RATUNKU!!! Log HiJack

Witam...

Ratujcie, wziąłem na weekend komputer z pracy, wlazłem na jakąś stronę porno :oops: , naściągałem jakiegoś syfu no i mam teraz
I nie wiem jak się tłumaczyć jutro w robocie...
Próbowałem juź wszystkiego :cry: a strona analizy logów nie działa
Czy moźe ktoś z Was zerknąć na ten LOG?





Z góry wielkie dzięki!


Logfile of HijackThis v1.99.1
Scan saved at 18:57:47, on 2006–01–01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\system32\sistray.EXE
C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\sysldr32.exe
C:\WINDOWS\system32\priva.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\batserv2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\winstall.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\sywsvcs.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system32\sysc.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\jacekg\Pulpit\HijackThis.exe

R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://C:\WINDOWS\blank.mht
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F3 – REG:win.ini: run=C:\WINDOWS\system32\vxgame6.exe
O2 – BHO: HomepageBHO – {e0103cd4–d1ce–411a–b75b–4fec072867f4} – C:\WINDOWS\system32\hpBDB8.tmp
O4 – HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 – HKLM\..\Run: [SiS Tray] C:\WINDOWS\system32\sistray.EXE
O4 – HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 –k
O4 – HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
O4 – HKLM\..\Run: [WellPhone DirectSync – ScheduleSync] C:\PROGRA~1\WELLPH~1\SCHEDU~1.EXE
O4 – HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 – HKLM\..\Run: [PCSuiteTrayApplication] D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe –onlytray
O4 – HKLM\..\Run: [SystemLoader] C:\WINDOWS\sysldr32.exe
O4 – HKLM\..\Run: [xp_system] C:\WINDOWS\system32\vxgame6.exe
O4 – HKLM\..\Run: [ControlPanel] C:\WINDOWS\system32\priva.exe internat.dll,LoadMouseCarpetProfile
O4 – HKLM\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe /s
O4 – HKLM\..\Run: [BatSrv] C:\WINDOWS\batserv2.exe
O4 – HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 – HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 – HKCU\..\Run: [xp_system] C:\WINDOWS\system32\vxgame6.exe
O4 – HKCU\..\Run: [aupd] C:\WINDOWS\system32\sywsvcs.exe
O4 – HKCU\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe
O4 – Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 – Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:\WINDOWS\System32\msjava.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:\WINDOWS\System32\msjava.dll
O9 – Extra button: Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra 'Tools' menuitem: Windows Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O12 – Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 – Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 – DPF: {745395C8–D0E1–4227–8586–624CA9A10A8D} (AxisMediaControl Class) – http://wx198.internetdsl.tpnet.pl:8084/activex/AMC.cab
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab
O17 – HKLM\System\CCS\Services\Tcpip\..\{1D62D0AE–D678–4164–8BDA–974E61B91C65}: NameServer = 217.30.129.149,217.30.137.200
O17 – HKLM\System\CCS\Services\Tcpip\..\{FC4A9A40–546A–44F9–B1F5–5C414DBD988D}: NameServer = 194.204.152.34,194.204.159.1
O20 – Winlogon Notify: msupdate – C:\WINDOWS\SYSTEM32\msupdate32.dll
O23 – Service: AVG6 Service (AvgServ) – GRISOFT s.r.o – C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 – Service: Machine Debug Manager (MDM) – Unknown owner – C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing)
O23 – Service: nMtskBar Service (nMtskService) – Intracom S.A. – C:\WINDOWS\nMtsk.exe
O23 – Service: SmartLinkService (SLService) – – C:\WINDOWS\SYSTEM32\slserv.exe
O23 – Service: SpamPal – Unknown owner – C:\WINDOWS\srvany.exe

Odpowiedzi: 1

Rzeczywiście zdąrzyłęś syfu nałapać

C:\WINDOWS\system32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\WINDOWS\sysldr32.exe
C:\WINDOWS\system32\priva.exe
C:\WINDOWS\batserv2.exe
C:\winstall.exe
C:\WINDOWS\system32\sywsvcs.exe
C:\WINDOWS\system32\sysc.exe
R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://C:\WINDOWS\blank.mht
F3 – REG:win.ini: run=C:\WINDOWS\system32\vxgame6.exe
O2 – BHO: HomepageBHO – {e0103cd4–d1ce–411a–b75b–4fec072867f4} – C:\WINDOWS\system32\hpBDB8.tmp
O4 – HKLM\..\Run: [SystemLoader] C:\WINDOWS\sysldr32.exe
O4 – HKLM\..\Run: [xp_system] C:\WINDOWS\system32\vxgame6.exe
O4 – HKLM\..\Run: [ControlPanel] C:\WINDOWS\system32\priva.exe internat.dll,LoadMouseCarpetProfile
O4 – HKLM\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe /s
O4 – HKLM\..\Run: [BatSrv] C:\WINDOWS\batserv2.exe
O4 – HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 – HKCU\..\Run: [xp_system] C:\WINDOWS\system32\vxgame6.exe
O4 – HKCU\..\Run: [aupd] C:\WINDOWS\system32\sywsvcs.exe
O4 – HKCU\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe
O20 – Winlogon Notify: msupdate – C:\WINDOWS\SYSTEM32\msupdate32.dll


Wiesz co z tym zrobić, działaj.
Bobi
Dodano
01.01.2006 21:43:26
alus
Dodano:
01.01.2006 20:59:50
Komentarzy:
1
Strona 1 / 1