Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    proszę o sprawdzenie

    IP: *.neoplus.adsl.tpnet.pl 08.09.05, 21:45
    Logfile of HijackThis v1.99.1
    Scan saved at 21:45:09, on 2005-09-08
    Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AVPersonal\AVGUARD.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\AVPersonal\AVWUPSRV.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\PROGRA~1\NEOSTR~1\CnxMon.exe
    C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\AVPersonal\AVGNT.EXE
    C:\Program Files\AVPersonal\AVSched32.EXE
    C:\Program Files\Atomic Clock Sync\Atomic.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Gadu-Gadu\gg.exe
    C:\Program Files\a2\a2guard.exe
    C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    C:\Program Files\GetRight\getright.exe
    C:\Program Files\GetRight\getright.exe
    C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
    C:\PROGRA~1\NEOSTR~1\ComComp.exe
    C:\PROGRA~1\NEOSTR~1\Watch.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\ania w\Pulpit\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
    szukaj.wp.pl
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.onet.pl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
    szukaj.wp.pl
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.neostrada.pl
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada
    TP
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    R3 - Default URLSearchHook is missing
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut]
    HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1
    \isuspm.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common
    Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
    Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
    O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Atomic.exe] C:\Program Files\Atomic Clock Sync\Atomic.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [SSS6_Suite] "C:\Program Files\Steganos Security Suite 6
    \sss.exe" /booting
    O4 - HKCU\..\Run: [SSS6_SAFE] "C:\Program Files\Steganos Security Suite 6
    \safe.exe" /booting
    O4 - HKCU\..\Run: [SSS6_SPM] "C:\Program Files\Steganos Security Suite 6
    \spm.exe" /booting
    O4 - HKCU\..\Run: [Dzieńdobry!] C:\Program Files\VSD Software\Dzieńdobry!
    \dziendobry.exe /auto
    O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
    O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"
    O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
    \dslmon.exe
    O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program
    Files\GetRight\getright.exe
    O4 - Global Startup: Microsoft Office.lnk = D:\OFFICE\Office10\OSA.EXE
    O8 - Extra context menu item: Download with GetRight - C:\Program
    Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
    res://D:\OFFICE\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Open with GetRight Browser - C:\Program
    Files\GetRight\GRbrowse.htm
    O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} -
    C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-
    00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no
    file)
    O12 - Plugin for .spop: C:\Program Files\Internet
    Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
    update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121012640421
    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) -
    www.windowsecurity.com/trojanscan/axscan.cab
    O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
    skaner.mks.com.pl/SkanerOnline.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{272F35D1-3FDD-476B-8F30-
    F0D9E7ADB9E0}: NameServer = 194.204.152.34 217.98.63.164
    O17 - HKLM\System\CS1\Services\Tcpip\..\{272F35D1-3FDD-476B-8F30-
    F0D9E7ADB9E0}: NameServer = 194.204.152.34 217.98.63.164
    O17 - HKLM\System\CS2\Services\Tcpip\..\{272F35D1-3FDD-476B-8F30-
    F0D9E7ADB9E0}: NameServer = 194.204.152.34 217.98.63.164
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH -
    C:\Program Files\AVPersonal\AVGUARD.EXE
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
    Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
    Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
    Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany -
    C:\Program Files\AVPersonal\AVWUPSRV.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
    Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
    \IDriverT.exe

    Obserwuj wątek
      • Gość: Kolobos Re: proszę o sprawdzenie IP: *.warszawa.sdi.tpnet.pl 08.09.05, 21:54
        Mozna miec tylko jeden antyvirus! Usun jeden!

        W hijackthis usun:
        R3 - Default URLSearchHook is missing

        Wywal aplikacje od neostrady:
        forum.gazeta.pl/forum/72,2.html?f=34&w=15679891&a=15680440
        Messengera tez mozesz wywalic:
        Start->Uruchom->Wpisz polecenie
        RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove
        • Gość: 12 Re: proszę o ponowne sprawdzenie IP: *.neoplus.adsl.tpnet.pl 08.09.05, 22:18
          Logfile of HijackThis v1.99.1
          Scan saved at 22:17:45, on 2005-09-08
          Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\AVPersonal\AVGUARD.EXE
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\Program Files\AVPersonal\AVWUPSRV.EXE
          C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
          C:\WINDOWS\system32\wdfmgr.exe
          C:\WINDOWS\System32\alg.exe
          C:\PROGRA~1\NEOSTR~1\CnxMon.exe
          C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
          C:\WINDOWS\SOUNDMAN.EXE
          C:\WINDOWS\ALCWZRD.EXE
          C:\WINDOWS\system32\igfxtray.exe
          C:\WINDOWS\system32\hkcmd.exe
          C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
          C:\Program Files\Common Files\Real\Update_OB\realsched.exe
          C:\Program Files\AVPersonal\AVGNT.EXE
          C:\Program Files\AVPersonal\AVSched32.EXE
          C:\Program Files\Atomic Clock Sync\Atomic.exe
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Messenger\msmsgs.exe
          C:\Program Files\a2\a2guard.exe
          C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
          C:\Program Files\GetRight\getright.exe
          C:\Program Files\GetRight\getright.exe
          C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
          C:\PROGRA~1\NEOSTR~1\ComComp.exe
          C:\PROGRA~1\NEOSTR~1\Watch.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Documents and Settings\ania w\Pulpit\HijackThis.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
          szukaj.wp.pl
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
          www.onet.pl
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
          szukaj.wp.pl
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
          www.neostrada.pl
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
          C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
          O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
          O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
          O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
          O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut]
          HDAudPropShortcut.exe
          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
          O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
          O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
          O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
          O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
          O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1
          \isuspm.exe -startup
          O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common
          Files\InstallShield\UpdateService\issch.exe" -start
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
          Files\Real\Update_OB\realsched.exe" -osboot
          O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
          O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKLM\..\Run: [Atomic.exe] C:\Program Files\Atomic Clock Sync\Atomic.exe
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [SSS6_Suite] "C:\Program Files\Steganos Security Suite 6
          \sss.exe" /booting
          O4 - HKCU\..\Run: [SSS6_SAFE] "C:\Program Files\Steganos Security Suite 6
          \safe.exe" /booting
          O4 - HKCU\..\Run: [SSS6_SPM] "C:\Program Files\Steganos Security Suite 6
          \spm.exe" /booting
          O4 - HKCU\..\Run: [Dzieńdobry!] C:\Program Files\VSD Software\Dzieńdobry!
          \dziendobry.exe /auto
          O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
          O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"
          O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
          \dslmon.exe
          O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program
          Files\GetRight\getright.exe
          O4 - Global Startup: Microsoft Office.lnk = D:\OFFICE\Office10\OSA.EXE
          O8 - Extra context menu item: Download with GetRight - C:\Program
          Files\GetRight\GRdownload.htm
          O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
          res://D:\OFFICE\Office10\EXCEL.EXE/3000
          O8 - Extra context menu item: Open with GetRight Browser - C:\Program
          Files\GetRight\GRbrowse.htm
          O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} -
          C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-
          00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no
          file)
          O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
          update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121012640421
          O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) -
          www.windowsecurity.com/trojanscan/axscan.cab
          O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
          skaner.mks.com.pl/SkanerOnline.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{272F35D1-3FDD-476B-8F30-F0D9E7ADB9E0}:
          NameServer = 194.204.152.34 217.98.63.164
          O17 - HKLM\System\CS1\Services\Tcpip\..\{272F35D1-3FDD-476B-8F30-F0D9E7ADB9E0}:
          NameServer = 194.204.152.34 217.98.63.164
          O17 - HKLM\System\CS2\Services\Tcpip\..\{272F35D1-3FDD-476B-8F30-F0D9E7ADB9E0}:
          NameServer = 194.204.152.34 217.98.63.164
          O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
          O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH -
          C:\Program Files\AVPersonal\AVGUARD.EXE
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
          Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
          Software\Avast4\ashMaiSv.exe" /service (file missing)
          O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
          Software\Avast4\ashWebSv.exe" /service (file missing)
          O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany -
          C:\Program Files\AVPersonal\AVWUPSRV.EXE
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
          Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
          \IDriverT.exe

          Który antyvirus usunąć?
          • Gość: Kolobos Re: proszę o ponowne sprawdzenie IP: *.warszawa.sdi.tpnet.pl 08.09.05, 22:29
            Chcesz mnie zdenerwowac? Po co wklejasz to samo? Czemu dalej masz dwa
            antyvirusy oraz reszte?

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.
    Wybrane treści z serwisu Sport.pl są dostępne po wykupieniu płatnej subskrypcji