czytom
8 Styczeń 2008 12:53
#1
Witam
Mam dziwne objawy na jednej z maszyn. Jeden (co prawda stary ramol ADM Athlon 700 MHz) z kompów podczas pracy zwiesza się, na liście błędów jest dziwna informacja, że inny użytkownik używa tej samej nazwy?
Czy można by prosić o sprawdzenie logów, czy czego tam nie ma. Od czegoś muszę zacząć
Logfile of HijackThis v1.99.1 Scan saved at 12:49:57, on 2008-01-08 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: D:\WINNT\System32\smss.exe D:\WINNT\system32\winlogon.exe D:\WINNT\system32\services.exe D:\WINNT\system32\lsass.exe D:\WINNT\system32\svchost.exe D:\WINNT\system32\LEXBCES.EXE D:\WINNT\system32\spoolsv.exe D:\WINNT\system32\LEXPPS.EXE D:\WINNT\system32\acs.exe D:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe D:\Program Files\ArcaBit\ArcaUpdate\update.exe D:\WINNT\System32\svchost.exe D:\Program Files\FERRO Software\Ferro Backup System\FBSWorker.exe D:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe D:\WINNT\system32\regsvc.exe D:\WINNT\system32\MSTask.exe D:\WINNT\System32\WBEM\WinMgmt.exe D:\WINNT\system32\svchost.exe D:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe D:\WINNT\Explorer.EXE D:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe D:\Program Files\ArcaBit\Common\TaskScheduler.exe D:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe D:\Program Files\TP-LINK\TWCU\TWCU.exe D:\Program Files\ArcaBit\ArcaVir\ABregmon.exe D:\Program Files\ArcaBit\ArcaVir\AVMenu.exe D:\Program Files\Nix-Ware\DOSprinter\DOSprint.exe D:\WINNT\system32\internat.exe C:\Program Files\Arisco\KASA-depozyty\kasa.exe A:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx O4 - HKLM…\Run: [synchronization Manager] mobsync.exe /logon O4 - HKLM…\Run: [NeroCheck] D:\WINNT\system32\NeroCheck.exe O4 - HKLM…\Run: [TWCU] “D:\Program Files\TP-LINK\TWCU\TWCU.exe” -nogui O4 - HKLM…\Run: [ABRegmon] D:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM…\Run: [AvMenu] D:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM…\Run: [ArcaCheck] D:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKLM…\Run: [NixWareDOSPrint] “D:\Program Files\Nix-Ware\DOSprinter\DOSprint.exe” /hide O4 - HKCU…\Run: [internat.exe] internat.exe O4 - HKCU…\Run: [MailScanner] C:\Program Files\MKS_VIR_2006\Mks_mail.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup … 3351111322 O16 - DPF: {B9C1D4C0-A59C-47F5-A3D2-1A4DF7341F08} (InfSave Class) - https://www.cdn.com.pl/izam/_rejinf/cdnsrs.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_24.cab O20 - Winlogon Notify: TS_LogonListener - D:\WINNT\SYSTEM32\TS_LogonListener.dll O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - D:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - D:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - D:\WINNT\system32\acs.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - D:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - D:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit sp. z o.o. - D:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - D:\Program Files\ArcaBit\ArcaUpdate\update.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe O23 - Service: Ferro Backup System - Worker (FBSWorker) - Unknown owner - D:\Program Files\FERRO Software\Ferro Backup System\FBSWorker.exe" -SERVICE (file missing) O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - D:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - D:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: HASPSrv - CDN - D:\WINNT\system32\HASPSrv.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINNT\system32\LEXBCES.EXE
Gutek
8 Styczeń 2008 20:29
#2
Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=213350
HJT Ok
Daj log z ComboFix