Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    proszę o sprawdzenie loga

    IP: *.neoplus.adsl.tpnet.pl 02.11.05, 17:34
    Logfile of HijackThis v1.99.1
    Scan saved at 17:33:21, on 2005-11-02
    Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\PavProt.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Pinnacle\MediaServer\Microsoft SQL
    Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\oodag.exe
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\PaSSrv.exe
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\Firewall\PavFires.exe
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\PavFnSvr.exe
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\Pavkre.exe
    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\pavsrv51.exe
    c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\AVENGINE.EXE
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\prevsrv.exe
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\PsImSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\PowerS.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
    C:\Program Files\DU Meter\DUMeter.exe
    C:\Program Files\SpyStopper\spystopper.exe
    C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    E:\Do noki\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\APVXDWIN.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\SRVLOAD.EXE
    C:\Program Files\Panda Software\Panda Platinum 2005 Internet
    Security\WebProxy.exe
    C:\Program Files\AutoConnect\AutoConnect.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    E:\AAAKopia\eMule\emule.exe
    C:\totalcmd\TOTALCMD.EXE
    C:\a\hijackthis.com

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
    www.quicksearch360.com/sp2.php
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
    www.quicksearch360.com/sp2.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.gazeta.pl/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    R3 - URLSearchHook: (no name) - {CFBFAEA6-B9D4-11D0-9C78-00C04FD64497} - (no
    file)
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program
    Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe
    bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02
    \bin\jusched.exe
    O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
    O4 - HKLM\..\Run: [SpyStopper] C:\Program Files\SpyStopper\spystopper.exe
    O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32
    \NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -
    CheckReg
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\kodeki\ACE Mega CoDecS
    Pack\SystemS\RealMedia\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -
    atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common
    Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Do noki\Nokia\Nokia PC Suite 6
    \LaunchApplication.exe -onlytray
    O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio
    Shared\System\EngUtil.exe"
    O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda
    Platinum 2005 Internet Security\Inicio.exe"
    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum
    2005 Internet Security\APVXDWIN.EXE" /s
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [System service79] C:\WINDOWS\\\etb\\pokapoka79.exe
    O4 - HKLM\..\RunServices: [PANDA ANTISPAM SERVER SERVICE] "C:\Program
    Files\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft
    ActiveSync\WCESCOMM.EXE"
    O4 - HKCU\..\Run:
    [Skype] "E:\AAAKopia\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common
    Files\Ahead\Lib\NeroScoutOptions.exe
    O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
    \dslmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
    Office\Office10\OSA.EXE
    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL
    Server\80\Tools\Binn\sqlmangr.exe
    O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
    res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
    C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
    00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-
    00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -
    C:\PROGRA~1\MICROS~4\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-
    9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
    a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) -
    217.113.232.40/activex/AxisCamControl.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B36D1F11-35FA-46DF-8748-
    5F3DB6606E9F}: NameServer = 194.204.152.34 217.98.63.164
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
    C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program
    Files\iPod\bin\iPodService.ex
    Obserwuj wątek
      • Gość: Kolobos Re: proszę o sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 02.11.05, 21:16
        --------------------------------------------------------------------------------
        Logfile of HijackThis v1.99.1
        Scan saved at 17:33:21, on 2005-11-02
        Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\csrss.exe
        C:\WINDOWS\SYSTEM32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\PavProt.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\CTsvcCDA.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
        C:\Program Files\Pinnacle\MediaServer\Microsoft SQL
        Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\WINDOWS\system32\oodag.exe
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\PaSSrv.exe
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\Firewall\PavFires.exe
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\PavFnSvr.exe
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\Pavkre.exe
        C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\pavsrv51.exe
        c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\AVENGINE.EXE
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\prevsrv.exe
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\PsImSvc.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\wdfmgr.exe
        C:\WINDOWS\system32\UAService7.exe
        C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
        C:\WINDOWS\system32\MsPMSPSv.exe
        C:\WINDOWS\PowerS.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
        C:\Program Files\DU Meter\DUMeter.exe
        C:\Program Files\SpyStopper\spystopper.exe
        C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
        E:\Do noki\Nokia\Nokia PC Suite 6\LaunchApplication.exe
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\APVXDWIN.EXE
        C:\Program Files\iPod\bin\iPodService.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
        C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
        C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
        C:\WINDOWS\System32\alg.exe
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\SRVLOAD.EXE
        C:\Program Files\Panda Software\Panda Platinum 2005 Internet
        Security\WebProxy.exe
        C:\Program Files\AutoConnect\AutoConnect.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        E:\AAAKopia\eMule\emule.exe
        C:\totalcmd\TOTALCMD.EXE
        C:\a\hijackthis.com

        R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
        www.quicksearch360.com/sp2.php
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
        www.quicksearch360.com/sp2.php
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
        R3 - URLSearchHook: (no name) - {CFBFAEA6-B9D4-11D0-9C78-00C04FD64497} - (no
        file)
        O4 - HKLM\..\Run: [SpyStopper] C:\Program Files\SpyStopper\spystopper.exe <-
        odinstaluj.
        O4 - HKLM\..\Run: [System service79] C:\WINDOWS\\\etb\\pokapoka79.exe <-
        sciagnij sobie z google elite toolbar remove i uzyj, katalog i plik oczywiscie
        kasujesz.

        Przeskanuj tez komputer tym co zwykle.
        • Gość: laik Re: proszę o sprawdzenie loga IP: *.neoplus.adsl.tpnet.pl 02.11.05, 21:56
          Witam
          Czy mógbys troche jaśniej:)
          Nie moge odszkać tego" C:\WINDOWS\\\etb\\pokapoka79.exe"
          I dlaczego mam odinstalowac spysttopera?
          • Gość: Kolobos Re: proszę o sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 02.11.05, 22:32
            Wlacz pokazywnie plikow ukrytych i chronionych w opcjach folderow.
            I usun katalog etb w katalogu windows o ile oczyiwiscie wczesniej tego nie
            zrobiles.

            SpyStoper to falszywy program anty i dlatego masz go odinstalowac.
            • Gość: laik Re: proszę o sprawdzenie loga IP: *.neoplus.adsl.tpnet.pl 03.11.05, 19:41
              Dzięki
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.