Prosze o sprawdzenie loga

Dla specjalistów Bezpieczeństwo
#1

system longhorn 5048: cos mi spowalnia kompa ale nie wiem co :

Logfile of HijackThis v1.99.1

Scan saved at 9:27:53 PM, on 5/6/2005

Platform: Unknown Windows (WinNT 6.00.0952)

MSIE: Internet Explorer v6.00 SP2 (6.00.5048.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\LEXBCES.EXE

C:\WINDOWS\System32\spoolsv.exe

C:\WINDOWS\System32\LEXPPS.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\autoclk.exe

C:\WINDOWS\system32\RunDll32.exe

C:\Program Files\MKS\Bin\mks_menu.exe

C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

C:\Program Files\SAGEM\SAGEM F@st 800-840\EndDisk32.exe

C:\Program Files\MKS\Bin\NetMonSV.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\MKS\Bin\mksmonsv.exe

C:\WINDOWS\system32\SLsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wpabaln.exe

C:\WINDOWS\system32\mssearch.exe

C:\WINDOWS\system32\mssdmn.exe

c:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O4 - HKLM…\Run: [searchConfigUi] RUNDLL32.EXE srchcnfg.dll,TrayApp

O4 - HKLM…\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent

O4 - HKLM…\Run: [autoclk] autoclk.exe

O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM…\Run: [MKS_MENU] C:\Program Files\MKS\Bin\mks_menu.exe

O4 - HKLM…\Run: [ABREGMON] C:\Program Files\MKS\Bin\ABregmon.exe

O4 - HKLM…\Run: [LHWerQueuedReporting] %SYSTEMROOT%\System32\wermgr.exe -spawn -queuereporting

O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

O4 - Global Startup: IDW Logging Tool.lnk = C:\Windows\System32\idwlog.exe

O17 - HKLM\System\CCS\Services\Tcpip…{FFA98A5C-E0CD-4634-A8FC-D0EF454B14A1}: NameServer = 194.204.152.34 217.98.63.164

O18 - Protocol: msmailhtml - {F6D6F026-E766-436B-8291-5CF29E916348} - C:\WINDOWS\system32\msmail.dll (file missing)

O21 - SSODL: WscNotify - {FD6905CE-952F-41F1-9A6F-135D9C6622CC} - wscntfy.dll (file missing)

O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit sp. z o.o. - C:\Program Files\MKS\Bin\NetMonSV.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\System32\LEXBCES.EXE

O23 - Service: MkSUpdateInt - MkS Sp. z o. o. - C:\Program Files\MKS\bin\MkSUpdateInt.exe

O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\MKS\Bin\mksmonsv.exe

O23 - Service: MkS_Scan - Unknown owner - C:\Program Files\MKS\Bin\mks_scan.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - c:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - c:\Program Files\Kerio\Personal Firewall\persfw.exe

O23 - Service: Secondary Logon (SecLogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

#2

wg mnie to ci spowolania

sp2 nie jest kompatybilne z longhornem

ale juz to przerabialismy

ten system w tym stanie jeszcze sie nie sprawdza :slight_smile:

#3

hmm…ale ja nie instalowalem sp2 , ten system ma sp2 jako latke na IE !!

a log jest czysty czy nie??

#4

Z loga wywal tylko to:

O21 - SSODL: WscNotify - {FD6905CE-952F-41F1-9A6F-135D9C6622CC} - wscntfy.dll (file missing)

Reszta czysta.