Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    Proszę o sprawdzenie

    IP: *.pub1.ino.tvknet.pl 11.08.05, 12:41
    Logfile of HijackThis v1.99.1
    Scan saved at 12:37:31, on 2005-08-11
    Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\BitComet\BitComet.exe
    E:\Program Files\GG\Gadu-Gadu\gg.exe
    E:\Program Files\Norton System Works\Norton AntiVirus\navapsvc.exe
    E:\Program Files\Norton System Works\Norton Utilities\NPROTECT.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    E:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\x\Pulpit\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.google.pl/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    R3 - Default URLSearchHook is missing
    F3 - REG:win.ini: load=e:\progra~1\angiel~1\colins\watch.exe
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    e:\program files\acrobat reader\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: Local Spool Net support DLL - {41943050-65CC-454B-81E4-9C8A9D7CBAEA}
    - C:\WINDOWS\system32\localsplnet.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program
    Files\Norton System Works\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: MiastoPlusa - {30863749-9AE5-4d67-9A7C-81B8D6F4B656} -
    C:\WINDOWS\Downloaded Program Files\MPToolBar.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
    E:\Program Files\Norton System Works\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control
    Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program
    Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program
    Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
    Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
    Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [KAZAA] "C:\Program Files\Kazaa\Kazaa Lite\kpp.exe"
    "C:\Program Files\Kazaa\Kazaa Lite\kazaa.kpp" /SYSTRAY
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    /Consumer
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP
    Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Dblsnmky] C:\Program Files\Aoutrvz\Stjt.exe
    O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Komunikator] F:\tlen\tlen.exe
    O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
    O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Program Files\GG\Gadu-Gadu\gg.exe" /tray
    O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
    res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
    C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
    C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger -
    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
    a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -
    www3.ca.com/securityadvisor/virusinfo/webscan.cab
    O16 - DPF: {809415DF-2296-496E-A018-9CA2EC157088} (InstallCtrl Class) -
    www.miastoplusa.pl/toolbar/MPToolBar.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) -
    www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class)
    - www.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) -
    www.ravantivirus.com/scan/ravonline.cab
    O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
    skaner.mks.com.pl/SkanerOnline.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
    download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4415/mcfscan.cab
    O17 -
    HKLM\System\CCS\Services\Tcpip\..\{C4F84621-8433-476F-AC36-FB0B052C1012}:
    NameServer = 217.96.13.211,194.204.159.1
    O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - (no file)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -
    C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec
    Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec
    Corporation - E:\Program Files\Norton System Works\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec
    Corporation - E:\Program Files\Norton System Works\Norton Utilities\NPROTECT.EXE
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
    C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
    Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) -
    Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Speed Disk service - Symantec Corporation -
    E:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program
    Files\Common Files\Symantec Shared\Security
    Obserwuj wątek
      • Gość: joasia_23 up IP: *.pub1.ino.tvknet.pl 11.08.05, 16:26
      • neder Re: Proszę o sprawdzenie 11.08.05, 16:35
        usuwasz z dysku (w awaryjnym):
        > localsplnet.dll -> z C:\WINDOWS\system32\
        > MediaAccess -> poprzez dodaj/usuń programy
        > Aoutrvz -> jw


        w HJ usuwasz:
        > R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        > R3 - Default URLSearchHook is missing
        > O2 - BHO: Local Spool Net support DLL - {41943050-65CC-454B-81E4-9C8A9D7CBAEA}
        > - C:\WINDOWS\system32\localsplnet.dll
        > O4 - HKLM\..\Run: [Dblsnmky] C:\Program Files\Aoutrvz\Stjt.exe
        > O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe


        wpisy nieszkodliwe ale zbędne w autostarcie -> o usunieciu tego z autostartu zadecyduj sama, jesli coś chcesz usunąć to rób to nie poprzez HJ tylko start > uruchom> msconfig> zakładka Uruchamianie i tam odznaczasz co niepotrzebne:
        > O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        > O4 - HKLM\..\Run: [RemoteControl] "C:\Program
        > Files\CyberLink\PowerDVD\PDVDServ.exe"
        > O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
        > O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
        > C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
        > O4 - HKLM\..\Run: [HP Component Manager] "C:\Program
        > Files\HP\hpcoretech\hpcmpmgr.exe"
        > O4 - HKLM\..\Run: [KAZAA] "C:\Program Files\Kazaa\Kazaa Lite\kpp.exe"
        > "C:\Program Files\Kazaa\Kazaa Lite\kazaa.kpp" /SYSTRAY
        > O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP
        > Software Update\HPWuSchd2.exe

        korzystasz z Messengera? jak nie to też out.



        reset i nowy log
      • Gość: joasia_23 Re: Proszę o sprawdzenie IP: 217.98.71.* 11.08.05, 17:39
        Logfile of HijackThis v1.99.1
        Scan saved at 17:36:29, on 2005-08-11
        Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
        C:\Program Files\Common Files\Symantec Shared\ccApp.exe
        C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
        C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
        C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
        E:\Program Files\GG\Gadu-Gadu\gg.exe
        E:\Program Files\Norton System Works\Norton AntiVirus\navapsvc.exe
        E:\Program Files\Norton System Works\Norton Utilities\NPROTECT.EXE
        C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
        E:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
        C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Documents and Settings\x\Pulpit\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.google.pl/
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
        F3 - REG:win.ini: load=e:\progra~1\angiel~1\colins\watch.exe
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
        e:\program files\acrobat reader\Reader\ActiveX\AcroIEHelper.ocx
        O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program
        Files\Norton System Works\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: MiastoPlusa - {30863749-9AE5-4d67-9A7C-81B8D6F4B656} -
        C:\WINDOWS\Downloaded Program Files\MPToolBar.dll
        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
        E:\Program Files\Norton System Works\Norton AntiVirus\NavShExt.dll
        O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control
        Panel\atiptaxx.exe"
        O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
        Shared\ccRegVfy.exe"
        O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
        /Consumer
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP
        Software Update\HPWuSchd2.exe
        O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
        O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [KAZAA] "C:\Program Files\Kazaa\Kazaa Lite\kpp.exe"
        "C:\Program Files\Kazaa\Kazaa Lite\kazaa.kpp" /SYSTRAY
        O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
        C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
        O4 - HKLM\..\Run: [HP Component Manager] "C:\Program
        Files\HP\hpcoretech\hpcmpmgr.exe"
        O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Program Files\GG\Gadu-Gadu\gg.exe" /tray
        O4 - HKCU\..\Run: [Komunikator] F:\tlen\tlen.exe
        O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
        res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
        C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
        C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger -
        {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
        O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
        a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
        O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -
        www3.ca.com/securityadvisor/virusinfo/webscan.cab
        O16 - DPF: {809415DF-2296-496E-A018-9CA2EC157088} (InstallCtrl Class) -
        www.miastoplusa.pl/toolbar/MPToolBar.cab
        O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) -
        www.bitdefender.com/scan/Msie/bitdefender.cab
        O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
        www.pandasoftware.com/activescan/as5free/asinst.cab
        O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) -
        www.ravantivirus.com/scan/ravonline.cab
        O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
        skaner.mks.com.pl/SkanerOnline.cab
        O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
        download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4415/mcfscan.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{C4F84621-8433-476F-AC36-FB0B052C1012}:
        NameServer = 217.96.13.211,194.204.159.1
        O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - (no file)
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -
        C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
        C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec
        Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec
        Corporation - E:\Program Files\Norton System Works\Norton AntiVirus\navapsvc.exe
        O23 - Service: Norton Unerase Protection (NProtectService) - Symantec
        Corporation - E:\Program Files\Norton System Works\Norton Utilities\NPROTECT.EXE
        O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
        C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation
        - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
        O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) -
        Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
        O23 - Service: Speed Disk service - Symantec Corporation -
        E:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
        O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program
        Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

        • neder Re: Proszę o sprawdzenie 11.08.05, 22:50
          już jest ok. Nie powywalałaś tych zbędnych rzeczy z autostartu. Sporo ich tam
          masz, prawde mówiąc.
          • Gość: joasia_23 Re: Proszę o sprawdzenie IP: 217.98.71.* 12.08.05, 08:52
            Powywalałam....Ale komputer nadal nie działa tak jak powinien...
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.
    Wybrane treści z serwisu Sport.pl są dostępne po wykupieniu płatnej subskrypcji