Proszę o sprawdzenie loga


(Radosq) #1

Proszę o sprawdzenie loga.

Logfile of HijackThis v1.99.1

Scan saved at 08:55:23, on 2005-03-07

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\PANASO~1\REMOTE~1\kmentsrv.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Windows AdControl\WinAdCtl.exe

C:\auditpro\Scan.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Corel\Graphics8\programs\MFIndexer.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Windows AdControl\WinAdAlt.exe

C:\Program Files\Remote Desktop\mstsc.exe

C:\Program Files\Outlook Express\MSIMN.EXE

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Handlowiec\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM..\Run: [nwiz] nwiz.exe /install

O4 - HKLM..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe

O4 - HKLM..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe

O4 - HKLM..\Run: [AuditPro Scan] c:\auditpro\Scan.exe PRO\SCAN /H /TCP:777

O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU..\Run: [WrCtrl] "C:\Program Files\WinRoute Pro\wrctrl.exe"

O4 - HKCU..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook

O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKCU..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8\programs\MFIndexer.exe

O4 - Global Startup: Ekran Stanu.lnk = ?

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: komentator - http://sport.onet.pl/komentator.cab

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file. ... 49cd86b302

O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://www.casper.pl/msrdp.cab

O16 - DPF: {CB8E6DE7-DEF3-41AB-9772-9E6584722F07} (DrvInstall Class) - https://www.casper.pl/DrvInstObj.cab

O16 - DPF: {E3F7811E-BBE8-4C75-B576-43601C6230A8} (CivToOp Control) - https://www.casper.pl/CivToOp.cab

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab

O23 - Service: KME Remote Server - Unknown owner - C:\PROGRA~1\PANASO~1\REMOTE~1\kmentsrv.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Dziękuję


(Musg) #2

wylacz przywracanie systemu i usun

C:\Program Files\Windows AdControl\WinAdAlt.exe

O4 - HKLM..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file. ... 53ab6d9321 ecb8bd411d16779342ab0e706ffb49cd86b302b14f5e2d49208a898df5d4266dec5ee6429e6471f5 73ff3aec438d7643261:b681345e8b8d0ced0ab1ce5d44fc1da6

a to znasz to zostaw nie to wywal

O4 - HKLM..\Run: [AuditPro Scan] c:\auditpro\Scan.exe PRO\SCAN /H /TCP:777

i daj raz jeszcze log

przeskanuj wczesniej system

http://forum.dobreprogramy.pl/viewtopic.php?t=17671


(Kuz5) #3

Możesz wyłączyć CTFMON.EXE: Panel sterowania => Opcje regionalne=> Języki => Szczegóły => Zaawansowane => zaznaczasz wyłącz zaawansowane usługi tekstowe

Jeżeli nie używasz Windows Messenger to go usuń:

Start=>Uruchom=>Wpisz polecenie

RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove

Lub programem Xp-AntiSpy PL