Analiza loga#2
To znowu ja;)
Kolejny log, (nie mój) Bardzo proszę o sprawdzenie.
Dziękuje
Kolejny log, (nie mój) Bardzo proszę o sprawdzenie.
Logfile of HijackThis v1.99.1
Scan saved at 17:37:36, on 2005–02–18
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32logonui.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesQuickTimeqttask.exe
C:WINDOWSLiveChatut.exe
C:WINDOWSSystem32 undll32.exe
C:Program FilesMessengermsmsgs.exe
D:DaniProgramySouls2slsk.exe
H:programyWS_FTPftpsched.exe
C:WINDOWSSystem32gearsec.exe
C:WINDOWSSystem32 vsvc32.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesTrend MicroPC–cillin 2002Tmntsrv.exe
C:Program FilesTrend MicroPC–cillin 2002PCCPFW.exe
C:ProgramyGadu–Gadugg.exe
C:WINDOWSSystem32wuauclt.exe
C:Program FilesInternet Exploreriexplore.exe
D:RóznehijackthisHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R1 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,AutoConfigURL = 192.168.21.4
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 – BHO: DAPHelper Class – {0000CC75–ACF3–4cac–A0A9–DD3868E06852} – C:ProgramyDAPDAPBHO.dll
O2 – BHO: (no name) – {008DB894–99ED–445D–8547–0E7C9808898D} – C:WINDOWSmslagent4b_1,0,1,2_mslagent.dll
O2 – BHO: MyWebSearch Search Assistant BHO – {00A6FAF1–072E–44cf–8957–5838F569A31D} – C:Program FilesMyWebSearchSrchAstt1.binMWSSRCAS.DLL
O2 – BHO: Yahoo! Companion BHO – {02478D38–C3F9–4efb–9B51–7695ECA05670} – C:Program FilesYahoo!CompanionInstallscpnycomp5_3_19_0.dll
O2 – BHO: myBar BHO – {0494D0D1–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O2 – BHO: mwsBar BHO – {07B18EA1–A523–4961–B6BB–170DE4475CCA} – C:Program FilesMyWebSearchar1.binMWSBAR.DLL
O3 – Toolbar: DAP Bar – {62999427–33FC–4baf–9C9C–BCE6BD127F08} – C:ProgramyDAPDAPIEBar.dll
O3 – Toolbar: &SearchBar – {0494D0D9–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O3 – Toolbar: DashBar Toolbar – {CC90CDA0–74A0–45b4–80EF–D89CA8C249B8} – C:Program FilesDashBarDashBar15.dll
O3 – Toolbar: Yahoo! Companion – {EF99BD32–C1FB–11D2–892F–0090271D4F88} – C:Program FilesYahoo!CompanionInstallscpnycomp5_3_19_0.dll
O3 – Toolbar: My &Web Search – {07B18EA9–A523–4961–B6BB–170DE4475CCA} – C:Program FilesMyWebSearchar1.binMWSBAR.DLL
O3 – Toolbar: DailyToolbar – {8333C319–0669–4893–A418–F56D9249FCA6} – C:WINDOWSDownloaded Program FilesDailyToolbar.dll
O4 – HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" –atboottime
O4 – HKLM..Run: [LiveChatut] C:WINDOWSLiveChatut.exe
O4 – HKLM..Run: [NetDy] C:WINDOWSVisualGuard.exe
O4 – HKCU..Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess
O4 – HKCU..Run: [Gadu–Gadu] "C:ProgramyGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – Startup: Skrót do slsk (2).lnk = D:DaniProgramySouls2slsk.exe
O8 – Extra context menu item: &Download with &DAP – C:PROGRAMYDAPdapextie.htm
O8 – Extra context menu item: &Search – http://bar.mywebsearch.com/menusearch.html?p=ZRxdm076XXPL
O8 – Extra context menu item: Download &all with DAP – C:PROGRAMYDAPdapextie2.htm
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra button: Run DAP – {669695BC–A811–4A9D–8CDF–BA8C795F261C} – C:PROGRAMYDAPDAP.EXE
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O16 – DPF: IEToolbarCab – http://www.dailytoolbar.com/DailyToolbar.CAB
O16 – DPF: {1D4DB7D2–6EC9–47A3–BD87–1E41684E07BB} – http://ak.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversInitialSetup1.0.0.8.cab
O16 – DPF: {3E339D3C–4B12–4E8C–A529–9CC4BEEAFD4F} (VacPro.russia_ver3) – http://advnt01.com/dialer/russia.CAB
O16 – DPF: {486E48B5–ABF2–42BB–A327–2679DF3FB822} – http://akamai.downloadv3.com/binaries/IA/ia.cab
O16 – DPF: {DF780F87–FF2B–4DF8–92D0–73DB16A1543A} (PopCapLoader Object) – http://download.games.yahoo.com/games/web_games/popcap/insaniquarium/popcaploader_v6.cab
O16 – DPF: {F72BC3F0–6C20–4793–9DDA–258589D8A907} – http://akamai.downloadv3.com/binaries/IA/netslv32_EN_XP.cab
O23 – Service: Ipswitch WS_FTP Queue (ftpqueue) – Ipswitch, Inc., 81 Hartwell Ave, Lexington MA 02421 – H:programyWS_FTPftpsched.exe
O23 – Service: Gear Security Service (GEARSecurity) – GEAR Software – C:WINDOWSSystem32gearsec.exe
O23 – Service: iPod Service (iPodService) – Apple Computer, Inc. – C:Program FilesiPodiniPodService.exe
O23 – Service: NVIDIA Driver Helper Service (NVSvc) – NVIDIA Corporation – C:WINDOWSSystem32 vsvc32.exe
O23 – Service: PC–cillin PersonalFirewall (PCCPFW) – Trend Micro Inc. – C:Program FilesTrend MicroPC–cillin 2002PCCPFW.exe
O23 – Service: Trend NT Realtime Service (Tmntsrv) – Trend Micro Inc. – C:Program FilesTrend MicroPC–cillin 2002Tmntsrv.exe
Dziękuje
Odpowiedzi: 2
Po wywaleniu Yahoo padla mi wyszukiwarka IE albo jakies bzdury wyskakiwaly jak to nie przeszkadza to radze zostawic. Albo zainstalowac sobie jakiegos AV i FW i po sprawie. Nic sie nie powinno wgrac itp.. A ten z FW z SP2 tez jest dobry on + Panda Titanium 2005 i juz nic mi do kompa nie wlazi
Robal Netsky i pare toolbarow i search...
Do usuniecia:
Jesli jakies kontroli sa Twoje to zostaw
Do usuniecia:
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
O2 – BHO: (no name) – {008DB894–99ED–445D–8547–0E7C9808898D} – C:WINDOWSmslagent4b_1,0,1,2_mslagent.dll
O2 – BHO: MyWebSearch Search Assistant BHO – {00A6FAF1–072E–44cf–8957–5838F569A31D} – C:Program FilesMyWebSearchSrchAstt1.binMWSSRCAS.DLL
O2 – BHO: Yahoo! Companion BHO – {02478D38–C3F9–4efb–9B51–7695ECA05670} – C:Program FilesYahoo!CompanionInstallscpnycomp5_3_19_0.dll
O2 – BHO: myBar BHO – {0494D0D1–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O2 – BHO: mwsBar BHO – {07B18EA1–A523–4961–B6BB–170DE4475CCA} – C:Program FilesMyWebSearchar1.binMWSBAR.DLL
O3 – Toolbar: &SearchBar – {0494D0D9–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
cx
O3 – Toolbar: Yahoo! Companion – {EF99BD32–C1FB–11D2–892F–0090271D4F88} – C:Program FilesYahoo!CompanionInstallscpnycomp5_3_19_0.dll
O3 – Toolbar: My &Web Search – {07B18EA9–A523–4961–B6BB–170DE4475CCA} – C:Program FilesMyWebSearchar1.binMWSBAR.DLL
O3 – Toolbar: DailyToolbar – {8333C319–0669–4893–A418–F56D9249FCA6} – C:WINDOWSDownloaded Program FilesDailyToolbar.dll
O4 – HKLM..Run: [NetDy] C:WINDOWSVisualGuard.exe
O4 – HKCU..Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess
O8 – Extra context menu item: &Search – http://bar.mywebsearch.com/menusearch.html?p=ZRxdm076XXPL
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O16 – DPF: IEToolbarCab – http://www.dailytoolbar.com/DailyToolbar.CAB
O16 – DPF: {1D4DB7D2–6EC9–47A3–BD87–1E41684E07BB} – http://ak.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversInitialSetup1.0.0.8.cab
O16 – DPF: {3E339D3C–4B12–4E8C–A529–9CC4BEEAFD4F} (VacPro.russia_ver3) – http://advnt01.com/dialer/russia.CAB
O16 – DPF: {486E48B5–ABF2–42BB–A327–2679DF3FB822} – http://akamai.downloadv3.com/binaries/IA/ia.cab
O16 – DPF: {DF780F87–FF2B–4DF8–92D0–73DB16A1543A} (PopCapLoader Object) – http://download.games.yahoo.com/games/web_games/popcap/insaniquarium/popcaploader_v6.cab
O16 – DPF: {F72BC3F0–6C20–4793–9DDA–258589D8A907} – http://akamai.downloadv3.com/binaries/IA/netslv32_EN_XP.cab
Jesli jakies kontroli sa Twoje to zostaw