Trojan?

Dla specjalistów Bezpieczeństwo
#1

Czy to trojan?

O4 - HKLM…\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

reszta loga

Logfile of HijackThis v1.98.2

Scan saved at 00:11:30, on 2005-03-02

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\vcdplayx.exe

E:\Program Files\ZoneAlarm\zlclient.exe

C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE

E:\Program Files\ProtoWall 1.42\ProtoWall\ProtoWall.exe

C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

C:\Program Files\Executive Software\Diskeeper\DkService.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\OO Software\CleverCache\OOCCSVC.exe

C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe

C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZONELABS\vsmon.exe

C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe

C:\WINDOWS\system32\wuauclt.exe

E:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.17.1.26:14000

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Acrobat Reader 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [vcdplayx] “C:\WINDOWS\vcdplayx.exe”

O4 - HKLM…\Run: [Zone Labs Client] “E:\Program Files\ZoneAlarm\zlclient.exe”

O4 - HKLM…\Run: [sCANINICIO] “C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe”

O4 - HKLM…\Run: [APVXDWIN] “C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE” /s

O4 - HKLM…\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKCU…\Run: [ProtoWall] E:\Program Files\ProtoWall 1.42\ProtoWall\ProtoWall.exe

O4 - HKCU…\Run: [Konnekt] “C:\Program Files\Konnekt\konnekt.exe” /autostart

O4 - Startup: zonealarm.lnk = E:\Program Files\ZoneAlarm\zonealarm.exe

O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

#2

nie to nie trojan to efekt zrzutu pamięi fizycznej po zawieszeniu bądź wysypaniu się systemu. Jak powstał to wszystko jest OK i wpis można skasować.

Do kasacji:

Kosmetycznie:

#3

Możesz zrobić loga nowszą wersją HijackThis :smiley:

#4

a czy to jest caly log?Wyglada na urwany.

#5

oto cały log zrobiony najnowszą wersją programu

Logfile of HijackThis v1.99.1

Scan saved at 10:38:09, on 2005-03-02

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Program Files\Executive Software\Diskeeper\DkService.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\OO Software\CleverCache\OOCCSVC.exe

C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe

C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE

C:\WINDOWS\system32\ZONELABS\vsmon.exe

C:\WINDOWS\vcdplayx.exe

C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE

E:\Program Files\ProtoWall 1.42\ProtoWall\ProtoWall.exe

C:\Program Files\Konnekt\konnekt.exe

C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

E:\Program Files\ZoneAlarm\zlclient.exe

C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe

C:\WINDOWS\system32\wuauclt.exe

E:\Program Files\Firefox\firefox.exe

C:\Documents and Settings\123\Moje dokumenty\Downlands\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.17.1.26:14000

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

F2 - REG:system.ini: Shell=explorer.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Acrobat Reader 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [vcdplayx] “C:\WINDOWS\vcdplayx.exe”

O4 - HKLM…\Run: [Zone Labs Client] “E:\Program Files\ZoneAlarm\zlclient.exe”

O4 - HKLM…\Run: [sCANINICIO] “C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe”

O4 - HKLM…\Run: [APVXDWIN] “C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE” /s

O4 - HKCU…\Run: [ProtoWall] E:\Program Files\ProtoWall 1.42\ProtoWall\ProtoWall.exe

O4 - HKCU…\Run: [Konnekt] “C:\Program Files\Konnekt\konnekt.exe” /autostart

O4 - Startup: zonealarm.lnk = E:\Program Files\ZoneAlarm\zonealarm.exe

O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: O&O CleverCache Pro (OOCleverCache) - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\OOCCSVC.exe

O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

#6

Wobec powyższych stwierdzeń Twój post,

jest OT ===::> Kosz

#7

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.17.1.26:14000 znasz zostaw/nie-wywal

wywal to

O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)

i kosmetyka

O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)

Start > programy > autostart /i usuwasz/ Microsoft Office

#8

wielkie dzieki !!

#9

Możesz wykasować jeszcze wpisy:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =