Log z ht do sprawdzenia

crazyworld · 27 Kwiecień 2006 16:41

kaspersky znalazł trojana(Trojan-Downloader.Win32.Small.bke) i wyleczył (chyba) więc daje loga do sprawdzenia.

Dzięki

Logfile of HijackThis v1.99.1 Scan saved at 18:43:24, on 2006-04-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: E:\WINDOW\System32\smss.exe E:\WINDOW\system32\winlogon.exe E:\WINDOW\system32\services.exe E:\WINDOW\system32\lsass.exe E:\WINDOW\system32\svchost.exe E:\WINDOW\System32\svchost.exe E:\WINDOW\Explorer.EXE E:\WINDOW\system32\LEXBCES.EXE E:\WINDOW\system32\spoolsv.exe E:\WINDOW\system32\LEXPPS.EXE E:\Program Files\ewido\security suite\ewidoctrl.exe E:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE E:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe E:\WINDOW\System32\svchost.exe E:\Program Files\Veoh\VeohClientService.exe E:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe E:\Program Files\Creative\Desktop Wireless\mouse_2k.exe E:\Program Files\Creative\Desktop Wireless\kb_2k.exe E:\Program Files\Beniamin\tguard.exe E:\WINDOW\system32\ctfmon.exe E:\Program Files\Globe Software\StatBar\StatBar.exe E:\Program Files\Weather Watcher\ww.exe E:\Program Files\PeerGuardian2\pg2.exe E:\Program Files\Rainlendar\Rainlendar.exe E:\WINDOW\system32\wuauclt.exe E:\Program Files\Tlen\tlen.exe E:\Program Files\Opera\Opera.exe E:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\Rar$EX00.879\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local., R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - E:\Program Files\Desktop Sidebar\sbhelp.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - E:\PROGRA~1\FlashGet\jccatch.dll O4 - HKLM…\Run: [Easy-PrintToolBox] E:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM…\Run: [CreativeMouse] E:\Program Files\Creative\Desktop Wireless\mouse_2k.exe O4 - HKLM…\Run: [CreativeKeyboard] E:\Program Files\Creative\Desktop Wireless\kb_2k.exe O4 - HKLM…\Run: [tguard] E:\Program Files\Beniamin\tguard.exe O4 - HKLM…\Run: [KAVPersonal50] “E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe” /minimize O4 - HKLM…\Run: [Lexmark X1100 Series] “E:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe” O4 - HKLM…\Run: [WinampAgent] “E:\Program Files\Winamp\winampa.exe” O4 - HKCU…\Run: [CTFMON.EXE] E:\WINDOW\system32\ctfmon.exe O4 - HKCU…\Run: [statBar] E:\Program Files\Globe Software\StatBar\StatBar.exe O4 - HKCU…\Run: [WeatherWatcher] E:\Program Files\Weather Watcher\ww.exe O4 - HKCU…\Run: [peerguardian] E:\Program Files\PeerGuardian2\pg2.exe O4 - Startup: Rainlendar.lnk = E:\Program Files\Rainlendar\Rainlendar.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Pobierz z &BitSpirit - E:\Program Files\BitSpirit\bsurl.htm O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - E:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - E:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - E:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra ‘Tools’ menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - E:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\flashget.exe O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\flashget.exe O10 - Unknown file in Winsock LSP: e:\program files\bonjour\mdnsnsp.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O23 - Service: ewido security suite control - ewido networks - E:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPodService - Unknown owner - E:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: kavsvc - Kaspersky Lab - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - E:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - E:\WINDOW\system32\LEXBCES.EXE O23 - Service: Veoh Client Service - Veoh Networks, Inc. - E:\Program Files\Veoh\VeohClientService.exe

===================================

Zmień tytuł na konkretny => inaczej temat wyladuje w Śmietniku :evil:

Pozdrawiam kuz5

Bieniol · 27 Kwiecień 2006 16:45

Log jest czysty

crazyworld · 27 Kwiecień 2006 16:50

też fajnie.Dzieki za sprawdzenie zastanawiam się tylko co to jest to:

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll 

O10 - Unknown file in Winsock LSP: e:\window\system32\bnmndrv.dll

Bieniol · 27 Kwiecień 2006 16:54

To są wpisy w łańcuchu od Beniamina

crazyworld · 27 Kwiecień 2006 16:57

ok-jeszcze raz dzięki