jakas nowa cholera? Log...

[sierzant_nowak]

Z gory dziekuje za pomoc w rozpoznaniu, co znowu wysyla ode mnie w kosmos niewiadomo co... Uwaga: mam zainstalowane ewido i spy sweeper i nic nie widza - jakas nowa cholera??

Logfile of HijackThis v1.99.1
Scan saved at 00:25:34, on 2006-09-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programs\Apache Group\Apache2\bin\Apache.exe
D:\Programs\ewido anti-spyware 4.0\guard.exe
d:\programs\mcafee.com\agent\mcdetect.exe
d:\programs\mcafee.com\vso\mcshield.exe
d:\programs\mcafee.com\agent\mctskshd.exe
D:\Programs\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Programs\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\Explorer.EXE
D:\Programs\McAfee\SPAMKI~1\MSKSrvr.exe
D:\Programs\DU Meter\DUMeter.exe
D:\Programs\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
D:\Programs\QuickTime\qttask.exe
D:\Programs\Anti-Blaxx\Anti-Blaxx.exe
C:\WINDOWS\system32\rundll32.exe
D:\Programs\DAEMON Tools\daemon.exe
D:\Programs\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
D:\Programs\AGEIA Technologies\TrayIcon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Programs\McAfee.com\VSO\mcvsshld.exe
D:\Programs\McAfee.com\VSO\oasclnt.exe
D:\Programs\Webroot\Spy Sweeper\WRSSSDK.exe
d:\programs\mcafee.com\agent\mcagent.exe
d:\programs\mcafee.com\vso\mcvsescn.exe
D:\Programs\McAfee.com\PERSON~1\MpfTray.exe
D:\programs\mcafee.com\mps\mscifapp.exe
D:\Programs\McAfee\SPAMKI~1\MskAgent.exe
D:\Programs\TortoiseSVN\bin\TSVNCache.exe
D:\Programs\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Programs\Webroot\Spy Sweeper\SpySweeper.exe
D:\Programs\ewido anti-spyware 4.0\ewido.exe
D:\Programs\Creative\Shared Files\CamTray.exe
D:\Programs\Opera\Opera.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Programs\Skype\Phone\Skype.exe
D:\Programs\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Programs\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
D:\Programs\Adobe\Acrobat 7.0\Reader\reader_sl.exe
D:\Programs\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
D:\Programs\Logitech\SetPoint\SetPoint.exe
D:\Programs\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
D:\Programs\Apache Group\Apache2\bin\ApacheMonitor.exe
D:\Programs\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
D:\Programs\3M\PSNLite\PsnLite.exe
D:\Programs\3M\PSNLite\PSNGive.exe
C:\WINDOWS\system32\taskmgr.exe
C:\tools\totalcmd\TOTALCMD.EXE
Q:\install\- small tools\hijack\hijackthis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programs\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - d:\programs\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - d:\programs\mcafee.com\mps\popupkiller.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - d:\programs\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programs\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\programs\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [DU Meter] D:\Programs\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Programs\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programs\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Anti-Blaxx Manager] D:\Programs\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Programs\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] D:\Programs\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [VSOCheckTask] "D:\Programs\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] D:\Programs\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] D:\Programs\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] d:\programs\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\programs\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] D:\Programs\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] d:\programs\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] D:\Programs\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] D:\Programs\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [SpySweeper] "D:\Programs\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [!ewido] "D:\Programs\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative WebCam Tray] "D:\Programs\Creative\Shared Files\CamTray.exe"
O4 - HKCU\..\Run: [Skype] "D:\Programs\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Programs\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Shortcut to taskmgr.lnk = C:\WINDOWS\system32\taskmgr.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programs\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = D:\Programs\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Monitor Apache Servers.lnk = D:\Programs\Apache Group\Apache2\bin\ApacheMonitor.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = D:\Programs\3M\PSNLite\PsnLite.exe
O4 - Global Startup: Szybkie uruchamianie programu Microsoft Office OneNote 2003.lnk = D:\Programs\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Programs\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -

log - cd.

[sierzant_nowak]

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Programs\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programs\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programs\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - d:\programs\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - d:\programs\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programs\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119725222844
O17 - HKLM\System\CCS\Services\Tcpip\..\{167F6627-F6AB-428F-B82E-9394C1BACD3B}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{167F6627-F6AB-428F-B82E-9394C1BACD3B}: NameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{167F6627-F6AB-428F-B82E-9394C1BACD3B}: NameServer = 192.168.0.1
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2 - Unknown owner - D:\Programs\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\Programs\ewido anti-spyware 4.0\guard.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - d:\programs\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - d:\programs\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - d:\programs\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - D:\Programs\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - D:\Programs\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - D:\Programs\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: MySQL - Unknown owner - D:\Programs\MySQL\MySQL.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.0 (pgsql-8.0) - PostgreSQL Global Development Group - D:\Programs\PostgreSQL\8.0\bin\pg_ctl.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Programs\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - D:\Programs\java\Tomcat 5.5\bin\tomcat5.exe" //RS//Tomcat5 (file missing)

[Gość: Kolobos]

> Z gory dziekuje za pomoc w rozpoznaniu, co znowu wysyla ode mnie w kosmos
> niewiadomo co... ??

Tzn? Co wysyla? gdzie? jaki program? czym to sprawdzasz? o co Ci w ogole chodzi?

mam wychodzacy transfer

[sierzant_nowak]

z predkoscia maksymalna lacza (ok 30 kB/s) widoczny na DU Meter. Ubilem ta cholere blokujac sobie na firewallu porty 1-79, uzywam tylko HTTP na 80. Ale to cos dalej tu siedzi...

[Gość: Kolobos]

Zainstaluj firewall i zobacz co sie laczy z czym.

nic nie widac...

[sierzant_nowak]

netstat nic nie pokazuje, to samo netlimiter. Solidniejszy firewall nie wchodzi w gre bo mam rozsypany system, nie przezyje instalacji ;-) a nie mam mozliwosci reinstalacji w najblizszym tygodniu (potrzebuje pilnie maszyny) i musze jakos dociagnac... Ale ok, jakos sobie poradze