Logi - po problemie z netem


(Kosior6) #1

Witam. Miałem dzisiaj chwilowy problem z netem, otóz łączył sie normalnie, a na żadną stronę wejśc nie mogołem :(, kompunikator sie ni łączył, więc zadzwoniłem do pomocy technicznej i mi powiedzieli że u nich OK, więć wyłączyłem komputer, za pare minut przyszedłem włączam, net się połączyłi wszystko działa, ale mysle ze mógł to spowodowac jakiś wirus, a tym bardziej sie tego boje ponieważ uzywam Maxthona i jednak jakby nie było to jest IE, więc się troszeczkę boję, przeskanowałem kompa Nodem32, Ad-aware i nic nie znalazły FV mam KPF.

Dla pewności daje logi:

Logfile of HijackThis v1.99.1

Scan saved at 11:55:58, on 2006-08-23

Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe

D:\Programy\Nod32\nod32krn.exe

D:\Programy\Nod32\nod32kui.exe

D:\Programy\Registry Defragmentation\RegManServ.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe

D:\Programy\Maxthon\Maxthon.exe

D:\Programy\Konnekt\konnekt.exe

D:\Programy\Winamp\winamp.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Kosior\Menu Start\Programy\HijackThis 1.99\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [nod32kui] "D:\Programy\Nod32\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [Rscmpt] C:\WINDOWS\System32\Rscmpt.exe

O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

O8 - Extra context menu item: Download all with Free Download Manager - file://D:\Programy\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selected with Free Download Manager - file://D:\Programy\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download web site with Free Download Manager - file://D:\Programy\Free Download Manager\dlpage.htm

O8 - Extra context menu item: Download with Free Download Manager - file://D:\Programy\Free Download Manager\dllink.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programy\Java\bin\npjpi150_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programy\Java\bin\npjpi150_05.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{CA3F59D4-1F19-486C-AEE1-E143CE5CE64D}: NameServer = 217.75.61.12 80.244.128.1

O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Programy\Nod32\nod32krn.exe

O23 - Service: Registry Management Service (RegManServ) - Unknown owner - D:\Programy\Registry Defragmentation\RegManServ.exe

"Silent Runners.vbs", revision 41, http://www.silentrunners.org/

Operating System: Windows XP

Output limited to non-default values, except where indicated by "{++}"



Startup items buried in registry:

---------------------------------


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"nod32kui" = ""D:\Programy\Nod32\nod32kui.exe" /WAITSERVICE" ["Eset "]

"Rscmpt" = "C:\WINDOWS\System32\Rscmpt.exe" [null data]

"Tweak UI" = "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" [MS]


HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"

  -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"

  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"

  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real Alternative\rpshell.dll" ["RealNetworks, Inc."]

"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"

  -> {CLSID}\InProcServer32\(Default) = "D:\Programy\Nod32\nodshex.dll" [null data]

"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Eksplorator pulpitów"

  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"

  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]

"{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension"

  -> {CLSID}\InProcServer32\(Default) = "D:\Programy\7-Zip\7-zip.dll" ["Igor Pavlov"]


HKLM\Software\Classes\*\shellex\ContextMenuHandlers\

7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"

  -> {CLSID}\InProcServer32\(Default) = "D:\Programy\7-Zip\7-zip.dll" ["Igor Pavlov"]

NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"

  -> {CLSID}\InProcServer32\(Default) = "D:\Programy\Nod32\nodshex.dll" [null data]


HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"

  -> {CLSID}\InProcServer32\(Default) = "D:\Programy\7-Zip\7-zip.dll" ["Igor Pavlov"]


HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"

  -> {CLSID}\InProcServer32\(Default) = "D:\Programy\Nod32\nodshex.dll" [null data]



Active Desktop and Wallpaper:

-----------------------------


Active Desktop is disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState



Winsock2 Service Provider DLLs:

-------------------------------


Namespace Service Providers


HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]


Transport Service Providers


HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

C:\WINDOWS\System32\imon.dll ["Eset "], 01 - 05, 19

%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 18

%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10



Toolbars, Explorer Bars, Extensions:

------------------------------------


Extensions (Tools menu items, main toolbar menu buttons)


HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Sun Java Console"

"CLSIDExtension" = "{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}"

  -> {CLSID}\InProcServer32\(Default) = "D:\Programy\Java\bin\npjpi150_05.dll" ["Sun Microsystems, Inc."]



Miscellaneous IE Hijack Points

------------------------------


HKLM\Software\Microsoft\Internet Explorer\AboutURLs\


Missing lines (compared with English-language version):

HIJACK WARNING! "TuneUp" = "file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css" [file not found]



Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------


NOD32 Kernel Service, NOD32krn, ""D:\Programy\Nod32\nod32krn.exe"" ["Eset "]

Registry Management Service, RegManServ, "D:\Programy\Registry Defragmentation\RegManServ.exe" [null data]

Sunbelt Kerio Personal Firewall 4, KPF4, "C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe" ["Sunbelt Software"]



Print Monitors:

---------------


HKLM\System\CurrentControlSet\Control\Print\Monitors\

Monitor 2 języka BJ\Driver = "CNBJMON2.DLL" [MS]



----------

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

  launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

  DLL launch points and all Registry CLSIDs for dormant Explorer Bars,

  use the -supp parameter or answer "No" at the first message box.

---------- (total run time: 62 seconds, including 9 seconds for message boxes)

Z góry dziękuje...

:spoko:


(Qiko) #2

W hijacku czystoo....


(Kosior6) #3

Dzięki, a co z Silentem ?

:stuck_out_tongue:

:spoko:


(Ronaldinjo) #4

kosior6 pomyśl nad zainstalowaniem SP2


(Kosior6) #5

r10 , zainstaluje dopiero, jak mi sie wysypie ten system który mam obecnie, bo chce zobaczyc ile wytrzyma, narazie ciągnie 6 miesiąc, bez żadnych problemów praktycznie :P, więc narazie nie bedę go ruszał,

Dzięki... :spoko:


(Myszonus) #6

Silent też ok.


(Kosior6) #7

Dzięki wszystkim za odpowiedzi,

:spoko: