstrony dzialaja, kilka postow
    ponizej radzil netsec ale nie pomoglo,help.please:(

    Logfile of HijackThis v1.97.7
    Scan saved at 22:01:25, on 18.05.2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Programme\Trend Micro\PC-cillin 2002\pccguide.exe
    C:\Programme\Trend Micro\PC-cillin 2002\PCCClient.exe
    C:\Programme\Trend Micro\PC-cillin 2002\Pop3trap.exe
    C:\Programme\Messenger\msmsgs.exe
    C:\Programme\Gadu-Gadu\gg.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\PROGRA~1\ICQ\ICQ.exe
    C:\WINDOWS\System32\cisvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\tcpsvcs.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
    C:\Programme\Trend Micro\PC-cillin 2002\Tmntsrv.exe
    C:\Programme\Trend Micro\PC-cillin 2002\PCCPFW.exe
    C:\Programme\Internet Explorer\iexplore.exe
    C:\Programme\frnDSL\frnDSL.exe
    C:\WINDOWS\System32\cidaemon.exe
    C:\Programme\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
    D:\Treiber i uzytki\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.gazeta.pl/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    www.idg.pl
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Program
    Microsoft Internet Explorer dostarczony przez IDG.pl
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
    C:\Programme\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [pccguide.exe] "C:\Programme\Trend Micro\PC-cillin 2002
    \pccguide.exe"
    O4 - HKLM\..\Run: [PCCClient.exe] "C:\Programme\Trend Micro\PC-cillin 2002
    \PCCClient.exe"
    O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Programme\Trend Micro\PC-cillin 2002
    \Pop3trap.exe"
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
    \NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
    \NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programme\Gadu-Gadu\gg.exe" /tray
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft
    Office\Office10\OSA.EXE
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk =
    C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
    O8 - Extra context menu item: Nach Microsoft &Excel exportieren -
    res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: ICQ Pro (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=www.idg.pl
    O16 - DPF: komentator - sport.onet.pl/komentator.cab
    O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX
    Control) - download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) -
    a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
    O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} -
    arcade.icq.com/multiplayer/odyssey_web8.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer
    Class) - www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
    download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
    bezpieczenstwo.onet.pl/skaner/SkanerOnline.cab
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments
    Control) - by1fd.bay1.hotmail.msn.com/activex/HMAtchmt.ocx
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B5451C32-CB05-4CA0-84BC-
    98755B696506}: NameServer = 194.97.173.125 62.104.64.3

    Obserwuj wątek
      • netsec Re: log HijackThis v1.97.7 19.05.04, 00:05
        Gość portalu: kura napisał(a):

        > nie moge wlaczyc strony www.onet.pl ale inne podstrony dzialaja, kilka postow
        > ponizej radzil netsec ale nie pomoglo,help.please:(
        >
        > Logfile of HijackThis v1.97.7
        > Scan saved at 22:01:25, on 18.05.2004
        > Platform: Windows XP (WinNT 5.01.2600)
        > MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

        Uruchom HijackThis wykonaj SCAN i zaznacz te pozycje.

        O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe

        Po tym zrób FixChecked i uruchom komputer ponownie.
        Włącz zaporę we właściwościach połączenia do Internetu zakładka Zaawansowane.
        Zaktualizuj Windows w WindowsUpdate www.windowsupdate.com
        System masz dziurawy jak ser szwajcarski :)
        Wyczyść w Opcjach Internetowych w Panelu sterowania Tymczasowe pliki
        Internetowe i Cooki.

        Takie pytanie na koniec, to się samo tak zrobiło czy próbowałeś coś naprawić ;)
        • Gość: kura Re: log HijackThis v1.97.7 IP: *.d.pppool.de 19.05.04, 00:08
          szczerze mowiac to sam nie wiem, chcialem wyrzucic to co mi programy mowily
          jako trojany wirusy itd.dzieki Netsec juz robie to co kazales:)
        • Gość: kura nowy log po tym co kazales... IP: *.d.pppool.de 19.05.04, 00:26
          zrobilem wszystko jak mowiles ponizej masz loga bo www.onet.pl dalej nie moge
          wlaczyc:(((

          Logfile of HijackThis v1.97.7
          Scan saved at 00:24:50, on 19.05.2004
          Platform: Windows XP (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\Programme\Trend Micro\PC-cillin 2002\pccguide.exe
          C:\Programme\Trend Micro\PC-cillin 2002\PCCClient.exe
          C:\Programme\Trend Micro\PC-cillin 2002\Pop3trap.exe
          C:\Programme\Messenger\msmsgs.exe
          C:\Programme\Gadu-Gadu\gg.exe
          C:\WINDOWS\System32\ctfmon.exe
          C:\PROGRA~1\ICQ\ICQ.exe
          C:\Programme\Internet Explorer\iexplore.exe
          C:\WINDOWS\System32\cisvc.exe
          C:\WINDOWS\System32\nvsvc32.exe
          C:\WINDOWS\System32\tcpsvcs.exe
          C:\WINDOWS\System32\snmp.exe
          C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
          C:\Programme\Trend Micro\PC-cillin 2002\Tmntsrv.exe
          C:\Programme\Trend Micro\PC-cillin 2002\PCCPFW.exe
          C:\Programme\frnDSL\frnDSL.exe
          D:\Treiber i uzytki\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
          www.gazeta.pl/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
          www.idg.pl
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Program
          Microsoft Internet Explorer dostarczony przez IDG.pl
          O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
          C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
          C:\Programme\Spybot - Search & Destroy\SDHelper.dll
          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
          C:\WINDOWS\System32\msdxm.ocx
          O4 - HKLM\..\Run: [pccguide.exe] "C:\Programme\Trend Micro\PC-cillin 2002
          \pccguide.exe"
          O4 - HKLM\..\Run: [PCCClient.exe] "C:\Programme\Trend Micro\PC-cillin 2002
          \PCCClient.exe"
          O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Programme\Trend Micro\PC-cillin 2002
          \Pop3trap.exe"
          O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
          \NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
          \NvMcTray.dll,NvTaskbarInit
          O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
          O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programme\Gadu-Gadu\gg.exe" /tray
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft
          Office\Office10\OSA.EXE
          O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk =
          C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
          O8 - Extra context menu item: Nach Microsoft &Excel exportieren -
          res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
          O9 - Extra button: ICQ Pro (HKLM)
          O9 - Extra 'Tools' menuitem: ICQ (HKLM)
          O9 - Extra button: Messenger (HKLM)
          O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
          O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
          O14 - IERESET.INF: START_PAGE_URL=www.idg.pl
          O16 - DPF: komentator - sport.onet.pl/komentator.cab
          O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
          download.macromedia.com/pub/shockwave/cabs/director/sw.cab
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) -
          a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
          O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} -
          arcade.icq.com/multiplayer/odyssey_web8.cab
          O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
          www.pandasoftware.com/activescan/as5/asinst.cab
          O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
          v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38125.6353009259
          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
          download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
          O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
          bezpieczenstwo.onet.pl/skaner/SkanerOnline.cab
          O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments
          Control) - by1fd.bay1.hotmail.msn.com/activex/HMAtchmt.ocx
          O17 - HKLM\System\CCS\Services\Tcpip\..\{B5451C32-CB05-4CA0-84BC-98755B696506}:
          NameServer = 194.97.173.125 62.104.64.3

        • Gość: kura i jeszcze jeden log IP: *.d.pppool.de 19.05.04, 01:00
          Logfile of HijackThis v1.97.7
          Scan saved at 00:59:49, on 19.05.2004
          Platform: Windows XP (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\Programme\Trend Micro\PC-cillin 2002\pccguide.exe
          C:\Programme\Trend Micro\PC-cillin 2002\PCCClient.exe
          C:\Programme\Trend Micro\PC-cillin 2002\Pop3trap.exe
          C:\Programme\Messenger\msmsgs.exe
          C:\Programme\Gadu-Gadu\gg.exe
          C:\WINDOWS\System32\ctfmon.exe
          C:\PROGRA~1\ICQ\ICQ.exe
          C:\WINDOWS\System32\cisvc.exe
          C:\WINDOWS\System32\nvsvc32.exe
          C:\WINDOWS\System32\tcpsvcs.exe
          C:\WINDOWS\System32\snmp.exe
          C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
          C:\Programme\Trend Micro\PC-cillin 2002\Tmntsrv.exe
          C:\Programme\Trend Micro\PC-cillin 2002\PCCPFW.exe
          C:\Programme\Internet Explorer\iexplore.exe
          C:\Programme\frnDSL\frnDSL.exe
          D:\Treiber i uzytki\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
          www.gazeta.pl/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
          www.idg.pl
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Program
          Microsoft Internet Explorer dostarczony przez IDG.pl
          O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
          C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
          C:\Programme\Spybot - Search & Destroy\SDHelper.dll
          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
          C:\WINDOWS\System32\msdxm.ocx
          O4 - HKLM\..\Run: [pccguide.exe] "C:\Programme\Trend Micro\PC-cillin 2002
          \pccguide.exe"
          O4 - HKLM\..\Run: [PCCClient.exe] "C:\Programme\Trend Micro\PC-cillin 2002
          \PCCClient.exe"
          O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Programme\Trend Micro\PC-cillin 2002
          \Pop3trap.exe"
          O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
          \NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
          \NvMcTray.dll,NvTaskbarInit
          O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
          O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programme\Gadu-Gadu\gg.exe" /tray
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft
          Office\Office10\OSA.EXE
          O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk =
          C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
          O8 - Extra context menu item: Nach Microsoft &Excel exportieren -
          res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
          O9 - Extra button: ICQ Pro (HKLM)
          O9 - Extra 'Tools' menuitem: ICQ (HKLM)
          O9 - Extra button: Messenger (HKLM)
          O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
          O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
          O14 - IERESET.INF: START_PAGE_URL=www.idg.pl
          O16 - DPF: komentator - sport.onet.pl/komentator.cab
          O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
          download.macromedia.com/pub/shockwave/cabs/director/sw.cab
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) -
          a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
          O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} -
          arcade.icq.com/multiplayer/odyssey_web8.cab
          O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
          www.pandasoftware.com/activescan/as5/asinst.cab
          O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
          v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38125.6353009259
          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
          download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
          O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
          bezpieczenstwo.onet.pl/skaner/SkanerOnline.cab
          O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments
          Control) - by1fd.bay1.hotmail.msn.com/activex/HMAtchmt.ocx
          O17 - HKLM\System\CCS\Services\Tcpip\..\{B5451C32-CB05-4CA0-84BC-98755B696506}:
          NameServer = 194.97.173.125 194.97.3.83

      • netsec Re: log HijackThis v1.97.7 19.05.04, 06:16
        Gość portalu: kura napisał(a):

        > nie moge wlaczyc strony www.onet.pl ale inne podstrony dzialaja, kilka postow
        > ponizej radzil netsec ale nie pomoglo,help.please:(

        Odszukaj plik hosts i sprawdź jego zawartość, czy przypadkiem onet nie jest tam
        zablokowany.
      • netsec Re: log HijackThis v1.97.7 19.05.04, 08:29
        Kliknij ten link => 213.180.130.200/ zobaczymy czy w ten sposób Onet się otworzy.
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin