proszę o sprawdzenie loga

**Posty:** 9 · przez **Pyrkosz19** 07 Cze 2007, 11:50

Proszę o sprawdzenie loga. Obawiam się, że mam program szpiegujący.

Logfile of HijackThis v1.99.1
Scan saved at 11:28:22, on 2007-06-09
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Łukasz\Pulpit\hijackthis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [PC-CAM 300 STI App Registration] RunDLL32.exe Pd016pin.dll,RunDLL32EP 513
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

**Posty:** 18165 · przez **wojtas** 07 Cze 2007, 13:20

a czemu masz takie obawy?

**Posty:** 9 · przez **Pyrkosz19** 07 Cze 2007, 14:37

Ponieważ, gram w gre internetową tibia. Ciągle ktoś włamuje mi sie na postac lecz nie bierze moich itemków. na pewno nie jest to żaden z kumpli. Obawiam się że czeka tylko az bedę OFFline aby móc w spokoju mnie okraść. jest w tym logu jakis program typu kelogger?

[ Dodano: Dzisiaj o 18:17 ]
Odświeżam

**Posty:** 18165 · przez **wojtas** 07 Cze 2007, 22:29

tu nic nie ma daj loga z:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 9 · przez **Pyrkosz19** 07 Cze 2007, 23:56

Kod: Zaznacz wszystko: ComboFix 07-06-3B - Running from: "C:\Documents and Settings\ťukasz\Pulpit\" ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\services.exe ((((((((((((((((((((((((( Files Created from 2007-05-09 to 2007-06-09 ))))))))))))))))))))))))))))))) 2007-05-30 16:06 <DIR> d-------- C:\DOCUME~1\LOCALS~1\DANEAP~1\Creative 2007-05-30 16:06 <DIR> d-------- C:\DOCUME~1\LOCALS~1\DANEAP~1\CR680TWN 2007-05-28 16:28 28,377 -ra------ C:\WINDOWS\system32\drivers\PD016blk.sys 2007-05-28 16:23 90,112 -ra------ C:\WINDOWS\system32\PD016Foa.dll 2007-05-28 16:23 8,192 --a------ C:\WINDOWS\system32\tsbyuv.dll 2007-05-28 16:23 76,800 -ra------ C:\WINDOWS\system32\Rawsnap.dll 2007-05-28 16:23 74,752 -ra------ C:\WINDOWS\system32\Raw2SVGA.dll 2007-05-28 16:23 73,728 -ra------ C:\WINDOWS\system32\Raw2Xga.dll 2007-05-28 16:23 73,728 -ra------ C:\WINDOWS\system32\PD016Raw.dll 2007-05-28 16:23 66,560 -ra------ C:\WINDOWS\system32\Raw2RGB.DLL 2007-05-28 16:23 65,536 -ra------ C:\WINDOWS\system32\CtCamMgr.dll 2007-05-28 16:23 61,440 -ra------ C:\WINDOWS\CtDrvIns.exe 2007-05-28 16:23 57,344 -ra------ C:\WINDOWS\system32\PD016GRA.dll 2007-05-28 16:23 53,248 -ra------ C:\WINDOWS\Pd016Cfg.exe 2007-05-28 16:23 50,688 --a------ C:\WINDOWS\system32\vfwwdm32.dll 2007-05-28 16:23 5,665 -ra------ C:\WINDOWS\system32\CtRegApp.dll 2007-05-28 16:23 45,568 --a------ C:\WINDOWS\system32\iyuv_32.dll 2007-05-28 16:23 45,056 -ra------ C:\WINDOWS\system32\PD016sti.dll 2007-05-28 16:23 45,056 -ra------ C:\WINDOWS\system32\PD016Hwx.dll 2007-05-28 16:23 433,408 -ra------ C:\WINDOWS\system32\drivers\PD016vid.sys 2007-05-28 16:23 42,768 -ra------ C:\WINDOWS\system32\drivers\PD016cmd.sys 2007-05-28 16:23 40,960 -ra------ C:\WINDOWS\system32\PD016DNL.dll 2007-05-28 16:23 36,864 -ra------ C:\WINDOWS\system32\PD016if.dll 2007-05-28 16:23 3,584 -ra------ C:\WINDOWS\system32\Pd016Swa.dll 2007-05-28 16:23 28,672 -ra------ C:\WINDOWS\system32\VqSetup.dll 2007-05-28 16:23 28,672 -ra------ C:\WINDOWS\system32\PD016Pin.dll 2007-05-28 16:23 24,576 -ra------ C:\WINDOWS\system32\PD016Vfw.dll 2007-05-28 16:23 200,704 -ra------ C:\WINDOWS\system32\PD016api.dll 2007-05-28 16:23 147,456 -ra------ C:\WINDOWS\system32\Pd016Wia.dll 2007-05-28 16:23 135,168 -ra------ C:\WINDOWS\system32\PD016vex.dll 2007-05-28 16:23 131,072 -ra------ C:\WINDOWS\system32\PD016dec.dll 2007-05-28 16:23 114,688 -ra------ C:\WINDOWS\system32\PD016JPG.dll 2007-05-28 16:19 182,880 --a------ C:\WINDOWS\system32\iuengine.dll 2007-05-27 21:29 <DIR> d-------- C:\DOCUME~1\Klaudia\DANEAP~1\Skype 2007-05-26 13:15 <DIR> d-------- C:\DOCUME~1\Rodzice\DANEAP~1\Opera 2007-05-26 13:14 786,432 --ah----- C:\DOCUME~1\Rodzice\NTUSER.DAT 2007-05-26 13:14 <DIR> dr-h----- C:\DOCUME~1\Rodzice\Dane aplikacji 2007-05-26 13:14 <DIR> dr------- C:\DOCUME~1\Rodzice\Ulubione 2007-05-26 13:14 <DIR> dr------- C:\DOCUME~1\Rodzice\Moje dokumenty 2007-05-26 13:14 <DIR> dr------- C:\DOCUME~1\Rodzice\Menu Start 2007-05-26 13:14 <DIR> d--h----- C:\DOCUME~1\Rodzice\Ustawienia lokalne 2007-05-26 13:14 <DIR> d--h----- C:\DOCUME~1\Rodzice\Szablony 2007-05-26 13:14 <DIR> d-------- C:\DOCUME~1\Rodzice\Pulpit 2007-05-25 21:24 <DIR> d-------- C:\Program Files\Skype 2007-05-25 21:24 <DIR> d-------- C:\DOCUME~1\UKASZ~1\DANEAP~1\Skype 2007-05-25 19:36 <DIR> d-------- C:\Program Files\WebServ 2007-05-25 13:22 <DIR> d-------- C:\DOCUME~1\Klaudia\DANEAP~1\Opera 2007-05-23 21:55 <DIR> d-------- C:\DOCUME~1\Klaudia\Gadu-Gadu 2007-05-23 09:48 <DIR> d---s---- C:\DOCUME~1\Klaudia\UserData 2007-05-23 09:29 1,310,720 --ah----- C:\DOCUME~1\Klaudia\NTUSER.DAT 2007-05-23 09:29 <DIR> dr-h----- C:\DOCUME~1\Klaudia\Dane aplikacji 2007-05-23 09:29 <DIR> dr------- C:\DOCUME~1\Klaudia\Ulubione 2007-05-23 09:29 <DIR> dr------- C:\DOCUME~1\Klaudia\Moje dokumenty 2007-05-23 09:29 <DIR> dr------- C:\DOCUME~1\Klaudia\Menu Start 2007-05-23 09:29 <DIR> d--h----- C:\DOCUME~1\Klaudia\Ustawienia lokalne 2007-05-23 09:29 <DIR> d--h----- C:\DOCUME~1\Klaudia\Szablony 2007-05-23 09:29 <DIR> d-------- C:\DOCUME~1\Klaudia\Pulpit 2007-05-21 21:10 <DIR> dr-hsc--- C:\WINDOWS\system32\dllcache 2007-05-21 21:10 <DIR> dr--s---- C:\WINDOWS\Fonts 2007-05-21 21:10 <DIR> dr------- C:\WINDOWS\Web 2007-05-21 21:10 <DIR> d--h----- C:\WINDOWS\inf 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\WinSxS 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\twain_32 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\wins 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\wbem 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\usmt 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\spool 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\ShellExt 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\Setup 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\ras 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\oobe 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\npp 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\mui 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\inetsrv 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\IME 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\icsxml 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\ias 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\export 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\drivers\etc 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\drivers\disdn 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\drivers 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\dhcp 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\config 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\3com_dmi 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\3076 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\2052 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\1054 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\1045 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\1042 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\1041 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\1037 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\1033 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\1031 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\1028 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32\1025 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system32 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\system 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\security 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\Resources 2007-05-21 21:10 <DIR> d-------- C:\WINDOWS\repair (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-21 17:31:42 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-05-21 17:31:42 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-05-21 17:24:06 -------- d-----w C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 12:02] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "nwiz"="nwiz.exe" [2004-07-01 10:12 C:\WINDOWS\system32\nwiz.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42] "PC-CAM 300 STI App Registration"="Pd016pin.dll" [2002-06-06 03:10 C:\WINDOWS\system32\PD016Pin.dll] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* ************************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-09 23:27:02 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-06-09 23:29:18 C:\ComboFix-quarantined-files.txt ... 2007-06-09 23:29 --- E O F ---

**Posty:** 18165 · przez **wojtas** 08 Cze 2007, 11:03

jest ok

proszę o sprawdzenie loga

proszę o sprawdzenie loga

Kto jest na forum