Prosze o sprawdzenie loga

Dla specjalistów Bezpieczeństwo
#1

Logfile of HijackThis v1.98.2

Scan saved at 14:46:34, on 2005-01-29

Platform: Windows XP SP2(WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WIND\System32\smss.exe

C:\WIND\system32\winlogon.exe

C:\WIND\system32\services.exe

C:\WIND\system32\lsass.exe

C:\WIND\system32\svchost.exe

C:\WIND\System32\svchost.exe

C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WIND\system32\spoolsv.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WIND\Explorer.EXE

C:\PROGRA~1\NEOSTR~1\CnxMon.exe

C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe

C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe

C:\WIND\Xhrmy.exe

C:\Program Files\Webroot\Accelerate\accelerate.exe

C:\program files\powerstrip\pstrip.exe

C:\Program Files\Hide and Protect any Drives\HPDAgent.exe

C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

C:\WIND\system32\usbn.exe

C:\WIND\System32\ctfmon.exe

C:\Program Files\TGTSoft\StyleXP\StyleXP.exe

C:\Program Files\AutoConnect\AutoConnect.exe

C:\Program Files\ActiveScreenLock\ActiveScreenLock.exe

C:\Documents and Settings\kowal\Ustawienia lokalne\Temp\Katalog tymczasowy 3 dla hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\kowal\USTAWI~1\Temp\sp.dll/sp.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl … ar=msnhome

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl … r=iesearch

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\kowal\USTAWI~1\Temp\sp.dll/sp.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {51BAB405-5E3D-4B3C-8965-F8BB257322F2} - C:\WIND\System32\lmkghi.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WIND\System32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [nwiz] nwiz.exe /install

O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon

O4 - HKLM…\Run: [ccApp] “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

O4 - HKLM…\Run: [Accelerate] C:\Program Files\Webroot\Accelerate\accelerate.exe /S

O4 - HKLM…\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe

O4 - HKLM…\Run: [Outpost Firewall] “C:\Program Files\Agnitum\Outpost Firewall 1.0\outpost.exe” /waitservice

O4 - HKLM…\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe

O4 - HKLM…\Run: [HPDAgent] C:\Program Files\Hide and Protect any Drives\HPDAgent.exe

O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

O4 - HKCU…\Run: [CTFMON.EXE] C:\WIND\System32\ctfmon.exe

O4 - HKCU…\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe

O4 - HKCU…\Run: [ActiveScreenLock] C:\Program Files\ActiveScreenLock\ActiveScreenLock.exe /s

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [King Of The Hill] C:\Program Files\King Of The Hill\King Of The Hill.exe

O4 - Startup: Neostrada TP.lnk = ?

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O18 - Filter: text/html - {12B05E81-0986-449B-8B66-D8013FD09C59} - C:\WIND\System32\lmkghi.dll

O18 - Filter: text/plain - {12B05E81-0986-449B-8B66-D8013FD09C59} - C:\WIND\System32\lmkghi.dll

#2

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

do usuniecia

#3

do kasacji:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\kowal\USTAWI~1\Temp\sp.dll/sp.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl … ar=msnhome

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl … r=iesearch

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\kowal\USTAWI~1\Temp\sp.dll/sp.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

R3 - Default URLSearchHook is missing

#4

Nie usuwaj

O10 - Hijacked Internet access by New.Net programem HijackThis bo cie net padnie !!

To sie usuwa programem LSP-Fix

Usuwasz nim tylko New.Net

Wyłączasz przywracanie systemu.

Start kompa do awarynjego.

Za pomocą HijackThis usuwasz to co napisał detektyw 997 oraz :

O2 - BHO: (no name) - {51BAB405-5E3D-4B3C-8965-F8BB257322F2} - C:\WIND\System32\lmkghi.dll

Teraz : Start - uruchom -Wpisujesz : regsvr32 \u C:\WINDOWS\System32\ tu wpisujesz nazwe pliku dll. \ naciskasz Enter . Masz wpisać lmkghi.dll. Teraz znajdz go w ukrytych i usuń. Usuń też zdysku C:\WIND\ Xhrmy.exe oraz C:\WIND\system32\ usbn.exe Tto jest trojan Win32.Small.afa Restart kompa. Pobierz i sprawdz system programani:PestpatrolEwido Free Security SuiteETD Security Scanner 3.0http://www.download.com/ETD-Security-Sc … 29424.htmlCWShredder 2.12Restart kompa jeszcze raz i dajesz nowego loga do sprawdzenia. Jak jeszcze masz połączenie. :smiley: Aaa… i to też wywalasz:

O18 - Filter: text/html - {12B05E81-0986-449B-8B66-D8013FD09C59} - C:\WIND\System32\lmkghi.dll

O18 - Filter: text/plain - {12B05E81-0986-449B-8B66-D8013FD09C59} - C:\WIND\System32\lmkghi.dll