proszę o sprawdzenie loga •

**Posty:** 37 · przez **Milu** 12 Lip 2007, 14:46

Witam, zwracam się z prośbą o sprawdzenie loga. Ostatnio Internet trochę muli, a programy które korzystają z sieci chodzą jak mucha w smole ;/ Te 2 przedostatnie wpisy próbowałem usunąć, ale automatycznie "wracają"

Logfile of HijackThis v1.99.1
Scan saved at 14:31:08, on 2007-07-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
F:\Milu\Programy\Antyviry & nietylko\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX6400" /O6 "USB001" /M "Stylus CX6400"
O4 - HKLM\..\Run: [Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{1B44C090-7729-4D20-B303-9BBD03583F9A}: NameServer = 194.204.159.1,194.204.152.34
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Control Center Service (NOD32ControlCenter) - Unknown owner - C:\WINDOWS\system32\nod32cc.exe" -service (file missing)
O23 - Service: NOD32 Service (NOD32Service) - Unknown owner - C:\WINDOWS\system32\nod32m2.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Z góry dziękuję za pomoc :wink:

**Posty:** 18165 · przez **wojtas** 12 Lip 2007, 15:56

Milu napisał(a):Te 2 przedostatnie wpisy próbowałem usunąć, ale automatycznie "wracają"

ktore??

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

skasuj

i daj loga z combofixa

**Posty:** 37 · przez **Milu** 12 Lip 2007, 20:49

Te wpisy nie dają się usunąć ;( Myślę, że to jest pozostałość po nodzie, którego zainstalowałem, ale instalacja nie została dokończona z powodu wystąpienia blue-screena. Potem musiałem usunąć ręcznie reszte plików.

O23 - Service: NOD32 Control Center Service (NOD32ControlCenter) - Unknown owner - C:\WINDOWS\system32\nod32cc.exe" -service (file missing)
O23 - Service: NOD32 Service (NOD32Service) - Unknown owner - C:\WINDOWS\system32\nod32m2.exe (file missing)

Log z combofixa:

"ja" - 2007-07-12 20:21:15 - ComboFix 07-07-12.3 - Dodatek Service Pack 2

/wow section - STAGE #8

((((((((((((((((((((((((( Files Created from 2007-06-12 to 2007-07-12 )))))))))))))))))))))))))))))))

2007-07-12 20:21 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-04 22:18 <DIR> d-------- C:\Program Files\xp-AntiSpy
2007-07-04 22:17 <DIR> d-------- C:\Program Files\Essentials Codec Pack
2007-07-04 22:16 <DIR> d-------- C:\Program Files\XP Codec Pack
2007-06-29 19:01 <DIR> d-------- C:\Program Files\Lavasoft
2007-06-27 20:27 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2007-06-27 20:27 <DIR> d-------- C:\WINDOWS\RegisteredPackages
2007-06-27 18:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles
2007-06-27 18:29 7,168 --a------ C:\WINDOWS\system32\hccoin.dll
2007-06-27 18:29 61,056 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys
2007-06-27 18:29 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-06-27 18:29 53,248 --a------ C:\WINDOWS\system32\drivers\1394bus.sys
2007-06-27 18:29 26,624 --a------ C:\WINDOWS\system32\drivers\usbehci.sys
2007-06-27 10:49 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2007-06-23 08:34 69,632 --a--c--- C:\WINDOWS\system32\nms32.dll
2007-06-23 08:34 24,064 --a------ C:\WINDOWS\system32\drivers\upd_serv.sys
2007-06-23 08:34 133,440 --a------ C:\WINDOWS\system32\drivers\amon.sys
2007-06-19 14:44 <DIR> d--h----- C:\WINDOWS\PIF
2007-06-17 20:54 <DIR> d--h----- C:\DOCUME~1\ja\Recent(3)
2007-06-16 21:14 4,456,448 --a------ C:\DOCUME~1\ja\ntuser.dat

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-12 13:29:03 49,608 ----a-w C:\WINDOWS\system32\perfc015.dat
2007-07-12 13:29:03 355,820 ----a-w C:\WINDOWS\system32\perfh015.dat
2007-07-09 17:08:53 -------- d-----w C:\DOCUME~1\ja\DANEAP~1\Tlen.pl
2007-07-06 08:01:36 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-06 08:01:36 -------- d-----w C:\Program Files\EPSON
2007-07-04 20:20:39 -------- d-----w C:\Program Files\Messenger
2007-06-29 16:56:24 -------- d-----w C:\Program Files\WebServ
2007-06-29 13:27:45 -------- d-----w C:\Program Files\Eraser
2007-06-11 11:40:59 -------- d-----w C:\Program Files\Juz w szkole klasa 1
2007-06-11 11:40:12 -------- d-----w C:\Program Files\Common Files\YDP
2007-06-09 18:36:09 -------- d-----w C:\Program Files\Ashampoo
2007-06-08 11:18:27 -------- d-----w C:\DOCUME~1\ja\DANEAP~1\TweakNow PowerPack
2007-06-08 11:17:33 -------- d-----w C:\Program Files\TweakNow PowerPack 2006
2007-05-23 17:05:00 -------- d-----w C:\DOCUME~1\ja\DANEAP~1\Gadu-Gadu
2007-05-23 17:04:33 -------- d-----w C:\Program Files\Gadu-Gadu
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-14 15:40:21 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-14 14:34:37 2,321,408 -c--a-w C:\WINDOWS\system32\TUKernel.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2001-04-16 17:39 37808 --------- C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2006-10-22 13:22 C:\WINDOWS\system32\nwiz.exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-07 20:26]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:44 C:\WINDOWS\system32\bthprops.cpl]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 09:34 C:\WINDOWS\SOUNDMAN.EXE]
"Ashampoo FireWall"="C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 14:57]
"Media Codec Update Service"="C:\Program Files\Essentials Codec Pack\update.exe" [2007-04-08 18:44]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=0 (0x0)
"NoDispBackgroundPage"=0 (0x0)
"NoDispScrSavPage"=0 (0x0)
"NoDispSettingsPage"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"=0 (0x0)
"NoRecentDocsMenu"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"ClearRecentDocsOnExit"=1 (0x1)
"NoRecentDocsHistory"=1 (0x1)
"MaxRecentDocs"=11 (0xb)
"NoStartMenuMFUprogramsList"=1 (0x1)
"NoLowDiskSpaceChecks"=0 (0x0)
"NoSharedDocuments"=00000000
"ForceClassicControlPanel"=1 (0x1)
"NoThemesTab"=0 (0x0)
"NoViewContextMenu"=0 (0x0)
"NoSaveSettings"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
UxTuneUp

Contents of the 'Scheduled Tasks' folder
2007-06-15 15:23:08 C:\WINDOWS\tasks\1-Click Maintenance.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-12 20:22:14
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-12 20:22:46

--- E O F ---

**Posty:** 18165 · przez **wojtas** 12 Lip 2007, 21:26

jesli nie masz noda robisz tak :

start>uruchom>cmd>wpisz:

sc stop NOD32ControlCenter
enter
sc delete NOD32ControlCenter
enter
sc stop NOD32Service
enter
sc delete NOD32Service
enter

w logu jest ok

Autor postu otrzymał pochwałę

**Posty:** 37 · przez **Milu** 12 Lip 2007, 23:39

Dzięki, zadziałało. bardzo fajny triczek :mrgreen:

Pochwała się należy, tylko jak ją dodać :roll:

Napisz na pw to dodam

**Posty:** 3854 · przez **Dzi@dek** 13 Lip 2007, 09:29

Milu napisał(a):tylko jak ją dodać

Zielony plus przy ostatniej odpowiedzi wojtas19162 po prawej stronie.

proszę o sprawdzenie loga &#8226;

proszę o sprawdzenie loga &#8226;

Kto jest na forum

proszę o sprawdzenie loga •

proszę o sprawdzenie loga •