Neostrada przerywa + logi

Ziem · 1 Luty 2007 14:56

Witam!

Mój kuzyn ma od jakiegoś czasu Neostrade 512 (modem usb zxdsl 852). Ostatnio narzeka na bardzo częste samoistne rozłączania. Zazwyczaj pisze:

Po 10-20 sekundach wszystko wraca do normy i można się normalnie połączyć. Co może być grane? Może logi coś pokażą?

Logi:

a) HijackThis:

Logfile of HijackThis v1.99.1 Scan saved at 21:19:24, on 2007-01-31 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\System32\ctfmon.exe E:\Programy\Gadu-Gadu\gg.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe E:\PROGRAMY\FIREFO~1\FIREFOX.EXE E:\Programy\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Programy\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [CnxDslTaskBar] “C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” “ZTE Corporation\ZXDSL852” O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “E:\Programy\Gadu-Gadu\gg.exe” /tray O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne … nicode.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab O17 - HKLM\System\CCS\Services\Tcpip…{4D77A398-AEA9-4BD8-BE2B-32DB0CEF6618}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip…{4D77A398-AEA9-4BD8-BE2B-32DB0CEF6618}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)

b) GMER:

GMER 1.0.12.12011 - http://www.gmer.net Rootkit scan 2007-01-31 21:07:17 Windows 5.1.2600 Dodatek Service Pack. 1 ---- System - GMER 1.0.12 ---- SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwClose SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateProcess SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateProcessEx SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateThread SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteValueKey SSDT \SystemRoot\system32\drivers\khips.sys ZwLoadDriver SSDT \SystemRoot\system32\drivers\khips.sys ZwMapViewOfSection SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwOpenFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwOpenKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwResumeThread SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwSetInformationFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwSetValueKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwWriteFile ---- Kernel code sections - GMER 1.0.12 ---- .text ntoskrnl.exe!KeInitializeInterrupt + B67 804DA23C 1 Byte [06] .text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 170 805025EC 4 Bytes [10, 41, D6, F3] .text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 1A0 8050261C 4 Bytes [20, 39, D6, F3] .text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 1B0 8050262C 4 Bytes [E0, FE, D5, F3] .text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 1C8 80502644 8 Bytes [20, 2F, D6, F3, 90, 2D, D6, …] .text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 1E0 8050265C 4 Bytes [80, 34, D6, F3] .text … PAGENDSM NDIS.sys!NdisMIndicateStatus F98EE87D 6 Bytes [FF, 25, 88, 55, DD, F3] .text ntdll.dll!NtClose 77F758AA 5 Bytes JMP 72033FAA .text ntdll.dll!NtCreateProcess 77F759F4 5 Bytes JMP 72034135 .text ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes JMP 72034019 .text ntdll.dll!NtCreateSection 77F75A21 5 Bytes JMP 72033FC8 ---- User code sections - GMER 1.0.12 ---- .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text E:\Programy\Gadu-Gadu\gg.exe[148] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text E:\Programy\Gadu-Gadu\gg.exe[148] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text E:\Programy\Gadu-Gadu\gg.exe[148] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC .text E:\Programy\Gadu-Gadu\gg.exe[148] WS2_32.dll!socket 71A53C22 5 Bytes JMP 001308C4 .text E:\Programy\Gadu-Gadu\gg.exe[148] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00130950 .text E:\Programy\Gadu-Gadu\gg.exe[148] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00130838 .text E:\Programy\Gadu-Gadu\gg.exe[148] WININET.dll!InternetConnectA 761D5DE6 5 Bytes JMP 00130F54 .text E:\Programy\Gadu-Gadu\gg.exe[148] WININET.dll!InternetConnectW 761DAA8A 5 Bytes JMP 00130FE0 .text E:\Programy\Gadu-Gadu\gg.exe[148] WININET.dll!InternetOpenA 761E017D 5 Bytes JMP 00130D24 .text E:\Programy\Gadu-Gadu\gg.exe[148] WININET.dll!InternetOpenW 761E08D4 5 Bytes JMP 00130DB0 .text E:\Programy\Gadu-Gadu\gg.exe[148] WININET.dll!InternetOpenUrlA 761E1DEF 5 Bytes JMP 00130E3C .text E:\Programy\Gadu-Gadu\gg.exe[148] WININET.dll!InternetOpenUrlW 76210D67 5 Bytes JMP 00130EC8 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text C:\Documents and Settings\Gorgo\Pulpit\gmer.exe[356] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC .text C:\WINDOWS\system32\csrss.exe[444] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00160720 .text C:\WINDOWS\system32\csrss.exe[444] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001607AC .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00160090 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00160694 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001602C0 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00160234 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!WinExec 77E6FD35 5 Bytes JMP 00160464 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0016034C .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0016011C .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00160004 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001604F0 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateThread 77E7BE53 5 Bytes JMP 0016057C .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001601A8 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001603D8 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00160608 .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\winlogon.exe[468] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\winlogon.exe[468] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\winlogon.exe[468] WS2_32.dll!socket 71A53C22 5 Bytes JMP 000708C4 .text C:\WINDOWS\system32\winlogon.exe[468] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00070950 .text C:\WINDOWS\system32\winlogon.exe[468] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00070838 .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\svchost.exe[724] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\svchost.exe[724] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\svchost.exe[724] WS2_32.dll!socket 71A53C22 5 Bytes JMP 000708C4 .text C:\WINDOWS\system32\svchost.exe[724] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00070950 .text C:\WINDOWS\system32\svchost.exe[724] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00070838 .text C:\WINDOWS\system32\svchost.exe[724] WININET.dll!InternetConnectA 761D5DE6 5 Bytes JMP 00070F54 .text C:\WINDOWS\system32\svchost.exe[724] WININET.dll!InternetConnectW 761DAA8A 5 Bytes JMP 00070FE0 .text C:\WINDOWS\system32\svchost.exe[724] WININET.dll!InternetOpenA 761E017D 5 Bytes JMP 00070D24 .text C:\WINDOWS\system32\svchost.exe[724] WININET.dll!InternetOpenW 761E08D4 5 Bytes JMP 00070DB0 .text C:\WINDOWS\system32\svchost.exe[724] WININET.dll!InternetOpenUrlA 761E1DEF 5 Bytes JMP 00070E3C .text C:\WINDOWS\system32\svchost.exe[724] WININET.dll!InternetOpenUrlW 76210D67 5 Bytes JMP 00070EC8 .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\svchost.exe[792] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\svchost.exe[792] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\svchost.exe[792] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\svchost.exe[792] WS2_32.dll!socket 71A53C22 5 Bytes JMP 000708C4 .text C:\WINDOWS\system32\svchost.exe[792] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00070950 .text C:\WINDOWS\system32\svchost.exe[792] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00070838 .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\explorer.exe[1708] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\explorer.exe[1708] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\explorer.exe[1708] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\explorer.exe[1708] WS2_32.dll!socket 71A53C22 5 Bytes JMP 000708C4 .text C:\WINDOWS\explorer.exe[1708] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00070950 .text C:\WINDOWS\explorer.exe[1708] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00070838 .text C:\WINDOWS\explorer.exe[1708] WININET.dll!InternetConnectA 761D5DE6 5 Bytes JMP 00070F54 .text C:\WINDOWS\explorer.exe[1708] WININET.dll!InternetConnectW 761DAA8A 5 Bytes JMP 00070FE0 .text C:\WINDOWS\explorer.exe[1708] WININET.dll!InternetOpenA 761E017D 5 Bytes JMP 00070D24 .text C:\WINDOWS\explorer.exe[1708] WININET.dll!InternetOpenW 761E08D4 5 Bytes JMP 00070DB0 .text C:\WINDOWS\explorer.exe[1708] WININET.dll!InternetOpenUrlA 761E1DEF 5 Bytes JMP 00070E3C .text C:\WINDOWS\explorer.exe[1708] WININET.dll!InternetOpenUrlW 76210D67 5 Bytes JMP 00070EC8 .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text E:\Programy\FIREFO~1\firefox.exe[1736] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text E:\Programy\FIREFO~1\firefox.exe[1736] WS2_32.dll!socket 71A53C22 5 Bytes JMP 001308C4 .text E:\Programy\FIREFO~1\firefox.exe[1736] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00130950 .text E:\Programy\FIREFO~1\firefox.exe[1736] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00130838 .text E:\Programy\FIREFO~1\firefox.exe[1736] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text E:\Programy\FIREFO~1\firefox.exe[1736] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe[1900] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC ---- Files - GMER 1.0.12 ---- ADS C:\Program Files\Internet Explorer\IEXPLORE.EXE:SummaryInformation ADS C:\Program Files\Internet Explorer\IEXPLORE.EXE:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} ADS E:\cichy\TibiCampod nizesz\TibiCAM.exe:SummaryInformation ADS E:\cichy\TibiCampod nizesz\TibiCAM.exe:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} ---- EOF - GMER 1.0.12 ----

Pozdrawiam!

adam9870 · 1 Luty 2007 15:03

Logi są czyste.

Skontaktuj się z prowiderem.

Proponuję zainstalować dodatek Service Pack 2. Poprawia on bezpieczeństwo w systemie etc. Więcej na jego temat znajdziesz tutaj:

http://xp.net.pl/art/xpsp2.html

http://xp.net.pl/art/windowsxp_sp2.html

Ziem · 2 Luty 2007 13:40

Dzięki! Kuzyn skontaktował się z prowiderem, czeka na reakcję.

Pozdrawiam!