Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    spyware

    IP: *.server.ntli.net 02.04.06, 11:59
    Prosze o rade w sprawie wirusa. probowalem antispywera z microsoftu oraz
    search & destroy. strasznie mi sie muli caly komputer i mam polpita ktorego
    nie moge zmienic. programy anty. wykryly na poczatku pare spywerow a potem
    nic a komp jak sie molil tak dalej sie muli. przesylam tez zrzut z
    hijackthis, bo nie wiem ktore logi mam wyczyscic.
    dzieki z gory.
    Obserwuj wątek
      • Gość: j_1 Re: spyware IP: *.server.ntli.net 02.04.06, 12:01
        jak mozna dodac jpegi do tematu? :) sorki jestem nowy
        • kalinowski11 Re: spyware 02.04.06, 12:08
          Wklej log , a nie jego zdjęcie :)

          www.mgregor.republika.pl/

          Tu jest wszystko opisane .
          • Gość: j_1 Re: spyware IP: *.server.ntli.net 02.04.06, 14:18
            Logfile of HijackThis v1.99.1
            Scan saved at 13:16:25, on 02/04/2005
            Platform: Windows XP SP1 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\System32\Ati2evxx.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\ntl\ntl Netguard\fws.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\WINDOWS\system32\Ati2evxx.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
            C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
            C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
            C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
            C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
            C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
            C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
            C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE
            C:\Program Files\BroadJump\Client Foundation\CFD.exe
            C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
            C:\Program Files\ntl\ntl Netguard\RPS.exe
            C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
            C:\WINDOWS\System32\TPSBattM.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
            C:\WINDOWS\System32\ctfmon.exe
            C:\Program Files\Logitech\Desktop Messenger\8876480
            \Program\LogitechDesktopMessenger.exe
            C:\Program Files\Save\Save.exe
            C:\Program Files\Logitech\SetPoint\SetPoint.exe
            C:\Program Files\Corel\Graphics9\Register\Remind32.exe
            C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
            C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
            C:\Program Files\Common Files\Command Software\dvpapi.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\DOCUME~1\piotr\LOCALS~1\Temp\Rar$EX01.000\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
            www.onet.pl/
            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
            Settings,ProxyOverride = 127.0.0.1
            O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
            C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
            O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} -
            C:\Program Files\ntl\ntl Netguard\pkR.dll
            O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
            Files\Spybot - Search & Destroy\SDHelper.dll
            O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program
            Files\ntl\ntl Netguard\FBHR.dll
            O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
            C:\WINDOWS\System32\msdxm.ocx
            O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
            O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
            O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
            O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
            O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
            O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming
            Utility\SmoothView.exe
            O4 - HKLM\..\Run: [PadTouch] "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
            O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32
            \spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46
            Series" /O5 "LPT1:" /M "Stylus C46"
            O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 1)] C:\WINDOWS\System32
            \spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy
            1)" /O6 "USB001" /M "Stylus C46"
            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
            O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
            O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch
            Jukebox\mm_tray.exe"
            O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch
            Jukebox\mmtask.exe"
            O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
            O4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32
            \spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800
            Series" /O6 "USB002" /M "Stylus DX4800"
            O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
            O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1
            \MotiveSB.exe
            O4 - HKLM\..\Run: [ntl Netguard] "C:\Program Files\ntl\ntl Netguard\RPS.exe"
            O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
            O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe
            irprops.cpl,,BluetoothAuthenticationAgent
            O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft
            AntiSpyware\gcasServ.exe"
            O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
            O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480
            \Program\LogitechDesktopMessenger.exe
            O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
            O4 - Startup: Rejestrowanie produktów Corela.lnk = C:\Program
            Files\Corel\Graphics9\Register\Remind32.exe
            O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband
            medic\bin\matcli.exe
            O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
            O4 - Global Startup: Logitech SetPoint.lnk = C:\Program
            Files\Logitech\SetPoint\SetPoint.exe
            O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
            res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
            C:\WINDOWS\System32\msjava.dll
            O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
            00401C608501} - C:\WINDOWS\System32\msjava.dll
            O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
            Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
            O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) -
            download.ewido.net/ewidoOnlineScan.cab
            O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
            update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143846865562
            O18 - Protocol: bw+0 - {9836C47B-162E-44A8-81AA-3091F09AA387} - C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw+0s - {9836C47B-162E-44A8-81AA-3091F09AA387} - C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw-0 - {9836C47B-162E-44A8-81AA-3091F09AA387} - C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw-0s - {9836C47B-162E-44A8-81AA-3091F09AA387} - C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw00 - {9836C47B-162E-44A8-81AA-3091F09AA387} - C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw00s - {9836C47B-162E-44A8-81AA-3091F09AA387} - C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw10 - {9836C47B-162E-44A8-81AA-3091F09AA387} - C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw10s - {9836C47B-162E-44A8-81AA-3091F09AA387} - C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw20 - {9836C47B-162E-44A8-81AA-3091F09AA387} - C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw20s - {9836C47B-162E-44A8-81AA-3091F09AA387} - C:\Program
            Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
            O18 - Protocol: bw30 - {9836C47B-162E-44A8-81AA-
            • kolobos Re: spyware 02.04.06, 15:07
              Odinstaluj: Logitech Desktop Messenger
              Na forum searchengines odszukaj swoja tapete i usun tak jak masz to opisane.

              W menadzerze zadan zakoncz:
              C:\Program Files\Save\Save.exe <- katalog save usun.

              W hijackthis:
              O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"

              Usun wszystkie wpisy O18.

              Po wszystkim wklej nowy log.
              • Gość: j_1 Re: spyware IP: *.server.ntli.net 02.04.06, 22:35
                ponizej daje loga po tym wszystkim
                ale tapeta nie pasuje do zadnej z tych na searchengine1?


                Logfile of HijackThis v1.99.1
                Scan saved at 21:32:17, on 02/04/2005
                Platform: Windows XP SP1 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\System32\Ati2evxx.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\ntl\ntl Netguard\fws.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\WINDOWS\system32\Ati2evxx.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
                C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
                C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
                C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
                C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE
                C:\Program Files\BroadJump\Client Foundation\CFD.exe
                C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
                C:\Program Files\ntl\ntl Netguard\RPS.exe
                C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                C:\WINDOWS\System32\TPSBattM.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
                C:\WINDOWS\System32\ctfmon.exe
                C:\Program Files\Corel\Graphics9\Register\Remind32.exe
                C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
                C:\Program Files\Common Files\Command Software\dvpapi.exe
                C:\Program Files\Gadu-Gadu\gg.exe
                C:\WINDOWS\System32\WISPTIS.EXE
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Program Files\WinRAR\WinRAR.exe
                C:\DOCUME~1\piotr\LOCALS~1\Temp\Rar$EX00.485\HijackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
                www.onet.pl/
                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
                Settings,ProxyOverride = 127.0.0.1
                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
                C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
                O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} -
                C:\Program Files\ntl\ntl Netguard\pkR.dll
                O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
                Files\Spybot - Search & Destroy\SDHelper.dll
                O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program
                Files\ntl\ntl Netguard\FBHR.dll
                O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
                C:\WINDOWS\System32\msdxm.ocx
                O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
                O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
                O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming
                Utility\SmoothView.exe
                O4 - HKLM\..\Run: [PadTouch] "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
                O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32
                \spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46
                Series" /O5 "LPT1:" /M "Stylus C46"
                O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 1)] C:\WINDOWS\System32
                \spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy
                1)" /O6 "USB001" /M "Stylus C46"
                O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
                O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch
                Jukebox\mm_tray.exe"
                O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch
                Jukebox\mmtask.exe"
                O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
                O4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32
                \spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800
                Series" /O6 "USB002" /M "Stylus DX4800"
                O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1
                \MotiveSB.exe
                O4 - HKLM\..\Run: [ntl Netguard] "C:\Program Files\ntl\ntl Netguard\RPS.exe"
                O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
                O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe
                irprops.cpl,,BluetoothAuthenticationAgent
                O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft
                AntiSpyware\gcasServ.exe"
                O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
                O4 - Startup: Rejestrowanie produktów Corela.lnk = C:\Program
                Files\Corel\Graphics9\Register\Remind32.exe
                O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband
                medic\bin\matcli.exe
                O4 - Global Startup: Logitech SetPoint.lnk = C:\Program
                Files\Logitech\SetPoint\SetPoint.exe
                O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
                res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
                C:\WINDOWS\System32\msjava.dll
                O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
                00401C608501} - C:\WINDOWS\System32\msjava.dll
                O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
                Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
                O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) -
                download.ewido.net/ewidoOnlineScan.cab
                O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
                update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143846865562
                O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32
                \Ati2evxx.exe
                O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program
                Files\TOSHIBA\ConfigFree\CFSvcs.exe
                O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program
                Files\Common Files\Command Software\dvpapi.exe
                O23 - Service: Radialpoint Service (FWS) - Radialpoint Inc. - C:\Program
                Files\ntl\ntl Netguard\fws.exe

                • Gość: k Re: spyware IP: *.warszawa.sdi.tpnet.pl 02.04.06, 23:29
                  Log wyglada ok, a co do tapety to wiekszosc sie usuwa podobnie wiec poczytaj
                  opisy i zobacz czy masz podobne wpisy u siebie.
                  Ewntualnie poszukaj na google opisu usuwania.
                  • Gość: j_1 Re: spyware IP: *.server.ntli.net 03.04.06, 00:35
                    Dzieki, za pomoc usunolem (mam nadzieje) do konca wira. a z ta tapeta tez jakos
                    dalem rady. dzieki serdeczne jeszcze raz.
                    pozdrawiam jac
                    • neder Re: spyware 03.04.06, 08:51
                      daj screena z tapety. Będziemy kombinować ;)

                      pzdr
                      • kalinowski11 Re: spyware 03.04.06, 08:54
                        "a z ta tapeta tez jakos dalem rady."

                        Neder , wstajemy koniec spania :)))
                        • neder Re: spyware 03.04.06, 08:59
                          Ooooops.... a ja już nawet po 2 kawach jestem :/

                          pzdr
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.