Prośba o analizę loga
Logfile of HijackThis v1.99.0
Scan saved at 16:09:14, on 2005–02–02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesMKSBinNetMonSV.exe
C:Program FilesMKSBinmksmonsv.exe
C:WINDOWSSystem32 cpsvcs.exe
C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
C:WINDOWSsystem32oneLabsvsmon.exe
C:Program FilesMKSBinmks_scan.exe
C:WINDOWSsystem32wscntfy.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesAnalog DevicesSoundMAXSMTray.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:Program FilesThomsonSpeedTouch USBDragdiag.exe
C:Program FilesJavaj2re1.4.2_04injusched.exe
C:PROGRA~1NORTON~1 avapw32.exe
C:Program FilesMKSBinmks_menu.exe
C:Program FilesMKSBinABregmon.exe
C:DOCUME~1DarekUSTAWI~1Temp20052214423_mcinfo.exe
C:Program Filesone LabsoneAlarmzlclient.exe
C:WINDOWSsystem32ctfmon.exe
C:Documents and SettingsMisiolekPulpitHijackThis.exe
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL (file missing)
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O2 – BHO: (no name) – {53707962–6F74–2D53–2644–206D7942484F} – C:Program FilesSpybot – Search & DestroySDHelper.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:Program FilesNorton AntiVirusNavShExt.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:Program FilesNorton AntiVirusNavShExt.dll
O4 – HKLM..Run: [Smapp] C:Program FilesAnalog DevicesSoundMAXSMTray.exe
O4 – HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 – HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_04injusched.exe
O4 – HKLM..Run: [NAV Agent] C:PROGRA~1NORTON~1 avapw32.exe
O4 – HKLM..Run: [MKS_MENU] C:Program FilesMKSBinmks_menu.exe
O4 – HKLM..Run: [ABREGMON] C:Program FilesMKSBinABregmon.exe
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O4 – HKLM..Run: [msci] C:DOCUME~1DarekUSTAWI~1Temp20052214423_mcinfo.exe /insfin
O4 – HKLM..Run: [Zone Labs Client] "C:Program Filesone LabsoneAlarmzlclient.exe"
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavaj2re1.4.2_04in pjpi142_04.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavaj2re1.4.2_04in pjpi142_04.dll
O9 – Extra button: Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra 'Tools' menuitem: Windows Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O23 – Service: ArcaBit NetMonitor – ArcaBit sp. z o.o. – C:Program FilesMKSBinNetMonSV.exe
O23 – Service: Ati HotKey Poller – Unknown – C:WINDOWSsystem32Ati2evxx.exe
O23 – Service: ATI Smart – Unknown – C:WINDOWSsystem32ati2sgag.exe
O23 – Service: MkSUpdateInt – MkS Sp. z o. o. – C:Program FilesMKSinMkSUpdateInt.exe
O23 – Service: MkS_Vir Monitor – Unknown – C:Program FilesMKSBinmksmonsv.exe
O23 – Service: MkS_Scan – Unknown – C:Program FilesMKSBinmks_scan.exe
O23 – Service: Usługa Autoochrony w programie Norton AntiVirus – Symantec Corporation – C:Program FilesNorton AntiVirus avapsvc.exe
O23 – Service: ScriptBlocking Service – Symantec Corporation – C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
O23 – Service: SoundMAX Agent Service – Analog Devices, Inc. – C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
O23 – Service: TrueVector Internet Monitor – Zone Labs Inc. – C:WINDOWSsystem32oneLabsvsmon.exe
Scan saved at 16:09:14, on 2005–02–02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesMKSBinNetMonSV.exe
C:Program FilesMKSBinmksmonsv.exe
C:WINDOWSSystem32 cpsvcs.exe
C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
C:WINDOWSsystem32oneLabsvsmon.exe
C:Program FilesMKSBinmks_scan.exe
C:WINDOWSsystem32wscntfy.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesAnalog DevicesSoundMAXSMTray.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:Program FilesThomsonSpeedTouch USBDragdiag.exe
C:Program FilesJavaj2re1.4.2_04injusched.exe
C:PROGRA~1NORTON~1 avapw32.exe
C:Program FilesMKSBinmks_menu.exe
C:Program FilesMKSBinABregmon.exe
C:DOCUME~1DarekUSTAWI~1Temp20052214423_mcinfo.exe
C:Program Filesone LabsoneAlarmzlclient.exe
C:WINDOWSsystem32ctfmon.exe
C:Documents and SettingsMisiolekPulpitHijackThis.exe
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL (file missing)
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O2 – BHO: (no name) – {53707962–6F74–2D53–2644–206D7942484F} – C:Program FilesSpybot – Search & DestroySDHelper.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:Program FilesNorton AntiVirusNavShExt.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:Program FilesNorton AntiVirusNavShExt.dll
O4 – HKLM..Run: [Smapp] C:Program FilesAnalog DevicesSoundMAXSMTray.exe
O4 – HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 – HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_04injusched.exe
O4 – HKLM..Run: [NAV Agent] C:PROGRA~1NORTON~1 avapw32.exe
O4 – HKLM..Run: [MKS_MENU] C:Program FilesMKSBinmks_menu.exe
O4 – HKLM..Run: [ABREGMON] C:Program FilesMKSBinABregmon.exe
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O4 – HKLM..Run: [msci] C:DOCUME~1DarekUSTAWI~1Temp20052214423_mcinfo.exe /insfin
O4 – HKLM..Run: [Zone Labs Client] "C:Program Filesone LabsoneAlarmzlclient.exe"
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavaj2re1.4.2_04in pjpi142_04.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavaj2re1.4.2_04in pjpi142_04.dll
O9 – Extra button: Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra 'Tools' menuitem: Windows Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O23 – Service: ArcaBit NetMonitor – ArcaBit sp. z o.o. – C:Program FilesMKSBinNetMonSV.exe
O23 – Service: Ati HotKey Poller – Unknown – C:WINDOWSsystem32Ati2evxx.exe
O23 – Service: ATI Smart – Unknown – C:WINDOWSsystem32ati2sgag.exe
O23 – Service: MkSUpdateInt – MkS Sp. z o. o. – C:Program FilesMKSinMkSUpdateInt.exe
O23 – Service: MkS_Vir Monitor – Unknown – C:Program FilesMKSBinmksmonsv.exe
O23 – Service: MkS_Scan – Unknown – C:Program FilesMKSBinmks_scan.exe
O23 – Service: Usługa Autoochrony w programie Norton AntiVirus – Symantec Corporation – C:Program FilesNorton AntiVirus avapsvc.exe
O23 – Service: ScriptBlocking Service – Symantec Corporation – C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
O23 – Service: SoundMAX Agent Service – Analog Devices, Inc. – C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
O23 – Service: TrueVector Internet Monitor – Zone Labs Inc. – C:WINDOWSsystem32oneLabsvsmon.exe
Odpowiedzi: 9
Norma ,nie ma się czym przejmować.
Obecnie siedze za ZA, co mnie troche martwi, test na grc.com – wszystkie porty ukryte. Z tego co moge sprawdzic w ZA upload powoduja 2 svchost'y
Czy jest spory? Na 10M sciagnietych 1,5M up. Norma?
Czy jest spory? Na 10M sciagnietych 1,5M up. Norma?
Zamknij kilka portow przy pomocy Windows Worms Doors Cleanera, miedzy innymi 135
To sprawdź w firewallu co powoduje upload.
Ten 20052214423_mcinfo.exe to pozostalosc po McAfee Firewall – teraz, dlaczego o tym pisze:
Po zainstalowaniu systemu posadzilem firewalla:
1. Norton – nie byl w stanie zamknac 7 portow,
2. Outpost – juz tylko jednego: 135!!!
3. Zone Alarm – grc.com mowi, ze stelth :wink:
4. McAfee – zablokowal internet...
svchost x2 aktywny caly czas i bajty ida w siec...
Po zainstalowaniu systemu posadzilem firewalla:
1. Norton – nie byl w stanie zamknac 7 portow,
2. Outpost – juz tylko jednego: 135!!!
3. Zone Alarm – grc.com mowi, ze stelth :wink:
4. McAfee – zablokowal internet...
svchost x2 aktywny caly czas i bajty ida w siec...
svchost moze byc nawet z 5 razy tym sie nie przejmuj
Wylacz przywracanie i proces:
20052214423_mcinfo.exe
Wywal wszystko z Temp
FIX:
PS: Ciesz sie ze EL NINO w tym momencie nie ma bo zapewne posłałby ten temat do kosza
Za co ?? Zgadnij
Odgraźał sie wiec mysle ze nie zartował
Wylacz przywracanie i proces:
20052214423_mcinfo.exe
Wywal wszystko z Temp
FIX:
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O4 – HKLM..Run: [msci] C:DOCUME~1DarekUSTAWI~1Temp20052214423_mcinfo.exe /insfin
PS: Ciesz sie ze EL NINO w tym momencie nie ma bo zapewne posłałby ten temat do kosza
Za co ?? Zgadnij
Odgraźał sie wiec mysle ze nie zartował
Tak.
Ten podwojny svchost moze byc?
Czysto,opróźnij tylko tempy.
Strona 1 / 1