dziwny proces w logu, prośba o sprawdzenie

**Posty:** 39 · przez **westside** 22 Lip 2007, 18:36

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:26:59, on 2007-07-22 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\atwtusb.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Windows\hgraphic.exe <----- chodzi o ten C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\SNDVOL32.EXE C:\Program Files\Winamp\winamp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Progsy\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O1 - Hosts: 195.122.131.45 dl22l32.rapidshare.com O1 - Hosts: 195.122.131.45 dl22cg.rapidshare.com O1 - Hosts: 195.122.131.45 dl22cg2.rapidshare.com O1 - Hosts: 195.122.131.45 dl22tl.rapidshare.com O1 - Hosts: 195.122.131.45 dl22tl2.rapidshare.com O1 - Hosts: 195.122.131.47 dl23l32.rapidshare.com O1 - Hosts: 195.122.131.47 dl23cg.rapidshare.com O1 - Hosts: 195.122.131.47 dl23cg2.rapidshare.com O1 - Hosts: 195.122.131.47 dl23tl.rapidshare.com O1 - Hosts: 195.122.131.47 dl23tl2.rapidshare.com O1 - Hosts: 195.122.131.49 dl24l32.rapidshare.com O1 - Hosts: 195.122.131.49 dl24cg.rapidshare.com O1 - Hosts: 195.122.131.49 dl24cg2.rapidshare.com O1 - Hosts: 195.122.131.49 dl24tl.rapidshare.com O1 - Hosts: 195.122.131.49 dl24tl2.rapidshare.com O1 - Hosts: 195.122.131.61 dl30l32.rapidshare.com O1 - Hosts: 195.122.131.61 dl30cg.rapidshare.com O1 - Hosts: 195.122.131.61 dl30cg2.rapidshare.com O1 - Hosts: 195.122.131.61 dl30tl.rapidshare.com O1 - Hosts: 195.122.131.61 dl30tl2.rapidshare.com O1 - Hosts: 195.122.131.63 dl31l32.rapidshare.com O1 - Hosts: 195.122.131.63 dl31cg.rapidshare.com O1 - Hosts: 195.122.131.63 dl31cg2.rapidshare.com O1 - Hosts: 195.122.131.63 dl31tl.rapidshare.com O1 - Hosts: 195.122.131.63 dl31tl2.rapidshare.com O1 - Hosts: 195.122.131.65 dl32l32.rapidshare.com O1 - Hosts: 195.122.131.65 dl32cg.rapidshare.com O1 - Hosts: 195.122.131.65 dl32cg2.rapidshare.com O1 - Hosts: 195.122.131.65 dl32tl.rapidshare.com O1 - Hosts: 195.122.131.65 dl32tl2.rapidshare.com O1 - Hosts: 195.122.131.67 dl33l32.rapidshare.com O1 - Hosts: 195.122.131.67 dl33cg.rapidshare.com O1 - Hosts: 195.122.131.67 dl33cg2.rapidshare.com O1 - Hosts: 195.122.131.67 dl33tl.rapidshare.com O1 - Hosts: 195.122.131.67 dl33tl2.rapidshare.com O1 - Hosts: 195.122.131.69 dl34l32.rapidshare.com O1 - Hosts: 195.122.131.69 dl34cg.rapidshare.com O1 - Hosts: 195.122.131.69 dl34cg2.rapidshare.com O1 - Hosts: 195.122.131.69 dl34tl.rapidshare.com O1 - Hosts: 195.122.131.69 dl34tl2.rapidshare.com O1 - Hosts: 195.122.131.81 dl40l32.rapidshare.com O1 - Hosts: 195.122.131.81 dl40cg.rapidshare.com O1 - Hosts: 195.122.131.81 dl40cg2.rapidshare.com O1 - Hosts: 195.122.131.81 dl40tl.rapidshare.com O1 - Hosts: 195.122.131.81 dl40tl2.rapidshare.com O1 - Hosts: 195.122.131.83 dl41l32.rapidshare.com O1 - Hosts: 195.122.131.83 dl41cg.rapidshare.com O1 - Hosts: 195.122.131.83 dl41cg2.rapidshare.com O1 - Hosts: 195.122.131.83 dl41tl.rapidshare.com O1 - Hosts: 195.122.131.83 dl41tl2.rapidshare.com O1 - Hosts: 195.122.131.85 dl42l32.rapidshare.com O1 - Hosts: 195.122.131.85 dl42cg.rapidshare.com O1 - Hosts: 195.122.131.85 dl42cg2.rapidshare.com O1 - Hosts: 195.122.131.85 dl42tl.rapidshare.com O1 - Hosts: 195.122.131.85 dl42tl2.rapidshare.com O1 - Hosts: 195.122.131.87 dl43l32.rapidshare.com O1 - Hosts: 195.122.131.87 dl43cg.rapidshare.com O1 - Hosts: 195.122.131.87 dl43cg2.rapidshare.com O1 - Hosts: 195.122.131.87 dl43tl.rapidshare.com O1 - Hosts: 195.122.131.87 dl43tl2.rapidshare.com O1 - Hosts: 195.122.131.89 dl44l32.rapidshare.com O1 - Hosts: 195.122.131.89 dl44cg.rapidshare.com O1 - Hosts: 195.122.131.89 dl44cg2.rapidshare.com O1 - Hosts: 195.122.131.89 dl44tl.rapidshare.com O1 - Hosts: 195.122.131.89 dl44tl2.rapidshare.com O1 - Hosts: 195.122.131.101 dl50l32.rapidshare.com O1 - Hosts: 195.122.131.101 dl50cg.rapidshare.com O1 - Hosts: 195.122.131.101 dl50cg2.rapidshare.com O1 - Hosts: 195.122.131.101 dl50tl.rapidshare.com O1 - Hosts: 195.122.131.101 dl50tl2.rapidshare.com O1 - Hosts: 195.122.131.103 dl51l32.rapidshare.com O1 - Hosts: 195.122.131.103 dl51cg.rapidshare.com O1 - Hosts: 195.122.131.103 dl51cg2.rapidshare.com O1 - Hosts: 195.122.131.103 dl51tl.rapidshare.com O1 - Hosts: 195.122.131.103 dl51tl2.rapidshare.com O1 - Hosts: 195.122.131.105 dl52l32.rapidshare.com O1 - Hosts: 195.122.131.105 dl52cg.rapidshare.com O1 - Hosts: 195.122.131.105 dl52cg2.rapidshare.com O1 - Hosts: 195.122.131.105 dl52tl.rapidshare.com O1 - Hosts: 195.122.131.105 dl52tl2.rapidshare.com O1 - Hosts: 195.122.131.107 dl53l32.rapidshare.com O1 - Hosts: 195.122.131.107 dl53cg.rapidshare.com O1 - Hosts: 195.122.131.107 dl53cg2.rapidshare.com O1 - Hosts: 195.122.131.107 dl53tl.rapidshare.com O1 - Hosts: 195.122.131.107 dl53tl2.rapidshare.com O1 - Hosts: 195.122.131.109 dl54l32.rapidshare.com O1 - Hosts: 195.122.131.109 dl54cg.rapidshare.com O1 - Hosts: 195.122.131.109 dl54cg2.rapidshare.com O1 - Hosts: 195.122.131.109 dl54tl.rapidshare.com O1 - Hosts: 195.122.131.109 dl54tl2.rapidshare.com O1 - Hosts: 195.122.131.121 dl60l32.rapidshare.com O1 - Hosts: 195.122.131.121 dl60cg.rapidshare.com O1 - Hosts: 195.122.131.121 dl60cg2.rapidshare.com O1 - Hosts: 195.122.131.121 dl60tl.rapidshare.com O1 - Hosts: 195.122.131.121 dl60tl2.rapidshare.com O1 - Hosts: 195.122.131.123 dl61l32.rapidshare.com O1 - Hosts: 195.122.131.123 dl61cg.rapidshare.com O1 - Hosts: 195.122.131.123 dl61cg2.rapidshare.com O1 - Hosts: 195.122.131.123 dl61tl.rapidshare.com O1 - Hosts: 195.122.131.123 dl61tl2.rapidshare.com O1 - Hosts: 195.122.131.125 dl62l32.rapidshare.com O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [hgraphic.exe] C:\Windows\hgraphic.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O17 - HKLM\System\CCS\Services\Tcpip\..\{9743834E-CEDE-42D4-BACF-159AAB91B861}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe

a poza tym mam jeszcze jeden problem, otóż cały czas mi się w windowsie muzyka ścisza

sama

**Posty:** 18165 · przez **wojtas** 22 Lip 2007, 18:56

dziwny proces

jaki ??

**Posty:** 39 · przez **westside** 22 Lip 2007, 18:59

westside napisał(a):C:\Windows\hgraphic.exe

nigdy przedtem go nie miałem...

**Posty:** 18165 · przez **wojtas** 22 Lip 2007, 19:13

skasuj"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

ten plik przeskanuj:

C:\Windows\hgraphic.exe

tu:

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty oraz daj loga z combofixa

**Posty:** 39 · przez **westside** 22 Lip 2007, 19:31

virustotal:

Kod: Zaznacz wszystko: AhnLab-V3 2007.7.21.0 2007.07.20 no virus found AntiVir 7.4.0.44 2007.07.22 no virus found Authentium 4.93.8 2007.07.20 no virus found Avast 4.7.997.0 2007.07.22 no virus found AVG 7.5.0.476 2007.07.21 Potentially harmful program HackTool.BTM BitDefender 7.2 2007.07.22 no virus found CAT-QuickHeal 9.00 2007.07.20 no virus found ClamAV devel-20070416 2007.07.22 no virus found DrWeb 4.33 2007.07.22 no virus found eSafe 7.0.15.0 2007.07.22 suspicious Trojan/Worm eTrust-Vet 30.8.3797 2007.07.20 no virus found Ewido 4.0 2007.07.22 no virus found FileAdvisor 1 2007.07.22 no virus found Fortinet 2.91.0.0 2007.07.22 no virus found F-Prot 4.3.2.48 2007.07.20 no virus found F-Secure 6.70.13030.0 2007.07.22 no virus found Ikarus T3.1.1.8 2007.07.22 no virus found Kaspersky 4.0.2.24 2007.07.22 no virus found McAfee 5079 2007.07.20 no virus found Microsoft 1.2704 2007.07.22 no virus found NOD32v2 2411 2007.07.21 no virus found Norman 5.80.02 2007.07.20 no virus found Panda 9.0.0.4 2007.07.22 no virus found Sophos 4.19.0 2007.07.17 no virus found Sunbelt 2.2.907.0 2007.07.21 no virus found Symantec 10 2007.07.22 no virus found TheHacker 6.1.7.151 2007.07.22 no virus found VBA32 3.12.2.1 2007.07.21 no virus found VirusBuster 4.3.26:9 2007.07.22 no virus found Webwasher-Gateway 6.0.1 2007.07.22 no virus found

virusscan:

Kod: Zaznacz wszystko: A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found HackTool.BTM BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

**Posty:** 18165 · przez **wojtas** 22 Lip 2007, 19:33

wojtas19162 napisał(a):daj loga z combofixa

**Posty:** 39 · przez **westside** 23 Lip 2007, 11:59

Kod: Zaznacz wszystko: ja - 2007-07-23 11:53:52 - ComboFix 07-07-23.6 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-23 to 2007-07-23 ))))))))))))))))))))))))))))))) 2007-07-23 11:53 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-22 11:22 7,304 --a------ C:\WINDOWS\desctemp.dat 2007-07-21 22:01 <DIR> d-------- C:\DOCUME~1\Gruczek\DANEAP~1\Google 2007-07-21 22:00 379,909 --a------ C:\WINDOWS\hgraphic.exe 2007-07-21 21:59 <DIR> d-------- C:\Program Files\Google 2007-07-20 22:41 <DIR> d-------- C:\Program Files\XP Codec Pack 2007-07-20 22:37 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-07-20 22:37 <DIR> d-------- C:\DOCUME~1\Gruczek\DANEAP~1\Real 2007-07-20 22:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-07-20 17:39 <DIR> d-------- C:\Program Files\PopCap Games 2007-07-01 17:00 44 --a------ C:\WINDOWS\popcinfo.dat 2007-06-29 13:06 <DIR> d-------- C:\Program Files\Tlen.pl 2007-06-29 13:06 <DIR> d-------- C:\DOCUME~1\Gruczek\DANEAP~1\Tlen.pl 2007-06-27 15:42 <DIR> d-------- C:\Ultisoft 2007-06-24 21:29 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-06-23 14:48 <DIR> d-------- C:\DOCUME~1\Gruczek\DANEAP~1\dvdcss (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-23 09:42:02 -------- d-----w C:\Program Files\AutoConnect 2007-07-22 21:28:00 -------- d-----w C:\Program Files\Neostrada TP 2007-07-22 15:20:57 -------- d-----w C:\Program Files\eMule 2007-07-22 14:16:26 -------- d-----w C:\Program Files\PowerArchiver 2007-07-22 07:10:40 -------- d-----w C:\Program Files\FlashGet 2007-07-21 18:55:42 -------- d-----w C:\Program Files\VideoLAN 2007-07-20 20:39:41 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-07-20 20:35:29 -------- d-----w C:\Program Files\SubEdit-Player 2007-07-17 08:06:40 -------- d-----w C:\DOCUME~1\Gruczek\DANEAP~1\SolidDocuments 2007-07-14 18:14:51 -------- d-----w C:\Program Files\NAPI-PROJEKT 2007-07-08 18:14:34 -------- d-----w C:\Program Files\Real Alternative 2007-07-06 08:15:43 -------- d-----w C:\Program Files\Gadu-Gadu 2007-06-24 19:29:49 -------- d-----w C:\Program Files\Common Files\Real 2007-06-14 13:44:11 -------- d-----w C:\Program Files\SK's 2007-06-08 13:51:06 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-08 13:43:10 -------- d-----w C:\Program Files\Motorola 2007-06-07 19:10:48 20,480 ----a-w C:\WINDOWS\system32\ac3config.exe 2007-06-07 16:11:35 -------- d-----w C:\DOCUME~1\Gruczek\DANEAP~1\Flasher_Temp 2007-06-07 16:08:31 0 ----a-w C:\confob.sys 2007-06-07 10:55:17 -------- d-----w C:\Program Files\SolidDocuments 2007-06-04 18:47:41 -------- d-----w C:\Program Files\Common Files\Teleca Shared 2007-06-04 18:46:41 -------- d-----w C:\Program Files\Sony Ericsson 2007-06-03 11:40:51 -------- d-----w C:\Program Files\Common Files\AVSMedia 2007-06-03 11:40:49 -------- d-----w C:\Program Files\AVSMedia 2007-06-03 11:39:17 -------- d-----w C:\DOCUME~1\Gruczek\DANEAP~1\FMA 2007-05-29 11:09:37 -------- d-----w C:\Program Files\ABBYY FineReader 8.0 Professional Edition 2007-05-26 10:39:05 -------- d-----w C:\Program Files\Lavalys 2007-05-24 17:41:46 -------- d-----w C:\Program Files\New Star Soccer 3 2007-05-11 21:03:58 720,896 ----a-w C:\WINDOWS\iun6002ev.exe 2007-05-03 12:16:50 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-05-03 12:16:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-05-01 10:01:18 737,280 -c--a-w C:\WINDOWS\iun6002.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-04-09 11:55] "atwtusb"="atwtusb.exe" [2005-09-21 18:08 C:\WINDOWS\system32\ATWTUSB.EXE] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 04:19] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27] "hgraphic.exe"="C:\Windows\hgraphic.exe" [2007-07-21 21:49] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-04-10 12:27:22] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-04-08 19:38:30] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BlueSoleil.lnk backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KEMailKb] C:\PROGRA~1\KEMailKb\KEMailKb.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerArchiver Tray] C:\Program Files\PowerArchiver\PASTARTER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler] "C:\Program Files\Registry Clean Expert\RCHelper.exe" /startup R0 BTHidMgr;Bluetooth HID Manager Service;C:\WINDOWS\system32\Drivers\BTHidMgr.sys R1 AFS2K;AFS2k;C:\WINDOWS\system32\drivers\AFS2K.sys R1 nod32drv;nod32drv;C:\WINDOWS\system32\drivers\nod32drv.sys R2 BlueSoleil Hid Service;BlueSoleil Hid Service;C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe R3 adiusbaw;USB ADSL WAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbaw.sys R3 BlueletAudio;Bluetooth Audio Service;C:\WINDOWS\system32\DRIVERS\blueletaudio.sys R3 BT;Bluetooth PAN Network Adapter;C:\WINDOWS\system32\DRIVERS\btnetdrv.sys R3 BTHidEnum;Bluetooth HID Enumerator;C:\WINDOWS\system32\DRIVERS\vbtenum.sys R3 ms_mpu401;Sterownik portu MIDI UART Microsoft MPU-401;C:\WINDOWS\system32\drivers\msmpu401.sys R3 NetBT;NetBios przez TCP/IP;C:\WINDOWS\system32\DRIVERS\netbt.sys R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft;C:\WINDOWS\system32\DRIVERS\usbuhci.sys R3 VComm;Virtual Serial port driver;C:\WINDOWS\system32\DRIVERS\VComm.sys R3 VcommMgr;Bluetooth VComm Manager Service;C:\WINDOWS\system32\Drivers\VcommMgr.sys S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys S2 ADILOADER;General Purpose USB Driver (adildr.sys);C:\WINDOWS\system32\Drivers\adildr.sys S3 Bridge;Mostek MAC;C:\WINDOWS\system32\DRIVERS\bridge.sys S3 BridgeMP;Miniport mostka MAC;C:\WINDOWS\system32\DRIVERS\bridge.sys S3 Btcsrusb;Bluetooth USB For Bluetooth Service;C:\WINDOWS\system32\Drivers\btcusb.sys S3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys S3 NABTSFEC;Koder-dekoder NABTS/FEC VBI;C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys S3 P2k;Motorola USB Device;C:\WINDOWS\system32\DRIVERS\P2k.sys S3 STIrUsb;Klucz szyfrujĄcy SigmaTel USB-IrDA;C:\WINDOWS\system32\DRIVERS\irstusb.sys S3 usbser;Motorola USB Modem Driver;C:\WINDOWS\system32\DRIVERS\usbser.sys ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-23 11:56:14 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-23 11:56:58 --- E O F ---

**Posty:** 18165 · przez **wojtas** 23 Lip 2007, 12:09

log jest ok... ten wpis dokladnie nie wiem od czego jest wiec go znajdz na dysku i poszukaj o nim jakies info

plik raczej jest ok bo skanery tak mowia

**Posty:** 39 · przez **westside** 23 Lip 2007, 12:22

ale avg znalazlo w nim jakiegos hack toola... ?

**Posty:** 18165 · przez **wojtas** 23 Lip 2007, 12:24

tak czasami jest ale 90% skanerow nic nie wykrylo czyli plik jest ok

**Posty:** 9 · przez **HOhi** 31 Lip 2007, 20:39

Mam ten sam problem co westside czyli głos się ścisza.

AhnLab-V3 2007.7.31.1 2007.07.31 -
AntiVir 7.4.0.54 2007.07.31 -
Authentium 4.93.8 2007.07.31 -
Avast 4.7.1029.0 2007.07.31 -
AVG 7.5.0.476 2007.07.31 Potentially harmful program HackTool.BTM
BitDefender 7.2 2007.07.31 -
CAT-QuickHeal 9.00 2007.07.31 -
ClamAV 0.91 2007.07.31 -
DrWeb 4.33 2007.07.31 -
eSafe 7.0.15.0 2007.07.31 suspicious Trojan/Worm
eTrust-Vet 31.1.5019 2007.07.31 -
Ewido 4.0 2007.07.31 -
FileAdvisor 1 2007.07.31 -
Fortinet 2.91.0.0 2007.07.31 -
F-Prot 4.3.2.48 2007.07.30 -
F-Secure 6.70.13030.0 2007.07.31 -
Ikarus T3.1.1.8 2007.07.31 -
Kaspersky 4.0.2.24 2007.07.31 -
McAfee 5087 2007.07.31 -
Microsoft 1.2704 2007.07.31 -
NOD32v2 2430 2007.07.31 -
Norman 5.80.02 2007.07.31 -
Panda 9.0.0.4 2007.07.31 Trj/Keylogger.BS
Dodatkowe informacje
File size: 379909 bytes
MD5: 71597a82ce9235ef30b824b31c63d67d
SHA1: c73f3e7665fb39cab2aec018ef2949bdb1520407
packers: UPX
packers: UPX
packers: UPX

Scan taken on 31 Jul 2007 18:11:40 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found HackTool.BTM
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found Trj/Keylogger.BS
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

Mój log.

Logfile of HijackThis v1.99.1
Scan saved at 10:09:36, on 2007-07-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\DialNet\WrOS.EXE
C:\Program Files\DialNet\winpppoverethernet.exe
C:\Program Files\BitComet\BitComet.exe
C:\Windows\hgraphic.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet Toolbar Helper - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - C:\Program Files\BitComet Toolbar\v2.0.0.4\BitComet_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.4\BitComet_Toolbar.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe"
O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT"
O4 - HKLM\..\Run: [z-wrdialer] "C:\Program Files\DialNet\wrdialer.exe"
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [z-WrDialer] C:\Program Files\DialNet\WrDialer.exe
O4 - HKCU\..\Run: [hgraphic.exe] C:\Windows\hgraphic.exe
O8 - Extra context menu item: Pobierz przez Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Pobierz wszystko przez Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_43.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} - http://mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3343F315-EBAA-4612-8C72-3F66F921014F}: NameServer = 217.30.129.149 217.30.137.200
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8F69CF4-D47C-4BCE-BC13-69949EF7B5CE}: NameServer = 217.30.129.149,217.30.137.200
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE

Będe wdzięczny za jakąkolwiek pomoc.[/quote]

**Posty:** 18165 · przez **wojtas** 31 Lip 2007, 21:01

HOhi zaloz swoj wlasny temat tam daj logi i opisz problem

dziwny proces w logu, prośba o sprawdzenie

dziwny proces w logu, prośba o sprawdzenie

Ten sam problem co "westside"

Kto jest na forum