Moj log zainstalowalem AGK

Klin · 27 Listopad 2005 17:30

Witam ,

zainstalowalem sobie programik auto gordian knot , jest to program do konwersji DVD—> XVID no i na IDG przeczytalem ,ze ma syf w sobie … ,ze musze koniecznie przerobic film to go zainstalowalem … no i podaje moj log bo chyba cos w nim jest o ile sie niemyle

Logfile of HijackThis v1.99.1

Scan saved at 18:21:41, on 27.11.2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Radeon Omega Drivers\v2.6.75a\ATI Tray Tools\atitray.exe

C:\Programme\Gadu-Gadu\gg.exe

C:\Programme\MSN Messenger\msnmsgr.exe

C:\Programme\Kalendarz XP\Kalendarz.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\kernel.exe

C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\sc_watch.exe

C:\PROGRA~1\T-Online\T-ONLI~2\BASIS-~1\Basis2\PROFIL~1.EXE

C:\PROGRA~1\T-Online\T-ONLI~2\Notifier\Notifier.exe

C:\Programme\T-Online\DSL-Manager\TODslMgr.exe

C:\Programme\T-Online\DSL-Manager\TODslSvc.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Windows Media Player\wmplayer.exe

C:\Dokumente und Einstellungen\Dawid\Desktop\Filmy\hijackthis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com/start.shtml

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize

O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [AtiTrayTools] "C:\Programme\Radeon Omega Drivers\v2.6.75a\ATI Tray Tools\atitray.exe"

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programme\Gadu-Gadu\gg.exe" /tray

O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background

O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

O4 - Global Startup: Kalendarz XP.lnk = C:\Programme\Kalendarz XP\Kalendarz.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O17 - HKLM\System\CCS\Services\Tcpip\..\{19BEA577-2585-4200-8613-68B89ACBEBD6}: NameServer = 217.237.150.97 217.237.150.225

O17 - HKLM\System\CS1\Services\Tcpip\..\{19BEA577-2585-4200-8613-68B89ACBEBD6}: NameServer = 217.237.150.97 217.237.150.225

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: T-Online DSL-Manager (TODslService) - T-Systems International GmbH - C:\Programme\T-Online\DSL-Manager\TODslSvc.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

nieznam sie na logach ale wydaje mi sie ,ze te wpisy powyzej sa syfem … ale niewiem , sprawdzcie jesli mozecie ;]

Pozdrawiam.

Klin · 27 Listopad 2005 17:37

a wiec mam AD-AWARE (czy jak to sie pisze:P) … to chyba styknie nie ?

A nieda rady tego tylko fix’nac ? A co to w ogole za spyweare ?

Klin · 27 Listopad 2005 18:12

No spoko , teraz skanuje znalazlo mi troszke syfu , podam pozniej nowy log

A wiec skan ad-aware sie skonczyl usunol 24 obiekty , spojrzalem na log i dalej to tam siedzi , weszlem w tryb awaryjny i chcialem te wpisy ciachnac , niedalo rady , hijackthis powiedzial mi ( ) ,ze do wpisow 010 trzeba uzywac LSPFIX , albo spybota wiec biore sie za szukanie LSPFIX jako pierwsze , mam tylko jedno male pytanie , co mam usunac w tym LSPFIX ?

W LSP-FIx znajduja sie 4 wpisy :

mswsock.dll TCP/IP

winrnr.dll NTDS

spacklsp.dll (Protocol handler)

rsvpsp.dll (protocol handler)

Czy ktorys z nich niejest poprawny ?

Sciagam spybota i skanuje , zobaczymy czy cos znajdzie

Wszystko co spybot znalazl wyrzucilem , weszlem w tryb awaryjny i chialem zfixowac te wpisy ale tak jak na poczatku sie niedaly … co mam zrobic ;/

Na wszelki wypadek wkleje jeszcze raz loga :

Logfile of HijackThis v1.99.1

Scan saved at 20:26:25, on 27.11.2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Radeon Omega Drivers\v2.6.75a\ATI Tray Tools\atitray.exe

C:\Programme\Gadu-Gadu\gg.exe

C:\Programme\MSN Messenger\msnmsgr.exe

C:\Programme\Kalendarz XP\Kalendarz.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programme\Winamp\Winamp.exe

C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\kernel.exe

C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\sc_watch.exe

C:\PROGRA~1\T-Online\T-ONLI~2\BASIS-~1\Basis2\PROFIL~1.EXE

C:\Programme\T-Online\DSL-Manager\TODslMgr.exe

C:\Programme\T-Online\DSL-Manager\TODslSvc.exe

C:\PROGRA~1\T-Online\T-ONLI~2\Notifier\Notifier.exe

C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE

C:\Dokumente und Einstellungen\Dawid\Desktop\Filmy\hijackthis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com/start.shtml

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize

O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [AtiTrayTools] "C:\Programme\Radeon Omega Drivers\v2.6.75a\ATI Tray Tools\atitray.exe"

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programme\Gadu-Gadu\gg.exe" /tray

O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background

O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

O4 - Global Startup: Kalendarz XP.lnk = C:\Programme\Kalendarz XP\Kalendarz.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O17 - HKLM\System\CCS\Services\Tcpip\..\{19BEA577-2585-4200-8613-68B89ACBEBD6}: NameServer = 217.237.150.97 217.237.150.225

O17 - HKLM\System\CS1\Services\Tcpip\..\{19BEA577-2585-4200-8613-68B89ACBEBD6}: NameServer = 217.237.150.97 217.237.150.225

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: T-Online DSL-Manager (TODslService) - T-Systems International GmbH - C:\Programme\T-Online\DSL-Manager\TODslSvc.exe

Zdaje sie ,ze to to , usunac to ?

Gutek · 27 Listopad 2005 20:38

zostaw O10 to od T-Online DSL Manager

Klin · 27 Listopad 2005 20:40

To czyli sie niezgadza ?

Log jest czysty ?

Gutek · 27 Listopad 2005 20:53

Tak czysty