Proszę o sprawdzenie loga

Rzewnis · 29 Kwiecień 2005 17:18

Logfile of HijackThis v1.99.1

Scan saved at 19:08:10, on 2005-04-29

Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe

C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

C:\Program Files\Common Files\pestpatrol\ppRemoteService.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\WINDOWS\system32\ZONELABS\vsmon.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\System32\CTFMON.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Programy\hijackthis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

R3 - Default URLSearchHook is missing

O2 - BHO: Local Spool Net support DLL - {4E7BD750-2C8E-469B-C1E2-F063C081BF33} - c:\windows\system32\localsplnet.dll

O2 - BHO: IE SP2 AddOn - {FC6C5257-5BEC-4D2E-8A27-77E8886C1EDD} - C:\WINDOWS\System32\spekd.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ie2cltr.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab

O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1108663222468

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{49A7E055-AC7B-4210-9139-9869148CBB82}: NameServer = 69.50.176.156,195.225.176.31

O17 - HKLM\System\CCS\Services\Tcpip\..\{EAFAAF4A-7865-42E6-850F-9C1EFDAD6549}: NameServer = 69.50.176.156,195.225.176.31

O17 - HKLM\System\CS1\Services\Tcpip\..\{49A7E055-AC7B-4210-9139-9869148CBB82}: NameServer = 69.50.176.156,195.225.176.31

O17 - HKLM\System\CS2\Services\Tcpip\..\{49A7E055-AC7B-4210-9139-9869148CBB82}: NameServer = 69.50.176.156,195.225.176.31

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates International Inc. - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe

O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

O23 - Service: PestPatrol Remote - Computer Associates International, Inc. - C:\Program Files\Common Files\pestpatrol\ppRemoteService.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

boczi · 29 Kwiecień 2005 17:20

W trybie awaryjnym z wył. przywracaniem systemu wywal:

R3 - Default URLSearchHook is missing

   	O2 - BHO: Local Spool Net support DLL - {4E7BD750-2C8E-469B-C1E2-F063C081BF33} - c:\windows\system32\localsplnet.dll

   	O2 - BHO: IE SP2 AddOn - {FC6C5257-5BEC-4D2E-8A27-77E8886C1EDD} - C:\WINDOWS\System32\spekd.dll

   	O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ie2cltr.dll

Zainstaluj SP2.

PS Używasz dwóch antywirów?!

Rzewnis · 29 Kwiecień 2005 17:26

Mam zainstalowany avg i zone alarm, ale 2 antywirów nie …

Nie wlazilem jeszcze do trybu awaryjnego. Ale pliku tego w normalnym trybie znalezc nie moge

Reszte zaraz usune thx

musg · 29 Kwiecień 2005 17:28

fixuj ten wpis hijackiem

Rzewnis · 29 Kwiecień 2005 17:51

Dzięki śliczne

Wszystko już jest okej

musg · 29 Kwiecień 2005 17:53

pamietaj jeszcze najwazniejszym-SP2

http://www.microsoft.com/poland/windows … fault.mspx

fiesta · 29 Kwiecień 2005 20:31

boczi gdzie Ty w logu widzisz drugiego antywira :?

Bo ja widzę tylko AVG w wersji darmowej Grisofta (co prawda wpisów ma do diabła) ale gdzie ten drugi ??

boczi · 29 Kwiecień 2005 20:36

Pomyłka :oops: . Przepraszam.

Nie wiem dlaczego, ale zmyliły mnie te wpisy:

C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe

C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe