blokowanie internetu, wysyłanie danych

**Posty:** 5 · przez **Royalmarcin** 26 Sty 2008, 00:55

Prosze o pomoc

Gdy polacze sie z internetem to po dwoch minutach samoczynnie zaczynaja sie wysylac dane, raportz czy cos takiego.Wyglada to tak

2008-25-01 23:38:31: <moje IP>5444 -> 72.20.4.170:80 : 1052bytes, protocol: 17
2008-25-01 23:38:32: <moje IP>5444 -> 72.20.4.170:80 : 1052bytes, protocol: 17

Wysylaja sie one z maksymalna predkoscia i blokuja mi automatycznie internet. Tak dokadnie to niewiem gdzie sie wysylaj, ale za pomoca programu BWMeter udalo mi sie ustalic ze wzszlaja sie po nastepujace IP 72.20.4.170 jezeli ktos wie jak zablokowac wysylanie danych czy jakos inaczej mi pomuc to prosze pisac

**Posty:** 3854 · przez **Dzi@dek** 26 Sty 2008, 02:19

http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
Pozamykaj porty.
Daj nowe logi z Combofix oraz Hijackthis.

**Posty:** 5 · przez **Royalmarcin** 26 Sty 2008, 13:57

ściągnąłem te programy ale jednego nie mogę uruchomić i wykryło go jako wirus w dodatku komp zaczął sie zawieszaćsprawdz czy niemam tu jakichś wirusów . oto skan z HijackThis:

Kod: Zaznacz wszystko: gfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:55:37, on 2008-01-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\SYSTEM32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe D:\Programy\antyvirus\Panda\pavsrv51.exe D:\Programy\antyvirus\Panda\AVENGINE.EXE C:\windows\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\windows\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\windows\system32\flower.exe C:\windows\system32\dms.exe C:\windows\system32\nvsvc32.exe D:\Programy\antyvirus\Panda\PsCtrls.exe C:\windows\system32\PnkBstrA.exe D:\Programy\antyvirus\Panda\PsImSvc.exe C:\windows\system32\drivers\svchost.exe C:\windows\MicroSoftImm.exe C:\windows\Explorer.EXE D:\Programy\antyvirus\Panda\ApvxdWin.exe D:\Programy\antyvirus\Panda\WebProxy.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\VDOTool\TBPanel.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\windows\system32\rundll32.exe C:\windows\system32\RUNDLL32.EXE C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\iPlus\iPlusChecker.exe C:\Program Files\Gadu-Gadu\gg.exe C:\windows\system32\ctfmon.exe D:\Programy\daemon\DAEMON Tools Lite\daemon.exe C:\iPlus\iPlusFlashSkin.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\windows\TEMP\DelTemp34567.exe D:\Programy\antyvirus\Panda\avciman.exe C:\Documents and Settings\Administrator\Pulpit\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: AdPopup - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program Files\Common Files\CPUSH\cpush0.dll O2 - BHO: (no name) - {242F800B-2172-4659-A381-476B66E3DE2A} - C:\WINDOWS\system32\ooptlxecglnhg.dll O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {8FD66659-A7AF-4641-9999-C56607D3A0AB} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing) O2 - BHO: ff Class - {B9751A53-4494-4d7c-9732-AE3058D8145F} - C:\windows\system32\c031.dll (file missing) O2 - BHO: Adobe Common Objects - {C86488AF-13D5-4FEF-9DDF-9FB88698CFC1} - C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\xkEkiWzpul.dll O2 - BHO: (no name) - {D064D15F-F40D-4234-8C66-FE1B8D7297FF} - C:\WINDOWS\system32\yrxulheesdzhf.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing) O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [LanzarL2007] "C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\{18504025-B710-4E6B-A265-4044A7EED728}\{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}\..\..\L2007tmp\Setup.exe" /SETUP:"/l0x0015" O4 - HKLM\..\Run: [GaduGadu] c:\windows\GaduGadu.scr O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [APVXDWIN] "D:\Programy\antyvirus\Panda\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\windows\system32\NeroCheck.exe O4 - HKLM\..\Run: [Onet.pl AutoUpdate] "C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" /updateexetsr O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [iPlusManager] C:\iPlus\iPlusChecker.exe O4 - HKCU\..\Run: [WinUpdater] "C:\Program Files\WinUpdater\update.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "D:\Programy\System Mechanic 6\PopupBlocker.exe" O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Programy\daemon\DAEMON Tools Lite\daemon.exe" O4 - HKCU\..\Run: [PictureShow] "C:\Program Files\PictureShow\poco_tools.exe" -p PictureShow O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Ň»ĆđŔ´ŇôŔÖÉçÇř - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} - http://www.yiqilai.com (file missing) O9 - Extra button: Ň×Č¤ąşÎď - {EE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=824 (file missing) O9 - Extra 'Tools' menuitem: Ň×Č¤ąşÎď - {EE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=824 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {631FF594-EC25-4CFF-B869-402DF294E1D6} (Instalator oprogramowania Onet.pl) - http://slimak.onet.pl/_m/kamerzysta/OnetInstalator012s.ocx O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://betway.microgaming.com/betway/FlashAX.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{23C88912-32E0-41E6-A816-4141E2CDE5D0}: NameServer = 212.2.96.51 212.2.96.52 O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Provisioning Transaction Service (meng5555) - Unknown owner - C:\windows\system32\flower.exe O23 - Service: Fax 2Client (ms_2fax) - Unknown owner - C:\windows\system32\03271.exe (file missing) O23 - Service: NTPDate Service - Unknown owner - C:\windows\system32\dms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe O23 - Service: Panda Software Controller - Panda Software International - D:\Programy\antyvirus\Panda\PsCtrls.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - D:\Programy\antyvirus\Panda\pavsrv51.exe O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - D:\Programy\antyvirus\Panda\PsImSvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: Server Access Manager - Unknown owner - C:\windows\system32\drivers\svchost.exe O23 - Service: Windows Manager MicroSoft IMM (SogouService) - Sogou.com - C:\windows\MicroSoftImm.exe O23 - Service: Ň»ĆđŔ´ŇôŔÖÖúĘÖ (Yiqilai) - Unknown owner - C:\Program Files\Yiqilai\wmp\YiqilaiLyrics.exe (file missing) -- End of file - 10387 bytes

**Posty:** 18165 · przez **wojtas** 26 Sty 2008, 16:49

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 5 · przez **Royalmarcin** 29 Sty 2008, 21:36

Dalej się wysyłają dane. A ten port 137:138:139 to nie jest od internetu, bo jak
go zamknąłem to nie mogłem się z internetem połączyć, dla waszej wiadomości mam modem iPlus.
Proszę sprawdzić logi Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:28:52, on 2008-01-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\SYSTEM32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe D:\Programy\antyvirus\Panda\pavsrv51.exe D:\Programy\antyvirus\Panda\AVENGINE.EXE C:\windows\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\windows\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\windows\system32\flower.exe C:\windows\system32\dms.exe C:\windows\system32\nvsvc32.exe D:\Programy\antyvirus\Panda\PsCtrls.exe C:\windows\system32\PnkBstrA.exe D:\Programy\antyvirus\Panda\PsImSvc.exe C:\windows\system32\drivers\svchost.exe C:\windows\MicroSoftImm.exe C:\windows\Explorer.EXE D:\Programy\antyvirus\Panda\ApvxdWin.exe D:\Programy\antyvirus\Panda\WebProxy.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\windows\system32\rundll32.exe C:\Program Files\VDOTool\TBPanel.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\windows\system32\RUNDLL32.EXE C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\iPlus\iPlusChecker.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\Gadu-Gadu\gg.exe C:\windows\system32\ctfmon.exe D:\Programy\daemon\DAEMON Tools Lite\daemon.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\iPlus\iPlusFlashSkin.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Hamachi\hamachi.exe C:\Documents and Settings\Administrator\Pulpit\HiJackThis.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: AdPopup - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program Files\Common Files\CPUSH\cpush0.dll O2 - BHO: (no name) - {242F800B-2172-4659-A381-476B66E3DE2A} - C:\WINDOWS\system32\ooptlxecglnhg.dll O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {8FD66659-A7AF-4641-9999-C56607D3A0AB} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing) O2 - BHO: ff Class - {B9751A53-4494-4d7c-9732-AE3058D8145F} - C:\windows\system32\c031.dll (file missing) O2 - BHO: Adobe Common Objects - {C86488AF-13D5-4FEF-9DDF-9FB88698CFC1} - C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\xkEkiWzpul.dll O2 - BHO: (no name) - {D064D15F-F40D-4234-8C66-FE1B8D7297FF} - C:\WINDOWS\system32\yrxulheesdzhf.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing) O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [LanzarL2007] "C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\{18504025-B710-4E6B-A265-4044A7EED728}\{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}\..\..\L2007tmp\Setup.exe" /SETUP:"/l0x0015" O4 - HKLM\..\Run: [GaduGadu] c:\windows\GaduGadu.scr O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [APVXDWIN] "D:\Programy\antyvirus\Panda\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\windows\system32\NeroCheck.exe O4 - HKLM\..\Run: [Onet.pl AutoUpdate] "C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" /updateexetsr O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [iPlusManager] C:\iPlus\iPlusChecker.exe O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKCU\..\Run: [WinUpdater] "C:\Program Files\WinUpdater\update.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "D:\Programy\System Mechanic 6\PopupBlocker.exe" O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Programy\daemon\DAEMON Tools Lite\daemon.exe" O4 - HKCU\..\Run: [PictureShow] "C:\Program Files\PictureShow\poco_tools.exe" -p PictureShow O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Ň»ĆđŔ´ŇôŔÖÉçÇř - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} - http://www.yiqilai.com (file missing) O9 - Extra button: Ň×Č¤ąşÎď - {EE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=824 (file missing) O9 - Extra 'Tools' menuitem: Ň×Č¤ąşÎď - {EE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=824 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://betway.microgaming.com/betway/FlashAX.cab O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Provisioning Transaction Service (meng5555) - Unknown owner - C:\windows\system32\flower.exe O23 - Service: Fax 2Client (ms_2fax) - Unknown owner - C:\windows\system32\03271.exe (file missing) O23 - Service: NTPDate Service - Unknown owner - C:\windows\system32\dms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe O23 - Service: Panda Software Controller - Panda Software International - D:\Programy\antyvirus\Panda\PsCtrls.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - D:\Programy\antyvirus\Panda\pavsrv51.exe O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - D:\Programy\antyvirus\Panda\PsImSvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: Server Access Manager - Unknown owner - C:\windows\system32\drivers\svchost.exe O23 - Service: Windows Manager MicroSoft IMM (SogouService) - Sogou.com - C:\windows\MicroSoftImm.exe O23 - Service: Ň»ĆđŔ´ŇôŔÖÖúĘÖ (Yiqilai) - Unknown owner - C:\Program Files\Yiqilai\wmp\YiqilaiLyrics.exe (file missing) -- End of file - 10329 bytes

**Posty:** 18165 · przez **wojtas** 29 Sty 2008, 21:41

wojtas napisał(a):Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

czekamy nasz wszystkie logi

**Posty:** 5 · przez **Royalmarcin** 30 Sty 2008, 16:12

cze wczoraj niemogłem umieścić raportu bo mi neta zablokowało. Zrobiłem skana gmerem i wtkryło mi rootkita niewiem co to jest czy plik ststemowy czy wirus. A tak ogulnie to podejżewam że ktoś się włamałmi do systemu
zaraz wrzuce raport

[ Dodano: Dzisiaj o 15:30 ]
rozwiązałem już problem ale nadal mam jaikeś wirusy. Wczoraj je skasowałem ale dziś są znowu. CZy możecie mi powiedzieć co to jest i jak to usunąć
Daje tu raport z Adevancedta

Kod: Zaznacz wszystko: Advanced Spyware Remover Scan Report Program Version Info: v1.98 (Free Edition) Generated on 2008-02-01 15:15:44 Operation System: Windows XP HomePage: www.Evonsoft.com Technical Support: support@evonsoft.com ------------ Infection Type Object Name Risk Entry Critical Object 2006-072715-4249-99 adware High HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16} Critical Object 2006-072715-4249-99 adware High HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}

blokowanie internetu, wysyłanie danych

blokowanie internetu, wysyłanie danych

re

Kto jest na forum