prosze o sprawdzenie loga

**Posty:** 133 · przez **damek555** 05 Paź 2007, 15:08

Witam

mam pewien problem z przeglądarką explorera gdy jej używam nie umie się nigdzie zalogowac

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:01:58, on 2007-10-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\system32\lxctcoms.exe C:\WINDOWS\winsrv.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\Lexmark 5400 Series\lxctmon.exe C:\Program Files\Lexmark 5400 Series\ezprint.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Kalendarz XP\Kalendarz.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\System32\alg.exe C:\Program Files\neostrada tp\neostradatp.exe C:\Program Files\neostrada tp\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\neostrada tp\Watch.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\NOTEPAD.EXE D:\Programy\Optymalizacja\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe" O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll (file missing) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O17 - HKLM\System\CCS\Services\Tcpip\..\{0F9C5B06-E781-427B-9408-53FF54CF9660}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{201B61D5-4F1C-4339-88FA-85D6A3639C05}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing) O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe O23 - Service: WinSrv (MainSrv) - Unknown owner - C:\WINDOWS\winsrv.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

**Posty:** 18165 · przez **wojtas** 05 Paź 2007, 15:57

sciagnij combofixa

Wklej do Notatnika:

File::
C:\WINDOWS\winsrv.exe

Driver::
MainSrv

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

potem nowy log z hijacka oraz wlasnie combofixa

**Posty:** 133 · przez **damek555** 05 Paź 2007, 20:01

wojtas19162 napisał(a):sciagnij combofixa

Wklej do Notatnika:

File::
C:\WINDOWS\winsrv.exe

Driver::
MainSrv

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

potem nowy log z hijacka oraz wlasnie combofixa

o to nowy log

Kod: Zaznacz wszystko: ComboFix 07-10-05.3 - Artek 2007-10-05 19:33:35.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.170 [GMT 2:00] Running from: C:\Documents and Settings\Artek\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Artek\Pulpit\CFScript.txt ..txt * Created a new restore point FILE:: C:\WINDOWS\winsrv.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\kdwlv.exe C:\WINDOWS\winsrv.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_MAINSRV -------\MainSrv ((((((((((((((((((((((((( Files Created from 2007-09-05 to 2007-10-05 ))))))))))))))))))))))))))))))) . 2007-10-05 19:31 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-05 15:24 <DIR> d-------- C:\Program Files\mks_vir_2007 2007-10-03 15:46 2,304 --a------ C:\WINDOWS\mozver.dat 2007-10-03 15:46 0 --a------ C:\WINDOWS\nsreg.dat 2007-10-01 13:41 <DIR> d-------- C:\Program Files\Alwil Software 2007-10-01 13:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2007-09-29 18:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-09-25 19:14 <DIR> d-------- C:\Documents and Settings\Artek\Dane aplikacji\WinRAR 2007-09-24 22:00 <DIR> d-------- C:\Program Files\IrfanView 2007-09-17 20:49 <DIR> d-------- C:\Program Files\Lavasoft 2007-09-17 20:37 <DIR> d-------- C:\Documents and Settings\Artek\Dane aplikacji\Lavasoft 2007-09-09 12:04 <DIR> d--hs---- C:\Documents and Settings\Artek\Phone Browser 2007-09-09 10:04 <DIR> d-------- C:\Documents and Settings\Artek\Dane aplikacji\Nokia 2007-09-09 10:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2007-09-09 10:03 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-09-09 10:03 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2007-09-09 10:03 <DIR> d-------- C:\Program Files\DIFX 2007-09-09 10:03 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-09-09 10:03 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-09-09 10:03 <DIR> d-------- C:\Documents and Settings\Artek\Dane aplikacji\PC Suite 2007-09-09 10:02 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-09-09 10:02 <DIR> d-------- C:\Program Files\Nokia 2007-09-09 09:55 <DIR> d-------- C:\Program Files\Deutsch Translator 2 2007-09-09 09:09 <DIR> d-------- C:\Program Files\English Translator 3 2007-09-09 08:46 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2007-09-09 08:46 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2007-09-09 08:46 <DIR> d-------- C:\Program Files\D-Tools 2007-09-05 18:12 <DIR> d-------- C:\WINDOWS\USB-IrDA 2007-09-05 17:50 <DIR> d-------- C:\Program Files\MOBILedit! . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-05 19:46 --------- d-------- C:\Program Files\neostrada tp 2007-10-05 19:46 --------- d-------- C:\Documents and Settings\Artek\Dane aplikacji\Skype 2007-10-05 19:45 --------- d-------- C:\Program Files\Lx_cats 2007-10-05 19:44 442144 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-05 19:44 12950816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-05 19:43 45632 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-05 19:43 178676 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-10-05 19:43 --------- d-------- C:\Program Files\Kalendarz XP 2007-10-01 13:24 78415 --a------ C:\WINDOWS\system32\drivers\klif.cab 2007-10-01 12:50 --------- d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-09-24 22:00 --------- d-------- C:\Program Files\Google 2007-09-17 20:35 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-08 17:38 --------- d-------- C:\Program Files\Abbyy FineReader 6.0 Sprint 2007-09-03 18:32 82061 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-09-03 18:32 81549 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-08-31 19:36 22404 --a------ C:\WINDOWS\inet.bin 2007-08-31 19:36 --------- d-------- C:\Program Files\AutoMapaTPC 2007-08-31 19:36 --------- d-------- C:\Documents and Settings\Artek\Dane aplikacji\AutoMapa 2007-08-25 12:59 --------- d-------- C:\Documents and Settings\Artek\Dane aplikacji\AdobeUM 2007-08-22 17:38 --------- d-------- C:\Program Files\Opera 2007-08-22 17:38 --------- d-------- C:\Documents and Settings\Artek\Dane aplikacji\Opera 2007-08-22 12:41 --------- d-------- C:\Program Files\Gadu-Gadu 2007-08-22 09:03 --------- d-------- C:\Program Files\DivX 2007-08-22 09:01 --------- d-------- C:\Program Files\SubEdit-Player 2007-08-22 08:57 --------- d-------- C:\Program Files\ffdshow 2007-08-21 19:56 --------- d-------- C:\Documents and Settings\Artek\Dane aplikacji\Google 2007-08-21 19:23 --------- d-------- C:\Program Files\Lexmark Toolbar 2007-08-21 19:19 --------- d-------- C:\Program Files\Lexmark 5400 Series 2007-08-21 19:19 --------- d-------- C:\Documents and Settings\Artek\Dane aplikacji\5400 Series 2007-08-21 19:17 --------- d-------- C:\Documents and Settings\All Users\Dane aplikacji\5400 Series 2007-08-21 18:27 --------- d-------- C:\Documents and Settings\All Users\Dane aplikacji\Google 2007-08-21 17:15 --------- d-------- C:\Documents and Settings\Artek\Dane aplikacji\Media Player Classic 2007-08-21 16:35 --------- d-------- C:\Documents and Settings\Artek\Dane aplikacji\Gadu-Gadu 2007-08-21 16:29 --------- d-------- C:\Documents and Settings\Artek\Dane aplikacji\Real 2007-08-21 16:23 --------- d-------- C:\Program Files\ATI Technologies 2007-08-21 16:18 --------- d-------- C:\Program Files\Realtek AC97 2007-08-21 16:15 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-08-21 16:07 --------- d-------- C:\Program Files\VIA 2007-08-21 15:58 --------- d-------- C:\Documents and Settings\Artek\Dane aplikacji\Help 2007-08-21 15:51 --------- d-------- C:\Program Files\Thomson 2007-08-21 15:48 --------- d-------- C:\Program Files\Winamp 2007-08-21 15:43 --------- d-------- C:\Program Files\Real Alternative 2007-08-21 15:43 --------- d-------- C:\Program Files\Media Player Classic 2007-08-21 15:43 --------- d-------- C:\Program Files\CCleaner 2007-08-21 15:43 --------- d-------- C:\Documents and Settings\All Users\Dane aplikacji\Real 2007-08-21 15:42 --------- d-------- C:\Program Files\Skype 2007-08-21 15:39 --------- d-------- C:\Program Files\Microsoft.NET 2007-08-21 15:38 --------- d-------- C:\Program Files\Common Files\Ahead 2007-08-21 15:38 --------- d-------- C:\Program Files\Ahead 2007-08-21 15:30 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll --------- C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 14:49] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 16:55] "SoundMan"="SOUNDMAN.EXE" [2005-11-11 08:07 C:\WINDOWS\soundman.exe] "lxctmon.exe"="C:\Program Files\Lexmark 5400 Series\lxctmon.exe" [2006-06-20 15:37] "Lexmark 5400 Series Fax Server"="C:\Program Files\Lexmark 5400 Series\fm3032.exe" [2006-07-11 01:30] "EzPrint"="C:\Program Files\Lexmark 5400 Series\ezprint.exe" [2006-06-07 05:05] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 13:27] "LXCTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-06-07 14:09] "MKSRegmon"="C:\Program Files\mks_vir_2007\bin\mksregmon.exe" [2007-05-24 05:06] "mks_mail"="C:\Program Files\mks_vir_2007\bin\mks_mail.exe" [2007-05-24 05:06] "mkstray"="C:\Program Files\mks_vir_2007\bin\mkstray.exe" [2007-08-13 18:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-08-21 17:37] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-27 20:44] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Kalendarz XP.lnk - C:\Program Files\Kalendarz XP\Kalendarz.exe [2007-08-23 11:18:03] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MkS_Scan] @="service" R0 mksidsa;mksidsa;C:\WINDOWS\system32\mksidsa.sys R1 mksfwallf;mksfwallf;\??\C:\WINDOWS\system32\mksfwallf.sys R1 mksfwallt;mksfwallt;\??\C:\WINDOWS\system32\mksfwallt.sys R2 MksFwall;MksFwall;"C:\Program Files\mks_vir_2007\bin\MksFwall.exe" R2 MksPC;MksPC;"C:\Program Files\mks_vir_2007\bin\MksPC.exe" R2 MksUpdate;MksUpdate;"C:\Program Files\mks_vir_2007\bin\mksupdate.exe" R3 mksidsf;mksidsf;\??\C:\WINDOWS\system32\mksidsf.sys R3 MksMonEn;MksMonEn;\??\C:\Program Files\mks_vir_2007\bin\MksMonEn.sys R3 MksMonEv;MksMonEv;\??\C:\Program Files\mks_vir_2007\bin\MksMonEv.sys R3 MksMonFd;MksMonFd;\??\C:\Program Files\mks_vir_2007\bin\MksMonFd.sys R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] AutoRun\command- F:\setup.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-05 19:45:10 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-05 19:48:06 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-10-05 19:48 . --- E O F ---

i drugi

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:50:42, on 2007-10-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\system32\lxctcoms.exe C:\Program Files\mks_vir_2007\bin\MksFwall.exe C:\Program Files\mks_vir_2007\bin\MksPC.exe C:\Program Files\mks_vir_2007\bin\mksupdate.exe C:\Program Files\mks_vir_2007\bin\mksvirmonsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Lexmark 5400 Series\lxctmon.exe C:\Program Files\Lexmark 5400 Series\ezprint.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\mks_vir_2007\bin\mksregmon.exe C:\Program Files\mks_vir_2007\bin\mks_mail.exe C:\Program Files\mks_vir_2007\bin\mkstray.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Kalendarz XP\Kalendarz.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\neostrada tp\neostradatp.exe C:\Program Files\mks_vir_2007\bin\mks_scan.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\neostrada tp\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\neostrada tp\Watch.exe D:\Programy\Optymalizacja\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe" O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [MKSRegmon] C:\Program Files\mks_vir_2007\bin\mksregmon.exe O4 - HKLM\..\Run: [mks_mail] C:\Program Files\mks_vir_2007\bin\mks_mail.exe O4 - HKLM\..\Run: [mkstray] C:\Program Files\mks_vir_2007\bin\mkstray.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{0F9C5B06-E781-427B-9408-53FF54CF9660}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{201B61D5-4F1C-4339-88FA-85D6A3639C05}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing) O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe O23 - Service: MksFwall - MKS Sp z o.o. - C:\Program Files\mks_vir_2007\bin\MksFwall.exe O23 - Service: MksPC - Unknown owner - C:\Program Files\mks_vir_2007\bin\MksPC.exe O23 - Service: MksUpdate - MKS Sp. z o. o. - C:\Program Files\mks_vir_2007\bin\mksupdate.exe O23 - Service: mks_vir file monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\mks_vir_2007\bin\mksvirmonsvc.exe O23 - Service: MkS_Scan - Unknown owner - C:\Program Files\mks_vir_2007\bin\mks_scan.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

i zauważyłem że mi zużycie procka spadło bo mniałem przedtym nostop 100% ale explorer dalej nie dziala nie idzie sie logowac na konta

**Posty:** 18165 · przez **wojtas** 05 Paź 2007, 20:21

jest czysto

prosze o sprawdzenie loga

Prosze o sprawdzenie loga

Kto jest na forum