fixujesz a to, a tak to okO4 - HKLM..RunOnce: [iMeshBar Uninstall] rundll32 CROGRA~1UNINST~1.DLL,O -2
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -[/b]
Chcesz sprawdzić swój log z Hijackthisa? Wklej go tutaj...
- Thread starter patology
- Rozpoczęty
- Status
T4j3mn1czy
Użytkownik
- Dołączył
- Styczeń 2, 2006
- Posty
- 4
Zobaczcie mój
Kod:
Logfile of HijackThis v1.99.1
Scan saved at 14:06:28, on 2006-03-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:usrMYSQLbinmysqld.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32WgaTray.exe
C:WINDOWSsystem32wscntfy.exe
C:Program FilesJavajre1.5.0_06binjusched.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesGadu-Gadugg.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesBitCometBitComet.exe
C:Program FilesWindows Media Playerwmplayer.exe
F:instalkiHijackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:Program FilesRXToolBarsfcont.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.5.0_06binssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavajre1.5.0_06binjusched.exe
O4 - HKLM..Run: [SemanticInsight] C:Program FilesRXToolBarSemantic InsightSemanticInsight.exe
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengerMSMSGS.EXE" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:program filesgoogleGoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:program filesgoogleGoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:program filesgoogleGoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:program filesgoogleGoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:program filesgoogleGoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:program filesgoogleGoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:Program FilesVisualRoutevrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:Program FilesVisualRoutevrie.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_06binssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_06binssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O17 - HKLMSystemCCSServicesTcpip..{C8690E8E-811F-4D17-986E-55BDCB1CF08F}: NameServer = 194.204.152.34,217.98.63.164
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:Program FilesRXToolBarsfcont.dll
O20 - Winlogon Notify: WgaLogon - C:WINDOWSSYSTEM32WgaLogon.dll
O23 - Service: MySql - Unknown owner - c:usr/MYSQL/bin/mysqld.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%WinPcaprpcapd.exe" -d -f "%ProgramFiles%WinPcaprpcapd.ini (file missing)to FIXO2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C
O17 - HKLMSystemCCSServicesTcpip..{C8690E8E-811F-4D17-986E-55BDCB1CF08F}: NameServer = 194.204.152.34,217.98.63.164
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C
T4j3mn1czy
Użytkownik
- Dołączył
- Styczeń 2, 2006
- Posty
- 4
Ok dzięki
Ale to są moje dnsy " O17 - HKLMSystemCCSServicesTcpip..{C8690E8E-811F-4D17-986E-55BDCB1CF08F}: NameServer = 194.204.152.34,217.98.63.164 "
Więc raczej nie powinienem tego usuwać
Więc raczej nie powinienem tego usuwać
'194.204.152.34,217.98.63.164'Originally posted by T4j3mn1czy
Ok dziękiAle to są moje dnsy " O17 - HKLMSystemCCSServicesTcpip..{C8690E8E-811F-4D17-986E-55BDCB1CF08F}: NameServer = 194.204.152.34,217.98.63.164 "
Więc raczej nie powinienem tego usuwać
Sorry, nie usuwaj to jest prawidlowe =]
...
Możecie powiedziec cos na temat tych dwuch wpisów.
Możecie powiedziec cos na temat tych dwuch wpisów.
Mam jeszcze jedno pyatnie. Otóż przeskanowałem system antywirusem (BitDefender 9 Professional Plus) i wykrył mi coś takiego:O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)(file missing), O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C
O ile się nie myle to ten plik jest niezbedny do prawidłowego działania systemu, jeżeli jest on zainfekowany da się go przywrucic do poprzedniego stanu??
Komputer zaczyna się "nienormalnie" zachowywać: wolno pracuje, wolno otwierają się strony WWW, zamiast strony X otwiera się Y, często pojawiają się dziwne błędy i komunikaty, nowe (Dziwne) przyciski na pasku przeglądarki IE, na pasku obok zegara (Najczęściej dialery) zaczynają tajemniczo znikać pliki, połączenie z Internetem trwa 30s ... itp.
Może oznaczać tylko jedno - mamy gościa ...
by Aniołek.
Może oznaczać tylko jedno - mamy gościa ...
by Aniołek.
Re: ...
O ile sie nie myle to prawidlowy svchost jest tu --> C:Windowssystem32. Ten svchost z c:windows jest trojanem --> usun wpis w hijackthis, nastepnie usun plik w killboxie.
Mam jeszcze jedno pyatnie. Otóż przeskanowałem system antywirusem (BitDefender 9 Professional Plus) i wykrył mi coś takiego:O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)(file missing), O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C
O ile się nie myle to ten plik jest niezbedny do prawidłowego działania systemu, jeżeli jest on zainfekowany da się go przywrucic do poprzedniego stanu??[/b][/quote]
O ile sie nie myle to prawidlowy svchost jest tu --> C:Windowssystem32. Ten svchost z c:windows jest trojanem --> usun wpis w hijackthis, nastepnie usun plik w killboxie.
http://www.searchengines.pl/phpbb203/index...showtopic=15989
Logfile of HijackThis v1.99.1
Scan saved at 23:01:26, on 19/04/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
Crogram FilesCommon FilesSymantec SharedccSetMgr.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
Crogram FilesCommon FilesSymantec SharedccEvtMgr.exe
Crogram FilesCommon FilesSymantec SharedccApp.exe
Crogram FilesMessengermsmsgs.exe
C:WINDOWSwupdmgr.exe
C:WINDOWSosaupd.exe
C:WINDOWSsystem32spoolsv.exe
Crogram FilesCommon FilesSymantec SharedccProxy.exe
C:WINDOWSS2F0aWUcommand.exe
Crogram FilesNorton Internet SecurityNorton AntiVirusnavapsvc.exe
Crogram FilesNorton Internet SecurityNorton AntiVirusSAVScan.exe
Crogram FilesCommon FilesSymantec SharedSNDSrvc.exe
Crogram FilesInventelGatewaywlancfg.exe
C:WINDOWSSystem32wuauclt.exe
C:WINDOWSsystem32ezSP_Px.exe
Crogram FilesWindows Media Playerwmplayer.exe
Crogram FilesInternet Exploreriexplore.exe
Crogram FilesInternet Exploreriexplore.exe
Crogram FilesInternet Exploreriexplore.exe
crogra~1intern~1iexplore.exe
Cocuments and SettingsKatieDesktopHiJackHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = about:blank
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.wanadoo.co.uk/iesearch/default.htm
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = about:blank
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.wanadoo.co.uk/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = about:blank
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:blank
R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://www.wanadoo.co.uk/cd_redirects/wanadoohome
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Microsoft Internet Explorer provided by Wanadoo
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - CROGRA~1WanadooWSBarWSBar.dll
O4 - HKLM..Run: [ccApp] "Crogram FilesCommon FilesSymantec SharedccApp.exe"
O4 - HKLM..Run: [URLLSTCK.exe] Crogram FilesNorton Internet SecurityUrlLstCk.exe
O8 - Extra context menu item: &Google Search - res://crogram filesgoogleGoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://crogram filesgoogleGoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://crogram filesgoogleGoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://crogram filesgoogleGoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download with NetPumper - Crogram FilesNetPumperAddUrl.htm
O8 - Extra context menu item: Search with Wanadoo - res://CROGRA~1WanadooWSBarWSBar.dll/VSearch.htm
O8 - Extra context menu item: Similar Pages - res://crogram filesgoogleGoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://crogram filesgoogleGoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavaj2re1.4.2_03binnpjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavaj2re1.4.2_03binnpjpi142_03.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_39.cab
O16 - DPF: {A6212120-01D4-11D5-9A39-0080C8D85044} (GameDesire Slots 70th) - http://67.15.101.3/g_bin/pl/slots70_2_0_0_26.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/1.cab
O20 - Winlogon Notify: ThemeManager - C:WINDOWSsystem32lv0609dse.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:WINDOWSSystem32Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - Crogram FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - Crogram FilesCommon FilesSymantec SharedccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - Crogram FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - Crogram FilesCommon FilesSymantec SharedccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:WINDOWSS2F0aWUcommand.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - Crogram FilesNorton Internet SecurityNorton AntiVirusnavapsvc.exe
O23 - Service: PACSPTISVR - Unknown owner - Crogram FilesCommon FilesSony SharedAVLibPacsptisvr.exe
O23 - Service: SAVScan - Symantec Corporation - Crogram FilesNorton Internet SecurityNorton AntiVirusSAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - CROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - Crogram FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - Crogram FilesCommon FilesSony SharedAVLibSptisrv.exe
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - Crogram Filessonyvaio media music serverSSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - Crogram FilesCommon FilesSony Sharedvaio media platformsv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsMusicServerHTTP (file missing)
O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - Crogram FilesCommon FilesSony Sharedvaio media platformUPnPFramework.exe
O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - Crogram Filessonyphoto serverappsrvPhotoAppSrv.exe
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - Crogram FilesCommon Filessony sharedvaio media platformSV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsPhotoServerHTTP (file missing)
O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - Crogram FilesCommon Filessony sharedvaio media platformUPnPFramework.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - Crogram FilesInventelGatewaywlancfg.exe
Moze ktos pomoc mam cos w rejestrze co sie nazywa cmdservice i nei mozna usunac . po za tym wiele innych procesow uruchamia sie podczas otwierania komputera. Nie mozan polowy usunac probowalem spybootem regdoctorem winoptimizerem niszczarkoplikow recznie wszystko i nic nie poskutkowalo nadal jest a uzywalem tez l2mfix.
Nic nie pomaga jakies dziadostwa sie uruchamia przy kazdorazowym uruchomieniu komputera i nie wiemjak to wywalic. Bo nic nie dziala. Mam nortona chociaz wiem ze to beznadziejny antywirus jak naprawie wgram lepszy ale co jest z tym ze nie mozna usunac tego cmdservice?? A razem z tym wszystkim uruchamia sie wiele innych programow min Adware Reviews ktory otwiera co sekunde strony np
http://www.topadwarereviews.com/?adv=196&ads=d
Pomozcie mam na dysku dane ktore ie chce utracic podczas formatowania.
Jesli mozna prosic o pomoc bede wdzieczny
Scan saved at 23:01:26, on 19/04/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C
rogram FilesCommon FilesSymantec SharedccSetMgr.exeC:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C
rogram FilesCommon FilesSymantec SharedccEvtMgr.exeC
rogram FilesCommon FilesSymantec SharedccApp.exeC
rogram FilesMessengermsmsgs.exeC:WINDOWSwupdmgr.exe
C:WINDOWSosaupd.exe
C:WINDOWSsystem32spoolsv.exe
C
rogram FilesCommon FilesSymantec SharedccProxy.exeC:WINDOWSS2F0aWUcommand.exe
C
rogram FilesNorton Internet SecurityNorton AntiVirusnavapsvc.exeC
rogram FilesNorton Internet SecurityNorton AntiVirusSAVScan.exeC
rogram FilesCommon FilesSymantec SharedSNDSrvc.exeC
rogram FilesInventelGatewaywlancfg.exeC:WINDOWSSystem32wuauclt.exe
C:WINDOWSsystem32ezSP_Px.exe
C
rogram FilesWindows Media Playerwmplayer.exeC
rogram FilesInternet Exploreriexplore.exeC
rogram FilesInternet Exploreriexplore.exeC
rogram FilesInternet Exploreriexplore.exec
rogra~1intern~1iexplore.exeC
ocuments and SettingsKatieDesktopHiJackHijackThis.exeR1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = about:blank
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.wanadoo.co.uk/iesearch/default.htm
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = about:blank
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.wanadoo.co.uk/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = about:blank
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:blank
R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://www.wanadoo.co.uk/cd_redirects/wanadoohome
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Microsoft Internet Explorer provided by Wanadoo
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C
ROGRA~1WanadooWSBarWSBar.dllO4 - HKLM..Run: [ccApp] "C
rogram FilesCommon FilesSymantec SharedccApp.exe"O4 - HKLM..Run: [URLLSTCK.exe] C
rogram FilesNorton Internet SecurityUrlLstCk.exeO8 - Extra context menu item: &Google Search - res://c
rogram filesgoogleGoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: &Translate English Word - res://c
rogram filesgoogleGoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: Backward Links - res://c
rogram filesgoogleGoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://c
rogram filesgoogleGoogleToolbar2.dll/cmcache.htmlO8 - Extra context menu item: Download with NetPumper - C
rogram FilesNetPumperAddUrl.htmO8 - Extra context menu item: Search with Wanadoo - res://C
ROGRA~1WanadooWSBarWSBar.dll/VSearch.htmO8 - Extra context menu item: Similar Pages - res://c
rogram filesgoogleGoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Translate Page into English - res://c
rogram filesgoogleGoogleToolbar2.dll/cmtrans.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C
rogram FilesJavaj2re1.4.2_03binnpjpi142_03.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C
rogram FilesJavaj2re1.4.2_03binnpjpi142_03.dllO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_39.cab
O16 - DPF: {A6212120-01D4-11D5-9A39-0080C8D85044} (GameDesire Slots 70th) - http://67.15.101.3/g_bin/pl/slots70_2_0_0_26.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/1.cab
O20 - Winlogon Notify: ThemeManager - C:WINDOWSsystem32lv0609dse.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:WINDOWSSystem32Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C
rogram FilesCommon FilesSymantec SharedccEvtMgr.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C
rogram FilesCommon FilesSymantec SharedccProxy.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C
rogram FilesCommon FilesSymantec SharedccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C
rogram FilesCommon FilesSymantec SharedccSetMgr.exeO23 - Service: Command Service (cmdService) - Unknown owner - C:WINDOWSS2F0aWUcommand.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C
rogram FilesNorton Internet SecurityNorton AntiVirusnavapsvc.exeO23 - Service: PACSPTISVR - Unknown owner - C
rogram FilesCommon FilesSony SharedAVLibPacsptisvr.exeO23 - Service: SAVScan - Symantec Corporation - C
rogram FilesNorton Internet SecurityNorton AntiVirusSAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C
ROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C
rogram FilesCommon FilesSymantec SharedSNDSrvc.exeO23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C
rogram FilesCommon FilesSony SharedAVLibSptisrv.exeO23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C
rogram Filessonyvaio media music serverSSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C
rogram FilesCommon FilesSony Sharedvaio media platformsv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsMusicServerHTTP (file missing)O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C
rogram FilesCommon FilesSony Sharedvaio media platformUPnPFramework.exeO23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C
rogram Filessonyphoto serverappsrvPhotoAppSrv.exeO23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C
rogram FilesCommon Filessony sharedvaio media platformSV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsPhotoServerHTTP (file missing)O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C
rogram FilesCommon Filessony sharedvaio media platformUPnPFramework.exeO23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C
rogram FilesInventelGatewaywlancfg.exeMoze ktos pomoc mam cos w rejestrze co sie nazywa cmdservice i nei mozna usunac . po za tym wiele innych procesow uruchamia sie podczas otwierania komputera. Nie mozan polowy usunac probowalem spybootem regdoctorem winoptimizerem niszczarkoplikow recznie wszystko i nic nie poskutkowalo nadal jest a uzywalem tez l2mfix.
Nic nie pomaga jakies dziadostwa sie uruchamia przy kazdorazowym uruchomieniu komputera i nie wiemjak to wywalic. Bo nic nie dziala. Mam nortona chociaz wiem ze to beznadziejny antywirus jak naprawie wgram lepszy ale co jest z tym ze nie mozna usunac tego cmdservice?? A razem z tym wszystkim uruchamia sie wiele innych programow min Adware Reviews ktory otwiera co sekunde strony np
http://www.topadwarereviews.com/?adv=196&ads=d
Pomozcie mam na dysku dane ktore ie chce utracic podczas formatowania.
Jesli mozna prosic o pomoc bede wdzieczny
W trybie awaryjnym i bez przywracania systemu
znajdz i usuń pliki z dysku
C:WINDOWSwupdmgr.exe <--
C:WINDOWSosaupd.exe <--
C:WINDOWSS2F0aWUcommand.exe <-- cały folder "S2F0aWU" wywal
jak bedą oporne użyj Killboxa
KillBox
Instrukcja do Killbox
Fix w Hijack
Jak instalowałes to zostaw jak nie to wywal:
Skan Ewido lub Spybot
Sp2 by się przydał i zmien albo aktualizuj IE bo dziurawiec ;/
znajdz i usuń pliki z dysku
C:WINDOWSwupdmgr.exe <--
C:WINDOWSosaupd.exe <--
C:WINDOWSS2F0aWUcommand.exe <-- cały folder "S2F0aWU" wywal
jak bedą oporne użyj Killboxa
KillBox
Instrukcja do Killbox
Fix w Hijack
Kod:
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = about:blank
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = about:blank
O8 - Extra context menu item: Search with Wanadoo - res://C:PROGRA~1WanadooWSBarWSBar.dll/VSearch.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - [url]http://www.azebar.com/install/1.cab[/url]
O20 - Winlogon Notify: ThemeManager - C:WINDOWSsystem32lv0609dse.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:WINDOWSS2F0aWUcommand.exeJak instalowałes to zostaw jak nie to wywal:
Kod:
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:Program Filessonyvaio media music serverSSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:Program FilesCommon FilesSony Sharedvaio media platformsv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsMusicServerHTTP (file missing)
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:Program FilesCommon Filessony sharedvaio media platformSV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsPhotoServerHTTP (file missing)Skan Ewido lub Spybot
Sp2 by się przydał i zmien albo aktualizuj IE bo dziurawiec ;/
TO i ja sobie nie będę żałował. Ściągnąłem podejrzaną gierkę któa się nie chciała zainstalować nigdzie indziej niż w C:/Windows. CTOP:
Logfile of HijackThis v1.99.1
Scan saved at 1:32:28 PM, on 5/7/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32CTHELPER.EXE
Crogram FilesJavajre1.5.0_06binjusched.exe
Crogram FilesiTunesiTunesHelper.exe
Crogram FilesQuickTimeqttask.exe
C:WINDOWSSystem32ctfmon.exe
Crogram FilesMSN MessengerMsnMsgr.Exe
Crogram FilesSkypePhoneSkype.exe
C:WINDOWSSystem32nvsvc32.exe
C:WINDOWSSystem32svchost.exe
Crogram FilesiPodbiniPodService.exe
Crogram FilesGadu-Gadugg.exe
Crogram FilesMozilla Firefoxfirefox.exe
Crogram FilesWinRARWinRAR.exe
COCUME~1MaxLOCALS~1TempRar$EX00.966HijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://g.msn.com/0SEENUS/SAOS01
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - Crogram FilesYahoo!CompanionInstallscpnyt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - Crogram FilesJavajre1.5.0_06binssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Crogram FilesYahoo!CompanionInstallscpnyt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O4 - HKLM..Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 - HKLM..Run: [Jet Detection] "Crogram FilesCreativeSBLivePROGRAMADGJDet.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [SunJavaUpdateSched] Crogram FilesJavajre1.5.0_06binjusched.exe
O4 - HKLM..Run: [iTunesHelper] "Crogram FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [QuickTime Task] "Crogram FilesQuickTimeqttask.exe" -atboottime
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 - HKCU..Run: [MsnMsgr] "Crogram FilesMSN MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [Skype] "Crogram FilesSkypePhoneSkype.exe" /nosplash /minimized
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.5.0_06binssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.5.0_06binssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O17 - HKLMSystemCCSServicesTcpip..{6C80199F-5FA8-4CC5-949D-4DDDD81C8638}: NameServer = 194.72.0.98,194.72.9.38
O17 - HKLMSystemCS1ServicesTcpip..{6C80199F-5FA8-4CC5-949D-4DDDD81C8638}: NameServer = 194.72.0.98,194.72.9.38
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "CROGRA~1MSNMES~1msgrapp.dll" (file missing)
O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - Crogram FilesSpikurl_wpmsg.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - Crogram FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - Crogram FilesiPodbiniPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSSystem32nvsvc32.exe
Logfile of HijackThis v1.99.1
Scan saved at 1:32:28 PM, on 5/7/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32CTHELPER.EXE
C
rogram FilesJavajre1.5.0_06binjusched.exeC
rogram FilesiTunesiTunesHelper.exeC
rogram FilesQuickTimeqttask.exeC:WINDOWSSystem32ctfmon.exe
C
rogram FilesMSN MessengerMsnMsgr.ExeC
rogram FilesSkypePhoneSkype.exeC:WINDOWSSystem32nvsvc32.exe
C:WINDOWSSystem32svchost.exe
C
rogram FilesiPodbiniPodService.exeC
rogram FilesGadu-Gadugg.exeC
rogram FilesMozilla Firefoxfirefox.exeC
rogram FilesWinRARWinRAR.exeC
OCUME~1MaxLOCALS~1TempRar$EX00.966HijackThis.exeR1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://g.msn.com/0SEENUS/SAOS01
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C
rogram FilesYahoo!CompanionInstallscpnyt.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C
rogram FilesJavajre1.5.0_06binssv.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C
rogram FilesYahoo!CompanionInstallscpnyt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O4 - HKLM..Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 - HKLM..Run: [Jet Detection] "C
rogram FilesCreativeSBLivePROGRAMADGJDet.exe"O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [SunJavaUpdateSched] C
rogram FilesJavajre1.5.0_06binjusched.exeO4 - HKLM..Run: [iTunesHelper] "C
rogram FilesiTunesiTunesHelper.exe"O4 - HKLM..Run: [QuickTime Task] "C
rogram FilesQuickTimeqttask.exe" -atboottimeO4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 - HKCU..Run: [MsnMsgr] "C
rogram FilesMSN MessengerMsnMsgr.Exe" /backgroundO4 - HKCU..Run: [Skype] "C
rogram FilesSkypePhoneSkype.exe" /nosplash /minimizedO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C
rogram FilesJavajre1.5.0_06binssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C
rogram FilesJavajre1.5.0_06binssv.dllO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O17 - HKLMSystemCCSServicesTcpip..{6C80199F-5FA8-4CC5-949D-4DDDD81C8638}: NameServer = 194.72.0.98,194.72.9.38
O17 - HKLMSystemCS1ServicesTcpip..{6C80199F-5FA8-4CC5-949D-4DDDD81C8638}: NameServer = 194.72.0.98,194.72.9.38
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C
ROGRA~1MSNMES~1msgrapp.dll" (file missing)O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C
rogram FilesSpikurl_wpmsg.dllO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C
rogram FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C
rogram FilesiPodbiniPodService.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSSystem32nvsvc32.exe
Bartek_wawa
Użytkownik
- Dołączył
- Styczeń 16, 2006
- Posty
- 29
Logfile of HijackThis v1.99.1
Scan saved at 17:14:34, on 2006-05-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
Drogram FilesSygateSPFsmc.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
drogram FilesBorlandInterBasebinibguard.exe
drogram FilesEsetnod32krn.exe
drogram FilesBorlandInterBasebinibserver.exe
C:WINDOWSSOUNDMAN.EXE
Crogram FilesJavajre1.5.0_06binjusched.exe
Crogram FilesDAEMON Toolsdaemon.exe
Drogram FilesEsetnod32kui.exe
DROGRAM FILESFRAPSFRAPS.EXE
Crogram FilesLinksysWireless-B PCI AdapterOdHost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
Drogram FilesSkypePhoneSkype.exe
Drogram FilesVentSrvventrilo_srv.exe
D:gryCall of DutyQ3E Minimizer_v1.45.exe
Drogram FileseMule 0.47a-MorphXTv8.0-binemuleemule.exe
Drogram Filesfoobar2000foobar2000.exe
Drogram FilesOperaOpera.exe
Drogram FilesGadu-Gadugg.exe
drogram FilesWinRARWinRAR.exe
COCUME~1BartekUSTAWI~1TempRar$EX00.656HijackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.wirusy.onet.pl/
R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://megapanel.gem.pl/q.php?s=ORPAYyUXg9...4161222&n=1
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - Crogram FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - drogram FilesSpybot - Search & DestroySDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - Crogram FilesJavajre1.5.0_06binssv.dll
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [SunJavaUpdateSched] Crogram FilesJavajre1.5.0_06binjusched.exe
O4 - HKLM..Run: [DAEMON Tools] "Crogram FilesDAEMON Toolsdaemon.exe" -lang 1033
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [SmcService] DROGRA~1SygateSPFsmc.exe -startgui
O4 - HKLM..Run: [nod32kui] "drogram FilesEsetnod32kui.exe" /WAITSERVICE
O4 - HKCU..Run: [Fraps] DROGRAM FILESFRAPSFRAPS.EXE
O4 - HKCU..Run: [eMuleAutoStart] Drogram FileseMule 0.47a-MorphXTv8.0-binemuleemule.exe -AutoStart
O4 - Startup: Xfire.lnk = Drogram FilesXfireXfire.exe
O4 - Global Startup: Wireless-B Notebook Adapter Utility.lnk = Crogram FilesLinksysWireless-B PCI AdapterStartup.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://CROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz z &BitSpirit - Crogram FilesBitSpiritbsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.5.0_06binssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.5.0_06binssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - CROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://bezpieczenstwo.onet.pl/skaner/ArcaOnline.cab
O17 - HKLMSystemCCSServicesTcpip..{5BD238BE-EFEF-4065-91CF-3F122DC06FBA}: NameServer = 195.225.121.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - drogram FilesBorlandInterBasebinibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - drogram FilesBorlandInterBasebinibserver.exe
O23 - Service: MySql - Unknown owner - c:usr/MYSQL/bin/mysqld.exe (file missing)
O23 - Service: NICSer_WMP11 - Unknown owner - Crogram FilesLinksysWireless-B PCI AdapterNICServ.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - drogram FilesEsetnod32krn.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - Drogram FilesSygateSPFsmc.exe
Chyba wszystko wporządku... ale może jednak :>
Scan saved at 17:14:34, on 2006-05-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
D
rogram FilesSygateSPFsmc.exeC:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
d
rogram FilesBorlandInterBasebinibguard.exed
rogram FilesEsetnod32krn.exed
rogram FilesBorlandInterBasebinibserver.exeC:WINDOWSSOUNDMAN.EXE
C
rogram FilesJavajre1.5.0_06binjusched.exeC
rogram FilesDAEMON Toolsdaemon.exeD
rogram FilesEsetnod32kui.exeD
ROGRAM FILESFRAPSFRAPS.EXEC
rogram FilesLinksysWireless-B PCI AdapterOdHost.exeC:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
D
rogram FilesSkypePhoneSkype.exeD
rogram FilesVentSrvventrilo_srv.exeD:gryCall of DutyQ3E Minimizer_v1.45.exe
D
rogram FileseMule 0.47a-MorphXTv8.0-binemuleemule.exeD
rogram Filesfoobar2000foobar2000.exeD
rogram FilesOperaOpera.exeD
rogram FilesGadu-Gadugg.exed
rogram FilesWinRARWinRAR.exeC
OCUME~1BartekUSTAWI~1TempRar$EX00.656HijackThis.exeR0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.wirusy.onet.pl/
R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://megapanel.gem.pl/q.php?s=ORPAYyUXg9...4161222&n=1
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C
rogram FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - d
rogram FilesSpybot - Search & DestroySDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C
rogram FilesJavajre1.5.0_06binssv.dllO4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [SunJavaUpdateSched] C
rogram FilesJavajre1.5.0_06binjusched.exeO4 - HKLM..Run: [DAEMON Tools] "C
rogram FilesDAEMON Toolsdaemon.exe" -lang 1033O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [SmcService] D
ROGRA~1SygateSPFsmc.exe -startguiO4 - HKLM..Run: [nod32kui] "d
rogram FilesEsetnod32kui.exe" /WAITSERVICEO4 - HKCU..Run: [Fraps] D
ROGRAM FILESFRAPSFRAPS.EXEO4 - HKCU..Run: [eMuleAutoStart] D
rogram FileseMule 0.47a-MorphXTv8.0-binemuleemule.exe -AutoStartO4 - Startup: Xfire.lnk = D
rogram FilesXfireXfire.exeO4 - Global Startup: Wireless-B Notebook Adapter Utility.lnk = C
rogram FilesLinksysWireless-B PCI AdapterStartup.exeO8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C
ROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000O8 - Extra context menu item: Pobierz z &BitSpirit - C
rogram FilesBitSpiritbsurl.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C
rogram FilesJavajre1.5.0_06binssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C
rogram FilesJavajre1.5.0_06binssv.dllO9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C
ROGRA~1MICROS~2OFFICE11REFIEBAR.DLLO16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://bezpieczenstwo.onet.pl/skaner/ArcaOnline.cab
O17 - HKLMSystemCCSServicesTcpip..{5BD238BE-EFEF-4065-91CF-3F122DC06FBA}: NameServer = 195.225.121.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - d
rogram FilesBorlandInterBasebinibguard.exeO23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - d
rogram FilesBorlandInterBasebinibserver.exeO23 - Service: MySql - Unknown owner - c:usr/MYSQL/bin/mysqld.exe (file missing)
O23 - Service: NICSer_WMP11 - Unknown owner - C
rogram FilesLinksysWireless-B PCI AdapterNICServ.exeO23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - d
rogram FilesEsetnod32krn.exeO23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - D
rogram FilesSygateSPFsmc.exeChyba wszystko wporządku... ale może jednak :>
Logfile of HijackThis v1.99.1
Scan saved at 21:23:49, on 2006-05-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
crogram FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
Crogram FilesEsetnod32krn.exe
Crogram FilesSpyware Doctorsdhelp.exe
C:WINDOWSsystem32slserv.exe
C:WINDOWSsystem32wdfmgr.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
Crogram FilesQuickTimeqttask.exe
Crogram FilesEsetnod32kui.exe
Crogram FilesJavajre1.5.0_06binjusched.exe
Crogram FilesWinampwinampa.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSBricoPacksVista InspiratObjectDockObjectDock.exe
C:WINDOWSBricoPacksVista InspiratYzToolbarYzToolBar.exe
C:Mozilla FireFoxfirefox.exe
C:Gadu - gaduGadu-Gadugg.exe
Cocuments and SettingsIrena WilkockaPulpithijackthisHijackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.silkroad-online.pl/
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O1 - Hosts: 222.111.150.111 gwgt1.joymax.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - Crogram FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - CROGRA~1SPYWAR~1toolsiesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - Crogram FilesJavajre1.5.0_06binssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - CROGRA~1SPYWAR~1toolsiesdpb.dll
O4 - HKLM..Run: [QuickTime Task] "Crogram FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [nod32kui] "Crogram FilesEsetnod32kui.exe" /WAITSERVICE
O4 - HKLM..Run: [SunJavaUpdateSched] Crogram FilesJavajre1.5.0_06binjusched.exe
O4 - HKLM..Run: [WinampAgent] Crogram FilesWinampwinampa.exe
O4 - HKCU..Run: [Gadu-Gadu] "C:Gadu - gaduGadu-Gadugg.exe" /tray
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:WINDOWSBricoPacksVista InspiratObjectDockObjectDock.exe
O4 - Startup: Y'z ToolBar.lnk = C:WINDOWSBricoPacksVista InspiratYzToolbarYzToolBar.exe
O4 - Global Startup: Microsoft Office.lnk = Crogram FilesOfficeOffice10OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.5.0_06binssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.5.0_06binssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - CROGRA~1SPYWAR~1toolsiesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Crogram FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Crogram FilesMessengermsmsgs.exe
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLMSystemCCSServicesTcpip..{2502161A-B12E-4A2B-AAB3-78CAF29E9CE2}: NameServer = 192.168.2.1
O17 - HKLMSystemCCSServicesTcpip..{3A8CF8DB-89FD-4763-B312-EE68A65D4C61}: NameServer = 192.168.2.1
O17 - HKLMSystemCS1ServicesTcpip..{2502161A-B12E-4A2B-AAB3-78CAF29E9CE2}: NameServer = 192.168.2.1
O20 - Winlogon Notify: igfxcui - C:WINDOWSSYSTEM32igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:WINDOWSSYSTEM32WgaLogon.dll
O23 - Service: AVK Service (AVKService) - Unknown owner - Crogram FilesAntiVirenKitAVKService.exe (file missing)
O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - Crogram FilesAntiVirenKitAVKWCtl.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - Crogram FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - Crogram FilesEsetnod32krn.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - Crogram FilesSpyware Doctorsdhelp.exe
O23 - Service: SmartLinkService (SLService) - - C:WINDOWSSYSTEM32slserv.exe
Prosilbym o sprawdzenie mojego Scana
Scan saved at 21:23:49, on 2006-05-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
c
rogram FilesCommon FilesMicrosoft SharedVS7Debugmdm.exeC
rogram FilesEsetnod32krn.exeC
rogram FilesSpyware Doctorsdhelp.exeC:WINDOWSsystem32slserv.exe
C:WINDOWSsystem32wdfmgr.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
C
rogram FilesQuickTimeqttask.exeC
rogram FilesEsetnod32kui.exeC
rogram FilesJavajre1.5.0_06binjusched.exeC
rogram FilesWinampwinampa.exeC:WINDOWSsystem32ctfmon.exe
C:WINDOWSBricoPacksVista InspiratObjectDockObjectDock.exe
C:WINDOWSBricoPacksVista InspiratYzToolbarYzToolBar.exe
C:Mozilla FireFoxfirefox.exe
C:Gadu - gaduGadu-Gadugg.exe
C
ocuments and SettingsIrena WilkockaPulpithijackthisHijackThis.exeR0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.silkroad-online.pl/
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O1 - Hosts: 222.111.150.111 gwgt1.joymax.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C
rogram FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dllO2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C
ROGRA~1SPYWAR~1toolsiesdsg.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C
rogram FilesJavajre1.5.0_06binssv.dllO2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C
ROGRA~1SPYWAR~1toolsiesdpb.dllO4 - HKLM..Run: [QuickTime Task] "C
rogram FilesQuickTimeqttask.exe" -atboottimeO4 - HKLM..Run: [nod32kui] "C
rogram FilesEsetnod32kui.exe" /WAITSERVICEO4 - HKLM..Run: [SunJavaUpdateSched] C
rogram FilesJavajre1.5.0_06binjusched.exeO4 - HKLM..Run: [WinampAgent] C
rogram FilesWinampwinampa.exeO4 - HKCU..Run: [Gadu-Gadu] "C:Gadu - gaduGadu-Gadugg.exe" /tray
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:WINDOWSBricoPacksVista InspiratObjectDockObjectDock.exe
O4 - Startup: Y'z ToolBar.lnk = C:WINDOWSBricoPacksVista InspiratYzToolbarYzToolBar.exe
O4 - Global Startup: Microsoft Office.lnk = C
rogram FilesOfficeOffice10OSA.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C
rogram FilesJavajre1.5.0_06binssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C
rogram FilesJavajre1.5.0_06binssv.dllO9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C
ROGRA~1SPYWAR~1toolsiesdpb.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C
rogram FilesMessengermsmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C
rogram FilesMessengermsmsgs.exeO16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLMSystemCCSServicesTcpip..{2502161A-B12E-4A2B-AAB3-78CAF29E9CE2}: NameServer = 192.168.2.1
O17 - HKLMSystemCCSServicesTcpip..{3A8CF8DB-89FD-4763-B312-EE68A65D4C61}: NameServer = 192.168.2.1
O17 - HKLMSystemCS1ServicesTcpip..{2502161A-B12E-4A2B-AAB3-78CAF29E9CE2}: NameServer = 192.168.2.1
O20 - Winlogon Notify: igfxcui - C:WINDOWSSYSTEM32igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:WINDOWSSYSTEM32WgaLogon.dll
O23 - Service: AVK Service (AVKService) - Unknown owner - C
rogram FilesAntiVirenKitAVKService.exe (file missing)O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C
rogram FilesAntiVirenKitAVKWCtl.exe (file missing)O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C
rogram FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exeO23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C
rogram FilesEsetnod32krn.exeO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C
rogram FilesSpyware Doctorsdhelp.exeO23 - Service: SmartLinkService (SLService) - - C:WINDOWSSYSTEM32slserv.exe
Prosilbym o sprawdzenie mojego Scana
Co mam wywalic??
Kod:
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32logonui.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesLexmark 5200 serieslxbtbmgr.exe
C:Program FilesWinampwinampa.exe
C:WINDOWSSystem32winzip.exe
C:Program FilesLexmark 5200 serieslxbtbmon.exe
C:Program FilesGadu-Gadugg.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32wuauclt.exe
C:Program FilesWinampwinamp.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Documents and SettingsChudyPulpitHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = [url]ftp://[email protected]/[/url]
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O4 - HKLM..Run: [Lexmark 5200 series] "C:Program FilesLexmark 5200 serieslxbtbmgr.exe"
O4 - HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 - HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 -k
O4 - HKLM..Run: [Microsoft Machinex] omgs.exe
O4 - HKLM..Run: [AdobeReaderPro] winzip.exe
O4 - HKLM..RunServices: [Microsoft Machinex] omgs.exe
O4 - HKLM..RunServices: [AdobeReaderPro] winzip.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O23 - Service: MySql - Unknown owner - c:usr/MYSQL/bin/mysqld.exe (file missing)Meżecie mi sprawdzić to:
Logfile of HijackThis v1.99.1
Scan saved at 17:48:57, on 2006-05-13
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
Crogram FilesGadu-Gadugg.exe
Crogram FilesRAM Idle StandardRAM_2K.exe
Crogram FilesSkypePhoneSkype.exe
Crogram FilesInternet Exploreriexplore.exe
Crogram FilesBearShareBearShare.exe
Crogram FilesFlashGetflashget.exe
Crogram FilesYNSYNS.exe
Crogram FilesInternet Exploreriexplore.exe
Crogram FilesWinRARWinRAR.exe
COCUME~1SzymonUSTAWI~1TempRar$EX00.324HijackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.onet.pl/
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - crogram filesgooglegoogletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - crogram filesgooglegoogletoolbar1.dll
O4 - HKLM..Run: [RAM Idle] Crogram FilesRAM Idle StandardRAM_2K.exe
O4 - HKLM..Run: [YNS] Crogram FilesYNSYNS.exe
O4 - HKCU..Run: [Gadu-Gadu] "Crogram FilesGadu-Gadugg.exe" /tray
O4 - HKCU..Run: [Skype] "Crogram FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - Startup: Gadu-Gadu.lnk = Crogram FilesGadu-Gadugg.exe
O4 - Startup: Dzieńdobry!.lnk = ?
O4 - Global Startup: Skype.lnk = Crogram FilesSkypePhoneSkype.exe
O4 - Global Startup: eTrust EZ Antivirus.lnk = Crogram FilesCAeTrust EZ ArmoreTrust EZ AntivirusCAV.exe
O4 - Global Startup: BearShare.lnk = Crogram FilesBearShareBearShare.exe
O8 - Extra context menu item: &Google Search - res://Crogram FilesGoogleGoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://Crogram FilesGoogleGoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://Crogram FilesGoogleGoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://Crogram FilesGoogleGoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://Crogram FilesGoogleGoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://Crogram FilesGoogleGoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - Crogram FilesFlashGetjc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - Crogram FilesFlashGetjc_all.htm
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar1.google.com/data/pl/big/1.1...g/GoogleNav.cab
O20 - Winlogon Notify: WgaLogon - C:WINDOWS
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - Crogram FilesCAeTrust EZ ArmoreTrust EZ AntivirusVetMsg.exe
Logfile of HijackThis v1.99.1
Scan saved at 17:48:57, on 2006-05-13
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C
rogram FilesGadu-Gadugg.exeC
rogram FilesRAM Idle StandardRAM_2K.exeC
rogram FilesSkypePhoneSkype.exeC
rogram FilesInternet Exploreriexplore.exeC
rogram FilesBearShareBearShare.exeC
rogram FilesFlashGetflashget.exeC
rogram FilesYNSYNS.exeC
rogram FilesInternet Exploreriexplore.exeC
rogram FilesWinRARWinRAR.exeC
OCUME~1SzymonUSTAWI~1TempRar$EX00.324HijackThis.exeR0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.onet.pl/
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c
rogram filesgooglegoogletoolbar1.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c
rogram filesgooglegoogletoolbar1.dllO4 - HKLM..Run: [RAM Idle] C
rogram FilesRAM Idle StandardRAM_2K.exeO4 - HKLM..Run: [YNS] C
rogram FilesYNSYNS.exeO4 - HKCU..Run: [Gadu-Gadu] "C
rogram FilesGadu-Gadugg.exe" /trayO4 - HKCU..Run: [Skype] "C
rogram FilesSkypePhoneSkype.exe" /nosplash /minimizedO4 - Startup: Gadu-Gadu.lnk = C
rogram FilesGadu-Gadugg.exeO4 - Startup: Dzieńdobry!.lnk = ?
O4 - Global Startup: Skype.lnk = C
rogram FilesSkypePhoneSkype.exeO4 - Global Startup: eTrust EZ Antivirus.lnk = C
rogram FilesCAeTrust EZ ArmoreTrust EZ AntivirusCAV.exeO4 - Global Startup: BearShare.lnk = C
rogram FilesBearShareBearShare.exeO8 - Extra context menu item: &Google Search - res://C
rogram FilesGoogleGoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: &Translate English Word - res://C
rogram FilesGoogleGoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: Backward Links - res://C
rogram FilesGoogleGoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://C
rogram FilesGoogleGoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: Similar Pages - res://C
rogram FilesGoogleGoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Translate Page into English - res://C
rogram FilesGoogleGoogleToolbar1.dll/cmtrans.htmlO8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C
rogram FilesFlashGetjc_link.htmO8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C
rogram FilesFlashGetjc_all.htmO16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar1.google.com/data/pl/big/1.1...g/GoogleNav.cab
O20 - Winlogon Notify: WgaLogon - C:WINDOWS
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C
rogram FilesCAeTrust EZ ArmoreTrust EZ AntivirusVetMsg.exeC:WINDOWSsystem32svchost.exe
C:WINDOWScsrss.exe
C:WINDOWSSOUNDMAN.EXE
Crogram FilesD-Toolsdaemon.exe
Crogram FilesJavajre1.5.0_06binjusched.exe
C:WINDOWSsystem32LVCOMSX.EXE
Crogram FilesLogitechVideoLogiTray.exe
CROGRA~1ALWILS~1Avast4ashDisp.exe
Crogram FilesGadu-Gadugg.exe
Crogram FilesD-Link AirPlusAirPlus.exe
Crogram FilesLogitechVideoFxSvr2.exe
Crogram FilesAlwil SoftwareAvast4ashSimpl.exe
Crogram FilesInternet Exploreriexplore.exe
C:WINDOWSsystem32NOTEPAD.EXE
Cocuments and SettingsWiejakPulpitHijackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - Crogram FilesJavajre1.5.0_06binssv.dll
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [DAEMON Tools-1033] "Crogram FilesD-Toolsdaemon.exe" -lang 1045
O4 - HKLM..Run: [SunJavaUpdateSched] Crogram FilesJavajre1.5.0_06binjusched.exe
O4 - HKLM..Run: [LVCOMSX] C:WINDOWSsystem32LVCOMSX.EXE
O4 - HKLM..Run: [LogitechVideoRepair] Crogram FilesLogitechVideoISStart.exe
O4 - HKLM..Run: [LogitechVideoTray] Crogram FilesLogitechVideoLogiTray.exe
O4 - HKLM..Run: [avast!] CROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [Synchronization Manager] %SystemRoot%system32mobsync.exe /logon
O4 - HKLM..Run: [PinnacleDriverCheck] C:WINDOWSsystem32PSDrvCheck.exe -CheckReg
O4 - HKCU..Run: [Gadu-Gadu] "Crogram FilesGadu-Gadugg.exe" /tray
O4 - Global Startup: Adobe Reader Speed Launch.lnk = Crogram FilesAdobeAcrobat 7.0Readerreader_sl.exe
O4 - Global Startup: D-Link AirPlus.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.5.0_06binssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.5.0_06binssv.dll
O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - Crogram FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - Crogram FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32nvsvc32.exe
Szczególny nacisk klade na C:WINDOWScsrss.exe cos nie tak z tym moim zdanie
C:WINDOWScsrss.exe
C:WINDOWSSOUNDMAN.EXE
C
rogram FilesD-Toolsdaemon.exeC
rogram FilesJavajre1.5.0_06binjusched.exeC:WINDOWSsystem32LVCOMSX.EXE
C
rogram FilesLogitechVideoLogiTray.exeC
ROGRA~1ALWILS~1Avast4ashDisp.exeC
rogram FilesGadu-Gadugg.exeC
rogram FilesD-Link AirPlusAirPlus.exeC
rogram FilesLogitechVideoFxSvr2.exeC
rogram FilesAlwil SoftwareAvast4ashSimpl.exeC
rogram FilesInternet Exploreriexplore.exeC:WINDOWSsystem32NOTEPAD.EXE
C
ocuments and SettingsWiejakPulpitHijackThis.exeR0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C
rogram FilesJavajre1.5.0_06binssv.dllO4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [DAEMON Tools-1033] "C
rogram FilesD-Toolsdaemon.exe" -lang 1045O4 - HKLM..Run: [SunJavaUpdateSched] C
rogram FilesJavajre1.5.0_06binjusched.exeO4 - HKLM..Run: [LVCOMSX] C:WINDOWSsystem32LVCOMSX.EXE
O4 - HKLM..Run: [LogitechVideoRepair] C
rogram FilesLogitechVideoISStart.exe O4 - HKLM..Run: [LogitechVideoTray] C
rogram FilesLogitechVideoLogiTray.exeO4 - HKLM..Run: [avast!] C
ROGRA~1ALWILS~1Avast4ashDisp.exeO4 - HKLM..Run: [Synchronization Manager] %SystemRoot%system32mobsync.exe /logon
O4 - HKLM..Run: [PinnacleDriverCheck] C:WINDOWSsystem32PSDrvCheck.exe -CheckReg
O4 - HKCU..Run: [Gadu-Gadu] "C
rogram FilesGadu-Gadugg.exe" /trayO4 - Global Startup: Adobe Reader Speed Launch.lnk = C
rogram FilesAdobeAcrobat 7.0Readerreader_sl.exeO4 - Global Startup: D-Link AirPlus.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C
rogram FilesJavajre1.5.0_06binssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C
rogram FilesJavajre1.5.0_06binssv.dllO20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C
rogram FilesAlwil SoftwareAvast4aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - C
rogram FilesAlwil SoftwareAvast4ashServ.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32nvsvc32.exe
Szczególny nacisk klade na C:WINDOWScsrss.exe cos nie tak z tym moim zdanie
l-PL- Status