Dodaj do ulubionych

prosze sprawdzenie loga

IP: *.internetdsl.tpnet.pl 14.12.05, 21:34
Logfile of HijackThis v1.99.1
Scan saved at 21:33:59, on 2005-12-14
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\System32\ctfmon.exe
E:\Kalendarz XP\Kalendarz.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
E:\wszystko\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.netpede.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
www.netpede.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital
Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP
Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program
Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Userinit] C:\Program Files\Common Files\system\lsass.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: Eurobarre.lnk = ?
O4 - Global Startup: Kalendarz XP.lnk = E:\Kalendarz XP\Kalendarz.exe
O4 - Global Startup: KVG.exe
O8 - Extra context menu item: &Google Search - res://c:\program
files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program
files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program
files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program
files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program
files\google\GoogleToolbar2.dll/cmtrans.html
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
software-dl.real.com/067613f421309a35f721/netzip/RdxIE601.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
Software\Avast4\ashServ.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32
\drivers\CDAC11BA.EXE

Obserwuj wątek
    • Gość: k Re: prosze sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 14.12.05, 21:57
      Usun w hijackthis:
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
      www.netpede.com/
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      www.netpede.com/
      O4 - HKLM\..\Run: [Userinit] C:\Program Files\Common Files\system\lsass.exe <-
      usun plik
      O4 - Global Startup: KVG.exe <- usun plik

      Sprawdz plik C:\WINDOWS\System32\userinit.exe tym skanerem:
      virusscan.jotti.org/ i napisz czy cos znalazl, ale pliku narazie nie
      ruszaj.
      • Gość: agnes Re: prosze sprawdzenie loga IP: *.internetdsl.tpnet.pl 15.12.05, 22:02
        AntiVir Found Backdoor-Server/Agent.QA.3 backdoor
        ArcaVir Found Trojan.Agent.Qa
        Avast Found nothing
        AVG Antivirus Found BackDoor.Agent.SB
        BitDefender Found Backdoor.Agent.QA
        ClamAV Found nothing
        Dr.Web Found nothing
        F-Prot Antivirus Found nothing
        Fortinet Found W32/Agent.QA!bdr
        Kaspersky Anti-Virus Found Backdoor.Win32.Agent.qa
        NOD32 Found Win32/Spy.Agent.HS
        Norman Virus Control Found nothing
        UNA Found nothing
        VBA32 Found Backdoor.Win32.Agent.qa

        • Gość: k Re: prosze sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 15.12.05, 22:24
          Tu masz opis konsoli odzyskiwania:
          www.searchengines.pl/phpbb203/index.php?showtopic=14270
          Wypakowujesz plik userinit.ex_ zamiast tego zainfekowanego poleceniem expand
          opis masz na stronie.

Nie masz jeszcze konta? Zarejestruj się


Nakarm Pajacyka