Sprawdzenie loga z Hijack This

IP: *.neoplus.adsl.tpnet.pl 27.11.05, 19:37
Logfile of HijackThis v1.99.1
Scan saved at 19:30:44, on 2005-11-27
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\inet20096\winlogon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\inet20096\skiller.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\inet20096\mm.exe
C:\Documents and Settings\Mary\Pulpit\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F3 - REG:win.ini: run=C:\WINDOWS\inet20096\winlogon.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} -
C:\WINDOWS\inet20096\3.00.11.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20096\winlogon.exe
O4 - HKLM\..\Run: [MSP] C:\WINDOWS\inet20096\skiller.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Microsoft standard protector] C:\WINDOWS\inet20096
\socks.exe 20096
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20096\winlogon.exe
O9 - Extra button: Wyslij SMS'a - {215940F1-E7E0-4801-BEE3-44D045534106} -
C:\Program Files\Common Files\moje.js
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1
\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe

    • Gość: k Re: Sprawdzenie loga z Hijack This IP: *.warszawa.sdi.tpnet.pl 27.11.05, 19:43
      heh, az tyle naiwnych osob zlapalo sie na link na gg.

      Zakoncz proces:
      C:\WINDOWS\inet20096\winlogon.exe
      C:\WINDOWS\inet20096\skiller.exe
      C:\WINDOWS\inet20096\mm.exe

      w hijackthis:

      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
      F3 - REG:win.ini: run=C:\WINDOWS\inet20096\winlogon.exe
      O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} -
      C:\WINDOWS\inet20096\3.00.11.dll
      O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20096\winlogon.exe
      O4 - HKLM\..\Run: [MSP] C:\WINDOWS\inet20096\skiller.exe
      O4 - HKLM\..\Run: [Microsoft standard protector] C:\WINDOWS\inet20096
      \socks.exe 20096 <- wywal caly katalog inet...
      O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20096\winlogon.exe
      O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
      C:\WINDOWS\web\related.htm
      O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
      00aa003c157a} - C:\WINDOWS\web\related.htm
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1
      \MSNMES~1\msgrapp.dll" (file missing)

      I skan ewido.
      • Gość: Mary Re: Sprawdzenie loga z Hijack This IP: *.neoplus.adsl.tpnet.pl 27.11.05, 20:47
        Logfile of HijackThis v1.99.1
        Scan saved at 20:45:51, on 2005-11-27
        Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\system32\spoolsv.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\WINDOWS\System32\RUNDLL32.EXE
        C:\Program Files\Tlen.pl\tlen.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        C:\Program Files\Skype\Phone\Skype.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\WINDOWS\System32\wuauclt.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Documents and Settings\Mary\Pulpit\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.google.pl/
        F3 - REG:win.ini: run=C:\WINDOWS\inet20096\winlogon.exe
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
        C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
        C:\WINDOWS\System32\msdxm.ocx
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
        \NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
        \NvMcTray.dll,NvTaskbarInit
        O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
        O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
        Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [Skype] "C:\Program
        Files\Skype\Phone\Skype.exe" /nosplash /minimized
        O9 - Extra button: Wyslij SMS'a - {215940F1-E7E0-4801-BEE3-44D045534106} -
        C:\Program Files\Common Files\moje.js
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
        (MsnMessengerSetupDownloadControl Class) -
        messenger.msn.com/download/MsnMessengerSetupDownloader.cab
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
        Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
        Software\Avast4\ashMaiSv.exe" /service (file missing)
        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
        Software\Avast4\ashWebSv.exe" /service (file missing)
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
        C:\WINDOWS\System32\nvsvc32.exe

        • Gość: k Re: Sprawdzenie loga z Hijack This IP: *.warszawa.sdi.tpnet.pl 27.11.05, 20:57
          Jeszcze to:
          F3 - REG:win.ini: run=C:\WINDOWS\inet20096\winlogon.exe
          • Gość: mary Re: Sprawdzenie loga z Hijack This IP: *.neoplus.adsl.tpnet.pl 28.11.05, 19:07
            Cos mi chyba nie wychdozi vbo z tego co widze nadal to co usunelam jest,
            zrobilam ten skan ejszcze raz, oto log:

            Logfile of HijackThis v1.99.1
            Scan saved at 19:06:18, on 2005-11-28
            Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\Explorer.EXE
            C:\WINDOWS\system32\spoolsv.exe
            C:\WINDOWS\inet20096\winlogon.exe
            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            C:\WINDOWS\System32\RUNDLL32.EXE
            C:\Program Files\Tlen.pl\tlen.exe
            C:\Program Files\Messenger\msmsgs.exe
            C:\Program Files\MSN Messenger\MsnMsgr.Exe
            C:\Program Files\Skype\Phone\Skype.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\WINDOWS\System32\nvsvc32.exe
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\WINDOWS\System32\wuauclt.exe
            C:\Program Files\Winamp\winamp.exe
            C:\Program Files\Internet Explorer\IEXPLORE.EXE
            C:\Program Files\Internet Explorer\IEXPLORE.EXE
            C:\Documents and Settings\Mary\Pulpit\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
            www.google.pl/
            F3 - REG:win.ini: run=C:\WINDOWS\inet20096\winlogon.exe
            O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
            C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
            O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
            O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
            C:\WINDOWS\System32\msdxm.ocx
            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
            \NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
            \NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20096\winlogon.exe
            O4 - HKLM\..\Run: [Microsoft standard protector] C:\WINDOWS\inet20096\socks.exe
            20096
            O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
            O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
            O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
            Messenger\MsnMsgr.Exe" /background
            O4 - HKCU\..\Run: [Skype] "C:\Program
            Files\Skype\Phone\Skype.exe" /nosplash /minimized
            O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20096\winlogon.exe
            O9 - Extra button: Wyslij SMS'a - {215940F1-E7E0-4801-BEE3-44D045534106} -
            C:\Program Files\Common Files\moje.js
            O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
            (MsnMessengerSetupDownloadControl Class) -
            messenger.msn.com/download/MsnMessengerSetupDownloader.cab
            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
            Software\Avast4\ashServ.exe
            O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
            Software\Avast4\ashMaiSv.exe" /service (file missing)
            O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
            Software\Avast4\ashWebSv.exe" /service (file missing)
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
            C:\WINDOWS\System32\nvsvc32.exe



            przepraszam ze tak zawracam glowe! moze wkoncu mi sie uda. aha nie moge
            zakonczyc procesu winlogon
            • Gość: k Re: Sprawdzenie loga z Hijack This IP: *.warszawa.sdi.tpnet.pl 28.11.05, 19:31
              Moge Ci to pisac i 100x...

              Zakoncz proces:
              C:\WINDOWS\inet20096\winlogon.exe
              Usun z dysku katalog inet20096 i w hijackthis:
              F3 - REG:win.ini: run=C:\WINDOWS\inet20096\winlogon.exe
              O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
              O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20096\winlogon.exe
              O4 - HKLM\..\Run: [Microsoft standard protector] C:\WINDOWS\inet20096\socks.exe
              20096
              O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20096\winlogon.exe
              • Gość: Mary Re: Sprawdzenie loga z Hijack This IP: *.neoplus.adsl.tpnet.pl 28.11.05, 20:59
                Juz wiem! wielkie dzieki! wszystko sie udalo! tylko mialam problemy zbey
                wywalic ten plik, i wywalalo mnie wtedy. a jak wyalilam plik atop pojawial sie
                od nowa tylko 2 x. takie to skomplikowane ale juz ejst ok. bardzo dziekuje za
                pomoc!
    • Gość: PoCiM Re: Sprawdzenie loga z Hijack This IP: 217.97.144.* 22.12.05, 11:51
      ej siemka tez mam tego virusa pomozecie mi go usunac
      • Gość: k Re: Sprawdzenie loga z Hijack This IP: *.icm.edu.pl / *.icm.edu.pl 22.12.05, 11:56
        Przeciez wszystko masz napisane.Zrob to samo, a po wszystkim wklej log do
        sprawdzenia.
Pełna wersja