Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    prosze o sprawdzenie loga

    11.06.05, 18:16
    Logfile of HijackThis v1.99.1
    Scan saved at 18:07:54, on 2005-06-11
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\init32m.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
    C:\WINDOWS\services.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\WINDOWS\services.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Gadu-Gadu\gg.exe
    C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
    D:\Instalki\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    195.95.218.172/index.php
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
    about:NavigationFailure
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
    about:NavigationFailure
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.interia.pl/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    195.95.218.172/index.php
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
    about:NavigationFailure
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    195.95.218.172/index.php
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    about:NavigationFailure
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    195.95.218.172/index.php
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    195.95.218.172/index.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    F2 - REG:system.ini: Shell=Explorer.exe init32m.exe
    F3 - REG:win.ini: load=C:\YDPDict\watch.exe
    O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} -
    C:\WINDOWS\localNRD.dll (file missing)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} -
    C:\WINDOWS\SYSTEM\Loader.dll (file missing)
    O2 - BHO: Xbrowse Class - {AC109D01-32D6-4EB5-8300-D3C5EBAC7C83} -
    C:\Documents and Settings\All Users\Dane aplikacji\x2ff\x2ff.dll
    O2 - BHO: (no name) - {B75D17A3-9731-4A6A-A291-D8A969FB3ADB} -
    C:\WINDOWS\System32\pdfha.dll (file missing)
    O2 - BHO: Xbrowse Class - {D319662B-D5BF-4538-ADF3-8D3E36362608} -
    C:\Documents and Settings\All Users\Dane aplikacji\x0ff\x0ff.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\PowerGG.exe"
    O8 - Extra context menu item: Web Rebates - file://C:\Program
    Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
    C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
    00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra button: Microsoft AntiSpyware helper - {9D7D5C8E-7F50-4315-AC3C-
    5C032F9BCB6A} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {9D7D5C8E-7F50-
    4315-AC3C-5C032F9BCB6A} - (no file) (HKCU)
    O15 - Trusted Zone: *.bestcounter.biz
    O15 - Trusted Zone: *.blazefind.com
    O15 - Trusted Zone: *.clickspring.net
    O15 - Trusted Zone: *.crazywinnings.com
    O15 - Trusted Zone: *.flingstone.com
    O15 - Trusted Zone: *.mt-download.com
    O15 - Trusted Zone: *.my-internet.info
    O15 - Trusted Zone: *.searchbarcash.com
    O15 - Trusted Zone: *.searchmiracle.com
    O15 - Trusted Zone: *.skoobidoo.com
    O15 - Trusted Zone: *.slotch.com
    O15 - Trusted Zone: *.slotchbar.com
    O15 - Trusted Zone: *.topconverting.com
    O15 - Trusted Zone: *.windupdates.com
    O15 - Trusted Zone: *.xxxtoolbar.com
    O15 - Trusted Zone: *.ysbweb.com
    O15 - Trusted Zone: *.blazefind.com (HKLM)
    O15 - Trusted Zone: *.clickspring.net (HKLM)
    O15 - Trusted Zone: *.crazywinnings.com (HKLM)
    O15 - Trusted Zone: *.flingstone.com (HKLM)
    O15 - Trusted Zone: *.mt-download.com (HKLM)
    O15 - Trusted Zone: *.my-internet.info (HKLM)
    O15 - Trusted Zone: *.searchbarcash.com (HKLM)
    O15 - Trusted Zone: *.searchmiracle.com (HKLM)
    O15 - Trusted Zone: *.skoobidoo.com (HKLM)
    O15 - Trusted Zone: *.slotch.com (HKLM)
    O15 - Trusted Zone: *.slotchbar.com (HKLM)
    O15 - Trusted Zone: *.topconverting.com (HKLM)
    O15 - Trusted Zone: *.windupdates.com (HKLM)
    O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
    O15 - Trusted Zone: *.ysbweb.com (HKLM)
    O15 - Trusted IP range: 195.95.218.170
    O15 - Trusted IP range: 195.95.218.170 (HKLM)
    O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be
    Internet Zone
    O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be
    Internet Zone (HKLM)
    O16 - DPF: {11111111-1111-1111-1111-111111111111} -
    www.akty.pl/www/oral.exe
    O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms-
    its:mhtml:file://c:\nosuxyz.mht!
    213.158.119.18/auto/loudtorg.chm::/bridge-c46.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer
    Class) - www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) -
    us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
    O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll
    O20 - Winlogon Notify: tcpGDC - C:\WINDOWS\SYSTEM32\tcpGDC.dll
    O21 - SSODL: Web Event Logger - {79FEACFF-FFCE-815E-A900-316290B5B738} - (no
    file)
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
    Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
    Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
    Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32
    \DRIVERS\CDANTSRV.EXE
    O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program
    Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: NetBiosExt32 - Unknown owner - C:\WINDOWS\services.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
    Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.e
    Obserwuj wątek
      • Gość: Kolobos Re: prosze o sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 11.06.05, 20:55
        Wiesz czemu masz syf? Bo nie masz aktualizacji, a czemu nie masz aktualizacji
        bo masz piracki windows i po co Ci taki smiec?

        Masz backdoor'a, ktory loguje wszystko co piszesz i umozliwia dostep do Twojego
        komputera, na ktorym nie ma nawet firewall'a nie przeszkadza Ci to?

        Tutaj masz opis jego usuwania Backdoor.Haxdoor:
        www.searchengines.pl/phpbb203/index.php?showtopic=12510&st=0&p=109496&#entry132561

        Przeskauj tez tym i wywal wszystko co znajdzie:
        download.microsoft.com/download/8/1/5/815d2d60-49b5-44dc-ae35-fca2f2c6f0cc/MicrosoftAntiSpywareInstall.exe

        Zamknij porty tym:
        www.firewallleaktester.com/tools/wwdc.exe
        To tez zainstaluj:
        www.javacoolsoftware.com/spywareblaster.html <- SpywareBlaster -> wlacz
        ochrone przegladarki


        W hijackthis kasujesz to:

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
        195.95.218.172/index.php
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
        about:NavigationFailure
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
        about:NavigationFailure
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
        195.95.218.172/index.php
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
        about:NavigationFailure
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
        195.95.218.172/index.php
        R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        about:NavigationFailure
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
        195.95.218.172/index.php
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
        195.95.218.172/index.php
        F2 - REG:system.ini: Shell=Explorer.exe init32m.exe
        O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} -
        C:\WINDOWS\localNRD.dll (file missing)
        O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} -
        C:\WINDOWS\SYSTEM\Loader.dll (file missing)
        O2 - BHO: Xbrowse Class - {AC109D01-32D6-4EB5-8300-D3C5EBAC7C83} -
        C:\Documents and Settings\All Users\Dane aplikacji\x2ff\x2ff.dll
        O2 - BHO: (no name) - {B75D17A3-9731-4A6A-A291-D8A969FB3ADB} -
        C:\WINDOWS\System32\pdfha.dll (file missing)
        O2 - BHO: Xbrowse Class - {D319662B-D5BF-4538-ADF3-8D3E36362608} -
        C:\Documents and Settings\All Users\Dane aplikacji\x0ff\x0ff.dll
        O8 - Extra context menu item: Web Rebates - file://C:\Program
        Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
        O9 - Extra button: Microsoft AntiSpyware helper - {9D7D5C8E-7F50-4315-AC3C-
        5C032F9BCB6A} - (no file) (HKCU)
        O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {9D7D5C8E-7F50-
        4315-AC3C-5C032F9BCB6A} - (no file) (HKCU)
        O15 - Trusted Zone: *.bestcounter.biz
        O15 - Trusted Zone: *.blazefind.com
        O15 - Trusted Zone: *.clickspring.net
        O15 - Trusted Zone: *.crazywinnings.com
        O15 - Trusted Zone: *.flingstone.com
        O15 - Trusted Zone: *.mt-download.com
        O15 - Trusted Zone: *.my-internet.info
        O15 - Trusted Zone: *.searchbarcash.com
        O15 - Trusted Zone: *.searchmiracle.com
        O15 - Trusted Zone: *.skoobidoo.com
        O15 - Trusted Zone: *.slotch.com
        O15 - Trusted Zone: *.slotchbar.com
        O15 - Trusted Zone: *.topconverting.com
        O15 - Trusted Zone: *.windupdates.com
        O15 - Trusted Zone: *.xxxtoolbar.com
        O15 - Trusted Zone: *.ysbweb.com
        O15 - Trusted Zone: *.blazefind.com (HKLM)
        O15 - Trusted Zone: *.clickspring.net (HKLM)
        O15 - Trusted Zone: *.crazywinnings.com (HKLM)
        O15 - Trusted Zone: *.flingstone.com (HKLM)
        O15 - Trusted Zone: *.mt-download.com (HKLM)
        O15 - Trusted Zone: *.my-internet.info (HKLM)
        O15 - Trusted Zone: *.searchbarcash.com (HKLM)
        O15 - Trusted Zone: *.searchmiracle.com (HKLM)
        O15 - Trusted Zone: *.skoobidoo.com (HKLM)
        O15 - Trusted Zone: *.slotch.com (HKLM)
        O15 - Trusted Zone: *.slotchbar.com (HKLM)
        O15 - Trusted Zone: *.topconverting.com (HKLM)
        O15 - Trusted Zone: *.windupdates.com (HKLM)
        O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
        O15 - Trusted Zone: *.ysbweb.com (HKLM)
        O15 - Trusted IP range: 195.95.218.170
        O15 - Trusted IP range: 195.95.218.170 (HKLM)
        O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be
        Internet Zone
        O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be
        Internet Zone (HKLM)
        O16 - DPF: {11111111-1111-1111-1111-111111111111} -
        www.akty.pl/www/oral.exe
        O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms-
        its:mhtml:file://c:\nosuxyz.mht!
        213.158.119.18/auto/loudtorg.chm::/bridge-c46.cab
        O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) -
        us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
        O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll
        O20 - Winlogon Notify: tcpGDC - C:\WINDOWS\SYSTEM32\tcpGDC.dll
        O21 - SSODL: Web Event Logger - {79FEACFF-FFCE-815E-A900-316290B5B738} - (no
        file)
        O23 - Service: NetBiosExt32 - Unknown owner - C:\WINDOWS\services.exe


        Nastepnie usuwasz z dysku przy pomocy killbox te pliki:

        C:\windows\system32\init32m.exe albo c:\windows
        C:\Documents and Settings\All Users\Dane aplikacji\x2ff\x2ff.dll
        C:\Documents and Settings\All Users\Dane aplikacji\x0ff\x0ff.dll
        C:\WINDOWS\SYSTEM32\drct16.dll
        C:\WINDOWS\SYSTEM32\tcpGDC.dll
        C:\WINDOWS\services.exe

        Jak juz wszystko zrobisz to mozesz wkleic nowy log z hijackthis.

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.
    Wybrane treści z serwisu Sport.pl są dostępne po wykupieniu płatnej subskrypcji