Logi HijackThis - Upewniam się czy nie wykorzystuje łącza

[ProAs (Arepet13)]

Proszę o rozwiązanie mojego problemu, chcę się upewnić czy mam syf jakiś który wykorzystywałby moje łącze. Oto logi HijackThis 2.0.2

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:02:43, on 2009-09-14

Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\ATKKBService.exe

C:\Program Files\cFosSpeed\spd.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS\AhnRpta.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\cFosSpeed\cFosSpeed.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.neostrada.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Arek Petrylowski\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\AREKPE~1\USTAWI~1\Temp\herss.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [WinMem] C:\Program Files\WinCleaner Memory Optimizer\WinMemOpt.exe

O4 - HKCU\..\Run: [Dzieńdobry!] C:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: lsass.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html

O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe


--

End of file - 7357 bytes

[Magik]

Przepraszam, rozwiązanie czego - krzyżówki ?

Proszę konkretnie zatytułować temat i opisać swój problem.

[deFco247]

Pokaż logi OTL oraz GMER.

W GMER nic nie zmieniamy -> wciskamy Szukaj (skan potrwa kilkadziesiąt minut) -> po skanie Kopiuj.

Logi wklejasz na wklej.org lub wklej.to, a w poście dajesz link.

[ProAs (Arepet13)]

oto logi OTL : http://wklej.org/id/150024/

Logi GMER już zachwile.

@@ z logami GMER coś nie wychodzi ;/ nie wyswietla mi logow

[Agaton (Agatonster)]

Logi HijackThis

ProAs ,

Byłeś proszony o poprawę tytułu tematu na konkretny, mówiący o problemie - dlaczego ignorujesz zalecenie ? :?

Popraw - więcej uwag nie będzie. Kolejne zignorowanie zalecenia będzie skutkowało usunięciem tematu do Kosza.

[deFco247]

z logami GMER coś nie wychodzi ;/ nie wyświetla mi logów

Po skończonym skanie wciskasz Kopiuj i wklejasz zawartość schowka na wklej.org lub wklej.to

Usuń infekcje z pendrive lub kart pamięci za pomocą Flash Disinfector lub tych narzędzi.

Lub format.

W Custom Scans/Fixes w OTL wklej:

:Processes Explorer.EXE AhnRpta.exe O4 - HKU\S-1-5-21-1085031214-448539723-1417001333-1003…\Run: [WinMem] C:\Program Files\WinCleaner Memory Optimizer\WinMemOpt.exe File not found O4 - HKU.DEFAULT…\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-18…\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-19…\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-20…\RunOnce: [nltide_2] File not found O4 - Startup: C:\Documents and Settings\Arek Petrylowski\Menu Start\Programy\Autostart\lsass.exe () O32 - AutoRun File - [2009-09-14 17:03:02 | 00,000,051 | RHS- | M] () - C:\autorun.inf – [NTFS] O32 - AutoRun File - [2009-09-14 17:03:02 | 00,000,051 | RHS- | M] () - D:\autorun.inf – [NTFS] O33 - MountPoints2{31c8647b-8697-11de-828c-806d6172696f}\Shell\AutoRun\command - “” = C:\mjafm.exe – [2009-09-13 18:09:33 | 00,115,737 | RHS- | M] () O33 - MountPoints2{31c8647b-8697-11de-828c-806d6172696f}\Shell\open\Command - “” = C:\mjafm.exe – [2009-09-13 18:09:33 | 00,115,737 | RHS- | M] () O33 - MountPoints2{31c8647c-8697-11de-828c-806d6172696f}\Shell\AutoRun\command - “” = D:\mjafm.exe – [2009-09-13 18:09:33 | 00,115,737 | RHS- | M] () O33 - MountPoints2{31c8647c-8697-11de-828c-806d6172696f}\Shell\open\Command - “” = D:\mjafm.exe – [2009-09-13 18:09:33 | 00,115,737 | RHS- | M] () O33 - MountPoints2{3be1c77c-9bbe-11de-90eb-001bbf57b80f}\Shell\AutoRun\command - “” = J:\9cquqs.exe – File not found O33 - MountPoints2{3be1c77c-9bbe-11de-90eb-001bbf57b80f}\Shell\open\Command - “” = J:\9cquqs.exe – File not found O33 - MountPoints2{56b2700b-9083-11de-90b7-001bbf57b80f}\Shell\AutoRun\command - “” = J:\g8k.exe – File not found O33 - MountPoints2{56b2700b-9083-11de-90b7-001bbf57b80f}\Shell\open\Command - “” = J:\g8k.exe – File not found O33 - MountPoints2{56b2700c-9083-11de-90b7-001bbf57b80f}\Shell\AutoRun\command - “” = K:\g8k.exe – File not found O33 - MountPoints2{56b2700c-9083-11de-90b7-001bbf57b80f}\Shell\open\Command - “” = K:\g8k.exe – File not found O33 - MountPoints2{90e23482-88c3-11de-90a3-001bbf57b80f}\Shell\AutoRun\command - “” = J:\lcw.exe – File not found O33 - MountPoints2{90e23482-88c3-11de-90a3-001bbf57b80f}\Shell\open\Command - “” = J:\lcw.exe – File not found O33 - MountPoints2{a2757026-8762-11de-909f-001bbf57b80f}\Shell\AutoRun\command - “” = J:\o9bxu.exe – File not found O33 - MountPoints2{a2757026-8762-11de-909f-001bbf57b80f}\Shell\open\Command - “” = J:\o9bxu.exe – File not found O33 - MountPoints2{b4fb05fa-a038-11de-90fa-001bbf57b80f}\Shell\AutoRun\command - “” = I:\ph.exe – File not found O33 - MountPoints2{b4fb05fa-a038-11de-90fa-001bbf57b80f}\Shell\open\Command - “” = I:\ph.exe – File not found :Files C:\86.exe C:\mjafm.exe C:\qcoageh.exe C:\ph.exe C:\63trvn.bat C:\q0.exe C:\dogyx90.exe C:\etmt1.bat C:\nkv.bat C:\10nb.exe C:\w3.exe C:\3c.exe C:\9cquqs.exe C:\m.exe C:\y.bat C:\cj3k.exe C:\o9bxu.exe C:\ewqij.bat C:\i0yva6.exe C:\mt2.exe C:\frg89pi.bat C:\pkkwng.exe C:\xbvv0.exe C:\b.bat C:\t8s2x.exe C:\hx.exe C:\g8k.exe C:\kgji.exe C:\lcw.exe D:\86.exe D:\mjafm.exe D:\qcoageh.exe D:\ph.exe D:\63trvn.bat D:\q0.exe D:\dogyx90.exe D:\etmt1.bat D:\nkv.bat D:\10nb.exe D:\w3.exe D:\3c.exe D:\9cquqs.exe D:\m.exe D:\y.bat D:\cj3k.exe D:\o9bxu.exe D:\ewqij.bat D:\i0yva6.exe D:\mt2.exe D:\frg89pi.bat D:\pkkwng.exe D:\xbvv0.exe D:\b.bat D:\t8s2x.exe D:\hx.exe D:\g8k.exe D:\kgji.exe D:\lcw.exe :Commands [emptytemp] [start explorer]

Run Fix. Restart, jeśli będzie potrzebny.

Potem log z usuwania oraz nowy OTL.txt