Sprawdźcie loga, winSvc32.exe
Logfile of HijackThis v1.99.1
Scan saved at 22:20:29, on 2005–03–01
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\WinSvc32\WinSvc32.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\mozilla.org\Mozilla\Mozilla.exe
C:\Documents and Settings\Kołkiewicz\Pulpit\hijackthis\HijackThis.exe
R0 – HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 – BHO: (no name) – {348FE907–249E–4C65–A838–F34A193FE1D1} – (no file)
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:\WINDOWS\System32\msdxm.ocx
O4 – HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 – HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 – HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 – HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 – Global Startup: WinSvc32.exe
O4 – Global User Startup: WinSvc32.exe
O8 – Extra context menu item: Pobierz z &BitSpirit – D:\BitSpirit\bsurl.htm
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – ms–its:mhtml:file://c:\nosuxxx.mht!http://www.kazaalite.pl/stats/xa.chm::/bridge–c46.cab
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:\WINDOWS\System32\nvsvc32.exe
Odpowiedzi: 2
Nie, nie to bedzie backdoor/robaczek z rodziny Sdbot
Wylacz przywracanie
Zakoncz proces:
WinSvc32.exe
Usun:
Wylacz przywracanie
Zakoncz proces:
WinSvc32.exe
Usun:
R0 – HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 – BHO: (no name) – {348FE907–249E–4C65–A838–F34A193FE1D1} – (no file)
O4 – Global Startup: WinSvc32.exe
O4 – Global User Startup: WinSvc32.exe
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – ms–its:mhtml:file://c:\nosuxxx.mht!http://www.kazaalite.pl/stats/xa.chm::/bridge–c46.cab
Co to jest ten WinSvc32.exe?
BitSpirit?
BitSpirit?
Strona 1 / 1