Dodaj do ulubionych

Prosze o sprawdzenie loga

IP: *.crowley.pl 10.05.06, 16:32
Logfile of HijackThis v1.99.1
Scan saved at 10:26:03 AM, on 5/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\PackethSvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\COMMON~1\MICROS~1\Msinfo\OFFPROV.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\COMMON~1\MICROS~1\Msinfo\OFFPRV10.EXE
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\qxmoieli.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\redistributor.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe
C:\Program Files\INSTALL.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\IZAMICHAL123\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.rr.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
www.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
C:\WINDOWS\about.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft
Internet Explorer provided by Roadrunner
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no
file)
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} -
C:\Program Files\SurfSideKick 3\SskBho.dll
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\gvunm.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe,rrcqwsx.exe
N3 - Netscape 7: user_pref("browser.startup.homepage", "<a href="interia.pl/");" target="_blank">interia.pl/");</a>
(C:\Documents and Settings\IZAMICHAL123\Application
Data\Mozilla\Profiles\default\wlncy5ld.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%
5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
(C:\Documents and Settings\IZAMICHAL123\Application
Data\Mozilla\Profiles\default\wlncy5ld.slt\prefs.js)
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} -
C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32
\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft
Money\System\Activation.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive
Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program
Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06
\bin\jusched.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google
Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [omvfauqqbcmuu] C:\WINDOWS\system32\qxmoieli.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program
Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround
Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [VoipDiscount] "C:\Program
Files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe" -nosplash -minimized
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program
Files\Microsoft Works\WkDetect.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program
Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O8 - Extra context menu item: Assign &hot key - C:\Program Files\Hot Keyboard
Pro\IEScript.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1
\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} -
C:\WINDOWS\system32\dmonwv.dll
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} -
C:\WINDOWS\system32\dmonwv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -
C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} -
C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} -
C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .htm: C:\Program Files\Netscape\Netscape
Browser\PLUGINS\npTrident.dll
O14 - IERESET.INF: START_PAGE_URL=www.rr.com
O16 - DPF: DigiChat Applet -
host.digichat.com/DigiChat/DigiClasses/Client_IE.cab
O18
Obserwuj wątek
    • Gość: k Re: Prosze o sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 10.05.06, 20:03
      W menadzerze zadan zakoncz:
      C:\WINDOWS\system32\qxmoieli.exe
      C:\WINDOWS\system32\redistributor.exe
      C:\Program Files\INSTALL.exe

      Usun w hjt:
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      www.dellnet.com/
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      C:\WINDOWS\about.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft
      Internet Explorer provided by Roadrunner
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no
      file)
      R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} -
      C:\Program Files\SurfSideKick 3\SskBho.dll
      F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\gvunm.exe <- usun
      plik gvunm.exe z dysku.
      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe,rrcqwsx.exe <-
      usun plik rrcqwsx.exe z dysku.
      O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} -
      C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll <- odinstaluj i usun
      katalog.
      O4 - HKLM\..\Run: [omvfauqqbcmuu] C:\WINDOWS\system32\qxmoieli.exe <- usun plik.
      O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
      O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe <-
      odinstaluj i usun katalog SurfSideKick 3.
      O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} -
      C:\WINDOWS\system32\dmonwv.dll
      O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} -
      C:\WINDOWS\system32\dmonwv.dll <- usun plik.
      O14 - IERESET.INF: START_PAGE_URL=www.rr.com
      O16 - DPF: DigiChat Applet -
      host.digichat.com/DigiChat/DigiClasses/Client_IE.cab

      Log sie nie zmiescil, doklej brakujaca czesc:
      O18

      Do tego zrob skan przy pomocy ewido i po wszystkim wklej nowy log.

    • Gość: maciek Re: Prosze o sprawdzenie loga IP: *.crowley.pl 11.05.06, 13:27
      Dalsza czesc loga

      O18 - Filter: text/html - (no CLSID) - (no file)
      O20 - AppInit_DLLs: repairs303169584.dll
      O20 - Winlogon Notify: logons - C:\WINDOWS\system32\redist.dll
      O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\enlul1391.dll
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32
      \Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
      O23 - Service: Command Service (cmdService) - Unknown owner -
      C:\WINDOWS\SVpBTUlDSEFMMTIz\command.exe (file missing)
      O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
      C:\WINDOWS\System32\CTsvcCDA.EXE
      O23 - Service: FireDaemon Service: ecure (ecure) - Unknown owner -
      C:\WINDOWS\Temp\FireDaemon.EXE (file missing)
      O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program
      Files\Common Files\EPSON\EBAPI\eEBSVC.exe
      O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON
      CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
      Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
      \IDriverT.exe
      O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. -
      C:\WINDOWS\System32\ImapiRox.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program
      Files\iPod\bin\iPodService.exe
      O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec
      Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
      O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner -
      C:\WINDOWS\Nhksrv.exe
      O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. -
      C:\WINDOWS\System32\PackethSvc.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: Retrospect Express HD Restore Helper (RetroExp Helper) - Dantz
      Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe
      O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - Dantz
      Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
      O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
      C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
      O23 - Service: FireDaemon Service: svchost1 (svchost1) - Unknown owner -
      C:\WINDOWS\Temp\FireDaemon.EXE (file missing)
      O23 - Service: FireDaemon Service: system (system) - Unknown owner -
      C:\WINDOWS\Temp\FireDaemon.EXE (file missing)
      O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp
      Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America
      Online, Inc. - C:\WINDOWS\wanmpsvc.exe
      O23 - Service: Windows Overlay Components - Unknown owner -
      C:\WINDOWS\vkwuyrt.exe
      • Gość: k Re: Prosze o sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 11.05.06, 15:05
        O18 - Filter: text/html - (no CLSID) - (no file)
        O20 - AppInit_DLLs: repairs303169584.dll <- usun plik z dysku
        O20 - Winlogon Notify: logons - C:\WINDOWS\system32\redist.dll <- i ten
        O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\enlul1391.dll <- i ten

        Uslugi do kasacji:
        O23 - Service: Command Service (cmdService) - Unknown owner -
        C:\WINDOWS\SVpBTUlDSEFMMTIz\command.exe (file missing)
        O23 - Service: FireDaemon Service: ecure (ecure) - Unknown owner -
        C:\WINDOWS\Temp\FireDaemon.EXE (file missing)
        O23 - Service: FireDaemon Service: svchost1 (svchost1) - Unknown owner -
        C:\WINDOWS\Temp\FireDaemon.EXE (file missing)
        O23 - Service: FireDaemon Service: system (system) - Unknown owner -
        C:\WINDOWS\Temp\FireDaemon.EXE (file missing)
        O23 - Service: Windows Overlay Components - Unknown owner -
        C:\WINDOWS\vkwuyrt.exe

        Jak juz wszystko zrobisz to wklej nowy log.

Nie pamiętasz hasła

lub ?

 

Nie masz jeszcze konta? Zarejestruj się

Nakarm Pajacyka