spowolnienie przy starcie

**Posty:** 80 · przez **wojtasb3** 29 Maj 2006, 16:13

Niecałe dwie godziny temu postawiłem nowego wina, przy starcie spowalnia a w logu jakies wpisy adresów banków. Przy starcie zauważyłem, że csrs.exe tak zamulał więc go ręcznie wyłączyłem i obawianm sie ze on jest winowajcą ale nie jestem pewien.

Z góry dziękuje za pomoc

Logfile of HijackThis v1.99.1
Scan saved at 14:28:11, on 2006-05-29
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\MSmedia.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\win32host.exe
C:\WINDOWS\winsock\csrss.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\WINDOWS\System32\svchozt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgr.exe
d:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\wojtas\USTAWI~1\Temp\Rar$EX00.547\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\winsock\csrss.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\winsock\csrss.exe
O1 - Hosts: 220.232.149.248 lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 online.lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 www.lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 www.lloydstsb.com
O1 - Hosts: 220.232.149.248 www.lloydstsb.com
O1 - Hosts: 220.232.149.248 personal.barclays.co.uk
O1 - Hosts: 220.232.149.248 barclays.co.uk
O1 - Hosts: 220.232.149.248 ibank.barclays.co.uk
O1 - Hosts: 220.232.149.248 www.barclays.co.uk
O1 - Hosts: 220.232.149.248 www.nwolb.com
O1 - Hosts: 220.232.149.248 nwolb.com
O1 - Hosts: 220.232.149.248 hsbc.co.uk
O1 - Hosts: 220.232.149.248 www.hsbc.co.uk
O1 - Hosts: 220.232.149.248 abbey.com
O1 - Hosts: 220.232.149.248 www.abbey.com
O1 - Hosts: 220.232.149.248 www.abbey.co.uk
O1 - Hosts: 220.232.149.248 abbey.co.uk
O1 - Hosts: 220.232.149.248 cahoot.com
O1 - Hosts: 220.232.149.248 www.cahoot.com
O1 - Hosts: 220.232.149.248 www.cahoot.co.uk
O1 - Hosts: 220.232.149.248 cahoot.co.uk
O1 - Hosts: 220.232.149.248 www.co-operativebank.co.uk
O1 - Hosts: 220.232.149.248 co-operativebank.co.uk
O1 - Hosts: 220.232.149.248 www.co-operativebank.com
O1 - Hosts: 220.232.149.248 co-operativebank.com
O1 - Hosts: 220.232.149.248 welcome2.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome6.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome8.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome10.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 www.smile.co.uk
O1 - Hosts: 220.232.149.248 smile.co.uk
O1 - Hosts: 220.232.149.248 www.cajamar.es
O1 - Hosts: 220.232.149.248 cajamar.es
O1 - Hosts: 220.232.149.248 www.cajamar.com
O1 - Hosts: 220.232.149.248 cajamar.com
O1 - Hosts: 220.232.149.248 www.unicaja.es
O1 - Hosts: 220.232.149.248 unicaja.es
O1 - Hosts: 220.232.149.248 www.unicaja.com
O1 - Hosts: 220.232.149.248 unicaja.com
O1 - Hosts: 220.232.149.248 www.caixagalicia.es
O1 - Hosts: 220.232.149.248 caixagalicia.es
O1 - Hosts: 220.232.149.248 www.caixagalicia.com
O1 - Hosts: 220.232.149.248 caixagalicia.com
O1 - Hosts: 220.232.149.248 activa.caixagalicia.es
O1 - Hosts: 220.232.149.248 www.caixapenedes.es
O1 - Hosts: 220.232.149.248 caixapenedes.es
O1 - Hosts: 220.232.149.248 www.caixapenedes.com
O1 - Hosts: 220.232.149.248 caixapenedes.com
O1 - Hosts: 220.232.149.248 bancae.caixapenedes.com
O1 - Hosts: 220.232.149.248 www.caixasabadell.es
O1 - Hosts: 220.232.149.248 caixasabadell.es
O1 - Hosts: 220.232.149.248 www.caixasabadell.net
O1 - Hosts: 220.232.149.248 caixasabadell.net
O1 - Hosts: 220.232.149.248 www.cajamadrid.es
O1 - Hosts: 220.232.149.248 cajamadrid.es
O1 - Hosts: 220.232.149.248 www.cajamadrid.com
O1 - Hosts: 220.232.149.248 cajamadrid.com
O1 - Hosts: 220.232.149.248 oi.cajamadrid.es
O1 - Hosts: 220.232.149.248 www.ccm.es
O1 - Hosts: 220.232.149.248 ccm.es
O1 - Hosts: 220.232.149.248 www.haspa.de
O1 - Hosts: 220.232.149.248 haspa.de
O1 - Hosts: 220.232.149.248 ssl2.haspa.de
O1 - Hosts: 220.232.149.248 www.dresdner-bank.de
O1 - Hosts: 220.232.149.248 dresdner-bank.de
O1 - Hosts: 220.232.149.248 www.dresdner-privat.de
O1 - Hosts: 220.232.149.248 postbank.de
O1 - Hosts: 220.232.149.248 www.postbank.de
O1 - Hosts: 220.232.149.248 banking.postbank.de
O1 - Hosts: 220.232.149.248 www.sparda-b.de
O1 - Hosts: 220.232.149.248 sparda-b.de
O1 - Hosts: 220.232.149.248 www.bankingonline.de
O1 - Hosts: 220.232.149.248 www.raiffeisenbank-erding.de
O1 - Hosts: 220.232.149.248 raiffeisenbank-erding.de
O1 - Hosts: 220.232.149.248 www.vr-networld-ebanking.de
O1 - Hosts: 220.232.149.248 vr-networld-ebanking.de
O1 - Hosts: 220.232.149.248 www.bnhof.de
O1 - Hosts: 220.232.149.248 bnhof.de
O1 - Hosts: 220.232.149.248 www.deutsche-bank.de
O1 - Hosts: 220.232.149.248 deutsche-bank.de
O1 - Hosts: 220.232.149.248 meine.deutsche-bank.de
O1 - Hosts: 220.232.149.248 www.citibank.de
O1 - Hosts: 220.232.149.248 citibank.de
O1 - Hosts: 220.232.149.248 www.dkb.de
O1 - Hosts: 220.232.149.248 dkb.de
O1 - Hosts: 220.232.149.248 www.sparkasse-regensburg.de
O1 - Hosts: 220.232.149.248 sparkasse-regensburg.de
O1 - Hosts: 220.232.149.248 www.berliner-bank.de
O1 - Hosts: 220.232.149.248 berliner-bank.de
O1 - Hosts: 220.232.149.248 www.berliner-sparkasse.de
O1 - Hosts: 220.232.149.248 berliner-sparkasse.de
O1 - Hosts: 220.232.149.248 www.wellsfargo.com
O1 - Hosts: 220.232.149.248 wellsfargo.com
O1 - Hosts: 220.232.149.248 www.bankofamerica.com
O1 - Hosts: 220.232.149.248 bankofamerica.com
O1 - Hosts: 220.232.149.248 www.usbank.com
O1 - Hosts: 220.232.149.248 usbank.com
O1 - Hosts: 220.232.149.248 www.bankone.com
O1 - Hosts: 220.232.149.248 bankone.com
O1 - Hosts: 220.232.149.248 www.citibank.com
O1 - Hosts: 220.232.149.248 citibank.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\System32\csrs.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows TCP/IP Socket Driver] C:\WINDOWS\winsock\csrss.exe
O4 - HKLM\..\Run: [Windows Core Kernel Update] C:\WINDOWS\System32\win32bootcfg.exe
O4 - HKLM\..\Run: [Windows Helper] C:\WINDOWS\System32\svchozt.exe
O4 - HKLM\..\Run: [Microsoft FixUp] petitzax.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft FixUp] petitzax.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148899845343
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148901115656
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: MicroSoft Media Tools - Unknown owner - C:\WINDOWS\MSmedia.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Win32 Kernel Update (Win32Kernel) - Unknown owner - C:\WINDOWS\win32host.exe
O23 - Service: Windows TCP/IP Socket Driver (winsck) - Unknown owner - C:\WINDOWS\winsock\csrss.exe

[quote][/quote]

**Posty:** 18165 · przez **wojtas** 29 Maj 2006, 16:13

Popraw log w tagi!

**Posty:** 80 · przez **wojtasb3** 29 Maj 2006, 16:18

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:28:11, on 2006-05-29 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\MSmedia.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\win32host.exe C:\WINDOWS\winsock\csrss.exe C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe C:\WINDOWS\System32\svchozt.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\taskmgr.exe d:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\wojtas\USTAWI~1\Temp\Rar$EX00.547\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\winsock\csrss.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\winsock\csrss.exe O1 - Hosts: 220.232.149.248 lloydstsb.co.uk O1 - Hosts: 220.232.149.248 online.lloydstsb.co.uk O1 - Hosts: 220.232.149.248 www.lloydstsb.co.uk O1 - Hosts: 220.232.149.248 www.lloydstsb.com O1 - Hosts: 220.232.149.248 www.lloydstsb.com O1 - Hosts: 220.232.149.248 personal.barclays.co.uk O1 - Hosts: 220.232.149.248 barclays.co.uk O1 - Hosts: 220.232.149.248 ibank.barclays.co.uk O1 - Hosts: 220.232.149.248 www.barclays.co.uk O1 - Hosts: 220.232.149.248 www.nwolb.com O1 - Hosts: 220.232.149.248 nwolb.com O1 - Hosts: 220.232.149.248 hsbc.co.uk O1 - Hosts: 220.232.149.248 www.hsbc.co.uk O1 - Hosts: 220.232.149.248 abbey.com O1 - Hosts: 220.232.149.248 www.abbey.com O1 - Hosts: 220.232.149.248 www.abbey.co.uk O1 - Hosts: 220.232.149.248 abbey.co.uk O1 - Hosts: 220.232.149.248 cahoot.com O1 - Hosts: 220.232.149.248 www.cahoot.com O1 - Hosts: 220.232.149.248 www.cahoot.co.uk O1 - Hosts: 220.232.149.248 cahoot.co.uk O1 - Hosts: 220.232.149.248 www.co-operativebank.co.uk O1 - Hosts: 220.232.149.248 co-operativebank.co.uk O1 - Hosts: 220.232.149.248 www.co-operativebank.com O1 - Hosts: 220.232.149.248 co-operativebank.com O1 - Hosts: 220.232.149.248 welcome2.co-operativebankonline.co.uk O1 - Hosts: 220.232.149.248 welcome6.co-operativebankonline.co.uk O1 - Hosts: 220.232.149.248 welcome8.co-operativebankonline.co.uk O1 - Hosts: 220.232.149.248 welcome10.co-operativebankonline.co.uk O1 - Hosts: 220.232.149.248 www.smile.co.uk O1 - Hosts: 220.232.149.248 smile.co.uk O1 - Hosts: 220.232.149.248 www.cajamar.es O1 - Hosts: 220.232.149.248 cajamar.es O1 - Hosts: 220.232.149.248 www.cajamar.com O1 - Hosts: 220.232.149.248 cajamar.com O1 - Hosts: 220.232.149.248 www.unicaja.es O1 - Hosts: 220.232.149.248 unicaja.es O1 - Hosts: 220.232.149.248 www.unicaja.com O1 - Hosts: 220.232.149.248 unicaja.com O1 - Hosts: 220.232.149.248 www.caixagalicia.es O1 - Hosts: 220.232.149.248 caixagalicia.es O1 - Hosts: 220.232.149.248 www.caixagalicia.com O1 - Hosts: 220.232.149.248 caixagalicia.com O1 - Hosts: 220.232.149.248 activa.caixagalicia.es O1 - Hosts: 220.232.149.248 www.caixapenedes.es O1 - Hosts: 220.232.149.248 caixapenedes.es O1 - Hosts: 220.232.149.248 www.caixapenedes.com O1 - Hosts: 220.232.149.248 caixapenedes.com O1 - Hosts: 220.232.149.248 bancae.caixapenedes.com O1 - Hosts: 220.232.149.248 www.caixasabadell.es O1 - Hosts: 220.232.149.248 caixasabadell.es O1 - Hosts: 220.232.149.248 www.caixasabadell.net O1 - Hosts: 220.232.149.248 caixasabadell.net O1 - Hosts: 220.232.149.248 www.cajamadrid.es O1 - Hosts: 220.232.149.248 cajamadrid.es O1 - Hosts: 220.232.149.248 www.cajamadrid.com O1 - Hosts: 220.232.149.248 cajamadrid.com O1 - Hosts: 220.232.149.248 oi.cajamadrid.es O1 - Hosts: 220.232.149.248 www.ccm.es O1 - Hosts: 220.232.149.248 ccm.es O1 - Hosts: 220.232.149.248 www.haspa.de O1 - Hosts: 220.232.149.248 haspa.de O1 - Hosts: 220.232.149.248 ssl2.haspa.de O1 - Hosts: 220.232.149.248 www.dresdner-bank.de O1 - Hosts: 220.232.149.248 dresdner-bank.de O1 - Hosts: 220.232.149.248 www.dresdner-privat.de O1 - Hosts: 220.232.149.248 postbank.de O1 - Hosts: 220.232.149.248 www.postbank.de O1 - Hosts: 220.232.149.248 banking.postbank.de O1 - Hosts: 220.232.149.248 www.sparda-b.de O1 - Hosts: 220.232.149.248 sparda-b.de O1 - Hosts: 220.232.149.248 www.bankingonline.de O1 - Hosts: 220.232.149.248 www.raiffeisenbank-erding.de O1 - Hosts: 220.232.149.248 raiffeisenbank-erding.de O1 - Hosts: 220.232.149.248 www.vr-networld-ebanking.de O1 - Hosts: 220.232.149.248 vr-networld-ebanking.de O1 - Hosts: 220.232.149.248 www.bnhof.de O1 - Hosts: 220.232.149.248 bnhof.de O1 - Hosts: 220.232.149.248 www.deutsche-bank.de O1 - Hosts: 220.232.149.248 deutsche-bank.de O1 - Hosts: 220.232.149.248 meine.deutsche-bank.de O1 - Hosts: 220.232.149.248 www.citibank.de O1 - Hosts: 220.232.149.248 citibank.de O1 - Hosts: 220.232.149.248 www.dkb.de O1 - Hosts: 220.232.149.248 dkb.de O1 - Hosts: 220.232.149.248 www.sparkasse-regensburg.de O1 - Hosts: 220.232.149.248 sparkasse-regensburg.de O1 - Hosts: 220.232.149.248 www.berliner-bank.de O1 - Hosts: 220.232.149.248 berliner-bank.de O1 - Hosts: 220.232.149.248 www.berliner-sparkasse.de O1 - Hosts: 220.232.149.248 berliner-sparkasse.de O1 - Hosts: 220.232.149.248 www.wellsfargo.com O1 - Hosts: 220.232.149.248 wellsfargo.com O1 - Hosts: 220.232.149.248 www.bankofamerica.com O1 - Hosts: 220.232.149.248 bankofamerica.com O1 - Hosts: 220.232.149.248 www.usbank.com O1 - Hosts: 220.232.149.248 usbank.com O1 - Hosts: 220.232.149.248 www.bankone.com O1 - Hosts: 220.232.149.248 bankone.com O1 - Hosts: 220.232.149.248 www.citibank.com O1 - Hosts: 220.232.149.248 citibank.com O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\System32\csrs.exe O4 - HKLM\..\Run: [Microsoft (R) Windows TCP/IP Socket Driver] C:\WINDOWS\winsock\csrss.exe O4 - HKLM\..\Run: [Windows Core Kernel Update] C:\WINDOWS\System32\win32bootcfg.exe O4 - HKLM\..\Run: [Windows Helper] C:\WINDOWS\System32\svchozt.exe O4 - HKLM\..\Run: [Microsoft FixUp] petitzax.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\RunServices: [Microsoft FixUp] petitzax.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148899845343 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148901115656 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: MicroSoft Media Tools - Unknown owner - C:\WINDOWS\MSmedia.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: Win32 Kernel Update (Win32Kernel) - Unknown owner - C:\WINDOWS\win32host.exe O23 - Service: Windows TCP/IP Socket Driver (winsck) - Unknown owner - C:\WINDOWS\winsock\csrss.exe

**Posty:** 1665 · przez **SER** 29 Maj 2006, 16:25

C:\WINDOWS\MSmedia.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\winsock\csrss.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\winsock\csrss.exe
O1 - Hosts: 220.232.149.248 lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 online.lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 www.lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 www.lloydstsb.com
O1 - Hosts: 220.232.149.248 www.lloydstsb.com
O1 - Hosts: 220.232.149.248 personal.barclays.co.uk
O1 - Hosts: 220.232.149.248 barclays.co.uk
O1 - Hosts: 220.232.149.248 ibank.barclays.co.uk
O1 - Hosts: 220.232.149.248 www.barclays.co.uk
O1 - Hosts: 220.232.149.248 www.nwolb.com
O1 - Hosts: 220.232.149.248 nwolb.com
O1 - Hosts: 220.232.149.248 hsbc.co.uk
O1 - Hosts: 220.232.149.248 www.hsbc.co.uk
O1 - Hosts: 220.232.149.248 abbey.com
O1 - Hosts: 220.232.149.248 www.abbey.com
O1 - Hosts: 220.232.149.248 www.abbey.co.uk
O1 - Hosts: 220.232.149.248 abbey.co.uk
O1 - Hosts: 220.232.149.248 cahoot.com
O1 - Hosts: 220.232.149.248 www.cahoot.com
O1 - Hosts: 220.232.149.248 www.cahoot.co.uk
O1 - Hosts: 220.232.149.248 cahoot.co.uk
O1 - Hosts: 220.232.149.248 www.co-operativebank.co.uk
O1 - Hosts: 220.232.149.248 co-operativebank.co.uk
O1 - Hosts: 220.232.149.248 www.co-operativebank.com
O1 - Hosts: 220.232.149.248 co-operativebank.com
O1 - Hosts: 220.232.149.248 welcome2.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome6.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome8.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome10.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 www.smile.co.uk
O1 - Hosts: 220.232.149.248 smile.co.uk
O1 - Hosts: 220.232.149.248 www.cajamar.es
O1 - Hosts: 220.232.149.248 cajamar.es
O1 - Hosts: 220.232.149.248 www.cajamar.com
O1 - Hosts: 220.232.149.248 cajamar.com
O1 - Hosts: 220.232.149.248 www.unicaja.es
O1 - Hosts: 220.232.149.248 unicaja.es
O1 - Hosts: 220.232.149.248 www.unicaja.com
O1 - Hosts: 220.232.149.248 unicaja.com
O1 - Hosts: 220.232.149.248 www.caixagalicia.es
O1 - Hosts: 220.232.149.248 caixagalicia.es
O1 - Hosts: 220.232.149.248 www.caixagalicia.com
O1 - Hosts: 220.232.149.248 caixagalicia.com
O1 - Hosts: 220.232.149.248 activa.caixagalicia.es
O1 - Hosts: 220.232.149.248 www.caixapenedes.es
O1 - Hosts: 220.232.149.248 caixapenedes.es
O1 - Hosts: 220.232.149.248 www.caixapenedes.com
O1 - Hosts: 220.232.149.248 caixapenedes.com
O1 - Hosts: 220.232.149.248 bancae.caixapenedes.com
O1 - Hosts: 220.232.149.248 www.caixasabadell.es
O1 - Hosts: 220.232.149.248 caixasabadell.es
O1 - Hosts: 220.232.149.248 www.caixasabadell.net
O1 - Hosts: 220.232.149.248 caixasabadell.net
O1 - Hosts: 220.232.149.248 www.cajamadrid.es
O1 - Hosts: 220.232.149.248 cajamadrid.es
O1 - Hosts: 220.232.149.248 www.cajamadrid.com
O1 - Hosts: 220.232.149.248 cajamadrid.com
O1 - Hosts: 220.232.149.248 oi.cajamadrid.es
O1 - Hosts: 220.232.149.248 www.ccm.es
O1 - Hosts: 220.232.149.248 ccm.es
O1 - Hosts: 220.232.149.248 www.haspa.de
O1 - Hosts: 220.232.149.248 haspa.de
O1 - Hosts: 220.232.149.248 ssl2.haspa.de
O1 - Hosts: 220.232.149.248 www.dresdner-bank.de
O1 - Hosts: 220.232.149.248 dresdner-bank.de
O1 - Hosts: 220.232.149.248 www.dresdner-privat.de
O1 - Hosts: 220.232.149.248 postbank.de
O1 - Hosts: 220.232.149.248 www.postbank.de
O1 - Hosts: 220.232.149.248 banking.postbank.de
O1 - Hosts: 220.232.149.248 www.sparda-b.de
O1 - Hosts: 220.232.149.248 sparda-b.de
O1 - Hosts: 220.232.149.248 www.bankingonline.de
O1 - Hosts: 220.232.149.248 www.raiffeisenbank-erding.de
O1 - Hosts: 220.232.149.248 raiffeisenbank-erding.de
O1 - Hosts: 220.232.149.248 www.vr-networld-ebanking.de
O1 - Hosts: 220.232.149.248 vr-networld-ebanking.de
O1 - Hosts: 220.232.149.248 www.bnhof.de
O1 - Hosts: 220.232.149.248 bnhof.de
O1 - Hosts: 220.232.149.248 www.deutsche-bank.de
O1 - Hosts: 220.232.149.248 deutsche-bank.de
O1 - Hosts: 220.232.149.248 meine.deutsche-bank.de
O1 - Hosts: 220.232.149.248 www.citibank.de
O1 - Hosts: 220.232.149.248 citibank.de
O1 - Hosts: 220.232.149.248 www.dkb.de
O1 - Hosts: 220.232.149.248 dkb.de
O1 - Hosts: 220.232.149.248 www.sparkasse-regensburg.de
O1 - Hosts: 220.232.149.248 sparkasse-regensburg.de
O1 - Hosts: 220.232.149.248 www.berliner-bank.de
O1 - Hosts: 220.232.149.248 berliner-bank.de
O1 - Hosts: 220.232.149.248 www.berliner-sparkasse.de
O1 - Hosts: 220.232.149.248 berliner-sparkasse.de
O1 - Hosts: 220.232.149.248 www.wellsfargo.com
O1 - Hosts: 220.232.149.248 wellsfargo.com
O1 - Hosts: 220.232.149.248 www.bankofamerica.com
O1 - Hosts: 220.232.149.248 bankofamerica.com
O1 - Hosts: 220.232.149.248 www.usbank.com
O1 - Hosts: 220.232.149.248 usbank.com
O1 - Hosts: 220.232.149.248 www.bankone.com
O1 - Hosts: 220.232.149.248 bankone.com
O1 - Hosts: 220.232.149.248 www.citibank.com
O1 - Hosts: 220.232.149.248 citibank.com

O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\System32\csrs.exe <- nie pomyl z csrss.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows TCP/IP Socket Driver] C:\WINDOWS\winsock\csrss.exe
O4 - HKLM\..\Run: [Windows Core Kernel Update] C:\WINDOWS\System32\win32bootcfg.exe
O4 - HKLM\..\Run: [Windows Helper] C:\WINDOWS\System32\svchozt.exe <- nie pomyl w svchost.exe
O4 - HKLM\..\Run: [Microsoft FixUp] petitzax.exe
O4 - HKLM\..\RunServices: [Microsoft FixUp] petitzax.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

Usuwasz w trybie awaryjnym, z wyłączonym Przywracaniem Systemu + pogrubione pliki ręcznie z dysku

======================

Później : Start -> Uruchom -> services.msc

Zatrzymujesz i wyłączasz usługi Windows TCP/IP Socket Driver (winsck) i Win32 Kernel Update (Win32Kernel)

======================

Po wszystkim nowy log

**Posty:** 80 · przez **wojtasb3** 29 Maj 2006, 16:57

Z tych wszystkich wpisów znalazłem tylko svchozt.exe, reszty nie jestem w stanie znaleźć ( albo oślepłem ). Jakbyś mnie naprowadził gdzie ich szukac to byłbym wdzięczny.

**Posty:** 18165 · przez **wojtas** 29 Maj 2006, 16:58

start>wyszukaj.pliki lub foldery wpisz nazwe i musi byc rob to w awaryjnym!!

**Posty:** 80 · przez **wojtasb3** 29 Maj 2006, 16:59

na koncie adminitratora??

**Posty:** 18165 · przez **wojtas** 29 Maj 2006, 16:59

mozesz ale nie musisz!

**Posty:** 1665 · przez **SER** 29 Maj 2006, 17:23

Wszystko robisz w trybie awaryjnym, z wyłączonym Przywracaniem Systemu :!:

--------------------------------------

Wpisy powinny być ... :roll:

A co do wpisów, to możesz usunąć je bez szukania narzędziem KillBox -> http://www.forum.programosy.pl/dodatkowe-narzedzia-do-usuwania-i-ochrony-vt42021.html

Pobierasz, zaznaczasz Delete on Reboot i All Files, a w pole Full Path of File to Delete wklejasz poniższe ścieżki :

C:\WINDOWS\MSmedia.exe
C:\WINDOWS\System32\csrs.exe
C:\WINDOWS\System32\win32bootcfg.exe
C:\WINDOWS\System32\svchozt.exe
C:\WINDOWS\web\related.htm
C:\WINDOWS\System32\petitzax.exe

i naciskasz na X -> program poprosi o reset kompa (zgadzasz się). Potem usuwasz ręcznie (znajdujesz na dysku) folder

C:\WINDOWS\winsock

i go też usuwasz

==============

Po wszystkim log do kontroli

na koncie adminitratora??

Jak uruchamiasz tryb awaryjny, to zawsze wyświetlą się Twoje konta i Administrator -> wybierasz to, z uprawnieniami Admina, które sam robiłeś (nie to o nazwie Administator)

**Posty:** 80 · przez **wojtasb3** 29 Maj 2006, 17:58

[code]Logfile of HijackThis v1.99.1
Scan saved at 16:30:18, on 2006-05-29
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\userinit.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\winsock\csrss.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
d:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\wojtas\USTAWI~1\Temp\Rar$EX00.625\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\winsock\csrss.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\winsock\csrss.exe
O1 - Hosts: 220.232.149.248 lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 online.lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 www.lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 www.lloydstsb.com
O1 - Hosts: 220.232.149.248 www.lloydstsb.com
O1 - Hosts: 220.232.149.248 personal.barclays.co.uk
O1 - Hosts: 220.232.149.248 barclays.co.uk
O1 - Hosts: 220.232.149.248 ibank.barclays.co.uk
O1 - Hosts: 220.232.149.248 www.barclays.co.uk
O1 - Hosts: 220.232.149.248 www.nwolb.com
O1 - Hosts: 220.232.149.248 nwolb.com
O1 - Hosts: 220.232.149.248 hsbc.co.uk
O1 - Hosts: 220.232.149.248 www.hsbc.co.uk
O1 - Hosts: 220.232.149.248 abbey.com
O1 - Hosts: 220.232.149.248 www.abbey.com
O1 - Hosts: 220.232.149.248 www.abbey.co.uk
O1 - Hosts: 220.232.149.248 abbey.co.uk
O1 - Hosts: 220.232.149.248 cahoot.com
O1 - Hosts: 220.232.149.248 www.cahoot.com
O1 - Hosts: 220.232.149.248 www.cahoot.co.uk
O1 - Hosts: 220.232.149.248 cahoot.co.uk
O1 - Hosts: 220.232.149.248 www.co-operativebank.co.uk
O1 - Hosts: 220.232.149.248 co-operativebank.co.uk
O1 - Hosts: 220.232.149.248 www.co-operativebank.com
O1 - Hosts: 220.232.149.248 co-operativebank.com
O1 - Hosts: 220.232.149.248 welcome2.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome6.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome8.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome10.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 www.smile.co.uk
O1 - Hosts: 220.232.149.248 smile.co.uk
O1 - Hosts: 220.232.149.248 www.cajamar.es
O1 - Hosts: 220.232.149.248 cajamar.es
O1 - Hosts: 220.232.149.248 www.cajamar.com
O1 - Hosts: 220.232.149.248 cajamar.com
O1 - Hosts: 220.232.149.248 www.unicaja.es
O1 - Hosts: 220.232.149.248 unicaja.es
O1 - Hosts: 220.232.149.248 www.unicaja.com
O1 - Hosts: 220.232.149.248 unicaja.com
O1 - Hosts: 220.232.149.248 www.caixagalicia.es
O1 - Hosts: 220.232.149.248 caixagalicia.es
O1 - Hosts: 220.232.149.248 www.caixagalicia.com
O1 - Hosts: 220.232.149.248 caixagalicia.com
O1 - Hosts: 220.232.149.248 activa.caixagalicia.es
O1 - Hosts: 220.232.149.248 www.caixapenedes.es
O1 - Hosts: 220.232.149.248 caixapenedes.es
O1 - Hosts: 220.232.149.248 www.caixapenedes.com
O1 - Hosts: 220.232.149.248 caixapenedes.com
O1 - Hosts: 220.232.149.248 bancae.caixapenedes.com
O1 - Hosts: 220.232.149.248 www.caixasabadell.es
O1 - Hosts: 220.232.149.248 caixasabadell.es
O1 - Hosts: 220.232.149.248 www.caixasabadell.net
O1 - Hosts: 220.232.149.248 caixasabadell.net
O1 - Hosts: 220.232.149.248 www.cajamadrid.es
O1 - Hosts: 220.232.149.248 cajamadrid.es
O1 - Hosts: 220.232.149.248 www.cajamadrid.com
O1 - Hosts: 220.232.149.248 cajamadrid.com
O1 - Hosts: 220.232.149.248 oi.cajamadrid.es
O1 - Hosts: 220.232.149.248 www.ccm.es
O1 - Hosts: 220.232.149.248 ccm.es
O1 - Hosts: 220.232.149.248 www.haspa.de
O1 - Hosts: 220.232.149.248 haspa.de
O1 - Hosts: 220.232.149.248 ssl2.haspa.de
O1 - Hosts: 220.232.149.248 www.dresdner-bank.de
O1 - Hosts: 220.232.149.248 dresdner-bank.de
O1 - Hosts: 220.232.149.248 www.dresdner-privat.de
O1 - Hosts: 220.232.149.248 postbank.de
O1 - Hosts: 220.232.149.248 www.postbank.de
O1 - Hosts: 220.232.149.248 banking.postbank.de
O1 - Hosts: 220.232.149.248 www.sparda-b.de
O1 - Hosts: 220.232.149.248 sparda-b.de
O1 - Hosts: 220.232.149.248 www.bankingonline.de
O1 - Hosts: 220.232.149.248 www.raiffeisenbank-erding.de
O1 - Hosts: 220.232.149.248 raiffeisenbank-erding.de
O1 - Hosts: 220.232.149.248 www.vr-networld-ebanking.de
O1 - Hosts: 220.232.149.248 vr-networld-ebanking.de
O1 - Hosts: 220.232.149.248 www.bnhof.de
O1 - Hosts: 220.232.149.248 bnhof.de
O1 - Hosts: 220.232.149.248 www.deutsche-bank.de
O1 - Hosts: 220.232.149.248 deutsche-bank.de
O1 - Hosts: 220.232.149.248 meine.deutsche-bank.de
O1 - Hosts: 220.232.149.248 www.citibank.de
O1 - Hosts: 220.232.149.248 citibank.de
O1 - Hosts: 220.232.149.248 www.dkb.de
O1 - Hosts: 220.232.149.248 dkb.de
O1 - Hosts: 220.232.149.248 www.sparkasse-regensburg.de
O1 - Hosts: 220.232.149.248 sparkasse-regensburg.de
O1 - Hosts: 220.232.149.248 www.berliner-bank.de
O1 - Hosts: 220.232.149.248 berliner-bank.de
O1 - Hosts: 220.232.149.248 www.berliner-sparkasse.de
O1 - Hosts: 220.232.149.248 berliner-sparkasse.de
O1 - Hosts: 220.232.149.248 www.wellsfargo.com
O1 - Hosts: 220.232.149.248 wellsfargo.com
O1 - Hosts: 220.232.149.248 www.bankofamerica.com
O1 - Hosts: 220.232.149.248 bankofamerica.com
O1 - Hosts: 220.232.149.248 www.usbank.com
O1 - Hosts: 220.232.149.248 usbank.com
O1 - Hosts: 220.232.149.248 www.bankone.com
O1 - Hosts: 220.232.149.248 bankone.com
O1 - Hosts: 220.232.149.248 www.citibank.com
O1 - Hosts: 220.232.149.248 citibank.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\System32\csrs.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows TCP/IP Socket Driver] C:\WINDOWS\winsock\csrss.exe
O4 - HKLM\..\Run: [Windows Core Kernel Update] C:\WINDOWS\System32\win32bootcfg.exe
O4 - HKLM\..\Run: [Windows Helper] C:\WINDOWS\System32\svchozt.exe
O4 - HKLM\..\Run: [Microsoft FixUp] petitzax.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft FixUp] petitzax.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148899845343
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148901115656
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: MicroSoft Media Tools - Unknown owner - C:\WINDOWS\MSmedia.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows TCP/IP Socket Driver (winsck) - Unknown owner - C:\WINDOWS\winsock\csrss.exe

[ Dodano: Dzisiaj o 16:04 ]

Logfile of HijackThis v1.99.1
Scan saved at 16:30:18, on 2006-05-29
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\userinit.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\winsock\csrss.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
d:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\wojtas\USTAWI~1\Temp\Rar$EX00.625\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\winsock\csrss.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\winsock\csrss.exe
O1 - Hosts: 220.232.149.248 lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 online.lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 www.lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 www.lloydstsb.com
O1 - Hosts: 220.232.149.248 www.lloydstsb.com
O1 - Hosts: 220.232.149.248 personal.barclays.co.uk
O1 - Hosts: 220.232.149.248 barclays.co.uk
O1 - Hosts: 220.232.149.248 ibank.barclays.co.uk
O1 - Hosts: 220.232.149.248 www.barclays.co.uk
O1 - Hosts: 220.232.149.248 www.nwolb.com
O1 - Hosts: 220.232.149.248 nwolb.com
O1 - Hosts: 220.232.149.248 hsbc.co.uk
O1 - Hosts: 220.232.149.248 www.hsbc.co.uk
O1 - Hosts: 220.232.149.248 abbey.com
O1 - Hosts: 220.232.149.248 www.abbey.com
O1 - Hosts: 220.232.149.248 www.abbey.co.uk
O1 - Hosts: 220.232.149.248 abbey.co.uk
O1 - Hosts: 220.232.149.248 cahoot.com
O1 - Hosts: 220.232.149.248 www.cahoot.com
O1 - Hosts: 220.232.149.248 www.cahoot.co.uk
O1 - Hosts: 220.232.149.248 cahoot.co.uk
O1 - Hosts: 220.232.149.248 www.co-operativebank.co.uk
O1 - Hosts: 220.232.149.248 co-operativebank.co.uk
O1 - Hosts: 220.232.149.248 www.co-operativebank.com
O1 - Hosts: 220.232.149.248 co-operativebank.com
O1 - Hosts: 220.232.149.248 welcome2.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome6.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome8.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome10.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 www.smile.co.uk
O1 - Hosts: 220.232.149.248 smile.co.uk
O1 - Hosts: 220.232.149.248 www.cajamar.es
O1 - Hosts: 220.232.149.248 cajamar.es
O1 - Hosts: 220.232.149.248 www.cajamar.com
O1 - Hosts: 220.232.149.248 cajamar.com
O1 - Hosts: 220.232.149.248 www.unicaja.es
O1 - Hosts: 220.232.149.248 unicaja.es
O1 - Hosts: 220.232.149.248 www.unicaja.com
O1 - Hosts: 220.232.149.248 unicaja.com
O1 - Hosts: 220.232.149.248 www.caixagalicia.es
O1 - Hosts: 220.232.149.248 caixagalicia.es
O1 - Hosts: 220.232.149.248 www.caixagalicia.com
O1 - Hosts: 220.232.149.248 caixagalicia.com
O1 - Hosts: 220.232.149.248 activa.caixagalicia.es
O1 - Hosts: 220.232.149.248 www.caixapenedes.es
O1 - Hosts: 220.232.149.248 caixapenedes.es
O1 - Hosts: 220.232.149.248 www.caixapenedes.com
O1 - Hosts: 220.232.149.248 caixapenedes.com
O1 - Hosts: 220.232.149.248 bancae.caixapenedes.com
O1 - Hosts: 220.232.149.248 www.caixasabadell.es
O1 - Hosts: 220.232.149.248 caixasabadell.es
O1 - Hosts: 220.232.149.248 www.caixasabadell.net
O1 - Hosts: 220.232.149.248 caixasabadell.net
O1 - Hosts: 220.232.149.248 www.cajamadrid.es
O1 - Hosts: 220.232.149.248 cajamadrid.es
O1 - Hosts: 220.232.149.248 www.cajamadrid.com
O1 - Hosts: 220.232.149.248 cajamadrid.com
O1 - Hosts: 220.232.149.248 oi.cajamadrid.es
O1 - Hosts: 220.232.149.248 www.ccm.es
O1 - Hosts: 220.232.149.248 ccm.es
O1 - Hosts: 220.232.149.248 www.haspa.de
O1 - Hosts: 220.232.149.248 haspa.de
O1 - Hosts: 220.232.149.248 ssl2.haspa.de
O1 - Hosts: 220.232.149.248 www.dresdner-bank.de
O1 - Hosts: 220.232.149.248 dresdner-bank.de
O1 - Hosts: 220.232.149.248 www.dresdner-privat.de
O1 - Hosts: 220.232.149.248 postbank.de
O1 - Hosts: 220.232.149.248 www.postbank.de
O1 - Hosts: 220.232.149.248 banking.postbank.de
O1 - Hosts: 220.232.149.248 www.sparda-b.de
O1 - Hosts: 220.232.149.248 sparda-b.de
O1 - Hosts: 220.232.149.248 www.bankingonline.de
O1 - Hosts: 220.232.149.248 www.raiffeisenbank-erding.de
O1 - Hosts: 220.232.149.248 raiffeisenbank-erding.de
O1 - Hosts: 220.232.149.248 www.vr-networld-ebanking.de
O1 - Hosts: 220.232.149.248 vr-networld-ebanking.de
O1 - Hosts: 220.232.149.248 www.bnhof.de
O1 - Hosts: 220.232.149.248 bnhof.de
O1 - Hosts: 220.232.149.248 www.deutsche-bank.de
O1 - Hosts: 220.232.149.248 deutsche-bank.de
O1 - Hosts: 220.232.149.248 meine.deutsche-bank.de
O1 - Hosts: 220.232.149.248 www.citibank.de
O1 - Hosts: 220.232.149.248 citibank.de
O1 - Hosts: 220.232.149.248 www.dkb.de
O1 - Hosts: 220.232.149.248 dkb.de
O1 - Hosts: 220.232.149.248 www.sparkasse-regensburg.de
O1 - Hosts: 220.232.149.248 sparkasse-regensburg.de
O1 - Hosts: 220.232.149.248 www.berliner-bank.de
O1 - Hosts: 220.232.149.248 berliner-bank.de
O1 - Hosts: 220.232.149.248 www.berliner-sparkasse.de
O1 - Hosts: 220.232.149.248 berliner-sparkasse.de
O1 - Hosts: 220.232.149.248 www.wellsfargo.com
O1 - Hosts: 220.232.149.248 wellsfargo.com
O1 - Hosts: 220.232.149.248 www.bankofamerica.com
O1 - Hosts: 220.232.149.248 bankofamerica.com
O1 - Hosts: 220.232.149.248 www.usbank.com
O1 - Hosts: 220.232.149.248 usbank.com
O1 - Hosts: 220.232.149.248 www.bankone.com
O1 - Hosts: 220.232.149.248 bankone.com
O1 - Hosts: 220.232.149.248 www.citibank.com
O1 - Hosts: 220.232.149.248 citibank.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\System32\csrs.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows TCP/IP Socket Driver] C:\WINDOWS\winsock\csrss.exe
O4 - HKLM\..\Run: [Windows Core Kernel Update] C:\WINDOWS\System32\win32bootcfg.exe
O4 - HKLM\..\Run: [Windows Helper] C:\WINDOWS\System32\svchozt.exe
O4 - HKLM\..\Run: [Microsoft FixUp] petitzax.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft FixUp] petitzax.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148899845343
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148901115656
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: MicroSoft Media Tools - Unknown owner - C:\WINDOWS\MSmedia.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows TCP/IP Socket Driver (winsck) - Unknown owner - C:\WINDOWS\winsock\csrss.exe

[ Dodano: Dzisiaj o 16:05 ]
sorki

[ Dodano: Dzisiaj o 16:22 ]
czyżby przypadek beznadzejny??? może bardziej sie opłaca format c jeszcze raz?niemam nic do stracenia oprócz czasu

**Posty:** 8694 · przez **Red** 29 Maj 2006, 19:19

nie beznadziejny ,a bardzo prosty ,tylko ze ty nie usuwsz ,a jesli probujesz usunac to wpisy wracają.....zastosuj sie do zasad usuwania:

usuwasz z wylaczonym przywracaniem systemu w xp i w trybie awaryjnym f8

tryb awaryjny wylaczysz tak:w momencie jak odpalasz kompa wciskasz pulsacyjnie klawisz f8 i w pewnym momenice wejdziesz do awaryjnego

wylacz przywracanie systemu tj
prawoklik na moj komputer >własciwosci >przywracanie systemu>i zaptaszkuj pozycje>wyłacz przywracanie systemu

**Posty:** 80 · przez **wojtasb3** 31 Maj 2006, 22:39

Logfile of HijackThis v1.99.1
Scan saved at 21:07:39, on 2006-05-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\tlntsvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Soulseek\slsk.exe
C:\WINDOWS\system32\cidaemon.exe
D:\Program Files\mozilla\mozilla.exe
D:\Program Files\Winamp\winamp.exe
C:\DOCUME~1\Wojtas\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [Zone Labs Client] "d:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz 10.1 Pro\odk_mcd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Komunikator] "D:\Program Files\Tlen.pl\tlen.exe" --confdir=home
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Usługa Kaspersky Anti-Virus (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

przez **jeff** 31 Maj 2006, 22:40

wojtasb3

jaja sobie robisz z tymi tagami ?

**Posty:** 1665 · przez **SER** 31 Maj 2006, 22:41

O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe

Usuwasz jeszcze ten wpis + folder pogrubiony ręcznie (opis usuwania bez zmian) i będziesz miał czysto ...

**Posty:** 8694 · przez **Red** 31 Maj 2006, 22:50

no tak to nie bedzie tutaj ,to nie wyscigi

**Posty:** 80 · przez **wojtasb3** 31 Maj 2006, 22:51

opis usuwania bez zmian

ręcznie czy killboxem??

**Posty:** 8694 · przez **Red** 31 Maj 2006, 22:52

prosze objąc log w tagi :evil:

**Posty:** 80 · przez **wojtasb3** 31 Maj 2006, 22:56

jeśli kogoś uraziłem to przepraszam

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:07:39, on 2006-05-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\tlntsvr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Soulseek\slsk.exe C:\WINDOWS\system32\cidaemon.exe D:\Program Files\mozilla\mozilla.exe D:\Program Files\Winamp\winamp.exe C:\DOCUME~1\Wojtas\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe O4 - HKLM\..\Run: [Zone Labs Client] "d:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz 10.1 Pro\odk_mcd.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Komunikator] "D:\Program Files\Tlen.pl\tlen.exe" --confdir=home O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Usługa Kaspersky Anti-Virus (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

**Posty:** 8694 · przez **Red** 31 Maj 2006, 23:12

C:\Program Files\VVSN<<usun recznie

**Posty:** 80 · przez **wojtasb3** 23 Cze 2006, 18:05

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:02:03, on 2006-06-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe C:\WINDOWS\CTHELPER.EXE C:\WINDOWS\system32\CTXFIHLP.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\WINDOWS\SYSTEM32\CTXFISPI.EXE C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\System32\tlntsvr.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\WINDOWS\system32\cidaemon.exe D:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\Wojtas\USTAWI~1\Temp\Rar$EX14.282\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe O4 - HKLM\..\Run: [Zone Labs Client] "d:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz 10.1 Pro\odk_mcd.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Komunikator] "D:\Program Files\Tlen.pl\tlen.exe" --confdir=home O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa Kaspersky Anti-Virus (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

spowolnienie przy starcie

spowolnienie przy starcie

Kto jest na forum