Na kompie cały czas uruchamiają się strony XXX i ściągają wirusy...
Oto log (serwer w mojej szkole):
- Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1
Scan saved at 13:48:33, on 05-10-10
Platform: Windows NT 4 SP5 (WinNT 4.00.1381)
MSIE: Internet Explorer v5.00 (5.00.2314.1000)
Running processes:
C:\WINNT.SBS\System32\smss.exe
C:\WINNT.SBS\system32\winlogon.exe
C:\WINNT.SBS\system32\services.exe
C:\WINNT.SBS\system32\lsass.exe
C:\WINNT.SBS\system32\spoolss.exe
C:\WINNT.SBS\System32\llssrv.exe
C:\Program Files\MKS\Bin\mksmonsr.exe
C:\WINNT.SBS\System32\nddeagnt.exe
C:\WINNT.SBS\explorer.exe
C:\msp\mspadmin.exe
C:\WINNT.SBS\System32\nvsvc32.exe
C:\WINNT.SBS\System32\LOCATOR.EXE
C:\WINNT.SBS\system32\RpcSs.exe
C:\WINNT.SBS\system32\tapisrv.exe
C:\msp\wspsrv.exe
C:\Program Files\MKS\Bin\mks_mail.exe
C:\WINNT.SBS\System32\esserver.exe
C:\msp\mailalrt.exe
C:\WINNT.SBS\System32\modemshr.exe
C:\exchsrvr\bin\mad.exe
C:\WINNT.SBS\System32\inetsrv\inetinfo.exe
C:\WINNT.SBS\System32\pstores.exe
C:\WINNT.SBS\system32\rasman.exe
C:\WINNT.SBS\system32\MSTask.exe
C:\WINNT.SBS\System32\SENS.EXE
C:\WINNT.SBS\System32\wins.exe
C:\WINNT.SBS\system32\rassrv.exe
C:\WINNT.SBS\System32\paytime.exe
C:\WINNT.SBS\tool2.exe
C:\WINNT.SBS\System32\RUNDLL32.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\winstall.exe
C:\WINNT.SBS\System32\paytime.exe
C:\WINNT.SBS\tool2.exe
C:\Program Files\MKS\Bin\mks_menu.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\SmallBusiness\console.exe
C:\Program Files\MKS\Bin\mks_scan.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\TEMP\Rar$EX00.033\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
F2 - REG:system.ini: UserInit=userinit,nddeagnt.exe
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\NetPanel\IEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT.SBS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [MENLogOn] \\MEN01\NETLOGON\MenLogOnNT
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /logon
O4 - HKLM\..\Run: [MailScanner] C:\Program Files\MKS\Bin\mks_mail.exe
O4 - HKLM\..\Run: [NetPanel] "C:\Program Files\NetPanel\Starter.exe" /path="C:\Program Files\NetPanel"
O4 - HKLM\..\Run: [SysTime] C:\WINNT.SBS\System32\systime.exe
O4 - HKLM\..\Run: [PayTime] C:\WINNT.SBS\System32\paytime.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT.SBS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [PayTime] C:\WINNT.SBS\System32\paytime.exe
O4 - Startup: SBS Todo List.lnk = C:\SmallBusiness\console.exe
O4 - Global Startup: Menu mks_vir.lnk = C:\Program Files\MKS\Bin\mks_menu.exe
O4 - Global Startup: Uruchamianie pakietu Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O13 - WWW. Prefix: http://
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O15 - Trusted Zone: *.iframedollars.biz
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.iframedollars.biz (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c4.cab
O16 - DPF: {8626DFA9-2BAC-4BDA-8663-8DAA0F942C0D} - http://megapanel.gem.pl/temp/netp/9947/3760/8505/6100/1_9947376085056100.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 194.204.152.34 194.204.159.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 194.204.152.34 194.204.159.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 194.204.152.34 194.204.159.1
O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\MKS\Bin\mksmonsr.exe
O23 - Service: MkS_Scan - Unknown owner - C:\Program Files\MKS\Bin\mks_scan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT.SBS\System32\nvsvc32.exe
