prośba o zbadanie loga z hijakcthis

20 sierpnia 2007

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:51:48, on 2007-08-20

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:WINDOWSSystem32smss.exe

C:WINDOWSsystem32winlogon.exe

C:WINDOWSsystem32services.exe

C:WINDOWSsystem32lsass.exe

C:WINDOWSSystem32Ati2evxx.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSSystem32svchost.exe

C:WINDOWSsystem32ZoneLabsvsmon.exe

C:Program FilesCommon FilesSymantec SharedccSvcHst.exe

C:Program FilesCommon FilesSymantec SharedAppCoreAppSvc32.exe

C:WINDOWSsystem32spoolsv.exe

C:Program FilesSymantecNorton Ghost 2003GhostStartService.exe

C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe

C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe

C:WINDOWSsystem32PnkBstrA.exe

C:WINDOWSsystem32Ati2evxx.exe

C:WINDOWSExplorer.EXE

C:Program FilesThomsonSpeedTouch USBDragdiag.exe

C:PROGRA~1NEOSTR~1CnxMon.exe

C:PROGRA~1NEOSTR~1taskbaricon.exe

C:Program FilesZone LabsZoneAlarmzlclient.exe

C:Program FilesCommon FilesSymantec SharedccApp.exe

F:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe

C:WINDOWSsystem32ctfmon.exe

F:Program FilesAntyDialerAntyDialer.exe

C:Program FilesCommon FilesTeleca SharedGeneric.exe

F:Program FilesSony EricssonMobile2Mobile Phone Monitorepmworker.exe

C:PROGRA~1NEOSTR~1NeostradaTP.exe

C:PROGRA~1NEOSTR~1ComComp.exe

C:PROGRA~1NEOSTR~1Watch.exe

C:PROGRA~1SymantecLIVEUP~1LUCOMS~2.EXE

C:Program FilesMozilla Firefoxfirefox.exe

F:Program FilesTrend MicroHijackThisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.neostrada.pl

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP

R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:PROGRA~1NEOSTR~1SEARCH~1.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - F:Program FilesFlashGetjccatch.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll (file missing)

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - F:PROGRA~1FlashGetgetflash.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM..Run: [speedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon

O4 - HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe

O4 - HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe

O4 - HKLM..Run: [WOOTASKBARICON] C:PROGRA~1NEOSTR~1taskbaricon.exe

O4 - HKLM..Run: [ZoneAlarm Client] "C:Program FilesZone LabsZoneAlarmzlclient.exe"

O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"

O4 - HKLM..Run: [osCheck] "C:Program FilesNorton AntiVirusosCheck.exe"

O4 - HKLM..Run: [sony Ericsson PC Suite] "F:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe" /startoptions

O4 - HKLM..Run: [MSConfig] C:WINDOWSPCHealthHelpCtrBinariesMSConfig.exe /auto

O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe

O4 - HKCU..Run: [Gadu-Gadu] "F:Program FilesGadu-Gadugg.exe" /tray

O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'USŁUGA LOKALNA')

O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'USŁUGA SIECIOWA')

O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'SYSTEM')

O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'Default user')

O4 - Startup: AntyDialer.lnk = F:Program FilesAntyDialerAntyDialer.exe

O8 - Extra context menu item: &Download All with FlashGet - F:Program FilesFlashGetjc_all.htm

O8 - Extra context menu item: &Download with FlashGet - F:Program FilesFlashGetjc_link.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_04binnpjpi142_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_04binnpjpi142_04.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:PROGRA~1FlashGetFlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:PROGRA~1FlashGetFlashGet.exe

O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab

O17 - HKLMSystemCCSServicesTcpip..{ACD84D19-A3DB-4CFB-8E24-37245293D6F4}: NameServer = 213.241.79.37 83.238.255.76

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSSystem32Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe

O23 - Service: GhostStartService - Symantec Corporation - C:Program FilesSymantecNorton Ghost 2003GhostStartService.exe

O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:Program FilesNorton AntiVirusisPwdSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:PROGRA~1SymantecLIVEUP~1LUCOMS~2.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:WINDOWSsystem32PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:WINDOWSsystem32PnkBstrB.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedAppCoreAppSvc32.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:WINDOWSsystem32ZoneLabsvsmon.exe

--

End of file - 7298 bytes

czy sa tu jakies procesy grozne dla mojego kompa lub ktore nalezy wylaczyc aby lepiej komp dzialal...

prosze o pomoc expertów

20 sierpnia 2007

Wklej log z ComboFix.

20 sierpnia 2007

za chwile wkleje obydwa skany...

[ Dodano: 2007-08-20, 23:35 ]

ComboFix 07-08-17.2 - "7UHAS29" 2007-08-20 23:34:06.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.115 [GMT 2:00]

* Created a new restore point

((((((((((((((((((((((((( Files Created from 2007-07-20 to 2007-08-20 )))))))))))))))))))))))))))))))

2007-08-20 23:33 51,200 --a------ C:WINDOWSnircmd.exe

2007-08-20 22:50 <DIR> d-------- C:WINDOWSpss

2007-08-20 22:33 <DIR> d-------- C:Program FilesSkanerOnline

2007-08-19 16:53 <DIR> d-------- C:Program FilesYahoo!

2007-08-04 21:03 <DIR> d-------- C:DOCUME~1LOCALS~1DANEAP~1Sony Ericsson

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-20 23:35 --------- d-------- C:DOCUME~17UHAS29DANEAP~1Azureus

2007-08-20 22:13 --------- d-------- C:Program FilesNeostrada TP

2007-08-19 16:54 --------- d-------- C:Program FilesCommon FilesSymantec Shared

2007-07-18 23:37 --------- d-------- C:DOCUME~17UHAS29DANEAP~1iGrafx

2007-07-18 23:18 --------- d-------- C:Program FilesiGrafx

2007-07-18 23:18 --------- d-------- C:Program FilesCommon FilesiGrafx

2007-07-18 22:41 8704 --a------ C:WINDOWSsystem32driversggsemc.sys

2007-07-18 12:47 2368 --a------ C:WINDOWSsystem32SVKP.sys

2007-07-17 16:34 --------- d-------- C:DOCUME~17UHAS29DANEAP~1Teleca

2007-07-17 16:31 --------- d-------- C:Program FilesSony Ericsson

2007-07-17 16:31 --------- d-------- C:Program FilesCommon FilesTeleca Shared

2007-07-17 16:29 --------- d-------- C:Program FilesCommon FilesSony Ericsson Shared

2007-07-06 21:15 --------- d--h----- C:Program FilesInstallShield Installation Information

2007-06-26 08:10 1104896 --a------ C:WINDOWSsystem32msxml3.dll

2007-06-19 15:32 282112 --a------ C:WINDOWSsystem32gdi32.dll

2007-06-13 15:23 1034752 --a------ C:WINDOWSexplorer.exe

2007-06-03 14:31 10752 --a------ C:WINDOWSsystem32ff_vfw.dll

2007-05-31 08:44 740442 --a------ C:WINDOWSsystem32divx.dll

2007-05-25 23:10 99904 --a------ C:WINDOWSsystem32PnkBstrB.exe

2007-05-24 20:06 63040 --a------ C:WINDOWSsystem32PnkBstrA.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"SpeedTouch USB Diagnostics"="C:Program FilesThomsonSpeedTouch USBDragdiag.exe" [2004-01-26 11:38]

"WooCnxMon"="C:PROGRA~1NEOSTR~1CnxMon.exe" [2003-10-16 19:07]

"WOOWATCH"="C:PROGRA~1NEOSTR~1Watch.exe" [2003-10-16 19:07]

"WOOTASKBARICON"="C:PROGRA~1NEOSTR~1taskbaricon.exe" [2003-10-16 19:07]

"ZoneAlarm Client"="C:Program FilesZone LabsZoneAlarmzlclient.exe" [2007-03-09 00:02]

"ccApp"="C:Program FilesCommon FilesSymantec SharedccApp.exe" [2007-01-09 22:59]

"osCheck"="C:Program FilesNorton AntiVirusosCheck.exe" [2006-09-05 19:22]

"Sony Ericsson PC Suite"="F:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe" [2007-05-28 10:14]

"MSConfig"="C:WINDOWSPCHealthHelpCtrBinariesMSConfig.exe" [2004-08-04 00:44]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"CTFMON.EXE"="C:WINDOWSsystem32ctfmon.exe" [2004-08-04 00:44]

"Gadu-Gadu"="F:Program FilesGadu-Gadugg.exe" [2006-11-14 11:12]

C:Documents and Settings7UHAS29Menu StartProgramyAutostart

AntyDialer.lnk - F:Program FilesAntyDialerAntyDialer.exe [2003-05-31 13:17:45]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^7UHAS29^Menu Start^Programy^Autostart^Yahoo! Widget Engine.lnk]

path=C:Documents and Settings7UHAS29Menu StartProgramyAutostartYahoo! Widget Engine.lnk

backup=C:WINDOWSpssYahoo! Widget Engine.lnkStartup

R0 pnpshark;pnpshark;C:WINDOWSsystem32DRIVERSpnpshark.sys

R0 st3shark;st3shark;C:WINDOWSsystem32DRIVERSst3shark.sys

R0 tffsport;M-Systems DiskOnChip 2000;C:WINDOWSsystem32DRIVERStffsport.sys

R1 GhPciScan;GhostPciScanner;??C:Program FilesSymantecNorton Ghost 2003ghpciscan.sys

R2 A4SII300;A4SII300;C:WINDOWSsystem32driversA4SII300.SYS

R2 DgiVecp;Team MFP Comm Driver;C:WINDOWSsystem32DriversDgiVecp.sys

R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;"C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe"

R2 SVKP;SVKP;??C:WINDOWSsystem32SVKP.sys

S3 ntportio;ntportio;??C:Documents and Settings7UHAS29PulpitProgramy do Sony EricssonowSEMCtool v8.4ntportio.sys

S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:WINDOWSsystem32DRIVERSw300bus.sys

S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:WINDOWSsystem32DRIVERSw300mdfl.sys

S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:WINDOWSsystem32DRIVERSw300mdm.sys

S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:WINDOWSsystem32DRIVERSw300mgmt.sys

S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:WINDOWSsystem32DRIVERSw300obex.sys

Contents of the 'Scheduled Tasks' folder

2007-08-03 19:25:11 C:WINDOWSTasksNorton AntiVirus - Uruchom pełne skanowanie systemu - 7UHAS29.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-08-20 23:35:59

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINEsystemControlSet001ServicesH a r m o n o g r a m a u t o m a t y c z n e j u s Bu g i L i v e U p d a t e ]

"ImagePath"=""C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe""

[HKEY_LOCAL_MACHINEsystemControlSet001Serviceshelpsvc]

"ServiceDll"="%WINDIR%PCHealthHelpCtrBinariespchsvc.dll"

[HKEY_LOCAL_MACHINEsystemControlSet001ServicesHidServ]

"ServiceDll"="%SystemRoot%System32hidserv.dll"

[HKEY_LOCAL_MACHINEsystemControlSet001ServicesHidUsb]

"ImagePath"="system32DRIVERShidusb.sys"

[HKEY_LOCAL_MACHINEsystemControlSet001Serviceshpn]

[HKEY_LOCAL_MACHINEsystemControlSet001Serviceshpt3xx]

[HKEY_LOCAL_MACHINEsystemControlSet001ServicesHTTP]

"ImagePath"="System32DriversHTTP.sys"

[HKEY_LOCAL_MACHINEsystemControlSet001ServicesHTTPFilter]

"ServiceDll"="%SystemRoot%System32w3ssl.dll"

Completion time: 2007-08-20 23:36:59

--- E O F ---