Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    Sprawdzenie logów

    IP: *.wroclaw.dialog.net.pl 01.11.05, 23:52
    Proszę o sprawdzenie logów. Nie mogę uruchamiać programów antywirusowych
    (Internet security,teraz Kaspersky)po ataku wirusa.Nie wiem czy dobrze
    oczyściłem kompa.
    Logfile of HijackThis v1.98.2
    Scan saved at 23:35:46, on 2005-11-01
    Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    E:\WINDOWS\system32\LEXBCES.EXE
    E:\WINDOWS\system32\spoolsv.exe
    E:\WINDOWS\system32\LEXPPS.EXE
    E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
    E:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
    E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    E:\WINDOWS\explorer.exe
    E:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
    E:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
    E:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
    E:\Program Files\Creative\Desktop Wireless\mouse_2k.exe
    E:\Program Files\Creative\Desktop Wireless\kb_2k.exe
    E:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    E:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    E:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    E:\WINDOWS\System32\wuauclt.exe
    E:\Program Files\Internet Explorer\iexplore.exe
    C:\HiJack\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.google.pl/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    E:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program
    Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    E:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [GhostStartTrayApp] E:\Program Files\Norton
    SystemWorks\Norton Ghost\GhostStartTrayApp.exe
    O4 - HKLM\..\Run: [EM_EXEC] E:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    O4 - HKLM\..\Run: [CreativeMouse ] E:\Program Files\Creative\Desktop
    Wireless\mouse_2k.exe
    O4 - HKLM\..\Run: [CreativeKeyboard ] E:\Program Files\Creative\Desktop
    Wireless\kb_2k.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\j2re1.4.2_05
    \bin\jusched.exe
    O4 - HKLM\..\Run: [PrinTray] E:\WINDOWS\System32\spool\DRIVERS\W32X86\3
    \printray.exe
    O4 - HKLM\..\Run: [PDF Converter Registry Controller] "E:\Program
    Files\ScanSoft\PDF Converter 2.0\\RegistryController.exe"
    O4 - HKLM\..\Run: [PDFCreateReminder] "E:\Program Files\ScanSoft\PDF Create! 2
    \EREG\Ereg.exe" -r "E:\Program Files\ScanSoft\PDF Create! 2\EREG\ereg.ini"
    O4 - HKLM\..\Run: [gcasServ] "E:\Program Files\Microsoft
    AntiSpyware\gcasServ.exe"
    O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
    res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open PDF in Word (PDF Converter 2.0) -
    res://E:\Program Files\ScanSoft\PDF Converter 2.0\IEShellExt.dll /100
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
    E:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
    00401C608501} - E:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
    E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
    www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
    a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -
    www3.ca.com/securityadvisor/virusinfo/webscan.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer
    Class) - www.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
    skaner.mks.com.pl/SkanerOnline.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{20618F8E-E027-4E7B-9722-
    5B3B550A56F0}: NameServer = 85.255.113.148,85.255.112.25
    O17 - HKLM\System\CCS\Services\Tcpip\..\{36BA4733-3914-479F-AC38-
    8142851554CB}: NameServer = 85.255.113.148,85.255.112.25
    O17 - HKLM\System\CS1\Services\Tcpip\..\{20618F8E-E027-4E7B-9722-
    5B3B550A56F0}: NameServer = 85.255.113.148,85.255.112.25

    L2MFIX find log 1.04a
    These are the registry keys present
    ******************************************************************************
    ****
    Winlogon/notify:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
    6c,00,00,00
    "Logoff"="ChainWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Logoff"="CryptnetWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName"="cscdll.dll"
    "Logon"="WinlogonLogonEvent"
    "Logoff"="WinlogonLogoffEvent"
    "ScreenSaver"="WinlogonScreenSaverEvent"
    "Startup"="WinlogonStartupEvent"
    "Shutdown"="WinlogonShutdownEvent"
    "StartShell"="WinlogonStartShellEvent"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    "DLLName"="wlnotify.dll"
    "Logon"="SCardStartCertProp"
    "Logoff"="SCardStopCertProp"
    "Lock"="SCardSuspendCertProp"
    "Unlock"="SCardResumeCertProp"
    "Enabled"=dword:00000001
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    NT\CurrentVersion\Winlogon\Notify\Schedule]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "StartShell"="SchedStartShell"
    "Logoff"="SchedEventLogOff"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    "Logoff"="WLEventLogoff"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001
    "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    NT\CurrentVersion\Winlogon\Notify\SensLogn]
    "DLLName"="WlNotify.dll"
    "Lock"="SensLockEvent"
    "Logon"="SensLogonEvent"
    "Logoff"="SensLogoffEvent"
    "Safe"=dword:00000001
    "MaxWait"=dword:00000258
    "StartScreenSaver"="SensStartScreenSaverEvent"
    "StopScreenSaver"="SensStopScreenSaverEvent"
    "Startup"="SensStartupEvent"
    "Shutdown"="SensShutdownEvent"
    "StartShell"="SensStartShellEvent"
    "Po
    Obserwuj wątek
      • browanx Re: Sprawdzenie logów 02.11.05, 08:57
        Jerzy wklej nowego loga z HijackThis 1.99.1 bo tamten to stara wersja.
        • Gość: Jerzy Re: Sprawdzenie logów IP: *.wroclaw.dialog.net.pl 02.11.05, 20:53
          wklejam loga
          Logfile of HijackThis v1.99.1
          Scan saved at 20:52:27, on 2005-11-02
          Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

          Running processes:
          E:\WINDOWS\System32\smss.exe
          E:\WINDOWS\system32\winlogon.exe
          E:\WINDOWS\system32\services.exe
          E:\WINDOWS\system32\lsass.exe
          E:\WINDOWS\system32\svchost.exe
          E:\WINDOWS\System32\svchost.exe
          E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
          E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
          E:\WINDOWS\system32\LEXBCES.EXE
          E:\WINDOWS\system32\spoolsv.exe
          E:\WINDOWS\system32\LEXPPS.EXE
          E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          E:\Program Files\Alwil Software\Avast4\ashServ.exe
          E:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
          E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
          E:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
          E:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
          E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          E:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
          E:\Program Files\Creative\Desktop Wireless\mouse_2k.exe
          E:\WINDOWS\System32\wuauclt.exe
          E:\Program Files\Creative\Desktop Wireless\kb_2k.exe
          E:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
          E:\Program Files\Microsoft AntiSpyware\gcasServ.exe
          E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          E:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
          E:\WINDOWS\explorer.exe
          E:\PROGRA~1\MOBILE~1\bin\SCfgSrv.exe
          E:\PROGRA~1\MOBILE~1\bin\PHONES~3.EXE
          E:\Program Files\Internet Explorer\iexplore.exe
          E:\Program Files\Internet Explorer\iexplore.exe
          E:\Documents and Settings\dom\Pulpit\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
          www.google.pl/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
          E:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program
          Files\Spybot - Search & Destroy\SDHelper.dll
          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
          E:\WINDOWS\System32\msdxm.ocx
          O4 - HKLM\..\Run: [GhostStartTrayApp] E:\Program Files\Norton
          SystemWorks\Norton Ghost\GhostStartTrayApp.exe
          O4 - HKLM\..\Run: [EM_EXEC] E:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
          O4 - HKLM\..\Run: [CreativeMouse ] E:\Program Files\Creative\Desktop
          Wireless\mouse_2k.exe
          O4 - HKLM\..\Run: [CreativeKeyboard ] E:\Program Files\Creative\Desktop
          Wireless\kb_2k.exe
          O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\j2re1.4.2_05
          \bin\jusched.exe
          O4 - HKLM\..\Run: [PrinTray] E:\WINDOWS\System32\spool\DRIVERS\W32X86\3
          \printray.exe
          O4 - HKLM\..\Run: [PDF Converter Registry Controller] "E:\Program
          Files\ScanSoft\PDF Converter 2.0\\RegistryController.exe"
          O4 - HKLM\..\Run: [PDFCreateReminder] "E:\Program Files\ScanSoft\PDF Create! 2
          \EREG\Ereg.exe" -r "E:\Program Files\ScanSoft\PDF Create! 2\EREG\ereg.ini"
          O4 - HKLM\..\Run: [gcasServ] "E:\Program Files\Microsoft
          AntiSpyware\gcasServ.exe"
          O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
          res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
          O8 - Extra context menu item: Open PDF in Word (PDF Converter 2.0) -
          res://E:\Program Files\ScanSoft\PDF Converter 2.0\IEShellExt.dll /100
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
          E:\WINDOWS\System32\msjava.dll
          O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
          00401C608501} - E:\WINDOWS\System32\msjava.dll
          O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
          E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
          O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
          www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
          a840.g.akamai.net/7/840/537/2005102501/housecall.trendmicro.com/housecall/xscan53.cab
          O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -
          www3.ca.com/securityadvisor/virusinfo/webscan.cab
          O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
          www.pandasoftware.com/activescan/as5free/asinst.cab
          O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
          skaner.mks.com.pl/SkanerOnline.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{20618F8E-E027-4E7B-9722-5B3B550A56F0}:
          NameServer = 85.255.113.148,85.255.112.25
          O17 - HKLM\System\CCS\Services\Tcpip\..\{36BA4733-3914-479F-AC38-8142851554CB}:
          NameServer = 85.255.113.148,85.255.112.25
          O17 - HKLM\System\CS1\Services\Tcpip\..\{20618F8E-E027-4E7B-9722-5B3B550A56F0}:
          NameServer = 85.255.113.148,85.255.112.25
          O20 - Winlogon Notify: st3i - E:\WINDOWS\
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
          E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil
          Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil
          Software\Avast4\ashMaiSv.exe" /service (file missing)
          O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil
          Software\Avast4\ashWebSv.exe" /service (file missing)
          O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
          E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
          O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation -
          E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
          O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
          E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
          O23 - Service: GhostStartService - Symantec Corporation - E:\PROGRA~1\NORTON~1
          \NORTON~4\GHOSTS~2.EXE
          O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
          E:\WINDOWS\system32\LEXBCES.EXE
          O23 - Service: Norton Unerase Protection (NProtectService) - Symantec
          Corporation - E:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
          O23 - Service: Speed Disk service - Symantec Corporation - E:\PROGRA~1\NORTON~1
          \NORTON~2\SPEEDD~1\NOPDB.EXE

          • browanx Re: Sprawdzenie logów 02.11.05, 21:22
            A SP2 gdzie:)
            Log moim skromnym zdaniem OK.
          • Gość: Kolobos Re: Sprawdzenie logów IP: *.warszawa.sdi.tpnet.pl 02.11.05, 21:24
            Usun:
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
            O20 - Winlogon Notify: st3i - E:\WINDOWS\

            Czemu masz takie dziwne dnsy?
            • Gość: jerzy Re: Sprawdzenie logów IP: *.wroclaw.dialog.net.pl 02.11.05, 21:48
              usunnąłem, moze bedzie dobrze
              Logfile of HijackThis v1.99.1
              Scan saved at 21:47:45, on 2005-11-02
              Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

              Running processes:
              E:\WINDOWS\System32\smss.exe
              E:\WINDOWS\system32\winlogon.exe
              E:\WINDOWS\system32\services.exe
              E:\WINDOWS\system32\lsass.exe
              E:\WINDOWS\system32\svchost.exe
              E:\WINDOWS\System32\svchost.exe
              E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
              E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
              E:\WINDOWS\system32\LEXBCES.EXE
              E:\WINDOWS\system32\spoolsv.exe
              E:\WINDOWS\system32\LEXPPS.EXE
              E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              E:\Program Files\Alwil Software\Avast4\ashServ.exe
              E:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
              E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
              E:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
              E:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
              E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              E:\WINDOWS\Explorer.EXE
              E:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
              E:\Program Files\Creative\Desktop Wireless\mouse_2k.exe
              E:\Program Files\Creative\Desktop Wireless\kb_2k.exe
              E:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
              E:\Program Files\Microsoft AntiSpyware\gcasServ.exe
              E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              E:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
              E:\Program Files\Internet Explorer\iexplore.exe
              E:\WINDOWS\System32\wuauclt.exe
              E:\Documents and Settings\dom\Pulpit\HijackThis.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
              www.google.pl/
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
              E:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
              O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program
              Files\Spybot - Search & Destroy\SDHelper.dll
              O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
              E:\WINDOWS\System32\msdxm.ocx
              O4 - HKLM\..\Run: [GhostStartTrayApp] E:\Program Files\Norton
              SystemWorks\Norton Ghost\GhostStartTrayApp.exe
              O4 - HKLM\..\Run: [EM_EXEC] E:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
              O4 - HKLM\..\Run: [CreativeMouse ] E:\Program Files\Creative\Desktop
              Wireless\mouse_2k.exe
              O4 - HKLM\..\Run: [CreativeKeyboard ] E:\Program Files\Creative\Desktop
              Wireless\kb_2k.exe
              O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\j2re1.4.2_05
              \bin\jusched.exe
              O4 - HKLM\..\Run: [PrinTray] E:\WINDOWS\System32\spool\DRIVERS\W32X86\3
              \printray.exe
              O4 - HKLM\..\Run: [PDF Converter Registry Controller] "E:\Program
              Files\ScanSoft\PDF Converter 2.0\\RegistryController.exe"
              O4 - HKLM\..\Run: [PDFCreateReminder] "E:\Program Files\ScanSoft\PDF Create! 2
              \EREG\Ereg.exe" -r "E:\Program Files\ScanSoft\PDF Create! 2\EREG\ereg.ini"
              O4 - HKLM\..\Run: [gcasServ] "E:\Program Files\Microsoft
              AntiSpyware\gcasServ.exe"
              O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
              res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
              O8 - Extra context menu item: Open PDF in Word (PDF Converter 2.0) -
              res://E:\Program Files\ScanSoft\PDF Converter 2.0\IEShellExt.dll /100
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
              E:\WINDOWS\System32\msjava.dll
              O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
              00401C608501} - E:\WINDOWS\System32\msjava.dll
              O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
              E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
              O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
              www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
              O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
              a840.g.akamai.net/7/840/537/2005102501/housecall.trendmicro.com/housecall/xscan53.cab
              O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -
              www3.ca.com/securityadvisor/virusinfo/webscan.cab
              O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
              www.pandasoftware.com/activescan/as5free/asinst.cab
              O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
              skaner.mks.com.pl/SkanerOnline.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{20618F8E-E027-4E7B-9722-5B3B550A56F0}:
              NameServer = 85.255.113.148,85.255.112.25
              O17 - HKLM\System\CCS\Services\Tcpip\..\{36BA4733-3914-479F-AC38-8142851554CB}:
              NameServer = 85.255.113.148,85.255.112.25
              O17 - HKLM\System\CS1\Services\Tcpip\..\{20618F8E-E027-4E7B-9722-5B3B550A56F0}:
              NameServer = 85.255.113.148,85.255.112.25
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
              E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil
              Software\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil
              Software\Avast4\ashMaiSv.exe" /service (file missing)
              O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil
              Software\Avast4\ashWebSv.exe" /service (file missing)
              O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
              E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
              O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation -
              E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
              O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
              E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
              O23 - Service: GhostStartService - Symantec Corporation - E:\PROGRA~1\NORTON~1
              \NORTON~4\GHOSTS~2.EXE
              O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
              E:\WINDOWS\system32\LEXBCES.EXE
              O23 - Service: Norton Unerase Protection (NProtectService) - Symantec
              Corporation - E:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
              O23 - Service: Speed Disk service - Symantec Corporation - E:\PROGRA~1\NORTON~1
              \NORTON~2\SPEEDD~1\NOPDB.EXE

          • browanx Re: Sprawdzenie logów 02.11.05, 21:34
            Dla jasności DNS to 017 w logu.
            • Gość: jerzy Re: Sprawdzenie logów IP: *.wroclaw.dialog.net.pl 02.11.05, 21:49
              pozdrawiam i dziękuję, Jerzy
              • Gość: tata1959 Re: Sprawdzenie logów IP: *.neoplus.adsl.tpnet.pl 02.11.05, 21:55
                witam
                tak... 85.255.113.148,85.255.112.25 to Ukraińskie DNS.
                zastosować usuwanie Rootkit "Windows Security Center"
                www.searchengines.pl/phpbb203/index.php?showtopic=47691
                pozdrawiam

                .
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.