podejrzewam zainfekowanie wirusem lub trojanem

**Posty:** 17 · przez **BOLO1990** 27 Mar 2006, 08:48

prosze sprawdzic loga nie znam sie na tym ale moze wy cos znajdziecie caly czas mi procesor chodzi na 100% i to za sprawa : svchost.exe, nie moge go nawet zeskanowac bo by mi komp nie wytrzymal ... co chwile wyskakiwaly mi raporty o wirusach BACKDOOR.Win32 .... na chwile przestal isc procek na 100% wiec zeskanowalem tylko folder WINDOWS znalzalo 12 wirusow typu BACKDOOR ale moze jeszcze cos zostalo przeciez nie ma dobrego antywirusa na wszystkie KANALIE Komp

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 07:33:44, on 2006-03-27 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\htpatch.exe C:\WINDOWS\System32\RunDll32.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\AntiVirenKit 2006\AVKService.exe C:\Program Files\AntiVirenKit 2006\AVKWCtl.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\Program Files\Agnitum\Outpost Firewall\outpost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\taskmgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\BOLO\Ustawienia lokalne\Temp\Katalog tymczasowy 5 dla hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe" O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe O4 - HKLM\..\Run: [Spik] C:\Program Files\Spik\Spik.exe -autostart O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe" O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{638F38FA-2834-4D62-975F-91C84E92A6F9}: NameServer = 213.77.75.2,213.77.75.100 O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Spik\url_wpmsg.dll O20 - AppInit_DLLs: C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\AntiVirenKit 2006\AVKService.exe O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C:\Program Files\AntiVirenKit 2006\AVKWCtl.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe

[/code]

**Posty:** 1620 · przez **mafia435** 27 Mar 2006, 08:57

Zmień jak w opisie.
http://forum.programosy.pl/hijackthis-gtobsuga-i-umieszczanie-loga-vt9452.html

**Posty:** 17 · przez **BOLO1990** 27 Mar 2006, 09:52

Ok juz Dzieki

a teraz moglby mi ktos pomoc ??

**Posty:** 8694 · przez **Red** 27 Mar 2006, 09:59

Log z hijacka nic nie pokazuje.Zupełnie czysto.Sciagnij:
http://www.sysinternals.com/Files/RootkitRevealer.zip
wylacz jak najwiecej procesów i zrob skan .Wynik wklej na forum

**Posty:** 17 · przez **BOLO1990** 27 Mar 2006, 13:35

a to ze procek mi chodzi na 100% moze miec zwiazek z tym ze te BACKDOORY mnie zaatakowaly ??i w ogole co to jest svchost.exe w menadzerze zadan

**Posty:** 8694 · przez **Red** 27 Mar 2006, 13:42

BOLO1990 napisał(a):a to ze procek mi chodzi na 100% moze miec zwiazek z tym ze te BACKDOORY mnie zaatakowaly ??i

moze

BOLO1990 napisał(a):co to jest svchost.exe w menadzerze zadan

www.google.pl

**Posty:** 17 · przez **BOLO1990** 27 Mar 2006, 16:00

wyniki z ROOTKITA mam nadzieje ze pomozecie mi przywrocic pozadek na moim zlomie

Kod: Zaznacz wszystko: HKLM\SOFTWARE\Agnitum\Outpost Firewall\Counters\Protect\Counter3Day 2006-03-27 13:41 4 bytes Data mismatch between Windows API and raw hive data. HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg 2006-03-13 18:00 0 bytes Access is denied. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000039 2006-03-27 13:44 0 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000039\LogEntries 2006-03-27 13:44 405 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000039\Values 2006-03-27 13:44 84 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000040 2006-03-27 13:53 0 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000040\LogEntries 2006-03-27 13:53 403 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000040\Values 2006-03-27 13:53 84 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000041 2006-03-27 14:05 0 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000041\LogEntries 2006-03-27 14:05 403 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000041\Values 2006-03-27 14:05 84 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000042 2006-03-27 14:29 0 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000042\LogEntries 2006-03-27 14:29 427 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000042\Values 2006-03-27 14:29 84 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000043 2006-03-27 14:30 0 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000043\LogEntries 2006-03-27 14:30 1.02 KB Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000043\Values 2006-03-27 14:30 84 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000044 2006-03-27 14:33 0 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000044\LogEntries 2006-03-27 14:33 399 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000044\Values 2006-03-27 14:33 84 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000045 2006-03-27 14:34 0 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000045\LogEntries 2006-03-27 14:34 397 bytes Hidden from Windows API. C:\Documents and Settings\All Users\Dane aplikacji\G DATA\AntiVirusKit\Log\AVKLog\0000000045\Values 2006-03-27 14:34 84 bytes Hidden from Windows API. C:\Documents and Settings\BOLO\Pulpit\avkis2005(2).exe.part 2006-03-27 13:26 12.14 MB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\BOLO\Pulpit\XoftSpy421_163.exe.part 2006-03-27 13:42 1.21 MB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\BOLO\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\3mo565tw.default\Cache\A8F81640d01 2006-03-27 13:26 14.19 MB Visible in Windows API, but not in MFT or directory index. C:\Program Files\Common Files\G DATA\AVKScanner\QBase\2703061344340.q 2006-03-27 13:44 60.09 KB Hidden from Windows API. C:\Program Files\Common Files\G DATA\AVKScanner\QBase\2703061353510.q 2006-03-27 13:53 60.09 KB Hidden from Windows API. C:\Program Files\Common Files\G DATA\AVKScanner\QBase\2703061405200.q 2006-03-27 14:05 60.09 KB Hidden from Windows API. C:\Program Files\Common Files\G DATA\AVKScanner\QBase\2703061429140.q 2006-03-27 14:29 288.60 KB Hidden from Windows API. C:\Program Files\Common Files\G DATA\AVKScanner\QBase\2703061430330.q 2006-03-27 14:30 88.65 KB Hidden from Windows API. C:\Program Files\Common Files\G DATA\AVKScanner\QBase\2703061430340.q 2006-03-27 14:30 75.65 KB Hidden from Windows API. C:\Program Files\Common Files\G DATA\AVKScanner\QBase\2703061433250.q 2006-03-27 14:33 192.59 KB Hidden from Windows API. C:\Program Files\Common Files\G DATA\AVKScanner\QBase\2703061434150.q 2006-03-27 14:34 60.09 KB Hidden from Windows API. C:\SIERRA\Half-Life\~GLH000d.TMP 2002-06-08 03:17 288.00 KB Visible in Windows API, but not in MFT or directory index. C:\System Volume Information\_restore{37A36B13-36BB-4A5B-AF59-4494EA98E7F2}\RP33\A0014896.exe 2006-03-26 21:40 88.00 KB Visible in Windows API, but not in MFT or directory index. C:\System Volume Information\_restore{37A36B13-36BB-4A5B-AF59-4494EA98E7F2}\RP33\A0014897.exe 2006-03-26 21:43 75.00 KB Visible in Windows API, but not in MFT or directory index. C:\WINDOWS\system32\nzwluyxl.exe 2006-03-27 13:42 34.50 KB Visible in Windows API, but not in MFT or directory index. C:\WINDOWS\system32\TFTP3836 2006-03-27 13:54 0 bytes Hidden from Windows API.

**Posty:** 8694 · przez **Red** 27 Mar 2006, 16:08

C:\WINDOWS\system32\nzwluyxl.exe
C:\WINDOWS\system32\TFTP3836

prosze sciagnac:
http://www.bleepingcomputer.com/files/killbox.php

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżki :
C:\WINDOWS\system32\nzwluyxl.exe
C:\WINDOWS\system32\TFTP3836
i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

Po restarcie sciagasz:
http://www.ewido.net/en/
skanujesz system i usuwasz wszystko co znajdzie .....

**Posty:** 17 · przez **BOLO1990** 27 Mar 2006, 17:06

dzieki jak narazie wszystko jest ok

**Posty:** 8694 · przez **Red** 27 Mar 2006, 17:11

BOLO1990 napisał(a):dzieki jak narazie wszystko jest ok

Jesli jest tak ,to dobrze.

**Posty:** 17 · przez **BOLO1990** 18 Kwi 2006, 21:16

znow mam problem z tym SVCHOST.EXE

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:59:05, on 2006-04-18 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\htpatch.exe C:\WINDOWS\System32\RunDll32.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Firewall\kavpf.exe C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe C:\Program Files\AntiVirenKit 2006\AVKService.exe C:\Program Files\AntiVirenKit 2006\AVKWCtl.exe C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Webfilter\WebFilter.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\G DATA\AntiVirenKit InternetSecurity\Webfilter\AdsCleaner.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\taskmgr.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\BOLO\Pulpit\cenzura!\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: Poly HTML Filter BHO - {0140DF95-9128-4053-AE72-F43F0CFCA062} - C:\WINDOWS\system32\SiKernel.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SIPAKBHO Class - {40FB69E1-9B7B-453F-B238-37D8E9528929} - C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Webfilter\PAKIEPlugins.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Offliner AdFilter Helper - {DC9377A2-2E8D-44A1-99DB-F8A821DF254D} - C:\WINDOWS\system32\SiPlugins.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Pasek Webfilter - {75CD0BC5-E317-449C-9FF6-4986B3D48F64} - C:\PROGRA~1\G DATA\AntiVirenKit InternetSecurity\Webfilter\PAKIEGUI.dll O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe" O4 - HKLM\..\Run: [Spik] C:\Program Files\Spik\Spik.exe -autostart O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe" O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: Firewall.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Add selected links to Link Container - C:\PROGRA~1\G DATA\AntiVirenKit InternetSecurity\Webfilter\System\Scripts\off_collector_sel.htm O8 - Extra context menu item: Show domain links - C:\PROGRA~1\G DATA\AntiVirenKit InternetSecurity\Webfilter\System\Scripts\off_domain_links.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{638F38FA-2834-4D62-975F-91C84E92A6F9}: NameServer = 213.77.75.2,213.77.75.100 O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Spik\url_wpmsg.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\AntiVirenKit 2006\AVKService.exe O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C:\Program Files\AntiVirenKit 2006\AVKWCtl.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe

**Posty:** 8694 · przez **Red** 18 Kwi 2006, 21:18

prosze sciagnac:
http://www.sysinternals.com/Files/RootkitRevealer.zip
wylacz wiekszosc aplikacji ,przeskanuj kompa i wklej wynik na forum

**Posty:** 17 · przez **BOLO1990** 18 Kwi 2006, 22:16

ciezko bedzie z tym zeskanowaniem bo on mi sie co 30 min wylacza wyskakuje tabela ze zostala 1 min do zakonczenia pracy systemu

i co ja mam zrobic ??

podejrzewam zainfekowanie wirusem lub trojanem

Podejrzewam zainfekowanie wirusem lub trojanem

Kto jest na forum