- Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1
Scan saved at 19:02:55, on 2006-03-09
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programs\ewido anti-malware\ewidoctrl.exe
C:\Programs\ewido anti-malware\ewidoguard.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programs\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\totalcmd\TOTALCMD.EXE
c:\Documents and Settings\Maciek.HOME\Pulpit\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p1
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O4 - HKLM\..\Run: [SmcService] C:\Programs\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [Jet Detection] C:\Programs\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [] mozilla.exe
O4 - HKLM\..\RunServices: [] mozilla.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programs\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [] mozilla.exe
O4 - HKCU\..\RunServices: [] mozilla.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programs\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programs\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Bootvis.lnk = C:\boot\Bootvis_Sleep.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\Programs\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_03\bin\npjpi141_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_03\bin\npjpi141_03.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{3959D4FC-F620-4BD8-A839-EB55FF1DD186}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: ewido security suite control - ewido networks - C:\Programs\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programs\ewido anti-malware\ewidoguard.exe
O23 - Service: mswmf32 - Unknown owner - C:\WINDOWS\mswmf32.exe (file missing)
O23 - Service: netconf32 - Unknown owner - C:\WINDOWS\netconf32.exe (file missing)
O23 - Service: Performance True Type Font (PerfFont) - Unknown owner - C:\WINDOWS\System32\perfont.exe (file missing)
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programs\SPF\smc.exe
i ewido
- Kod: Zaznacz wszystko
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 19:01:24, 2006-03-09
+ Report-Checksum: 1366B6AC
+ Scan result:
C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\KNGF0PKF\tds[1].exe -> Downloader.Agent.acv : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\W16FWXUB\rp5[1].exe -> Backdoor.SdBot.aad : Cleaned with backup
C:\WINDOWS\system32\a.exe -> Backdoor.SdBot.aad : Cleaned with backup
C:\WINDOWS\win32ssr.exe -> Backdoor.SdBot.aad : Cleaned with backup
C:\Documents and Settings\Maciek.HOME\Cookies\maciek@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup
C:\Documents and Settings\Maciek.HOME\Cookies\anyuser@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned with backup
::Report End
dzięki z góry
maciek_s
