Proszę o sprawdzenie logów, gdyz przed chwilką wyczaiłem, iż explorer.exe wysyła w świat jakiechś dane.
Podejrzeam, że mój syn dopuścił przez Firewalka jakieś G i gotowe!
Oczywiście już zablokowałem wysyłanie w firewalu, ale syf może pozostać. Oto log z RSIT-a:
- Kod: Zaznacz wszystko
Logfile of random's system information tool 1.06 (written by random/random)
Run by SPRĘŻAREK at 2009-09-14 19:11:03
Microsoft Windows XP Professional Dodatek Service Pack 3
System drive C: has 23 GB (78%) free of 30 GB
Total RAM: 511 MB (49% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:11:15, on 2009-09-14
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\DialNet\winpppoverethernet.exe
C:\WINDOWS\Config\csrss.exe
C:\Program Files\NetMeter\NetMeter.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\Program Files\DialNet\WrOS.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\mIRC\mirc.exe
C:\Documents and Settings\SPRĘŻAREK\Pulpit\RSIT.exe
C:\Program Files\trend micro\SPRĘŻAREK.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [CHotKey] mHotkey.exe
O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe"
O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT"
O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{AC0D5E8E-2B1D-426F-B596-687118AD5E1C}: NameServer = 217.30.129.149 217.30.137.200
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (Omega P 1.5672a) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE
--
End of file - 3812 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
AskBar BHO - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-11-18 333192]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-26 35840]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-26 73728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{3041d03e-fd4b-44e0-b742-2d9b88305f98} - Foxit Toolbar - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-11-18 333192]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CHotKey"=C:\WINDOWS\mHotkey.exe [2000-08-07 456192]
"a-winpoet-service"=C:\Program Files\DialNet\winpppoverethernet.exe [2007-07-06 405504]
""=C:\PROGRA~1\DialNet\FPLICE~1.EXE [2007-07-04 110592]
"z-WrDialer"=C:\Program Files\DialNet\wrdialer.exe [2007-07-11 561152]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2004-03-24 3309568]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"C:\Program Files\NetMeter\NetMeter.exe"=C:\Program Files\NetMeter\NetMeter.exe [2007-08-11 331264]
"Komunikator"=C:\Program Files\Tlen.pl\tlen.exe [2009-01-17 5853672]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2009-07-26 288048]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoSetActiveDesktop"=0
"NoActiveDesktopChanges"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoSetActiveDesktop"=
"NoActiveDesktopChanges"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\Tlen.pl\tlen.exe"="C:\Program Files\Tlen.pl\tlen.exe:*:Enabled:Komunikator Tlen.pl"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
======List of files/folders created in the last 1 months======
2009-09-14 19:11:03 ----D---- C:\rsit
2009-09-08 00:01:25 ----D---- C:\WINDOWS\pss
2009-09-07 17:40:59 ----A---- C:\WINDOWS\IsUn0415.exe
2009-09-07 14:11:03 ----A---- C:\WINDOWS\system32\Iyvu9_32.dll
2009-09-07 14:11:03 ----A---- C:\WINDOWS\system32\ir50_lcs.dll
2009-09-07 14:11:03 ----A---- C:\WINDOWS\system32\iacenc.dll
2009-09-07 14:10:52 ----A---- C:\WINDOWS\system32\WING32.DLL
2009-09-07 14:10:19 ----D---- C:\Program Files\DK Multimedia
2009-09-02 00:10:42 ----D---- C:\Documents and Settings\SPRĘŻAREK\Dane aplikacji\Help
2009-08-31 00:02:58 ----D---- C:\Documents and Settings\SPRĘŻAREK\Dane aplikacji\Ahead
2009-08-30 23:58:42 ----D---- C:\Program Files\Nero
2009-08-30 23:58:42 ----D---- C:\Program Files\Common Files\Ahead
2009-08-30 23:57:47 ----A---- C:\WINDOWS\system32\setb1.tmp
2009-08-30 23:57:26 ----A---- C:\WINDOWS\system32\setb0.tmp
2009-08-30 23:57:12 ----D---- C:\WINDOWS\RegisteredPackages
2009-08-25 19:54:41 ----D---- C:\WINDOWS\system32\LogFiles
2009-08-25 19:51:10 ----HD---- C:\WINDOWS\system32\GroupPolicy
2009-08-21 19:04:09 ----D---- C:\Temp
2009-08-21 19:02:31 ----D---- C:\Program Files\Adobe
2009-08-21 19:01:44 ----D---- C:\WINDOWS\Downloaded Installations
2009-08-21 19:00:16 ----D---- C:\Program Files\Microsoft Bootvis
2009-08-15 14:22:21 ----D---- C:\Lyrics
======List of files/folders modified in the last 1 months======
2009-09-14 19:11:12 ----D---- C:\Program Files\trend micro
2009-09-14 18:20:31 ----D---- C:\Program Files\mIRC
2009-09-14 18:05:21 ----D---- C:\Documents and Settings\SPRĘŻAREK\Dane aplikacji\The Bat!
2009-09-14 18:03:28 ----D---- C:\Program Files\Mozilla Firefox
2009-09-14 15:53:37 ----D---- C:\Documents and Settings\SPRĘŻAREK\Dane aplikacji\uTorrent
2009-09-14 15:53:35 ----D---- C:\Program Files\DialNet
2009-09-14 15:52:22 ----A---- C:\WINDOWS\WinPoET_Runtime.txt
2009-09-14 02:19:54 ----A---- C:\WINDOWS\win.ini
2009-09-14 02:19:53 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-09-14 02:17:21 ----D---- C:\Documents and Settings\SPRĘŻAREK\Dane aplikacji\Tlen.pl
2009-09-14 00:29:02 ----D---- C:\WINDOWS\Prefetch
2009-09-13 23:27:20 ----D---- C:\WINDOWS\system32\CatRoot2
2009-09-13 18:48:03 ----D---- C:\WINDOWS
2009-09-11 22:48:54 ----HD---- C:\WINDOWS\inf
2009-09-11 22:48:54 ----D---- C:\WINDOWS\system32\DirectX
2009-09-09 21:15:52 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-09-09 21:15:47 ----D---- C:\WINDOWS\system32\drivers
2009-09-09 16:21:31 ----HD---- C:\Program Files\InstallShield Installation Information
2009-09-07 17:41:49 ----RSD---- C:\WINDOWS\Fonts
2009-09-07 14:11:03 ----D---- C:\WINDOWS\system32
2009-09-07 14:11:02 ----D---- C:\WINDOWS\Help
2009-09-07 14:10:19 ----RD---- C:\Program Files
2009-09-06 15:57:11 ----D---- C:\WINDOWS\system32\Macromed
2009-09-06 13:35:28 ----D---- C:\Documents and Settings\SPRĘŻAREK\Dane aplikacji\foobar2000
2009-09-06 12:30:32 ----D---- C:\Program Files\uTorrent
2009-09-06 12:06:46 ----D---- C:\Program Files\Debugging Tools for Windows (x86)
2009-09-06 11:46:54 ----D---- C:\Program Files\Tlen.pl
2009-09-02 00:10:42 ----D---- C:\Program Files\TC PowerPack
2009-08-31 00:36:29 ----D---- C:\WINDOWS\security
2009-08-31 00:00:58 ----SHD---- C:\WINDOWS\Installer
2009-08-30 23:58:42 ----D---- C:\Program Files\Common Files
2009-08-30 23:57:53 ----D---- C:\Program Files\Windows Media Player
2009-08-30 23:57:50 ----D---- C:\WINDOWS\Temp
2009-08-29 17:01:36 ----D---- C:\WINDOWS\Minidump
2009-08-26 15:48:59 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-08-23 11:39:49 ----D---- C:\mysymbols
2009-08-21 19:16:38 ----D---- C:\Documents and Settings\SPRĘŻAREK\Dane aplikacji\mIRC
2009-08-21 19:02:31 ----D---- C:\Documents and Settings\SPRĘŻAREK\Dane aplikacji\Adobe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 SbFw;SbFw; C:\WINDOWS\system32\drivers\SbFw.sys [2008-10-31 270888]
R1 sbhips;Sunbelt HIPS Driver; C:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 irda;Protokół IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-14 88192]
R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\PfModNT.sys []
R2 TopWinPoETDriver;WinPoET PPPoE Optimized Driver; C:\WINDOWS\system32\DRIVERS\WrKPoET2000.sys [2007-07-04 52214]
R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\System32\drivers\ctac32k.sys [2002-07-19 127948]
R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2002-07-19 837548]
R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\System32\drivers\ctprxy2k.sys [2002-07-19 11068]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\drivers\ctsfm2k.sys [2002-07-19 213860]
R3 EL90XBC;Sterownik karty 3Com EtherLink XL 90XB/C; C:\WINDOWS\system32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\System32\drivers\emupia2k.sys [2002-07-19 156604]
R3 FPD;Fine Point Packet Service; \??\C:\WINDOWS\system32\drivers\fpd.sys []
R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\system32\drivers\ha10kx2k.sys [2002-07-24 998004]
R3 irsir;Sterownik portu szeregowego podczerwieni Microsoft; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-03-24 1895648]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2002-07-19 195432]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2004-04-01 10368]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport; C:\WINDOWS\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 WrKPoET2000;WrKPoET2000; \??\C:\Program Files\DialNet\WrKPoET2000.sys []
R3 WRSWanDD;WinPoET PPPoE Adapter; C:\WINDOWS\system32\DRIVERS\WrKPoETNic2000.sys [2007-07-04 65604]
S3 ctljystk;Port gier dla karty Creative SB Live!; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
S3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
S3 emu10k1;Sterownik Creative Interface Manager (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
S3 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter; \??\D:\temp\OnlineScanner\Anti-Virus\fsgk.sys []
S3 sfman;Sterownik Creative SoundFont Manager (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Sterownik filtru Przywracania systemu; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73472]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Irmon;Monitor podczerwieni; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-26 152984]
R2 NVSvc;NVIDIA Display Driver Service (Omega P 1.5672a); C:\WINDOWS\system32\nvsvc32.exe [2004-03-24 110659]
R2 SbPF.Launcher;SbPF.Launcher; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288]
R2 WinPPPoverEthernet;WinPPPoverEthernet; C:\Program Files\DialNet\WrOS.EXE [2007-07-04 135168]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe []
-----------------EOF-----------------
