Proszę o sprawdzenie loga Hijack this

Dla specjalistów Bezpieczeństwo
#1

Logfile of HijackThis v1.99.1

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\RunDll32.exe

D:\Programy\Winamp\winampa.exe

C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\System32\RUNDLL32.EXE

D:\Corel\programs\MFIndexer.exe

C:\Program Files\22M WLAN Adapter\WLANMON.exe

C:\WINDOWS\System32\rundll32.exe

D:\Programy\anty wirus\Kaspersky Anti-Hacker\KAVPF.exe

D:\Programy\Gadu-Gadu\gg.exe

D:\Programy\Spybot - Search & Destroy\SpybotSD.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\1\Ustawienia lokalne\Temp\Katalog tymczasowy 1 dla hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

F3 - REG:win.ini: run=C:\WINDOWS\inet10055\services.exe

O2 - BHO: (no name) - {366D8278-EE06-ED37-AD49-02B02A88CB7B} - C:\WINDOWS\system32\msadblock32.dll (file missing)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\SPYBOT~1\SDHelper.dll

O2 - BHO: IECatcher Class - {B930BA63-9E5A-11D3-A288-0000E80E2EDE} - D:\Programy\Mass Downloader\MDHELPER.DLL (file missing)

O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [nwiz] nwiz.exe /install

O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe

O4 - HKLM…\Run: [WinampAgent] D:\Programy\Winamp\winampa.exe

O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe

O4 - HKLM…\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe

O4 - HKLM…\Run: [KAVPersonal50] “D:\Programy\anty wirus\Kaspersky Anti-Virus Personal\kav.exe” /minimize

O4 - HKLM…\Run: [Admanager Controller] C:\Program Files\Admanager Controller\AdManCtl.exe

O4 - HKLM…\Run: [AdStatus Service] C:\Program Files\AdStatus Service\AdStatServ.exe

O4 - HKLM…\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe

O4 - HKLM…\Run: [skaner] d:\Programy\Ochrona\Ochraniacz\OPZTskaner.exe

O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background

O4 - HKCU…\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook

O4 - HKCU…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = D:\Corel\programs\MFIndexer.exe

O4 - Global Startup: 22M WLAN Adapter.lnk = ?

O4 - Global Startup: Kaspersky Anti-Hacker.lnk = D:\Programy\anty wirus\Kaspersky Anti-Hacker\KAVPF.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll

O15 - Trusted Zone: *.crazywinnings.com

O15 - Trusted Zone: *.iframedollars.biz

O15 - Trusted Zone: *.skoobidoo.com

O15 - Trusted Zone: *.windupdates.com

O15 - Trusted Zone: http://*.windupdates.com

O15 - Trusted Zone: *.crazywinnings.com (HKLM)

O15 - Trusted Zone: *.iframedollars.biz (HKLM)

O15 - Trusted Zone: *.skoobidoo.com (HKLM)

O15 - Trusted Zone: *.windupdates.com (HKLM)

O15 - Trusted IP range: 69.50.161.82

O15 - Trusted IP range: 69.50.161.82 (HKLM)

O15 - ProtocolDefaults: ‘http’ protocol is in Trusted Zone, should be Internet Zone

O15 - ProtocolDefaults: ‘https’ protocol is in Trusted Zone, should be Internet Zone

O15 - ProtocolDefaults: ‘http’ protocol is in Trusted Zone, should be Internet Zone (HKLM)

O15 - ProtocolDefaults: ‘https’ protocol is in Trusted Zone, should be Internet Zone (HKLM)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid= … lcid=0x409

O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v … 2791113265

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab

O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab

O17 - HKLM\System\CCS\Services\Tcpip…{AF6AF8C3-D6F9-49F9-92DC-6F49C0186145}: NameServer = 194.204.159.1,194.204.152.34,213.25.200.5

O18 - Protocol: textwareilluminatorbase - {CE5CD329-1650-414A-8DB0-4CBF72FAED87} - C:\WINDOWS\System32\textwareilluminatorbaseProtocol.dll

O23 - Service: kavsvc - Kaspersky Lab - D:\Programy\anty wirus\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

#2

Kasujesz

#3

Dzienki, a reszta wszystko ok ??

#4

do kasacji:

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid= … lcid=0x409

O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v … 2791113265

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab

O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab

#5

nie do konca ok .Daj caly log ,bo obcieło ci poczatek.

#6

Oto juz całkowity log i nic więcej nie ma :stuck_out_tongue:

Logfile of HijackThis v1.99.1

Scan saved at 18:00:33, on 2005-02-17

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\RunDll32.exe

D:\Programy\Winamp\winampa.exe

C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\System32\RUNDLL32.EXE

D:\Corel\programs\MFIndexer.exe

C:\Program Files\22M WLAN Adapter\WLANMON.exe

C:\WINDOWS\System32\rundll32.exe

D:\Programy\anty wirus\Kaspersky Anti-Hacker\KAVPF.exe

D:\Programy\Gadu-Gadu\gg.exe

D:\Programy\Spybot - Search & Destroy\SpybotSD.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\1\Ustawienia lokalne\Temp\Katalog tymczasowy 1 dla hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

F3 - REG:win.ini: run=C:\WINDOWS\inet10055\services.exe

O2 - BHO: (no name) - {366D8278-EE06-ED37-AD49-02B02A88CB7B} - C:\WINDOWS\system32\msadblock32.dll (file missing)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\SPYBOT~1\SDHelper.dll

O2 - BHO: IECatcher Class - {B930BA63-9E5A-11D3-A288-0000E80E2EDE} - D:\Programy\Mass Downloader\MDHELPER.DLL (file missing)

O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [nwiz] nwiz.exe /install

O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe

O4 - HKLM…\Run: [WinampAgent] D:\Programy\Winamp\winampa.exe

O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe

O4 - HKLM…\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe

O4 - HKLM…\Run: [KAVPersonal50] “D:\Programy\anty wirus\Kaspersky Anti-Virus Personal\kav.exe” /minimize

O4 - HKLM…\Run: [Admanager Controller] C:\Program Files\Admanager Controller\AdManCtl.exe

O4 - HKLM…\Run: [AdStatus Service] C:\Program Files\AdStatus Service\AdStatServ.exe

O4 - HKLM…\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe

O4 - HKLM…\Run: [skaner] d:\Programy\Ochrona\Ochraniacz\OPZTskaner.exe

O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background

O4 - HKCU…\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook

O4 - HKCU…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = D:\Corel\programs\MFIndexer.exe

O4 - Global Startup: 22M WLAN Adapter.lnk = ?

O4 - Global Startup: Kaspersky Anti-Hacker.lnk = D:\Programy\anty wirus\Kaspersky Anti-Hacker\KAVPF.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll

O15 - Trusted Zone: *.crazywinnings.com

O15 - Trusted Zone: *.iframedollars.biz

O15 - Trusted Zone: *.skoobidoo.com

O15 - Trusted Zone: *.windupdates.com

O15 - Trusted Zone: http://*.windupdates.com

O15 - Trusted Zone: *.crazywinnings.com (HKLM)

O15 - Trusted Zone: *.iframedollars.biz (HKLM)

O15 - Trusted Zone: *.skoobidoo.com (HKLM)

O15 - Trusted Zone: *.windupdates.com (HKLM)

O15 - Trusted IP range: 69.50.161.82

O15 - Trusted IP range: 69.50.161.82 (HKLM)

O15 - ProtocolDefaults: ‘http’ protocol is in Trusted Zone, should be Internet Zone

O15 - ProtocolDefaults: ‘https’ protocol is in Trusted Zone, should be Internet Zone

O15 - ProtocolDefaults: ‘http’ protocol is in Trusted Zone, should be Internet Zone (HKLM)

O15 - ProtocolDefaults: ‘https’ protocol is in Trusted Zone, should be Internet Zone (HKLM)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid= … lcid=0x409

O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v … 2791113265

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab

O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab

O17 - HKLM\System\CCS\Services\Tcpip…{AF6AF8C3-D6F9-49F9-92DC-6F49C0186145}: NameServer = 194.204.159.1,194.204.152.34,213.25.200.5

O18 - Protocol: textwareilluminatorbase - {CE5CD329-1650-414A-8DB0-4CBF72FAED87} - C:\WINDOWS\System32\textwareilluminatorbaseProtocol.dll

O23 - Service: kavsvc - Kaspersky Lab - D:\Programy\anty wirus\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

#7

Podsumowując, do usunięcia pozostały jeszcze wpisy:

O2 - BHO: (no name) - {366D8278-EE06-ED37-AD49-02B02A88CB7B} - C:\WINDOWS\system32\msadblock32.dll (file missing)

   	O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

   	O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe

   	O4 - HKLM\..\Run: [Admanager Controller] C:\Program Files\Admanager Controller\AdManCtl.exe

   	O4 - HKLM\..\Run: [AdStatus Service] C:\Program Files\AdStatus Service\AdStatServ.exe

   	O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe

O15 - Trusted Zone: *.crazywinnings.com

O15 - Trusted Zone: *.iframedollars.biz

O15 - Trusted Zone: *.skoobidoo.com

O15 - Trusted Zone: *.windupdates.com

O15 - Trusted Zone: http://*.windupdates.com

O15 - Trusted Zone: *.crazywinnings.com (HKLM)

O15 - Trusted Zone: *.iframedollars.biz (HKLM)

O15 - Trusted Zone: *.skoobidoo.com (HKLM)

O15 - Trusted Zone: *.windupdates.com (HKLM)

O15 - Trusted IP range: 69.50.161.82

O15 - Trusted IP range: 69.50.161.82 (HKLM)

O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone

O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone

O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)

O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone (HKLM) 

O18 - Protocol: textwareilluminatorbase - {CE5CD329-1650-414A-8DB0-4CBF72FAED87} - C:\WINDOWS\System32\textwareilluminatorbaseProtocol.dll

Zainstaluj firewalla oraz Service Pack 2. Koniecznie.

#8

Ok dzienki ale nie moglem usunać :

O15 - ProtocolDefaults: ‘http’ protocol is in Trusted Zone, should be Internet Zone

O15 - ProtocolDefaults: ‘https’ protocol is in Trusted Zone, should be Internet Zone

O15 - ProtocolDefaults: ‘http’ protocol is in Trusted Zone, should be Internet Zone (HKLM)

O15 - ProtocolDefaults: ‘https’ protocol is in Trusted Zone, should be Internet Zone (HKLM)

Bo mi poczta wtedy nie chodzi :frowning: czy to straszny grzech czy komp jakos to wytrzyma ??

#9

a serwice pack to mi sie nie chce zainstalowć bo jak sprawdza weryfikacje to wyskakuje mi że klucz może być błędny i żebym sie skontaktował z howtotel .com … :frowning: da się go jakoś innaczej zainstalować ??

#10

Niestety, masz pirackiego Windowsa. Kup oryginała. :twisted:

#11

W związku powyższym temat zamykam.