Proszę o sprawdzenie loga

IP: *.neoplus.adsl.tpnet.pl 16.07.07, 16:01
log początkowy hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:55:39, on 2007-07-16
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\WINDOWS\System32\brsvc01a.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\brss01a.exe
D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
D:\WINDOWS\system32\BRSPL01A.EXE
D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
D:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\tcpsvcs.exe
D:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\RunDll32.exe
D:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
D:\Program Files\QuickTime\qttask.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
D:\Program Files\Skype\Plugin Manager\SkypePM.exe
D:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
D:\Program Files\Microsoft Office\Office10\EXCEL.EXE
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\WinRAR\WinRAR.exe
D:\DOCUME~1\WLASCI~1\USTAWI~1\Temp\Rar$EX00.700\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O1 - Hosts: EVENT:HOST:127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -
D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1
\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program
Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} -
D:\PROGRA~1\FlashGet\fgiebar.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_01
\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software
Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1
\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [OrderReminder] D:\Program Files\Hewlett-
Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "D:\Program Files\Sony
Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "D:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Norton SystemWorks] "D:\Program Files\Norton
SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE
CfgWiz
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
(User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
(User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
(User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
(User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program
Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = D:\Program Files\SAGEM\SAGEM F@st 800-840
\dslmon.exe
O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = D:\Program
Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft
Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} -
D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) -
download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX
Control) - tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126650581218
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer
Class) - acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7B1E5172-FD6C-40DC-8B64-
B327F1C883E5}: NameServer = 217.96.88.14,195.150.102.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB9B07ED-15E9-45C0-B89E-
C09410EDFA9F}:
    • Gość: mif Re: Proszę o sprawdzenie loga IP: *.neoplus.adsl.tpnet.pl 16.07.07, 16:03
      Po przejechaniu fixwareout
      Username "Wlasciciel" - 2007-07-16 15:18:40 [Fixwareout edited 2007/07/05]

      »»»»»Prerun check

      Pomyślnie opróżniono pamięć podręczną programu rozpoznawania nazw DNS.


      System was rebooted successfully.

      »»»»» Postrun check
      HKLM\SOFTWARE\~\Winlogon\ "System"=""
      ....
      ....
      »»»»» Misc files.
      ....
      »»»»» Checking for older varients.
      ....

      »»»»» Current runs (hklm hkcu "run" Keys Only)
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "IgfxTray"="D:\\WINDOWS\\System32\\igfxtray.exe"
      "HotKeysCmds"="D:\\WINDOWS\\System32\\hkcmd.exe"
      "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
      "NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"
      "nwiz"="nwiz.exe /install"
      "NeroCheck"="D:\\WINDOWS\\system32\\NeroCheck.exe"
      "SunJavaUpdateSched"="D:\\Program Files\\Java\\j2re1.4.2_01\\bin\\jusched.exe"
      "HP Software Update"="D:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
      "ccApp"="\"D:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
      "Symantec NetDriver Monitor"="D:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
      "OrderReminder"="D:\\Program Files\\Hewlett-
      Packard\\OrderReminder\\OrderReminder.exe"
      "QuickTime Task"="\"D:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
      "Sony Ericsson PC Suite"="\"D:\\Program Files\\Sony Ericsson\\Mobile2
      \\Application Launcher\\Application Launcher.exe\" /startoptions"

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"="D:\\WINDOWS\\system32\\ctfmon.exe"
      "Skype"="\"D:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
      "Norton SystemWorks"="\"D:\\Program Files\\Norton
      SystemWorks\\cfgwiz.exe\" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE
      CfgWiz"
      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nView]
      "NVIEW"="rundll32.exe nview.dll,nViewLoadHook"
      ....
      Hosts file was reset, If you use a custom hosts file please replace it
      »»»»» End report »»»»»
      • Gość: mif Re: Proszę o sprawdzenie loga ostatni - dziękuję IP: *.neoplus.adsl.tpnet.pl 16.07.07, 16:06
        W efekcie HijackThis dał log:

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 15:34:19, on 2007-07-16
        Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.5730.0011)
        Boot mode: Normal

        Running processes:
        D:\WINDOWS\System32\smss.exe
        D:\WINDOWS\system32\winlogon.exe
        D:\WINDOWS\system32\services.exe
        D:\WINDOWS\system32\lsass.exe
        D:\WINDOWS\system32\svchost.exe
        D:\WINDOWS\System32\svchost.exe
        D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
        D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
        D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
        D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
        D:\WINDOWS\System32\brsvc01a.exe
        D:\WINDOWS\system32\spoolsv.exe
        D:\WINDOWS\System32\brss01a.exe
        D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        D:\WINDOWS\system32\BRSPL01A.EXE
        D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
        D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
        D:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
        D:\WINDOWS\System32\nvsvc32.exe
        D:\WINDOWS\System32\tcpsvcs.exe
        D:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
        D:\WINDOWS\System32\svchost.exe
        D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
        D:\WINDOWS\Explorer.EXE
        D:\WINDOWS\System32\svchost.exe
        D:\WINDOWS\system32\notepad.exe
        D:\WINDOWS\system32\RunDll32.exe
        D:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
        D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        D:\Program Files\Common Files\Symantec Shared\ccApp.exe
        D:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
        D:\Program Files\QuickTime\qttask.exe
        D:\WINDOWS\system32\ctfmon.exe
        D:\Program Files\Skype\Phone\Skype.exe
        D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
        D:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
        D:\Program Files\Skype\Plugin Manager\SkypePM.exe
        D:\Program Files\Internet Explorer\iexplore.exe
        D:\Program Files\WinRAR\WinRAR.exe
        D:\DOCUME~1\WLASCI~1\USTAWI~1\Temp\Rar$EX0o.h30\HijackThis.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
        go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.onet.pl/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
        go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
        go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
        go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
        go.microsoft.com/fwlink/?LinkId=69157
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
        D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -
        D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1
        \SPYBOT~1\SDHelper.dll
        O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program
        Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} -
        D:\PROGRA~1\FlashGet\fgiebar.dll (file missing)
        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
        D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
        O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
        O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\System32\hkcmd.exe
        O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_01
        \bin\jusched.exe
        O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software
        Update\HPWuSchd2.exe
        O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec
        Shared\ccApp.exe"
        O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1
        \SNDMon.exe /Consumer
        O4 - HKLM\..\Run: [OrderReminder] D:\Program Files\Hewlett-
        Packard\OrderReminder\OrderReminder.exe
        O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -
        atboottime
        O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "D:\Program Files\Sony
        Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
        O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [Skype] "D:\Program
        Files\Skype\Phone\Skype.exe" /nosplash /minimized
        O4 - HKCU\..\Run: [Norton SystemWorks] "D:\Program Files\Norton
        SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE
        CfgWiz
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
        (User 'USŁUGA LOKALNA')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
        (User 'USŁUGA SIECIOWA')
        O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
        (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
        (User 'Default user')
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program
        Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: DSLMON.lnk = D:\Program Files\SAGEM\SAGEM F@st 800-840
        \dslmon.exe
        O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = D:\Program
        Files\HP\Digital Imaging\bin\hpqthb08.exe
        O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft
        Office\Office10\OSA.EXE
        O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
        res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
        O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program
        Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
        Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
        O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) -
        download.ewido.net/ewidoOnlineScan.cab
        O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX
        Control) - tw.msi.com.tw/autobios/client/iftwclix.cab
        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
        update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126650581218
        O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
        acs.pandasoftware.com/activescan/as5free/asinst.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{7B1E5172-FD6C-40DC-8B64-B327F1C883E5}:
        NameServer = 217.96.88.14,195.150.102.1
        O17 - HKLM\System\CCS\Services\Tcpip\..\{BB9B07ED-15E9-45C0-B89E-C09410EDFA9F}:
        NameServer = 194.204.159.1 217.98.63.164
        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1
        \COMMON~1\Skype
        • Gość: Kolobos Re: Proszę o sprawdzenie loga ostatni - dziękuję IP: *.escom.net.pl 16.07.07, 18:03
          Po co wklejasz dwa razy log z hijackthis? Oba sie obciely.
          Napisz powod dla ktorego wklejasz log, a logi (z hijackthis i combofix) wklej na wklej.org i daj link.
          • Gość: mif Re: Już jest na wklej.org - dziękuję IP: *.neoplus.adsl.tpnet.pl 16.07.07, 22:55
            Skanując ewido, raport wykazał 2 programy szpiegujące, których nie mógł usunąć.
            Stąd mój niepokój i prośba :)
            • Gość: Kolobos Re: Już jest na wklej.org - dziękuję IP: *.escom.net.pl 16.07.07, 23:25
              Po wklejeniu na wklej miales podac link tutaj na forum, na przyszlosc pamietaj o tym.

              > Skanując ewido, raport wykazał 2 programy szpiegujące, których nie mógł
              > usunąć.

              W jakich plikach? Jakie mialy nazwy i lokalizacje?

              Zapewne o to chodzi:
              D:\WINDOWS\system32\drivers\vouayaxjcvfs.sys
              D:\WINDOWS\system32\drivers\hgjsybglqrgy.sys

              Oba pliki usun z dysku przy pomocy killbox'a z zaznaczona opcja delete on reboot, po kasacji daj LINK do nowego log'a z combofix oraz moze daj log z gmera z zakladki rootkit (opis w przyklejonym/naglowku forum).
              • Gość: mif Re: Już jest na wklej.org - dziękuję IP: *.neoplus.adsl.tpnet.pl 17.07.07, 01:41
                wklej.org/id/ac032fd598
                Niestety, nie mam raportu z ewido

                jeszcze raz dziękuję :)
                • Gość: Kolobos Re: Już jest na wklej.org - dziękuję IP: *.escom.net.pl 17.07.07, 02:27
                  Wyglada ok.
                  • Gość: mif Re: Jest O.K. - dziękuję n/t IP: *.neoplus.adsl.tpnet.pl 17.07.07, 10:56
Pełna wersja