proszę o sprawdzenie loga - trojany

IP: *.neoplus.adsl.tpnet.pl 02.01.06, 17:35
miałam trojany nie wiem czy wszystkie usunęłam proszę o sprawdzenie logów i wskazówki z góry dziękuję
nie moge otworzyć msconfig ani command


Logfile of HijackThis v1.99.1
Scan saved at 17:30:17, on 2006-01-02
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\autoclk.exe
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
C:\WINDOWS\System32\msappview32.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\mswindtc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\DSLMON.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\user1\Pulpit\hijackthis.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada Plus wita Cie w Internecie
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
O4 - HKLM\..\Run: [Microsoft Application Viewer] msappview32.exe
O4 - HKLM\..\Run: [BIOS Net Service] BIOSserv.exe
O4 - HKLM\..\Run: [Popup Blocker System9 Monitoring] PopUpBlocker9.exe
O4 - HKLM\..\Run: [MSN Messenger] msnmisgr.exe
O4 - HKLM\..\Run: [timessquare] C:\windows\timessquare.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\wprkaw.exe reg_run
O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006a.exe
O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [win msdt service] mswindtc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [Microsoft Application Viewer] msappview32.exe
O4 - HKLM\..\RunServices: [BIOS Net Service] BIOSserv.exe
O4 - HKLM\..\RunServices: [Popup Blocker System9 Monitoring] PopUpBlocker9.exe
O4 - HKLM\..\RunServices: [MSN Messenger] msnmisgr.exe
O4 - HKLM\..\RunServices: [win msdt service] mswindtc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Popup Blocker System9 Monitoring] PopUpBlocker9.exe
O4 - HKCU\..\Run: [MSN Messenger] msnmisgr.exe
O4 - HKCU\..\Run: [BIOS Net Service] BIOSserv.exe
O4 - HKCU\..\Run: [win msdt service] mswindtc.exe
O4 - HKCU\..\RunServices: [win msdt service] mswindtc.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\DSLMON.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB2EA51E-1124-4777-AF1E-0B18143F5B8D}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Enables Java Support (Java) - Unknown owner - C:\WINDOWS\system32\OfficeGUI1.exe (file missing)

    • Gość: k Re: proszę o sprawdzenie loga - trojany IP: *.warszawa.sdi.tpnet.pl 02.01.06, 17:41
      Mialas i masz dalej, masz tez piracki windows...

      Skan tym:
      www.webroot.com/shoppingcart/tryme.php?bjpc=64011&vcode=DT02&WRSID=fa418c3f36c473de8c7d2176ac7ada66 <- zrob update przed skanowaniem, po przeskanowaniu odinstaluj.
      download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po przeskanowaniu odinstaluj.
      Zamknij porty w wwdc:
      www.firewallleaktester.com/tools/wwdc.exe
      W hijackthis usun:

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = searchbar.findthewebsiteyouneed.com
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = searchbar.findthewebsiteyouneed.com
      O4 - HKLM\..\Run: [Microsoft Application Viewer] msappview32.exe
      O4 - HKLM\..\Run: [BIOS Net Service] BIOSserv.exe
      O4 - HKLM\..\Run: [Popup Blocker System9 Monitoring] PopUpBlocker9.exe
      O4 - HKLM\..\Run: [MSN Messenger] msnmisgr.exe
      O4 - HKLM\..\Run: [timessquare] C:\windows\timessquare.exe <- usun plik
      O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\wprkaw.exe reg_run
      O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006a.exe <- usun plik
      O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe <- usun plik
      O4 - HKLM\..\Run: [win msdt service] mswindtc.exe <- usun plik
      O4 - HKLM\..\RunServices: [Microsoft Application Viewer] msappview32.exe <- usun plik
      O4 - HKLM\..\RunServices: [BIOS Net Service] BIOSserv.exe
      O4 - HKLM\..\RunServices: [Popup Blocker System9 Monitoring] PopUpBlocker9.exe
      O4 - HKLM\..\RunServices: [MSN Messenger] msnmisgr.exe <- usun plik
      O4 - HKLM\..\RunServices: [win msdt service] mswindtc.exe
      O4 - HKCU\..\Run: [Popup Blocker System9 Monitoring] PopUpBlocker9.exe <- usun plik
      O4 - HKCU\..\Run: [MSN Messenger] msnmisgr.exe <- usun plik
      O4 - HKCU\..\Run: [BIOS Net Service] BIOSserv.exe <- usun plik
      O4 - HKCU\..\Run: [win msdt service] mswindtc.exe
      O4 - HKCU\..\RunServices: [win msdt service] mswindtc.exe <- usun plik
      O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
      O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
      O23 - Service: Enables Java Support (Java) - Unknown owner - C:\WINDOWS\system32\OfficeGUI1.exe (file missing) <- Start->Uruchom->cmd->sc stop Java oraz sc delete Java

      Po wszystkim wklej nowy log.
    • Gość: ela Re: proszę o sprawdzenie loga - trojany IP: *.neoplus.adsl.tpnet.pl 02.01.06, 17:46
      dzięki za szybką odpowiedź
    • Gość: ela Re: proszę o sprawdzenie loga - trojany IP: *.neoplus.adsl.tpnet.pl 02.01.06, 19:40
      wydaj mi sie że już jest ok ale prosze o sprawdzenie jeszcze

      Logfile of HijackThis v1.99.1
      Scan saved at 19:40:04, on 2006-01-02
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\System32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Ahead\InCD\InCDsrv.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
      C:\WINDOWS\autoclk.exe
      C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
      C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
      C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
      C:\Program Files\Ahead\InCD\InCD.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\SAGEM\SAGEM F@st 800-840\DSLMON.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Wanadoo\EspaceWanadoo.exe
      C:\Program Files\Wanadoo\ComComp.exe
      C:\Program Files\Wanadoo\Watch.exe
      C:\Program Files\Opera\Opera.exe
      C:\WINDOWS\system32\mswindtc.exe
      C:\Documents and Settings\user1\Pulpit\hijackthis.com

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada Plus wita Cie w Internecie
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [autoclk] autoclk.exe
      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
      O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
      O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
      O4 - HKLM\..\Run: [win msdt service] mswindtc.exe
      O4 - HKLM\..\RunServices: [win msdt service] mswindtc.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\DSLMON.exe
      O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
      O17 - HKLM\System\CCS\Services\Tcpip\..\{AB2EA51E-1124-4777-AF1E-0B18143F5B8D}: NameServer = 194.204.152.34 217.98.63.164
      O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
      O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
      O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
      O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
      • Gość: k Re: proszę o sprawdzenie loga - trojany IP: *.warszawa.sdi.tpnet.pl 02.01.06, 22:03
        Nie jest.Odinstaluj Spy Sweeper, wywal aplikacje od neostrady:
        forum.gazeta.pl/forum/72,2.html?f=34&w=15679891&a=15680440
        Zakoncz w menadzerze zadan:
        C:\WINDOWS\system32\mswindtc.exe
        plik usun

        W hijackthis usun:
        O4 - HKLM\..\Run: [win msdt service] mswindtc.exe
        O4 - HKLM\..\RunServices: [win msdt service] mswindtc.exe
Pełna wersja