Sprawdzenie loga


(Kosz201) #1

czy moglibyście sprawdzić loga? i jeszcze jedno gdzieś po 10 minutach pisze że lsass wykonał zły kod i wyłącza mi sie komp za 1 minutę.

Logfile of HijackThis v1.98.2

Scan saved at 21:51:57, on 2005-01-22

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

D:\WXP\System32\smss.exe

D:\WXP\system32\csrss.exe

D:\WXP\system32\winlogon.exe

D:\WXP\system32\services.exe

D:\WXP\system32\lsass.exe

D:\WXP\system32\svchost.exe

D:\WXP\System32\svchost.exe

D:\WXP\System32\svchost.exe

D:\WXP\System32\svchost.exe

D:\WXP\system32\spoolsv.exe

D:\WXP\System32___r.exe

D:\WXP\System32\nvsvc32.exe

D:\WXP\System32___synmgr.exe

D:\PROGRA~1\Toolbar\TBPS.exe

D:\PROGRA~1\Toolbar\PIB.exe

D:\WXP\System32\smsss.exe

D:\PROGRA~1\PESTPA~1\PPControl.exe

D:\PROGRA~1\PESTPA~1\CookiePatrol.exe

D:\WXP\System32___synmgr.exe

D:\WXP\System32___r.exe

D:\WXP\System32\trass.exe

D:\documents and settings\michał\ustawienia lokalne\temp\fsg_4203.exe

D:\WXP\System32\RunDLL32.exe

D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

D:\WXP\System32___synmgr.exe

D:\WXP\explorer.exe

D:\WXP\System32\P2P Networking\P2P Networking.exe

D:\PROGRA~1\Altnet\DOWNLO~1\ASM.exe

D:\PROGRA~1\Toolbar\TBPS.exe

D:\WXP\System32\crcss.exe

D:\Program Files\Internet Explorer\iexplore.exe

D:\Program Files\Outlook Express\msimn.exe

D:\Documents and Settings\michał\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50193

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://D:\PROGRA~1\Toolbar\toolbar.dll/sa

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - D:\PROGRA~1\Toolbar\toolbar.dll

O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - D:\PROGRA~1\Toolbar\toolbar.dll

O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - D:\PROGRA~1\Toolbar\toolbar.dll

O4 - HKLM..\Run: [start uploading] smsss.exe

O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WXP\System32\NvCpl.dll,NvStartup

O4 - HKLM..\Run: [Windows Sound Manager] SndMon32.exe

O4 - HKLM..\Run: [PPMemCheck] D:\PROGRA~1\PESTPA~1\PPMemCheck.exe

O4 - HKLM..\Run: [PestPatrol Control Center] D:\PROGRA~1\PESTPA~1\PPControl.exe

O4 - HKLM..\Run: [CookiePatrol] D:\PROGRA~1\PESTPA~1\CookiePatrol.exe

O4 - HKLM..\Run: [Microsoft Synchronization Manager] ___synmgr.exe

O4 - HKLM..\Run: [Microsoft Windows DHCP] D:\WXP\System32___r.exe

O4 - HKLM..\Run: [TBPS] D:\PROGRA~1\Toolbar\TBPS.exe

O4 - HKLM..\Run: [Microsoft Legacy Device] trass.exe

O4 - HKLM..\Run: [PCprot] crcss.exe

O4 - HKLM..\Run: [Cryptographic Service] D:\WXP\System32\aevskvl.exe

O4 - HKLM..\Run: [Trickler] "d:\documents and settings\michał\ustawienia lokalne\temp\fsg_4203.exe"

O4 - HKLM..\Run: [system32.exe] services32.exe

O4 - HKLM..\Run: [P2P Networking] D:\WXP\System32\P2P Networking\P2P Networking.exe /AUTOSTART

O4 - HKLM..\RunServices: [system32.exe] services32.exe

O4 - HKLM..\RunServices: [Windows Sound Manager] SndMon32.exe

O4 - HKLM..\RunServices: [start uploading] smsss.exe

O4 - HKLM..\RunServices: [PCprot] crcss.exe

O4 - HKLM..\RunServices: [Microsoft Synchronization Manager] ___synmgr.exe

O4 - HKLM..\RunServices: [Microsoft Legacy Device] trass.exe

O4 - HKLM..\RunOnce: [TBPS] D:\PROGRA~1\Toolbar\TBPS.exe /boot

O4 - HKCU..\Run: [start uploading] smsss.exe

O4 - HKCU..\Run: [Windows Sound Manager] SndMon32.exe

O4 - HKCU..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKCU..\Run: [spySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0

O4 - HKCU..\Run: [Microsoft Synchronization Manager] ___synmgr.exe

O4 - HKCU..\RunServices: [start uploading] smsss.exe

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

O17 - HKLM\System\CCS\Services\Tcpip..{925F6B6B-DB58-47A0-833A-28FE89636ED4}: NameServer = 194.204.152.34 217.98.63.164

O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - D:\PROGRA~1\Toolbar\toolbar.dll


(Chees) #2

do usuniecia wq trybie awaryjnym:

D:\WXP\System32___r.exe

D:\PROGRA~1\Toolbar\TBPS.exe

D:\WXP\System32\smsss.exe

D:\WXP\System32___r.exe

D:\WXP\System32\P2P Networking\P2P Networking.exe

D:\PROGRA~1\Toolbar\TBPS.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=5019

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://D:\PROGRA~1\Toolbar\toolbar.dll/sa

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - D:\PROGRA~1\Toolbar\toolbar.dll

O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - D:\PROGRA~1\Toolbar\toolbar.dll

O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - D:\PROGRA~1\Toolbar\toolbar.dll

O4 - HKLM..\Run: [Windows Sound Manager] SndMon32.exe

O4 - HKLM..\Run: [TBPS] D:\PROGRA~1\Toolbar\TBPS.exe

O4 - HKLM..\RunServices: [Windows Sound Manager] SndMon32.exe

O4 - HKLM..\RunOnce: [TBPS] D:\PROGRA~1\Toolbar\TBPS.exe /boot

O4 - HKCU..\Run: [Windows Sound Manager] SndMon32.exe

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P

Installer)

Chłopie a gdzie SP2? Nie dziw sie ze tyle syfu jest do usuniecia :?


(Adarek) #3

Po usunięci wskazanych plików i restarcie daj nowego loga do sprawdzenia. Z tej wersji

HijackThis