Prosze o pomoc wirus a moze proba wlamu?

Thor8 · 19 Październik 2006 18:07

Witam

Prosze Was o sprawdzenie logów ponieważ ostatnio mam

problem z kompem. Korzystam z neostrady i w momencie gdy

łącze się z internetem cały czas cos sie sciaga (tzn. oba monitorki symbolizujące połączenie sieciowe się cały czas świecą).

Oto moje logi

Logfile of HijackThis v1.99.1 Scan saved at 19:51:19, on 2006-10-19 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\spoolsv.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINXP\System32\lkcitdl.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINXP\Explorer.EXE C:\WINXP\System32\lkads.exe C:\WINXP\System32\lktsrv.exe C:\Program Files\National Instruments\MAX\nimxs.exe C:\Program Files\National Instruments\shared\Security\nidmsrv.exe C:\Program Files\National Instruments\shared\License Manager\Bin\lmgrd.exe C:\WINXP\System32\nisvcloc.exe C:\Program Files\National Instruments\shared\Tagger\tagsrv.exe C:\Program Files\National Instruments\shared\License Manager\Bin\nilm.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Eset\nod32krn.exe C:\WINXP\System32\nvsvc32.exe C:\WINXP\system32\PDFCreatorMessages.exe C:\WINXP\System32\svchost.exe C:\WINXP\System32\RunDll32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\JawsSystems\Jaws PDF Creator\PDFClient.exe C:\PROGRA~1\Wanadoo\TaskbarIcon.exe C:\WINXP\System32\RUNDLL32.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Eset\nod32kui.exe C:\WINXP\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\PROGRA~1\Wapster\AQQ\AQQ.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Wanadoo\EspaceWanadoo.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\Wanadoo\ComComp.exe C:\Program Files\Wanadoo\Watch.exe C:\Program Files\MultiProxy\MProxy.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINXP\system32\NOTEPAD.EXE D:\Programy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM…\Run: [NeroCheck] C:\WINXP\system32\NeroCheck.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINXP\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [PDFCreatorClient] C:\Program Files\JawsSystems\Jaws PDF Creator\PDFClient.exe O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINXP\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKCU…\Run: [CTFMON.EXE] C:\WINXP\System32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: officejet 6100.lnk = ? O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{B12BF2D4-402E-486C-8072-D167EA77FA9F}: NameServer = 194.204.152.34 217.98.63.164 O20 - Winlogon Notify: WgaLogon - C:\WINXP\SYSTEM32\WgaLogon.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINXP\System32\lkcitdl.exe O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINXP\System32\lkads.exe O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINXP\System32\lktsrv.exe O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe (file missing) O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\MKS\Bin\mksmonsv.exe (file missing) O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - C:\Program Files\National Instruments\MAX\nimxs.exe O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program Files\National Instruments\shared\Security\nidmsrv.exe O23 - Service: NILM License Manager (NILM License manager) - Macrovision Corporation - C:\Program Files\National Instruments\shared\License Manager\Bin\lmgrd.exe O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINXP\System32\nisvcloc.exe O23 - Service: National Instruments Variable Engine (NITaggerService) - National Instruments, Inc. - C:\Program Files\National Instruments\shared\Tagger\tagsrv.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\System32\nvsvc32.exe O23 - Service: PDFCreatorMessages - Global Graphics Software Ltd. - C:\WINXP\system32\PDFCreatorMessages.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\System32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINXP\System32\wdfmgr.exe (file missing)

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINXP\System32\ctfmon.exe” [MS] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“sms-express.com”] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [file not found] “AQQ” = “C:\PROGRA~1\Wapster\AQQ\AQQ.exe” [“AQQ Sp. z o.o.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Cmaudio” = “RunDll32 cmicnfg.cpl,CMICtrlWnd” [MS] “Share-to-Web Namespace Daemon” = “C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe” [“Hewlett-Packard”] “NeroCheck” = “C:\WINXP\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “NvCplDaemon” = “RUNDLL32.EXE C:\WINXP\System32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “PDFCreatorClient” = “C:\Program Files\JawsSystems\Jaws PDF Creator\PDFClient.exe” [“Global Graphics Software Ltd.”] “WOOWATCH” = “C:\PROGRA~1\Wanadoo\Watch.exe” [“France Télécom R&D”] “WOOTASKBARICON” = “C:\PROGRA~1\Wanadoo\TaskbarIcon.exe” [“France Télécom R&D”] “NvMediaCenter” = “RUNDLL32.EXE C:\WINXP\System32\NvMcTray.dll,NvTaskbarInit” [MS] “DAEMON Tools” = ““C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033” [“DT Soft Ltd.”] “QuickTime Task” = ““C:\Program Files\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “nod32kui” = ““C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE” ["Eset "] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINXP\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINXP\System32\hticons.dll” [“Hilgraeve, Inc.”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{A4DF5659-0801-4A60-9607-1C48695EFDA9}” = “Folder przesyłania Share-to-Web” -> {HKLM…CLSID} = “Folder przesyłania Share-to-Web” \InProcServer32(Default) = “C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL” [“Hewlett-Packard”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINXP\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINXP\System32\nvshell.dll” [“NVIDIA Corporation”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINXP\System32\nvcpl.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINXP\System32\nvshell.dll” [“NVIDIA Corporation”] “{ED65AB21-B24F-11d3-BA80-00C0CA16AA37}” = “Mobile” -> {HKLM…CLSID} = “Mobile” \InProcServer32(Default) = “C:\Program Files\Siemens Data Suite\DES\DESShellExt.dll” [“Siemens AG”] “{ED65AB22-B24F-11d3-BA80-00C0CA16AA37}” = “Mobile ContextMenuHandler” -> {HKLM…CLSID} = “Mobile ContextMenuHandler” \InProcServer32(Default) = “C:\Program Files\Siemens Data Suite\DES\DESShellExt.dll” [“Siemens AG”] “{ED65AB23-B24F-11d3-BA80-00C0CA16AA37}” = “Mobile PropertySheetHandler” -> {HKLM…CLSID} = “Mobile PropertySheetHandler” \InProcServer32(Default) = “C:\Program Files\Siemens Data Suite\DES\DESShellExt.dll” [“Siemens AG”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINXP\System32\nvcpl.dll” [“NVIDIA Corporation”] “{99F3B825-BDAB-4231-8EDB-5A369C2A2F80}” = “.LLB File Viewer and Icon Handler” -> {HKLM…CLSID} = “LabVIEW Library Files” \InProcServer32(Default) = “C:\Program Files\National Instruments\shared\LabVIEW Run-Time\8.0\LVShellExt.dll” [“National Instruments”] “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” = “NOD32 Context Menu Shell Extension” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ Hex Editor(Default) = “{6B28C27B-8A75-4DB1-A08A-86C8CCEC3AF3}” -> {HKLM…CLSID} = “HexEditor” \InProcServer32(Default) = “C:\Program Files\HHD Software\Hex Editor\hexedit.dll” [“HHD Software”] NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableTaskMgr” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options| Remove Task Manager} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\Tomek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Tomek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “Tomek” & “All Users” startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users.WINXP\Menu Start\Programy\Autostart “Adobe Gamma Loader.exe” -> shortcut to: “C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe” [“Adobe Systems, Inc.”] “DSLMON” -> shortcut to: “C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W” [empty string] “hp psc 2000 Series” -> shortcut to: “C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe” [“Hewlett-Packard Co.”] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l” [MS] “officejet 6100” -> shortcut to: “C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe” [“Hewlett-Packard Co.”] Enabled Scheduled Tasks: ------------------------ “FRU Task #Hewlett-Packard#hp psc 2100 series#1109617572” -> launches: "C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe -I “#Hewlett-Packard#hp psc 2100 series#1109617572"” [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: imon.dll ["Eset "], 01 - 05, 20 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 19 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Kerio Personal Firewall 4, KPF4, “C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe” [“Kerio Technologies”] Lookout Citadel Server, LkCitadelServer, “C:\WINXP\System32\lkcitdl.exe” [“National Instruments, Inc.”] National Instruments Domain Service, NIDomainService, “C:\Program Files\National Instruments\shared\Security\nidmsrv.exe” [“National Instruments, Inc.”] National Instruments PSP Server Locator, lkClassAds, “C:\WINXP\System32\lkads.exe” [“National Instruments, Inc.”] National Instruments Time Synchronization, lkTimeSync, “C:\WINXP\System32\lktsrv.exe” [“National Instruments, Inc.”] National Instruments Variable Engine, NITaggerService, “C:\Program Files\National Instruments\shared\Tagger\tagsrv.exe” [“National Instruments, Inc.”] NI Configuration Manager, mxssvr, “C:\Program Files\National Instruments\MAX\nimxs.exe” [“National Instruments Corporation”] NI Service Locator, niSvcLoc, “C:\WINXP\System32\nisvcloc.exe -s” [“National Instruments Corp.”] NILM License Manager, NILM License manager, ““C:\Program Files\National Instruments\shared\License Manager\Bin\lmgrd.exe”” [“Macrovision Corporation”] NOD32 Kernel Service, NOD32krn, ““C:\Program Files\Eset\nod32krn.exe”” ["Eset "] NVIDIA Display Driver Service, NVSvc, “C:\WINXP\System32\nvsvc32.exe” [“NVIDIA Corporation”] PDFCreatorMessages, PDFCreatorMessages, “C:\WINXP\system32\PDFCreatorMessages.exe” [“Global Graphics Software Ltd.”] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzlnt05\Driver = “hpzlnt05.dll” [“HP”] Jaws PDF Creator Port\Driver = “C:\WINXP\System32\PDFCreator.DLL” [“Global Graphics Software Ltd.”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 700 seconds. ---------- (total run time: 1506 seconds)

Wiem że to jest do wywalenia ale w trybie awaryjnym tego nie ma

co mam zrobić??

O17 - HKLM\System\CCS\Services\Tcpip…{B12BF2D4-402E-486C-8072-D167EA77FA9F}: NameServer = 194.204.152.34 217.98.63.164

Komputer skanowałem NODem32, mks_online, ad_aware i spybotem i nic nie zostało wykryte.

Dodatkowo mam zainstalowanego kerio oto kawałek logu z niego

wygląda to jakby cały czas następowały próby połączenia sie z moim kompem:

Za wszelką pomoc z góry wielkie dzięki

pozdrawiam

Bieniol · 19 Październik 2006 18:13

Logi są czyste

Przeczyść rejestr (polecam do tego jv16 PowerTools 2006 1.5.2.344), zrób defragmentację, oraz przejrzyj: Optymalizacja XP

Wejdź: Start --> uruchom --> msconfig i w zakładce uruchamianie odznacz (według Ciebie) niepotrzbne przy autostarcie programy

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (jeżeli jakieś znaczki są żółte, to niech takie zostaną). Po użyciu tego narzędzia wymagany jest reset sysa.

Thor8 · 19 Październik 2006 19:23

No a to

O17 - HKLM\System\CCS\Services\Tcpip…{B12BF2D4-402E-486C-8072-D167EA77FA9F}: NameServer = 194.204.152.34 217.98.63.164

(jak to usunac w trybie awaryjnym tego nie ma)

Windows Worms Doors Cleanera juz ustawiałem

Nadale nie mam pojęcia skąd sie biorą te ataki niskiego poziomu

zapisane w kerio (w ciagu godziny 19044 (to troche duzo))

czym to moze byc spowodowane?

jezeli to w czyms pomoze moge wzucic jeszcze

kawalek ruchu sieciowego przechwycone za pomoca ETHEREALa

adam9870 · 19 Październik 2006 19:33

Wpisu oznaczonego O17 nie ruszaj. Są to Twoje DNSy i jeśli je skasujesz, stracisz internet.

Ktoś chce mieć dojście do Twojego kompa a Kerio to blokuje. Póki co nie masz czym się przejmować.

Zrobiłeś co mogłeś - dałeś logi, które okazały się czyste i zamknąłeś porty używając wwdc.

Gutek · 19 Październik 2006 20:05

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

Thor8 · 24 Październik 2006 17:48

Witam

Powiedzcie mi jeszcze prosze co to za ataki,

które odnotowuje KERIO

za odpowiedz z gory dzieki