Komputer jest zamulony itp=/

Dla specjalistów Bezpieczeństwo
#1

log z hijackthis

#


Logfile of Trend Micro HijackThis v2.0.2


#


Scan saved at 23:33:24, on 2009-08-11


#


Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)


#


MSIE: Internet Explorer v7.00 (7.00.6000.20583)


#


Boot mode: Normal


#



#


Running processes:


#


C:\WINDOWS\System32\smss.exe


#


C:\WINDOWS\system32\winlogon.exe


#


C:\WINDOWS\system32\services.exe


#


C:\WINDOWS\system32\lsass.exe


#


C:\WINDOWS\system32\nvsvc32.exe


#


C:\WINDOWS\system32\svchost.exe


#


C:\WINDOWS\System32\svchost.exe


#


C:\WINDOWS\system32\spoolsv.exe


#


F:\Webserv\xampp\apache\bin\apache.exe


#


C:\WINDOWS\EXPLORER.EXE


#


F:\Webserv\xampp\mysql\bin\mysqld-nt.exe


#


C:\WINDOWS\system32\RUNDLL32.EXE


#


C:\WINDOWS\RTHDCPL.EXE


#


C:\PROGRA~1\NEOSTR~1\CnxMon.exe


#


C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe


#


C:\WINDOWS\system32\ctfmon.exe


#


C:\Program Files\Gadu-Gadu\gg.exe


#


C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe


#


C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe


#


C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\smgr34.exe


#


F:\Webserv\xampp\apache\bin\apache.exe


#


C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe


#


C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe


#


C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe


#


C:\PROGRA~1\NEOSTR~1\ComComp.exe


#


C:\PROGRA~1\NEOSTR~1\Watch.exe


#


C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe


#


C:\Program Files\Google\Picasa3\PicasaPhotoViewer.exe


#


C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


#



#


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl


#


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


#


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


#


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


#


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


#


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 


#


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 


#


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 


#


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP


#


R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 


#


R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL


#


F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE


#


O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll


#


O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll


#


O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll


#


O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll


#


O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll


#


O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll


#


O4 - HKLM\..\Run: [nwiz] nwiz.exe /install


#


O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit


#


O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup


#


O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE


#


O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"


#


O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe


#


O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe


#


O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe


#


O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe


#


O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"


#


O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


#


O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray


#


O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"


#


O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe


#


O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe


#


O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe


#


O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE


#


O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')


#


O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')


#


O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')


#


O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')


#


O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')


#


O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')


#


O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')


#


O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')


#


O4 - Startup: smgr34.exe


#


O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe


#


O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200


#


O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll


#


O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


#


O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


#


O17 - HKLM\System\CCS\Services\Tcpip\..\{8737AAB1-BBC0-443E-AEF8-0EBF39B3932A}: NameServer = 194.204.159.1 217.98.63.164


#


O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll


#


O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll


#


O23 - Service: Apache2.2 - Apache Software Foundation - F:\Webserv\xampp\apache\bin\apache.exe


#


O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe


#


O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - F:\Webserv\xampp\FileZillaFTP\FileZillaServer.exe


#


O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe


#


O23 - Service: mysql - Unknown owner - F:\Webserv\xampp\mysql\bin\mysqld-nt.exe


#


O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe


#


O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe


#


O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


#


O23 - Service: XAMPP Service (XAMPP) - Unknown owner - c:\xampp\service.exe (file missing)


#



#


--


#


End of file - 7347 bytes
#2

Logi wklejasz na wklej.org lub wklej.to, a w poście dajesz link.

Fix w HiJackThis: ( Do a system scan only -> zaznaczasz pola przy podanych niżej wpisach -> Fix checked )

Pokaż logi OTL oraz GMER.

W GMER nic nie zmieniamy -> wciskamy Szukaj (skan potrwa kilkadziesiąt minut) -> po skanie Kopiuj.

#3

Niestety nie mogę uruchomić OTL i GMER nie wiem dlaczego może jest tak zamulony komputer=/

#4

Uruchom w trybie awaryjnym (F8 przy starcie)

#5

ok zrobiłem loga gmer

http://www.wklej.org/id/134085/

i olt

http://www.wklej.org/id/134097/

#6

a ten CTFMON.EXE co to u mnie on tez działa wykryło mi go jako wirus i jak np ruszam myszką to się zatrzymuje a potem spowrotem działa