Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    nieznana transmisja w siecie

    10.09.06, 15:00
    Czesc,

    Sprawa jest taka - widze na DUMeter wychodzaca od siebie transmisje - jakies 35 kB/s (akurat tyle ile przepustowosc wychodzacego internetu). Po odlaczeniu od routera kabla od WAN - transmisja znika. Tylko ze nigdzie nic nie widac... netlimiter jej nie pokazuje, netstat tez nie, jakis shareware'owy net monitor - tez nic.

    Mam przysyfiony komputer, nacialem sie z tydzien temu na trojana - ogolnie przeczyscilem system, ale Mcafee cos sie zbiesil - ogolnie bajzel i kwalifikacja do reinstalki, tylko ze ja przez pare najblizszych dni nie mam na nia czasu a potrzebuje kompa. Jakies pomysly jak sprawidzic co to za transmisja? AdAware nic nie znalazl...
    Obserwuj wątek
      • Gość: T-800 Re: nieznana transmisja w siecie IP: *.tpnet.pl 10.09.06, 15:13
        forum.gazeta.pl/forum/72,2.html?f=430&w=38051058
        • sierzant_nowak jakbys popatrzyl - ja pytalem o sposob 10.09.06, 15:15
          monitorowania polaczen, ktore umykaja netstatowi czy narzedziom w rodzaju net-limitera. To NIE jest to samo, co pytanie o sposob usuniecia problemu... A z logiem mialem troche problemow, juz leci

          Logfile of HijackThis v1.99.1
          Scan saved at 15:13:52, on 2006-09-10
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          D:\Programs\Apache Group\Apache2\bin\Apache.exe
          d:\programs\mcafee.com\agent\mcdetect.exe
          d:\programs\mcafee.com\vso\mcshield.exe
          d:\programs\mcafee.com\agent\mctskshd.exe
          D:\Programs\Apache Group\Apache2\bin\Apache.exe
          C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
          D:\Programs\McAfee.com\PERSON~1\MpfService.exe
          D:\Programs\McAfee\SPAMKI~1\MSKSrvr.exe
          D:\Programs\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          D:\Programs\TortoiseSVN\bin\TSVNCache.exe
          C:\WINDOWS\system32\ctfmon.exe
          D:\Programs\DU Meter\DUMeter.exe
          D:\Programs\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
          D:\Programs\QuickTime\qttask.exe
          D:\Programs\Anti-Blaxx\Anti-Blaxx.exe
          C:\WINDOWS\system32\rundll32.exe
          D:\Programs\DAEMON Tools\daemon.exe
          D:\Programs\AGEIA Technologies\TrayIcon.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\WINDOWS\system32\NvVid.exe
          D:\Programs\McAfee.com\VSO\mcvsshld.exe
          d:\programs\mcafee.com\agent\mcagent.exe
          D:\Programs\McAfee.com\VSO\oasclnt.exe
          d:\programs\mcafee.com\vso\mcvsescn.exe
          D:\Programs\McAfee.com\PERSON~1\MpfTray.exe
          D:\programs\mcafee.com\mps\mscifapp.exe
          D:\Programs\McAfee\SPAMKI~1\MskAgent.exe
          C:\Program Files\Messenger\msmsgs.exe
          D:\Programs\Creative\Shared Files\CamTray.exe
          D:\Programs\Skype\Phone\Skype.exe
          D:\Programs\Gadu-Gadu\gg.exe
          C:\tools\totalcmd\TOTALCMD.EXE
          d:\programs\mcafee.com\vso\mcvsftsn.exe
          D:\Programs\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
          D:\Programs\McAfee.com\PERSON~1\MpfAgent.exe
          D:\Programs\Logitech\SetPoint\SetPoint.exe
          D:\Programs\Apache Group\Apache2\bin\ApacheMonitor.exe
          D:\Programs\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
          D:\Programs\3M\PSNLite\PsnLite.exe
          C:\WINDOWS\system32\taskmgr.exe
          D:\Programs\Opera\Opera.exe
          D:\Programs\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
          D:\Programs\3M\PSNLite\PSNGive.exe
          C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
          Q:\install\- small tools\hijack\hijackthis.exe

          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programs\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - d:\programs\mcafee.com\mps\mcbrhlpr.dll
          O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - d:\programs\mcafee.com\mps\popupkiller.dll
          O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - d:\programs\mcafee\spamkiller\mcapfbho.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programs\Java\jre1.5.0_06\bin\ssv.dll
          O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
          O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
          O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - D:\Programs\TextAloud\TAForIE.dll
          O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\programs\mcafee.com\vso\mcvsshl.dll
          O4 - HKLM\..\Run: [DU Meter] D:\Programs\DU Meter\DUMeter.exe
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Programs\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
          O4 - HKLM\..\Run: [QuickTime Task] "D:\Programs\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [Anti-Blaxx Manager] D:\Programs\Anti-Blaxx\Anti-Blaxx.exe
          O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
          O4 - HKLM\..\Run: [DAEMON Tools] "D:\Programs\DAEMON Tools\daemon.exe" -lang 1033
          O4 - HKLM\..\Run: [AGEIA PhysX SysTray] D:\Programs\AGEIA Technologies\TrayIcon.exe
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [NvVideoCenter] C:\WINDOWS\system32\NvVid.exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [VSOCheckTask] "D:\Programs\McAfee.com\VSO\mcmnhdlr.exe" /checktask
          O4 - HKLM\..\Run: [VirusScan Online] D:\Programs\McAfee.com\VSO\mcvsshld.exe
          O4 - HKLM\..\Run: [OASClnt] D:\Programs\McAfee.com\VSO\oasclnt.exe
          O4 - HKLM\..\Run: [MCAgentExe] d:\programs\mcafee.com\agent\mcagent.exe
          O4 - HKLM\..\Run: [MCUpdateExe] D:\programs\mcafee.com\agent\mcupdate.exe
          O4 - HKLM\..\Run: [MPFExe] D:\Programs\McAfee.com\PERSON~1\MpfTray.exe
          O4 - HKLM\..\Run: [MPSExe] d:\programs\mcafee.com\mps\mscifapp.exe /embedding
          O4 - HKLM\..\Run: [MSKAGENTEXE] D:\Programs\McAfee\SPAMKI~1\MskAgent.exe
          O4 - HKLM\..\Run: [MSKDetectorExe] D:\Programs\McAfee\SPAMKI~1\MSKDetct.exe /startup
          O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
          O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
          O4 - HKCU\..\Run: [Creative WebCam Tray] "D:\Programs\Creative\Shared Files\CamTray.exe"
          O4 - HKCU\..\Run: [Skype] "D:\Programs\Skype\Phone\Skype.exe" /nosplash /minimized
          O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Programs\Gadu-Gadu\gg.exe" /tray
          O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
          O4 - Startup: Shortcut to taskmgr.lnk = C:\WINDOWS\system32\taskmgr.exe
          O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
          O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
          O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programs\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          O4 - Global Startup: Bluetooth Manager.lnk = ?
          O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Programs\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
          O4 - Global Startup: Logitech SetPoint.lnk = D:\Programs\Logitech\SetPoint\SetPoint.exe
          O4 - Global Startup: Monitor Apache Servers.lnk = D:\Programs\Apache Group\Apache2\bin\ApacheMonitor.exe
          O4 - Global Startup: Post-it® Software Notes Lite.lnk = D:\Programs\3M\PSNLite\PsnLite.exe
          O4 - Global Startup: Szybkie uruchamianie programu Microsoft Office OneNote 2003.lnk = D:\Programs\Microsoft Office\OFFICE11\ONENOTEM.EXE
          O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
          O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
          O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
          O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
          O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
          O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
          O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
          O8 - Extra c
          • Gość: T-800 Re: jakbys popatrzyl - ja pytalem o sposob IP: *.tpnet.pl 10.09.06, 15:28
            Nie wszedł cały log. ;-]

            Do wywalenia:

            > O4 - HKLM\..\Run: [NvVideoCenter] C:\WINDOWS\system32\NvVid.exe

            > O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

            > O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe

            > O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe

            Masz dwa McAfee? Odinstaluj jeden czy coś...

            Odinstaluj Toolbar TextAloud (jeśli nie używasz).

            Przeskanuj system tym www.xkee.com/download/spysweeper4.5est.exe
            (wcześniej zaktualizuj); usuń wszystko, co znajdzie.

            Odpal msconfig (Start -> Uruchom) i wywal wszystko, co niepotrzebne z
            autostartu.

            Wklej nowy log.
            • sierzant_nowak dzieki, ajm on yt... 10.09.06, 15:31
              co do mcfee - jest wlasnie jajo, bo sie wiesza tez uninstaller... Dwa sa dlatego, ze mam plytke z calym suite, zainstalowalem samego antywira a potem suite i liczylem (glupi) na to, ze bedzie na tyle madry zeby sie nie dublowac...
              • sierzant_nowak spysweeper wywalil backdoor'a 10.09.06, 17:34
                nie widze zadnej nieznanej wychodzacej transmisji. A teraz - na przyszlosc. Czy jest jakas - poza wpieciem sie w router/brame - mozliwosc monitorwania tego rodzaju ruchu? Co to bylo, ze netlimiter, netstat tego nie widzial, a DUMeter pokazywal ruch?

                ---------
                Logfile of HijackThis v1.99.1
                Scan saved at 17:31:46, on 2006-09-10
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\spoolsv.exe
                D:\Programs\Apache Group\Apache2\bin\Apache.exe
                d:\programs\mcafee.com\agent\mcdetect.exe
                d:\programs\mcafee.com\vso\mcshield.exe
                D:\Programs\Apache Group\Apache2\bin\Apache.exe
                d:\programs\mcafee.com\agent\mctskshd.exe
                C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
                D:\Programs\McAfee.com\PERSON~1\MpfService.exe
                D:\Programs\McAfee\SPAMKI~1\MSKSrvr.exe
                D:\Programs\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
                C:\WINDOWS\system32\nvsvc32.exe
                C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
                C:\WINDOWS\system32\svchost.exe
                D:\Programs\Webroot\Spy Sweeper\WRSSSDK.exe
                C:\WINDOWS\Explorer.EXE
                D:\Programs\TortoiseSVN\bin\TSVNCache.exe
                C:\WINDOWS\system32\ctfmon.exe
                D:\Programs\DU Meter\DUMeter.exe
                D:\Programs\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
                D:\Programs\QuickTime\qttask.exe
                D:\Programs\Anti-Blaxx\Anti-Blaxx.exe
                C:\WINDOWS\system32\rundll32.exe
                D:\Programs\DAEMON Tools\daemon.exe
                D:\Programs\AGEIA Technologies\TrayIcon.exe
                C:\WINDOWS\system32\RUNDLL32.EXE
                D:\Programs\McAfee.com\VSO\oasclnt.exe
                D:\programs\mcafee.com\agent\mcagent.exe
                d:\programs\mcafee.com\vso\mcvsescn.exe
                D:\programs\mcafee.com\vso\mcvsshld.exe
                D:\Programs\McAfee.com\PERSON~1\MpfTray.exe
                D:\programs\mcafee.com\mps\mscifapp.exe
                D:\Programs\McAfee\SPAMKI~1\MskAgent.exe
                D:\Programs\McAfee.com\PERSON~1\MpfAgent.exe
                D:\Programs\Webroot\Spy Sweeper\SpySweeper.exe
                C:\Program Files\Messenger\msmsgs.exe
                D:\Programs\Creative\Shared Files\CamTray.exe
                D:\Programs\Skype\Phone\Skype.exe
                D:\Programs\Gadu-Gadu\gg.exe
                d:\programs\mcafee.com\vso\mcvsftsn.exe
                D:\Programs\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
                D:\Programs\Logitech\SetPoint\SetPoint.exe
                D:\Programs\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
                D:\Programs\Apache Group\Apache2\bin\ApacheMonitor.exe
                D:\Programs\3M\PSNLite\PsnLite.exe
                D:\Programs\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
                C:\WINDOWS\system32\taskmgr.exe
                D:\Programs\3M\PSNLite\PSNGive.exe
                C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
                C:\WINDOWS\system32\cmd.exe
                C:\tools\totalcmd\TOTALCMD.EXE
                Q:\install\- small tools\hijack\hijackthis.exe

                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programs\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - d:\programs\mcafee.com\mps\mcbrhlpr.dll
                O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - d:\programs\mcafee.com\mps\popupkiller.dll
                O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - d:\programs\mcafee\spamkiller\mcapfbho.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programs\Java\jre1.5.0_06\bin\ssv.dll
                O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
                O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
                O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\programs\mcafee.com\vso\mcvsshl.dll
                O4 - HKLM\..\Run: [DU Meter] D:\Programs\DU Meter\DUMeter.exe
                O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Programs\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
                O4 - HKLM\..\Run: [QuickTime Task] "D:\Programs\QuickTime\qttask.exe" -atboottime
                O4 - HKLM\..\Run: [Anti-Blaxx Manager] D:\Programs\Anti-Blaxx\Anti-Blaxx.exe
                O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
                O4 - HKLM\..\Run: [DAEMON Tools] "D:\Programs\DAEMON Tools\daemon.exe" -lang 1033
                O4 - HKLM\..\Run: [AGEIA PhysX SysTray] D:\Programs\AGEIA Technologies\TrayIcon.exe
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [VSOCheckTask] "D:\Programs\McAfee.com\VSO\mcmnhdlr.exe" /checktask
                O4 - HKLM\..\Run: [VirusScan Online] D:\Programs\McAfee.com\VSO\mcvsshld.exe
                O4 - HKLM\..\Run: [OASClnt] D:\Programs\McAfee.com\VSO\oasclnt.exe
                O4 - HKLM\..\Run: [MCAgentExe] d:\programs\mcafee.com\agent\mcagent.exe
                O4 - HKLM\..\Run: [MCUpdateExe] D:\programs\mcafee.com\agent\McUpdate.exe
                O4 - HKLM\..\Run: [MPFExe] D:\Programs\McAfee.com\PERSON~1\MpfTray.exe
                O4 - HKLM\..\Run: [MPSExe] d:\programs\mcafee.com\mps\mscifapp.exe /embedding
                O4 - HKLM\..\Run: [MSKAGENTEXE] D:\Programs\McAfee\SPAMKI~1\MskAgent.exe
                O4 - HKLM\..\Run: [MSKDetectorExe] D:\Programs\McAfee\SPAMKI~1\MSKDetct.exe /startup
                O4 - HKLM\..\Run: [SpySweeper] "D:\Programs\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                O4 - HKCU\..\Run: [Creative WebCam Tray] "D:\Programs\Creative\Shared Files\CamTray.exe"
                O4 - HKCU\..\Run: [Skype] "D:\Programs\Skype\Phone\Skype.exe" /nosplash /minimized
                O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Programs\Gadu-Gadu\gg.exe" /tray
                O4 - Startup: Shortcut to taskmgr.lnk = C:\WINDOWS\system32\taskmgr.exe
                O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
                O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
                O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programs\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                O4 - Global Startup: Bluetooth Manager.lnk = ?
                O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Programs\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                O4 - Global Startup: Logitech SetPoint.lnk = D:\Programs\Logitech\SetPoint\SetPoint.exe
                O4 - Global Startup: Monitor Apache Servers.lnk = D:\Programs\Apache Group\Apache2\bin\ApacheMonitor.exe
                O4 - Global Startup: Post-it® Software Notes Lite.lnk = D:\Programs\3M\PSNLite\PsnLite.exe
                O4 - Global Startup: Szybkie uruchamianie programu Microsoft Office OneNote 2003.lnk = D:\Programs\Microsoft Office\OFFICE11\ONENOTEM.EXE
                O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
                O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
                O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                O8 - Extra context menu item: Convert to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                O8 - Extra context menu item: E&ksport do programu
                • sierzant_nowak log - c.d. 10.09.06, 17:34
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programs\Java\jre1.5.0_06\bin\ssv.dll
                  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programs\Java\jre1.5.0_06\bin\ssv.dll
                  O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - d:\programs\mcafee\spamkiller\mcapfbho.dll
                  O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - d:\programs\mcafee\spamkiller\mcapfbho.dll
                  O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programs\MICROS~4\OFFICE11\REFIEBAR.DLL
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
                  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119725222844
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{167F6627-F6AB-428F-B82E-9394C1BACD3B}: NameServer = 192.168.0.1
                  O17 - HKLM\System\CS1\Services\Tcpip\..\{167F6627-F6AB-428F-B82E-9394C1BACD3B}: NameServer = 192.168.0.1
                  O17 - HKLM\System\CS2\Services\Tcpip\..\{167F6627-F6AB-428F-B82E-9394C1BACD3B}: NameServer = 192.168.0.1
                  O18 - Protocol: bw+0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw+0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw-0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw-0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw00 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw00s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw10 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw10s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw20 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw20s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw30 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw30s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw40 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw40s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw50 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw50s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw60 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw60s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw70 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw70s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw80 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw80s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw90 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bw90s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwa0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwa0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwb0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwb0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwc0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwc0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwd0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwd0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwe0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwe0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwf0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwf0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                  O18 - Protocol: bwg0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwg0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwh0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwh0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwi0 - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                  O18 - Protocol: bwi0s - {6AF8F530-89BA-4681-8F6D-A35341481EB2} - D:\Programs\Logitech\De
                  • sierzant_nowak co sie ten logitech tak rozsiadl?? 10.09.06, 17:35
                    cd i o.:O20 - Winlogon Notify: asusrx20 - asusrx20.dll (file missing)
                    O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
                    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
                    O23 - Service: Apache2 - Unknown owner - D:\Programs\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
                    O23 - Service: LiveUpdate - Symantec Corporation - D:\Programs\Symantec\LIVEUP~1\LUCOMS~1.EXE
                    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
                    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - d:\programs\mcafee.com\agent\mcdetect.exe
                    O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - d:\programs\mcafee.com\vso\mcshield.exe
                    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - d:\programs\mcafee.com\agent\mctskshd.exe
                    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - D:\Programs\McAfee.com\Agent\mcupdmgr.exe
                    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - D:\Programs\McAfee.com\PERSON~1\MpfService.exe
                    O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - D:\Programs\McAfee\SPAMKI~1\MSKSrvr.exe
                    O23 - Service: MySQL - Unknown owner - D:\Programs\MySQL\MySQL.exe (file missing)
                    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                    O23 - Service: PostgreSQL Database Server 8.0 (pgsql-8.0) - PostgreSQL Global Development Group - D:\Programs\PostgreSQL\8.0\bin\pg_ctl.exe
                    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
                    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Programs\Webroot\Spy Sweeper\WRSSSDK.exe
                    O23 - Service: Time Service (Time) - Unknown owner - C:\WINDOWS\system32\mlsdf8hftgtepa.exe (file missing)
                    O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - D:\Programs\java\Tomcat 5.5\bin\tomcat5.exe" //RS//Tomcat5 (file missing)
                • Gość: Kolobos Re: spysweeper wywalil backdoor'a IP: *.warszawa.sdi.tpnet.pl 10.09.06, 19:04
                  > A teraz - na przyszlosc. Czy jest jakas - poza wpieciem sie w router/brame -
                  > mozliwosc monitorwania tego rodzaju ruchu?

                  Zainstaluj firewall.

                  Odinstaluj Logitech Desktop Messenger i usun w hjt wszystkie wpisy O18 - Protocol:...

                  Odinstaluj tez Ms Messengera, opis masz w przyklejonym poscie.

                  Przeskanuj system przy pomocy ewido.

                  W hjt usun:
                  O4 - Startup: Shortcut to taskmgr.lnk = C:\WINDOWS\system32\taskmgr.exe <- chyba, ze sam dodales skrot to w takim wypadku zostaw.
                  O20 - Winlogon Notify: asusrx20 - asusrx20.dll (file missing)

                  Odszukaj w katalogu systemowym pliki:
                  asusrx25.sys oraz ksl48.bin i usun (o ile sa).

                  Usluga do kasacji, opis usuwania masz w przyklejonym poscie:
                  O23 - Service: Time Service (Time) - Unknown owner - C:\WINDOWS\system32\mlsdf8hftgtepa.exe (file missing)
                  • sierzant_nowak dzieki za pomoc 10.09.06, 19:56


          • sierzant_nowak natomiast jezeli monitorowac sie tego nie da 10.09.06, 15:29
            to moze ktos ma pomysl - po logu - co to za cholera i jak to zablokowac? BTW: proba uruchomienia patcha z watku o Generic Host Service wywala BSOD od razu...
            • t-800 Re: natomiast jezeli monitorowac sie tego nie da 10.09.06, 15:55
              Najpierw trzeba wywalić śmieci z systemu. Przeskanuj SpySweeperem i wklej log.

              MCAFee możesz spróbować odinstalować tym:
              www.softpedia.com/get/Tweak/Uninstallers/AV-Uninstaller-Tool.shtml

              Ale jak działa, to moŻe działać, tylko trochę za dużo procesów się ładuje przy
              starcie. ;-]
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.