|
Cytuj:
http://forum.pclab.pl/t268878.html Dałem na tych dwóch forach. Gdzie mam jeszcze loga umieścić ?? |
Odpowiedziałem na idg.pl ;)
A co do pliku hosts to użyj hijackthis do jego edycji. |
Poradnik nawet niezły. może pomoże tym co nie chcą mieć hacka ale nie sądze.
|
A mi tu jednego brakuje ... :P
Jeżeli w przeglądarce Internet Explorer mamy skonfigurowane proxy to te przekierowane hosty nic nie daja ! Przekierowane bo tak to można nazwać one nie są blokowane bo blokowane by byly gdyby byly wpisane w jakiś firewall W sumie ja radze całkowicie wywalić IEXPLORE***** z katalogow \Windows\System32\dllcache i \Program Files\Internet Explorer i działać na Firefoxie albo Operze ;S A jeszcze lepiej to wywalic całkowicie M$ Shita i zainstalować Linuxa Cytuj:
Dlaczego ma niby utrudniac zmienne ip w skanowaniu portow ? I co da że jakis pr0 h4x0r zna jakie masz uslugi odpalone na kompie jak itak nie da rady tego wykorzystac ... A bezpieczeństwa napewno nie poprawi ... h4xi0r! |
Mam pytanie...po zabezpieczeniu mój plik hosts powinien wyglądać tak:
127.0.0.1 localhost 127.0.0.1 owntibia.com 127.0.0.1 vip.owntibia.com 127.0.0.1 87.98.239.19 127.0.0.1 wizzard.home.pl ???? Dobrze to zrobiłem? ;p |
Logfile of HijackThis v1.99.1
Scan saved at 21:18:23, on 2007-07-13 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss***** C:\WINDOWS\system32\winlogon***** C:\WINDOWS\system32\services***** C:\WINDOWS\system32\lsass***** C:\WINDOWS\system32\svchost***** C:\WINDOWS\System32\svchost***** C:\WINDOWS\system32\spoolsv***** C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr***** C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc***** C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm***** C:\WINDOWS\System32\nvsvc32***** C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss***** C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui***** C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui***** C:\WINDOWS\System32\WgaTray***** C:\WINDOWS\Explorer***** C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc***** C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc***** D:\gry\steam\steam***** C:\Program Files\Gadu-Gadu\gg***** C:\Program Files\Teamspeak2_RC2\TeamSpeak***** C:\Program Files\Mozilla Firefox\firefox***** C:\Program Files\WinRAR\WinRAR***** C:\DOCUME~1\Artur\USTAWI~1\Temp\Rar$EX01.891\Hijac kThis***** R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: l2authd.lineage2.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll (file missing) O3 - Toolbar: Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc***** O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc***** /STARTUP O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32***** C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [Steam] "d:\gry\steam\steam*****" -silent O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg*****" /tray O4 - HKCU\..\Run: [Komunikator] "C:\Program Files\Tlen.pl\tlen*****" --confdir=home O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.74\AMVConverter\grab.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL*****/3000 O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.74\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1178306987437 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1178306949765 O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr***** O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc***** O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT***** O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32***** O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss***** Clean?:cyclops: |
@up
taaa masz chyba najladniejiejszy wpis jaki czytalem:) |
Moje loga !
Niejestempewien co do kilku ale dziś miałęm formata , jeśli to coś pomoże :P niechce znowu schrzanić systemu więc czekam na rady czego sie pozbyć :> Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:46:06, on 2007-07-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss***** C:\WINDOWS\system32\winlogon***** C:\WINDOWS\system32\services***** C:\WINDOWS\system32\lsass***** C:\WINDOWS\system32\svchost***** C:\WINDOWS\System32\svchost***** C:\Program Files\Alwil Software\Avast4\aswUpdSv***** C:\Program Files\Alwil Software\Avast4\ashServ***** C:\WINDOWS\Explorer***** C:\WINDOWS\system32\spoolsv***** C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol***** C:\WINDOWS\system32\Rundll32***** C:\PROGRA~1\NEOSTR~1\CnxMon***** C:\Program Files\Thomson\SpeedTouch USB\Dragdiag***** C:\PROGRA~1\NEOSTR~1\TaskbarIcon***** C:\PROGRA~1\ALWILS~1\Avast4\ashDisp***** C:\WINDOWS\system32\ctfmon***** C:\WINDOWS\system32\CTsvcCDA***** C:\Program Files\Alwil Software\Avast4\ashMaiSv***** C:\Program Files\Alwil Software\Avast4\ashWebSv***** C:\PROGRA~1\NEOSTR~1\ComComp***** C:\PROGRA~1\NEOSTR~1\Watch***** D:\Program Files\Gadu-Gadu\gg***** C:\PROGRA~1\MOZILL~1\FIREFOX***** C:\Program Files\Windows Media Player\wmplayer***** C:\WINDOWS\system32\taskmgr***** D:\Program Files\Trend Micro\HijackThis\HijackThis***** R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol***** /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg***** O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon***** O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag*****" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch***** O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon***** O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp***** O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa***** O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare*****" /pause O4 - HKCU\..\Run: [CTFMON*****] C:\WINDOWS\system32\ctfmon***** O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg*****" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON*****] C:\WINDOWS\system32\CTFMON***** (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON*****] C:\WINDOWS\system32\CTFMON***** (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON*****] C:\WINDOWS\system32\CTFMON***** (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON*****] C:\WINDOWS\system32\CTFMON***** (User 'Default user') O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs***** O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs***** O17 - HKLM\System\CCS\Services\Tcpip\..\{1833B75D-28FE-4C0F-803C-8A2D00BA70C6}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{1833B75D-28FE-4C0F-803C-8A2D00BA70C6}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv***** O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ***** O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv***** O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv***** O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA***** |
Poproszę o mały wzgląd ;D
Kod:
Logfile of Trend Micro HijackThis v2.0.0 (BETA) |
@Up i 2up
Czysto. |
Dzięki <10 znaków>
|
Poradnik ładnie opisany i wiele mi pomógł Wielkie Thx dla Autora ;p
|
Czy w tym może być key bo mi się zdaję
PHP Kod:
O4 - HKLM\..\Run: [orcToByloLatwe] C:\WINDOWS\winlogon***** |
Owntibia jak wół, tylko masz zamiast services, winlogon...
|
Aha ok już zaraz usówam weź też napisz ze winlogin tez moze byc
|
A czy jak usunę keya to już nie będzie tego wpisu w hijackthis?
|
Nie będę pisał, bo to może być dowolna nazwa. Poza tym daj loga na forum idg.pl albo na czymś podobnym bo masz jeszcze trochę syfu.
@Edit/up nie będzie. |
tzn co bym musiał jeszcze usunąć?
|
i czy ja powinienem z usuwaniem nie usówać service tylko winlogin ?
czy mam tak zrobić jak 2.Usuwanie Jeżeli wykryjemy na naszym komputerze owntibię uruchamiamy windows w trybie awaryjnym(klawisz F8 przy starcie systemu), oraz ponownie uruchamiamy hijackthin tym razem zaznaczamy "ptaszkiem" wpisy owntibii i klikamy na "fix checked". Teraz przechodzimy do katalogu C:\WINDOWS\ i usuwamy plik services. exe używając killbox'a http://www.idg.pl/ftp/pc_8881/Pocket.KillBox.2.0.0.473 . html Teraz ponownie uruchamiamy komputer i tworzymy log kontrolny by upewnić się o neutralizacji owntibii. |
Daj to an forum idg.pl, tam są eksperci i ci dokładnie powiedzą co i jak.
@Up Tak robisz wszystko jak opisałem tylko zamiast services, winlogon i nie pisz 500 postów pod rząd. |
Usunąłem hijackiem wpis oraz killboxem zaznaczyłem to usunięcia C:\WINDOWS\system32\winlogon***** jak dałem czarwony kwadracik do usunięcia wylogowało mnie. Uruchomiłem ponownie komputer. Teraz już wszystko powinno byś ok ??
Jak sprawdzić czy wszystko poprawnie zrobiłem? |
Napisz o tym na forum idg.pl z nowym logiem.
|
thx, przydalo mi sie :D uwazam ze temat powinien byc przyklejony
|
<ukłon>
Jestem ci bardzo wdzieczny za ten temat... :)
Logfile of HijackThis v1.99.1 Scan saved at 20:20:07, on 2007-07-30 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss***** C:\WINDOWS\system32\winlogon***** C:\WINDOWS\system32\services***** C:\WINDOWS\system32\lsass***** C:\WINDOWS\System32\Ati2evxx***** C:\WINDOWS\system32\svchost***** C:\WINDOWS\System32\svchost***** C:\WINDOWS\Explorer***** C:\Program Files\Alwil Software\Avast4\aswUpdSv***** C:\Program Files\Alwil Software\Avast4\ashServ***** C:\WINDOWS\System32\CTHELPER***** C:\PROGRA~1\NEOSTR~1\CnxMon***** C:\PROGRA~1\NEOSTR~1\TaskbarIcon***** C:\PROGRA~1\ALWILS~1\Avast4\ashDisp***** C:\WINDOWS\System32\ctfmon***** C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier***** C:\Program Files\Creative\MediaSource\Detector\CTDetect***** C:\Program Files\Messenger\MSMSGS***** C:\WINDOWS\system32\spoolsv***** C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon***** C:\WINDOWS\System32\CTsvcCDA***** C:\WINDOWS\System32\UAService7***** C:\WINDOWS\System32\MsPMSPSv***** C:\Program Files\Alwil Software\Avast4\ashMaiSv***** C:\Program Files\Alwil Software\Avast4\ashWebSv***** C:\WINDOWS\System32\wuauclt***** C:\Program Files\Neostrada TP\NeostradaTP***** C:\Program Files\Neostrada TP\ComComp***** C:\Program Files\Neostrada TP\Watch***** C:\Program Files\Internet Explorer\iexplore***** C:\Documents and Settings\Mateusz\Moje dokumenty\[email protected]\HijackThis***** R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SoundMan] SOUNDMAN***** O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER***** O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg***** O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet*****" O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl***** /run O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon***** O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch***** O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon***** O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp***** O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl*****" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON*****] C:\WINDOWS\System32\ctfmon***** O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg*****" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier***** O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect*****" /R O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS*****" /background O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon***** O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS***** O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS***** O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1184764752862 O17 - HKLM\System\CCS\Services\Tcpip\..\{16ED3AC6-D9D5-4D75-BE7D-ECD223E97FA3}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{16ED3AC6-D9D5-4D75-BE7D-ECD223E97FA3}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv***** O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx***** O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag***** O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ***** O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv*****" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv*****" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA***** O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService***** O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\System32\UAService7***** Cos tu moze mam?? :> |
plx :)
Prosilbym o sprawdzenie mojego jesli mozna ;P
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:09:16, on 2007-08-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss***** C:\WINDOWS\system32\winlogon***** C:\WINDOWS\system32\services***** C:\WINDOWS\system32\lsass***** C:\WINDOWS\system32\svchost***** C:\WINDOWS\System32\svchost***** C:\Program Files\Alwil Software\Avast4\aswUpdSv***** C:\Program Files\Alwil Software\Avast4\ashServ***** C:\WINDOWS\Explorer***** C:\PROGRA~1\ALWILS~1\Avast4\ashDisp***** C:\Program Files\CyberLink\PowerDVD\PDVDServ***** C:\WINDOWS\system32\spoolsv***** C:\Program Files\Java\jre1.5.0_09\bin\jusched***** C:\Program Files\Winamp\winampa***** C:\WINDOWS\system32\drivers\lsass***** C:\Program Files\Messenger\msmsgs***** C:\Program Files\Skype\Phone\Skype***** C:\Program Files\Gadu-Gadu\gg***** C:\WINDOWS\system32\svchost***** C:\Program Files\Alwil Software\Avast4\ashMaiSv***** C:\Program Files\Alwil Software\Avast4\ashWebSv***** C:\WINDOWS\system32\wscntfy***** C:\Program Files\Common Files\Teleca Shared\Generic***** C:\Documents and Settings\User\Pulpit\drchgfvhgbjhg\Mobile Phone Monitor\epmworker***** C:\Program Files\Winamp\winamp***** C:\Program Files\Mozilla Firefox\firefox***** C:\Program Files\Java\jre1.5.0_09\bin\jucheck***** C:\Program Files\Trend Micro\HijackThis\HijackThis***** R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tibia.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp***** O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ*****" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched*****" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa***** O4 - HKLM\..\Run: [] C:\WINDOWS\system32\drivers\lsass***** O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Documents and Settings\User\Pulpit\drchgfvhgbjhg\Application Launcher\Application Launcher*****" /startoptions O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs*****" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype*****" /nosplash /minimized O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam*****" -silent O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg*****" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON*****] C:\WINDOWS\system32\CTFMON***** (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON*****] C:\WINDOWS\system32\CTFMON***** (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON*****] C:\WINDOWS\system32\CTFMON***** (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON*****] C:\WINDOWS\system32\CTFMON***** (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9***** O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs***** O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs***** O12 - Plugin for .pcg: C:\Program Files\Internet Explorer\Plugins\nppcgplg.dll O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{98387A34-4605-4010-B6BE-CE33FE8C762F}: NameServer = 194.204.159.1,194.204.152.34 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv***** O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ***** O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv***** O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv***** -- End of file - 5664 bytes |
@Up
Proponuje www.pcformat.pl albo idg.pl |
@Cbo666
Masz sessera albo coś w tym stylu, zastosuj sie do tego co powiedział pan up. |
Swietny poradniek 9/10
|
dzienki za pomoc chlopcy :)
macie u mnie plusa |
|
Cytuj:
|
Zamieszcze tu mój skan systemu. Dziś miałem hacka więc napewno coś musi być -,- Prosze o wykrycie złych procesów i propo jak to usunąć -,-
Cytuj:
Wiz~ |
@Up
To Kod:
C:\WINDOWS\services*****Kod:
O4 - HKLM\..\Run: [Windows] C:\WINDOWS\services*****A plik C:\WINDOWS\services. exe kasujesz z dysku ręcznie. |
Hiho. Wiem że macie setki takich postów o sprawdzenie logów. Ja podaje mój bo parę wpisów mnie nie pokoi...
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:26:59, on 2007-08-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss***** C:\WINDOWS\system32\winlogon***** C:\WINDOWS\system32\services***** C:\WINDOWS\system32\lsass***** C:\WINDOWS\system32\svchost***** C:\WINDOWS\System32\svchost***** C:\Program Files\Alwil Software\Avast4\aswUpdSv***** C:\Program Files\Alwil Software\Avast4\ashServ***** C:\WINDOWS\system32\spoolsv***** C:\WINDOWS\ATKKBService***** C:\WINDOWS\system32\CTsvcCDA***** C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM***** C:\WINDOWS\system32\nvsvc32***** C:\WINDOWS\System32\svchost***** C:\WINDOWS\Explorer***** C:\Program Files\Alwil Software\Avast4\ashWebSv***** C:\WINDOWS\system32\WgaTray***** C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer***** C:\PROGRA~1\ALWILS~1\Avast4\ashDisp***** C:\WINDOWS\system32\rundll32***** D:\Program Files\D-Tools\daemon***** C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder***** D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy***** C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 9***** C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01***** C:\WINDOWS\system32\RUNDLL32***** C:\Program Files\Picasa2\PicasaMediaDetector***** C:\WINDOWS\system32\ctfmon***** C:\Program Files\Creative\Sync Manager Unicode\CTSyncU***** C:\Program Files\Messenger\msmsgs***** C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1**** * C:\Program Files\SAGEM\SAGEM F@st 800-840\DSLMON***** C:\Program Files\Mozilla Firefox\firefox***** C:\Program Files\Trend Micro\HijackThis\HijackThis***** R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem303.dll (file missing) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll (file missing) O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck***** O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer***** O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp***** O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32***** bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon*****" -lang 1033 O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder***** O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy*****" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 9***** O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01***** O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32***** C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz***** /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32***** C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector***** O4 - HKCU\..\Run: [Qdafo] C:\Program Files\Fgctw\Wktpkit***** O4 - HKCU\..\Run: [ctfmon*****] C:\WINDOWS\system32\ctfmon***** O4 - HKCU\..\Run: [CTSyncU*****] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU*****" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs*****" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON*****] C:\WINDOWS\System32\CTFMON***** (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON*****] C:\WINDOWS\System32\CTFMON***** (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON*****] C:\WINDOWS\System32\CTFMON***** (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON*****] C:\WINDOWS\System32\CTFMON***** (User 'Default user') O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC***** O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\DSLMON***** O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Program Files\Free Download Manager\dlpage.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL*****/3000 O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel***** O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel***** O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs***** O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs***** O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_63.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache...p1.0.0.8-2.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://bezpieczenstwo.onet.pl/skaner/ArcaOnline.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{AB49741D-E454-469C-921A-B814D0912334}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv***** O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService***** O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ***** O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv***** O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv***** O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA***** O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService***** O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32***** O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC***** (file missing) -- End of file - 7854 bytes Mam nadzieje że to tylko kilka toolbarów albo jakiś mało groźny syf.;) |
Dwa wpisy są bezpieczne, ale co do tego:
Kod:
O4 - HKCU\..\Run: [Qdafo] C:\ProgramFiles\Fgctw\Wktpkit***** |
Cytuj:
|
Logfile of HijackThis v1.99.1
Scan saved at 20:50:50, on 2007-08-28 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss***** C:\WINDOWS\SYSTEM32\winlogon***** C:\WINDOWS\system32\services***** C:\WINDOWS\system32\lsass***** C:\WINDOWS\system32\svchost***** C:\WINDOWS\System32\svchost***** d:\Program Files\Alwil Software\Avast4\aswUpdSv***** d:\Program Files\Alwil Software\Avast4\ashServ***** C:\WINDOWS\Explorer***** C:\WINDOWS\system32\spoolsv***** C:\Program Files\Analog Devices\SoundMAX\Smtray***** D:\Program Files\HP\HP Software Update\HPWuSchd2***** D:\PROGRA~1\ALWILS~1\Avast4\ashDisp***** C:\Program Files\Java\jre1.6.0_02\bin\jusched***** D:\Program Files\Creative\Mouse Optical\mouse_2k***** D:\Program Files\Zone Labs\ZoneAlarm\zlclient***** D:\Program Files\Google\Gmail Notifier\gnotify***** C:\Winamp\winampa***** C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\Go ogleToolbarNotifier***** C:\WINDOWS\System32\nvsvc32***** D:\Program Files\Advanced Registry Doctor\RegDfrgSch***** C:\WINDOWS\System32\HPZipm12***** d:\Program Files\Advanced Registry Doctor\RegManServ***** D:\Program Files\Gadu-Gadu\gg***** C:\WINDOWS\System32\svchost***** D:\Program Files\HP\Digital Imaging\bin\hpqtra08***** D:\Program Files\Vasilios Applications\TranspApps\TranspApps***** D:\Program Files\HP\Digital Imaging\bin\hpqimzone***** D:\Program Files\HP\Digital Imaging\bin\hpqSTE08***** d:\Program Files\Alwil Software\Avast4\ashWebSv***** d:\Program Files\Alwil Software\Avast4\ashMaiSv***** C:\WINDOWS\system32\ZoneLabs\vsmon***** c:\Winamp\winamp***** C:\WINDOWS\System32\WgaTray***** C:\Program Files\firefox***** C:\Documents and Settings\Przemek\Pulpit\HijackThis***** R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\PROGRA~1\FlashGet\getflash.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray***** O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32***** C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck***** O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2***** O4 - HKLM\..\Run: [DrvListnr] C:\Program Files\Analog Devices\SoundMAX\DrvListnr***** O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp***** O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ*****" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched*****" O4 - HKLM\..\Run: [CreativeMouse ] d:\Program Files\Creative\Mouse Optical\mouse_2k***** O4 - HKLM\..\Run: [ZoneAlarm Client] "d:\Program Files\Zone Labs\ZoneAlarm\zlclient*****" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] d:\Program Files\Google\Gmail Notifier\gnotify***** O4 - HKLM\..\Run: [nwiz] nwiz***** /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32***** C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] c:\Winamp\winampa***** O4 - HKCU\..\Run: [BPS Spyware Remover] d:\Program Files\BulletProofSoft.com\BPS Spyware Remover\SpyRem***** O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\Go ogleToolbarNotifier***** O4 - HKCU\..\Run: ["C:\WINDOWS\SoftwareDistribution\Download\6365088f 85b501588ee599470d0e71a8\msmsgs*****" /background] "C:\Program Files\Messenger\msmsgs*****" /background O4 - HKCU\..\Run: [RegDfrgSch] D:\Program Files\Advanced Registry Doctor\RegDfrgSch***** /tray O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg*****" /tray O4 - Startup: TranspApps.lnk = D:\Program Files\Vasilios Applications\TranspApps\TranspApps***** O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08***** O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqthb08***** O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA***** O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet*****/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet*****/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet*****/AddLink.htm O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL*****/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget***** O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget***** O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS***** (file missing) O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS***** (file missing) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv***** O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ***** O23 - Service: avast! Mail Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashMaiSv*****" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashWebSv*****" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32***** O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12***** O23 - Service: Registry Management Service (RegManServ) - Unknown owner - d:\Program Files\Advanced Registry Doctor\RegManServ***** O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon***** Prosiłbym o pw, i powiedz mi jeśli możesz, czy ogólnie tu się czai jakiś vir/script/inny syf? Bo ostatnio był hack. |
@2up
obaj nie macie owntibi i innego shitu, moze jakies niepotrzebne toolbary i spyware, nie sprawdzalem tak dokladnie |
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 09:59:56, on 2007-08-29 Platform: Windows Vista (WinNT 6.00.1904) Boot mode: Normal Running processes: C:\Windows\system32\Dwm***** C:\Windows\system32\taskeng***** C:\Windows\Explorer***** C:\Program Files\Windows Defender\MSASCui***** C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier***** C:\Program Files\Mozilla Firefox\firefox***** C:\Users\Paweł\Desktop\HiJackThis_v2***** R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui***** -hide O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa***** O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig*****" /auto O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg*****" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier***** O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6...ws-i586-jc.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx***** O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService***** O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService***** -- End of file - 3508 bytes Chce wiedziec czy jestem bezpieczny PS jak wzialem w viscie zeby pokaza all procesy to tam bylo ich od chuuuja... I nie wiem czy sie bac czy nie |
Wygląda na czysty...aczkolwiek nie znam się na procesach systemowych visty. Daj loga na idg.pl albo na forum.pcformat.pl
|
| Wszystkie czasy podano w strefie GMT +2. Teraz jest 06:57. |
Powered by vBulletin 3