Samoczynnie pojawiające się rekalmy - log z hijackthis




Ash Ketchum - 18 Sty 2007 18:57
Logfile of HijackThis v1.99.1
Scan saved at 17:49:25, on 2007-01-18
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Ahead\InCD\InCDsrv.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\system32\wscntfy.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
E:\WINDOWS\RTHDCPL.EXE
E:\Program Files\Gigabyte\ET5\GUI.exe
E:\Program Files\Winamp\winampa.exe
E:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
E:\Program Files\HP\hpcoretech\hpcmpmgr.exe
E:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
E:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
E:\Program Files\Ahead\InCD\InCD.exe
E:\Program Files\lg_fwupdate\fwupdate.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Gadu-Gadu\gg.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Internet Explorer\iexplore.exe
e:\progra~1\intern~1\iexplore.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Winamp\winamp.exe
E:\WINDOWS\system32\msiexec.exe
E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
E:\Program Files\WinRAR\WinRAR.exe
E:\DOCUME~1\ldm\USTAWI~1\Temp\Rar$EX00.187\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Skrót do strony właściwości High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [EasyTuneV] E:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [WinampAgent] E:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HP Software Update] "E:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "E:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] E:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "E:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [DRIVE GREY AXIS OPTION] E:\Documents and Settings\All Users\Dane aplikacji\Cdrom exit drive grey\Hide pure.exe
O4 - HKLM\..\Run: [kav] "E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [trust body] E:\DOCUME~1\ldm\DANEAP~1\CLOSER~1\hope wipe list.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0DAA8E2A-A224-4830-9B67-69BCF7546922}: NameServer = 213.241.79.37 83.238.255.76
O17 - HKLM\System\CS1\Services\Tcpip\..\{0DAA8E2A-A224-4830-9B67-69BCF7546922}: NameServer = 213.241.79.37 83.238.255.76
O20 - Winlogon Notify: klogon - E:\WINDOWS\system32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Ahead\InCD\InCDsrv.exe



Kolobos - 18 Sty 2007 19:19
Z E:\WINDOWS\tasks\ usun wszystkie zaplanowane zadania o ile sa tam jakies.

W hjt usun:
O4 - HKLM\..\Run: [DRIVE GREY AXIS OPTION] E:\Documents and Settings\All Users\Dane aplikacji\Cdrom exit drive grey\Hide pure.exe
O4 - HKCU\..\Run: [trust body] E:\DOCUME~1\ldm\DANEAP~1\CLOSER~1\hope wipe list.exe

Katalog CLOSER~1 oraz Cdrom exit drive gray usun z dysku. Na koniec skan przy pomocy ewido.


Ash Ketchum - 18 Sty 2007 19:24
Co to jest ewido?


gallus [pl] - 18 Sty 2007 20:09
Soft do usuwania spyware - dokładniej ewido anti spyware



Kolobos - 18 Sty 2007 23:08
battery
Google sie zepsulo?