Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    prosze o sprawdzenie loga

    IP: *.internetdsl.tpnet.pl 26.06.07, 20:07
    Logfile of HijackThis v1.99.1
    Scan saved at 20:03:15, on 2007-06-26
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\nvraidservice.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\Program Files\lg_fwupdate\fwupdate.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\USB Disk Win98 Driver\Res.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\BearShare\BearShare.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\Program Files\Common Files\RTE\RTEGPRS.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Gadu-Gadu\gg.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Gigabyte\Gigabyte WP01GS Wireless PCI Adapter
    SoftAP\Installer\WINXP\RaUI.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\WINDOWS\System32\wbem\unsecapp.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Documents and Settings\SZEF\Moje dokumenty\utorrent.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\SZEF\Ustawienia lokalne\Temporary Internet
    Files\Content.IE5\AP45EJ2F\hijackthis[1].exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant =
    search.bearshare.com/sidebar.html?src=ssb
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
    search.bearshare.com/sidebar.html?src=ssb
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
    search.bearshare.com/sidebar.html?src=ssb
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.onet.pl/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    search.bearshare.com/sidebar.html?src=ssb
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no
    file)
    O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} -
    C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
    O2 - BHO: Zango Search Assistant
    Helper /fleok=1D8A83A5C5E019769AA575760EA83FA5EF80752B94E2DD76597E432C36CF -
    {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\program files\zango\zangohook.dll
    (file missing)
    O2 - BHO: Zango Toolbar - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - C:\Program
    Files\ZangoToolbar\Bin\4.8.3.0\ZbHostIE.dll (file missing)
    O2 - BHO: ohb - {5ED7D3DE-6DBE-4516-8712-01B1B64B7057} - C:\WINDOWS\System32
    \UpMedia\ContentTool.dll
    O2 - BHO: Related Page - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} -
    C:\WINDOWS\System32\WinNB58.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
    Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} -
    C:\Program Files\webHancer\programs\whiehlpr.dll
    O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1
    \BEARSH~1\BEARSH~2\MediaBar.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} -
    C:\WINDOWS\System32\WinNB58.dll
    O3 - Toolbar: Zango Toolbar - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} -
    C:\Program Files\ZangoToolbar\Bin\4.8.3.0\ZbHostIE.dll (file missing)
    O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} -
    C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
    O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} -
    C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
    O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\System32\nvraidservice.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
    \NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
    \NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD
    Solution\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
    Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98
    Driver\Res.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
    Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec
    Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1
    \SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [webHancer Agent] C:\Program
    Files\webHancer\Programs\whagent.exe
    O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
    O4 - HKLM\..\Run: [BearShare] "C:\Program
    Files\BearShare\BearShare.exe" /pause
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_03
    \bin\jusched.exe"
    O4 - HKLM\..\Run: [LXCGCATS] rundll32 řT÷w˙˙˙˙Ťőw!çw\3
    \LXCGtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-
    Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [RTEGPRS] "C:\Program Files\Common Files\RTE\RTEGPRS.exe"
    tray
    O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton
    SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE
    CfgWiz
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
    O4 - HKCU\..\Run: [Skype] "C:\Program
    Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - Global Startup: GN-WP01GS Utility.lnk = C:\Program
    Files\Gigabyte\Gigabyte WP01GS Wireless PCI Adapter
    SoftAP\Installer\WINXP\RaUI.exe
    O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
    res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
    C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
    00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
    O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571
    Obserwuj wątek
      • Gość: Kolobos Re: prosze o sprawdzenie loga IP: *.escom.net.pl 27.06.07, 00:37
        Zamknij porty przy pomocy wwdc.exe, zrob skan przy pomocy SuperAntiSpyware.

        Logfile of HijackThis v1.99.1
        Scan saved at 20:03:15, on 2007-06-26
        Platform: Windows XP (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 (6.00.2600.0000)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Ahead\InCD\InCDsrv.exe
        C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
        C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\System32\nvraidservice.exe
        C:\WINDOWS\SOUNDMAN.EXE
        C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
        C:\Program Files\Ahead\InCD\InCD.exe
        C:\Program Files\lg_fwupdate\fwupdate.exe
        C:\Program Files\Common Files\Real\Update_OB\realsched.exe
        C:\Program Files\USB Disk Win98 Driver\Res.EXE
        C:\Program Files\Common Files\Symantec Shared\ccApp.exe
        C:\Program Files\Winamp\winampa.exe
        C:\Program Files\BearShare\BearShare.exe
        C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
        C:\Program Files\Common Files\RTE\RTEGPRS.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\Program Files\Gadu-Gadu\gg.exe
        C:\Program Files\Skype\Phone\Skype.exe
        C:\Program Files\Gigabyte\Gigabyte WP01GS Wireless PCI Adapter
        SoftAP\Installer\WINXP\RaUI.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
        C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
        C:\Program Files\Skype\Plugin Manager\skypePM.exe
        C:\WINDOWS\System32\wbem\unsecapp.exe
        C:\Program Files\Winamp\winamp.exe
        C:\Documents and Settings\SZEF\Moje dokumenty\utorrent.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Documents and Settings\SZEF\Ustawienia lokalne\Temporary Internet
        Files\Content.IE5\AP45EJ2F\hijackthis[1].exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant =
        search.bearshare.com/sidebar.html?src=ssb
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
        search.bearshare.com/sidebar.html?src=ssb
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
        search.bearshare.com/sidebar.html?src=ssb
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        search.bearshare.com/sidebar.html?src=ssb
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
        R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no
        file)
        O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} -
        C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
        O2 - BHO: Zango Search Assistant
        Helper /fleok=1D8A83A5C5E019769AA575760EA83FA5EF80752B94E2DD76597E432C36CF -
        {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\program files\zango\zangohook.dll
        (file missing)
        O2 - BHO: Zango Toolbar - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - C:\Program
        Files\ZangoToolbar\Bin\4.8.3.0\ZbHostIE.dll (file missing)
        O2 - BHO: ohb - {5ED7D3DE-6DBE-4516-8712-01B1B64B7057} - C:\WINDOWS\System32
        \UpMedia\ContentTool.dll <- katalog UpMedia usun z dysku.
        O2 - BHO: Related Page - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} -
        C:\WINDOWS\System32\WinNB58.dll
        O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} -
        C:\Program Files\webHancer\programs\whiehlpr.dll
        O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1
        \BEARSH~1\BEARSH~2\MediaBar.dll
        O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} -
        C:\WINDOWS\System32\WinNB58.dll <- plik usun z dysku.
        O3 - Toolbar: Zango Toolbar - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} -
        C:\Program Files\ZangoToolbar\Bin\4.8.3.0\ZbHostIE.dll (file missing)
        O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} -
        C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
        O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} -
        C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL <- katalog MyGlo.. usun z dysku.
        O4 - HKLM\..\Run: [webHancer Agent] C:\Program
        Files\webHancer\Programs\whagent.exe <- katalog webHancer usun z dysku.

        Jak juz to zrobisz to uzyj combofix + nowy log z hijackthis. Oba wklej na wklej.org i daj link.
        • Gość: noemi Re: prosze o sprawdzenie loga IP: *.internetdsl.tpnet.pl 27.06.07, 15:26
          troche się nie znam jak man zamknąć te porty?
          • Gość: @ Re: prosze o sprawdzenie loga IP: *.chello.pl 27.06.07, 16:47
            Jak zanknąć porty: cybertrash.pl/images/tata/WWDC.html
            Poza tym na samej górze forum pisze:
            Oszczędź czas, zanim zapytasz przeczytaj wskazówki

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.
    Wybrane treści z serwisu Sport.pl są dostępne po wykupieniu płatnej subskrypcji