Dodaj do ulubionych

Proszę o sprawdzenie loga

IP: *.ols.vectranet.pl / 88.156.63.* 01.05.06, 13:56
Logfile of HijackThis v1.99.1
Scan saved at 13:51:51, on 2006-05-01
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\intell321.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Leszek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = wp.pl/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
www.k-litemegacodecpack.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {196B9CB5-4C83-46F7-9B06-9672ECD9D99B} -
C:\WINDOWS\system32\winbrume.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI
Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy LS\Surround
Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [intell321.exe] C:\WINDOWS\System32\intell321.exe
O4 - Startup: .protected
O4 - Global Startup: .protected
O20 - Winlogon Notify: skyu16 - C:\WINDOWS\SYSTEM32\skyu16.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32
\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program
Files\Ahead\InCD\InCDsrv.exe

Obserwuj wątek
    • Gość: k Re: Proszę o sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 01.05.06, 14:29
      Dlaczego uzywasz IE skoro masz piracki windows bez aktualizacji?!
      Zamknij porty w wwdc oraz zmien przegladarke na Opere lub FF.

      Zakoncz:
      C:\WINDOWS\System32\intell321.exe
      plik usun.

      W hijackthis:
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
      www.k-litemegacodecpack.com/
      O2 - BHO: (no name) - {196B9CB5-4C83-46F7-9B06-9672ECD9D99B} -
      C:\WINDOWS\system32\winbrume.dll <- plik usun.
      O4 - HKLM\..\Run: [intell321.exe] C:\WINDOWS\System32\intell321.exe
      O4 - Startup: .protected
      O4 - Global Startup: .protected

      Co do tego to:
      O20 - Winlogon Notify: skyu16 - C:\WINDOWS\SYSTEM32\skyu16.dll <- Sciagnij
      sobie:
      users.telenet.be/marcvn/tools/haxfix.exe
      Uruchom i wybierz opcje 1, utworzy Ci sie log w pliku haxlog.txt (na C:\), jego
      zawartosc wklej na forum.
      • Gość: Leszek Re: Proszę o sprawdzenie loga IP: *.ols.vectranet.pl / 62.29.133.* 02.05.06, 17:59
        Nie można usunąć :
        > O4 - Startup: .protected
        > O4 - Global Startup: .protected

        Nowy log :

        Logfile of HijackThis v1.99.1
        Scan saved at 17:50:07, on 2006-05-02
        Platform: Windows XP (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 (6.00.2600.0000)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\savedump.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\System32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Ahead\InCD\InCDsrv.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\System32\CTsvcCDA.exe
        C:\WINDOWS\System32\MsPMSPSv.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Documents and Settings\Leszek\Pulpit\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = wp.pl/
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
        C:\WINDOWS\System32\msdxm.ocx
        O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
        Panel\atiptaxx.exe
        O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe"
        runtime -Delay
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy LS\Surround
        Mixer\CTSysVol.exe /r
        O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
        O4 - Startup: .protected
        O4 - Global Startup: .protected
        O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) -
        static.zangocash.com/cab/Seekmo/ie/bridge-c24.cab?1f9a979a74150cf8de259a45dd458c0cf096483a19f6578392de95aabf759fc4dd6df88f90f1bb8e
        fb42c549d11df9f385f16daab72cc1f57252fc7802e9cf64fe0a7af9:44b83125cbf5d26212ed9ca
        2c634191a
        O20 - Winlogon Notify: skyu16 - C:\WINDOWS\SYSTEM32\skyu16.dll
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32
        \Ati2evxx.exe
        O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
        O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
        Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
        Software\Avast4\ashMaiSv.exe" /service (file missing)
        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
        Software\Avast4\ashWebSv.exe" /service (file missing)
        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
        C:\WINDOWS\System32\CTsvcCDA.exe
        O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program
        Files\Ahead\InCD\InCDsrv.exe


        Dalej wg. instrukcji.

        HAXFIX logfile - by Marckie
        --------------
        version 2.40
        2006-05-02 17:54:53,12

        checking for a3d files....
        a3d files found
        ps2.a3d

        checking for matching notify keys....
        matching notify keys found
        skyu

        checking for matching services....
        matching services found
        skyu16
        skyu24

        checking for matching safeboot services....
        matching safeboot services found
        skyu16.sys
        skyu24.sys
        • kolobos Re: Proszę o sprawdzenie loga 02.05.06, 18:10
          Do kasacji:
          O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) -
          static.zangocash.com/cab/Seekmo/ie/bridge-c24.cab?
          1f9a979a74150cf8de259a45dd458c0cf096483a19f6578392de95aabf759fc4dd6df88f90f1bb8e
          fb42c549d11df9f385f16daab72cc1f57252fc7802e9cf64fe0a7af9:44b83125cbf5d26212ed9ca
          2c634191a

          Zainstaluj sobie SpyBot oraz Spyewarblaster i w obu wlacz ochrone przegladarki.

          Uruchom jeszcze raz haxfix, wybierz opcje 2 i wpisz jako nazwe do usuniecia:
          skyu

          Po usunieciu wygeneruje sie nowy raport z usuwania, wklej go na forum.

          Do tego wklej jeszcze log z:
          www.silentrunners.org/Silent%20Runners.vbs
          • Gość: Leszek Re: Proszę o sprawdzenie loga IP: *.ols.vectranet.pl / 88.156.63.* 03.05.06, 16:19
            1.Wg. instrukcji :

            HAXFIX logfile - by Marckie
            --------------
            version 2.40
            2006-05-03 16:06:30,45

            Auto Haxdoorfix


            haxdoor key: skyu
            searching for services....
            services not found, haxdoorkey skyu not added to delete

            2. Nie mogę wygenerować loga z www.silentrunners.org/Silent%20Runners.vbs ,
            komunikat: WMI Service not running !

            • Gość: k Re: Proszę o sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 03.05.06, 16:26
              Skoro WMI Service not running ! to nie przyszlo Ci do glowy zeby ta usluge
              wlaczyc? ;-)
              Start->Uruchom->services.msc

Nie masz jeszcze konta? Zarejestruj się


Nakarm Pajacyka