problem ze spyware

**Posty:** 23 · przez **monia4395** 31 Mar 2006, 22:24

Od kilku dni walczę z robakami i w tej chwili nie mam już pomysłu co robić dalej. Nagminnie pojawia się usługa posłaniec oraz od czasu do czasu restartuje mi się komputer.
Przy wchodzeniu do sieci AntiVirenKit sygnalizuje próbę dostania się do zainfekowanego pliku. Jakiś czas był to systemconfig32.exe a teraz jest appmr.dll. Obu fizycznie nie było i nie ma na dysku we wskazywanych lokalizacjach, natomiast ta informacja o tym pliku dopisuje się do rejestru

HKEY_USERS\S-1-5-21-220523388-1801674531-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603

Dorzucam loga?

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:57:46, on 2006-03-31 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe E:\Program Files\AntiVirenKit 2006\AVKService.exe E:\Program Files\AntiVirenKit 2006\AVKWCtl.exe K:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE E:\WINDOWS\System32\nvsvc32.exe E:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe K:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe E:\PROGRA~1\NEOSTR~1\CnxMon.exe E:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe E:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe E:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe K:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe E:\WINDOWS\System32\taskmgr.exe E:\Program Files\Neostrada TP\NeostradaTP.exe E:\Program Files\Neostrada TP\ComComp.exe E:\Program Files\Neostrada TP\Watch.exe K:\Program Files\Firefox\firefox.exe E:\WINDOWS\system32\NOTEPAD.EXE E:\WINDOWS\System32\wuauclt.exe E:\WINDOWS\system32\NOTEPAD.EXE E:\WINDOWS\regedit.exe K:\narzedzia\hijackthis\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - K:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - k:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - K:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - K:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] K:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [WooCnxMon] E:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] E:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] E:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [AVKTray] "E:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - Global Startup: DSLMON.lnk = E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://K:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O15 - Trusted Zone: http://arcaonline.arcabit.com O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{120BEF9C-FFAC-4F54-8312-2B91BA1F7B6E}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: AVKProxy - G DATA Software AG - E:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe O23 - Service: AVK Service (AVKService) - Unknown owner - E:\Program Files\AntiVirenKit 2006\AVKService.exe O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - E:\Program Files\AntiVirenKit 2006\AVKWCtl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe O23 - Service: iPodService - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - K:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe O23 - Service: QWNKEGNIIPMR - Sysinternals - www.sysinternals.com - E:\DOCUME~1\Mama\USTAWI~1\Temp\QWNKEGNIIPMR.exe

**Posty:** 8694 · przez **Red** 31 Mar 2006, 22:32

prosze o dodatkowy log:

otwierasz link>> http://www.silentrunners.org/Silent%20Runners.vbs >>zapisujesz jako na pulpicie>>klikasz dwa razy >>masz wybor i wybierasz no>>i czekasz troszke az wygeneruje sie cały log do konca
wrzucasz na forum

i sciagnij:
http://www.bleepingcomputer.com/files/steelwerx/regsearch.zip
i daj mu na wyszukiwanie:
systemconfig32.exe oraz appmr.dll Obydwa wyniki wklej na forum.

**Posty:** 23 · przez **monia4395** 31 Mar 2006, 22:42

przy wyszukiwaniu rejestru pojawia się błąd odczytu wartości TcpNumConnections

natomias grugi log jest następujący

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 44, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS] "IMONTRAY" = "C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe" [empty string] "Share-to-Web Namespace Daemon" = "K:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"] "WooCnxMon" = "E:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string] "WOOWATCH" = "E:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "E:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] "AVKTray" = ""E:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe"" ["G DATA Software"] "KernelFaultCheck" = "E:\WINDOWS\system32\dumprep 0 -k" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "K:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "k:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEToolbarHelper Class" \InProcServer32\(Default) = "K:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "E:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Eksplorator pulpitów" -> {HKLM...CLSID} = "Eksplorator pulpitów" \InProcServer32\(Default) = "E:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "K:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "K:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "k:\Program Files\WinRAR\rarext.dll" [null data] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "K:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."] "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = ""E:\Program Files\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = ""E:\Program Files\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = ""E:\Program Files\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = ""E:\Program Files\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "K:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] AVK9CM\(Default) = "{CAF4C320-32F5-11D3-A222-004095200FF2}" -> {HKLM...CLSID} = "AVK9ContextMenue" \InProcServer32\(Default) = "E:\Program Files\AntiVirenKit 2006\ShellExt.dll" [empty string] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "k:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "k:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVK9CM\(Default) = "{CAF4C320-32F5-11D3-A222-004095200FF2}" -> {HKLM...CLSID} = "AVK9ContextMenue" \InProcServer32\(Default) = "E:\Program Files\AntiVirenKit 2006\ShellExt.dll" [empty string] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "k:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "E:\Documents and Settings\Mama\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "E:\WINDOWS\System32\ssmypics.scr" [MS] Startup items in "Mama" & "All Users" startup folders: ------------------------------------------------------ E:\Documents and Settings\All Users\Menu Start\Programy\Autostart "DSLMON" -> shortcut to: "E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] Enabled Scheduled Tasks: ------------------------ "Norton SystemWorks One Button Checkup" -> launches: "E:\Program Files\Common Files\Symantec Shared\NMAIN.EXE /dat:K:\Program Files\Norton SystemWorks\swplugin.nsi /NSWCMD:OBCSchedule" ["Symantec Corporation"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "K:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided) -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "K:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "K:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data] Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "E:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "E:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "E:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVK Service, AVKService, "E:\Program Files\AntiVirenKit 2006\AVKService.exe" [empty string] AVKProxy, AVKProxy, ""E:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe"" ["G DATA Software AG"] Intel(R) Active Monitor, imonNT, "C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe" ["Intel Corp."] Norton Unerase Protection, NProtectService, "K:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE" ["Symantec Corporation"] NVIDIA Driver Helper Service, NVSvc, "E:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] Strażnik AVK, AVKWCtl, "E:\Program Files\AntiVirenKit 2006\AVKWCtl.exe" [empty string] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Adobe PDF Port\Driver = "E:\WINDOWS\System32\AdobePDF.dll" ["Adobe Systems Incorporated."] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 465 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 358 seconds. ---------- (total run time: 1492 seconds)

**Posty:** 8694 · przez **Red** 31 Mar 2006, 22:50

do usuniecia jest:

O23 - Service: QWNKEGNIIPMR - Sysinternals - www.sysinternals.com - E:\DOCUME~1\Mama\USTAWI~1\Temp\QWNKEGNIIPMR.exe

Wykonaj:
Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop QWNKEGNIIPMR
sc delete QWNKEGNIIPMR

Dodatkowo prosze sciagnac:

http://www.intermute.com/spysubtract/cwshredder_download.html
przeskanowac system i usunac wszystko co znajdzie

Przelec system obowiazkowo tez tym:
http://www.safer-networking.org/files/delcwssk.zip

Oraz sciagasz:
http://www.ewido.net/en/download/
skanujesz komputer i wynik wklejasz na forum

**Posty:** 23 · przez **monia4395** 01 Kwi 2006, 00:05

Przeskanowałam zgodnie ze wskazówkami.
Rozumiem, że chcesz wynik logu z ewido?

Kod: Zaznacz wszystko: --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 22:37:48, 2006-03-31 + Report-Checksum: B2394854 + Scan result: :mozilla.18:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.19:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.60:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.61:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.68:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.74:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.77:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.78:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.79:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.80:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.81:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.108:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup :mozilla.111:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup :mozilla.116:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.117:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.158:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup :mozilla.159:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup :mozilla.173:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup :mozilla.180:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup :mozilla.191:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.196:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.197:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.200:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.244:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup :mozilla.245:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup :mozilla.248:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Ivwbox : Cleaned with backup :mozilla.249:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.250:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.255:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup :mozilla.263:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup :mozilla.264:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup :mozilla.265:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup :mozilla.268:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup :mozilla.280:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup :mozilla.322:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.323:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.324:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.325:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.326:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.327:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.328:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.329:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.330:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.331:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.332:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.333:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.334:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.335:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.336:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.337:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.338:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.374:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.377:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.378:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.382:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup :mozilla.383:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup :mozilla.384:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup :mozilla.391:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.405:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.406:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.413:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Bfast : Cleaned with backup :mozilla.436:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup :mozilla.483:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup :mozilla.484:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup :mozilla.516:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.551:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup :mozilla.568:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup :mozilla.569:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup :mozilla.570:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.571:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.598:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup :mozilla.604:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup :mozilla.613:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup :mozilla.614:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup :mozilla.617:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.618:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.619:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup :mozilla.627:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.629:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup :mozilla.632:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup :mozilla.670:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup :mozilla.671:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup :mozilla.677:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned with backup :mozilla.678:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup :mozilla.679:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup :mozilla.680:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup :mozilla.681:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup :mozilla.694:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.702:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned with backup :mozilla.703:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned with backup :mozilla.714:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.715:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup :mozilla.728:E:\Documents and Settings\Mama\Dane aplikacji\Mozilla\Firefox\Profiles\zixvf11w.default\cookies.txt -> TrackingCookie.Trafic : Cleaned with backup ::Report End

**Posty:** 8694 · przez **Red** 01 Kwi 2006, 08:09

Ewido nic wielkiego nie znalazł.

Jesli zastosowałas wszystko to co napisałem powyzej ,to teraz sciagnij:
http://www.firewallleaktester.com/tools/wwdc.exe
pozamykaj wszystkie porty na enable >>tu masz widok:
http://forum.programosy.pl/-vp206299.html#206299
i napisz jaka jest sytuacja

**Posty:** 23 · przez **monia4395** 01 Kwi 2006, 23:15

Pomimo, że skanowanie nic nie znalazło, zawsze po odpaleniu firefoxa uruchomiał się ftp a po nim ładowały się "usługi posłaniec "

.
Po zamknięciu portów jest ok.
:lol:

Wielkie dzięki. Przyznaje się, że pomogłeś mi już drugi raz. Twoje rady są zawsze precyzyjne i trafione. Jeszcze raz dzięki.

**Posty:** 8694 · przez **Red** 01 Kwi 2006, 23:17

monia4395 napisał(a):Po zamknięciu portów jest ok.

Trzymaj sie

Autor postu otrzymał pochwałę

problem ze spyware

problem ze spyware

Kto jest na forum