log
czy cos tu jest nie tak :?:
Logfile of HijackThis v1.98.2
Scan saved at 14:12:41, on 04–10–29
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSYSTEMKERNEL32.DLL
C:WINDOWSSYSTEMMSGSRV32.EXE
C:WINDOWSSYSTEMSPOOL32.EXE
C:WINDOWSSYSTEMMPREXE.EXE
C:WINDOWSEXPLORER.EXE
A:HIJACKTHIS.EXE
A:HIJACKTHIS.EXE
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.idg.pl
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.idg.pl
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Program Microsoft Internet Explorer dostarczony przez IDG.pl
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSYSTEMMSDXM.OCX
O4 – HKLM..Run: [internat.exe] internat.exe
O4 – HKLM..Run: [ScanRegistry] C:WINDOWSscanregw.exe /autorun
O4 – HKLM..Run: [TaskMonitor] C:WINDOWS askmon.exe
O4 – HKLM..Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 – HKLM..Run: [WinampAgent] "C:PROGRAM FILESWINAMPWINAMPa.exe"
O4 – HKLM..Run: [Zasobnik systemowy] SysTray.Exe
O4 – HKLM..Run: [SystemTray] SysTray.Exe
O4 – HKLM..RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 – HKLM..RunServices: [SchedulingAgent] mstask.exe
O4 – HKLM..RunOnce: [OfficeTuneUp] "C:Program FilesMicrosoft OfficeOfficeotuneup.exe" –B
O4 – HKCU..Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 – Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O14 – IERESET.INF: START_PAGE_URL=http://www.idg.pl
O16 – DPF: Win32 Classes – file://C:WINDOWSJavaclasseswin32ie4.cab
Logfile of HijackThis v1.98.2
Scan saved at 14:12:41, on 04–10–29
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSYSTEMKERNEL32.DLL
C:WINDOWSSYSTEMMSGSRV32.EXE
C:WINDOWSSYSTEMSPOOL32.EXE
C:WINDOWSSYSTEMMPREXE.EXE
C:WINDOWSEXPLORER.EXE
A:HIJACKTHIS.EXE
A:HIJACKTHIS.EXE
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.idg.pl
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.idg.pl
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Program Microsoft Internet Explorer dostarczony przez IDG.pl
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSYSTEMMSDXM.OCX
O4 – HKLM..Run: [internat.exe] internat.exe
O4 – HKLM..Run: [ScanRegistry] C:WINDOWSscanregw.exe /autorun
O4 – HKLM..Run: [TaskMonitor] C:WINDOWS askmon.exe
O4 – HKLM..Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 – HKLM..Run: [WinampAgent] "C:PROGRAM FILESWINAMPWINAMPa.exe"
O4 – HKLM..Run: [Zasobnik systemowy] SysTray.Exe
O4 – HKLM..Run: [SystemTray] SysTray.Exe
O4 – HKLM..RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 – HKLM..RunServices: [SchedulingAgent] mstask.exe
O4 – HKLM..RunOnce: [OfficeTuneUp] "C:Program FilesMicrosoft OfficeOfficeotuneup.exe" –B
O4 – HKCU..Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 – Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O14 – IERESET.INF: START_PAGE_URL=http://www.idg.pl
O16 – DPF: Win32 Classes – file://C:WINDOWSJavaclasseswin32ie4.cab
Odpowiedzi: 7
Bobi_robert .Duźe dzieki ba coś system mi się zawieszał(Inna przyczyna –nero) i myslałem źe złapałem wirusa.
Pozdrawiam
Pozdrawiam
Jesli jest svchost.exe w katalogu system32 jest ok
Log jest czysty
Log jest czysty
McScr@by rzuć swoim okiem–svchost.exe
Logfile of HijackThis v1.97.7
Scan saved at 01:17:11, on 2004–10–30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
F:WINDOWSSystem32smss.exe
F:WINDOWSsystem32winlogon.exe
F:WINDOWSsystem32services.exe
F:WINDOWSsystem32lsass.exe
F:WINDOWSsystem32Ati2evxx.exe
F:WINDOWSsystem32svchost.exe
F:WINDOWSSystem32svchost.exe
F:WINDOWSsystem32Ati2evxx.exe
F:WINDOWSExplorer.EXE
F:WINDOWSsystem32spoolsv.exe
F:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
F:Program FilesAlwil SoftwareAvast4ashServ.exe
F:WINDOWSsystem32CTHELPER.EXE
F:PROGRA~1ALWILS~1Avast4ashDisp.exe
F:PROGRA~1ALWILS~1Avast4ashmaisv.exe
F:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
F:Program FilesJavaj2re1.4.2_05injusched.exe
F:WINDOWSsystem32ctfmon.exe
F:Program FilesLogitechMouseWaresystemem_exec.exe
F:Program FilesInternet Exploreriexplore.exe
F:HijackThis.exe
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.onet.pl
O2 – BHO: (no name) – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – F:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O4 – HKLM..Run: [Logitech Utility] Logi_MwX.Exe
O4 – HKLM..Run: [WINDVDPatch] CTHELPER.EXE
O4 – HKLM..Run: [UpdReg] F:WINDOWSUpdReg.EXE
O4 – HKLM..Run: [CTStartup] F:Program FilesCreativeSplash ScreenCTEaxSpl.EXE /run
O4 – HKLM..Run: [avast!] F:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 – HKLM..Run: [ashMaiSv] F:PROGRA~1ALWILS~1Avast4ashmaisv.exe
O4 – HKLM..Run: [CTHelper] CTHELPER.EXE
O4 – HKLM..Run: [ATIPTA] F:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 – HKLM..Run: [SunJavaUpdateSched] F:Program FilesJavaj2re1.4.2_05injusched.exe
O4 – HKCU..Run: [CTFMON.EXE] F:WINDOWSsystem32ctfmon.exe
O4 – Global Startup: Microsoft Office.lnk = F:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 – DPF: {0A5FD7C5–A45C–49FC–ADB5–9952547D5715} (Creative Software AutoUpdate) – http://www.creative.com/su/ocx/15007/CTSUEng.cab
O16 – DPF: {3E68E405–C6DE–49FF–83AE–41EE9F4C36CE} (Office Update Installation Engine) – http://office.microsoft.com/officeupdate/content/opuc.cab
O16 – DPF: {F6ACF75C–C32C–447B–9BEF–46B766368D29} (Creative Software AutoUpdate Support Package) – http://www.creative.com/su/ocx/15008/CTPID.cab
Pozdrawiam
Logfile of HijackThis v1.97.7
Scan saved at 01:17:11, on 2004–10–30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
F:WINDOWSSystem32smss.exe
F:WINDOWSsystem32winlogon.exe
F:WINDOWSsystem32services.exe
F:WINDOWSsystem32lsass.exe
F:WINDOWSsystem32Ati2evxx.exe
F:WINDOWSsystem32svchost.exe
F:WINDOWSSystem32svchost.exe
F:WINDOWSsystem32Ati2evxx.exe
F:WINDOWSExplorer.EXE
F:WINDOWSsystem32spoolsv.exe
F:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
F:Program FilesAlwil SoftwareAvast4ashServ.exe
F:WINDOWSsystem32CTHELPER.EXE
F:PROGRA~1ALWILS~1Avast4ashDisp.exe
F:PROGRA~1ALWILS~1Avast4ashmaisv.exe
F:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
F:Program FilesJavaj2re1.4.2_05injusched.exe
F:WINDOWSsystem32ctfmon.exe
F:Program FilesLogitechMouseWaresystemem_exec.exe
F:Program FilesInternet Exploreriexplore.exe
F:HijackThis.exe
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.onet.pl
O2 – BHO: (no name) – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – F:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O4 – HKLM..Run: [Logitech Utility] Logi_MwX.Exe
O4 – HKLM..Run: [WINDVDPatch] CTHELPER.EXE
O4 – HKLM..Run: [UpdReg] F:WINDOWSUpdReg.EXE
O4 – HKLM..Run: [CTStartup] F:Program FilesCreativeSplash ScreenCTEaxSpl.EXE /run
O4 – HKLM..Run: [avast!] F:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 – HKLM..Run: [ashMaiSv] F:PROGRA~1ALWILS~1Avast4ashmaisv.exe
O4 – HKLM..Run: [CTHelper] CTHELPER.EXE
O4 – HKLM..Run: [ATIPTA] F:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 – HKLM..Run: [SunJavaUpdateSched] F:Program FilesJavaj2re1.4.2_05injusched.exe
O4 – HKCU..Run: [CTFMON.EXE] F:WINDOWSsystem32ctfmon.exe
O4 – Global Startup: Microsoft Office.lnk = F:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 – DPF: {0A5FD7C5–A45C–49FC–ADB5–9952547D5715} (Creative Software AutoUpdate) – http://www.creative.com/su/ocx/15007/CTSUEng.cab
O16 – DPF: {3E68E405–C6DE–49FF–83AE–41EE9F4C36CE} (Office Update Installation Engine) – http://office.microsoft.com/officeupdate/content/opuc.cab
O16 – DPF: {F6ACF75C–C32C–447B–9BEF–46B766368D29} (Creative Software AutoUpdate Support Package) – http://www.creative.com/su/ocx/15008/CTPID.cab
Pozdrawiam
:arrow: http://www.mks.com.pl/baza.html?show=listBytype&typ=trojan
W zaleźności od wariantu.
W zaleźności od wariantu.
Siema wie ktos informacje o Trojan.Downloader :?: i co te gówno robi
Spece to i moze kiedy przyjda, ale jest OK. Mozna tylko usunac dwa wpisy z "related.htm".
na moj gust jest ok, ale ja narazie sie ucze :D
poczekaj na opienie specow w temacie.
poczekaj na opienie specow w temacie.
Strona 1 / 1