FAQ | Points | Add... | Recent posts | Search | Register | Log in


Wysyłanie danych w sieć. Mam jakiegoś wirusa.
Search:  
Post new topic  This topic is locked      Main Page -> Forum Index -> Computer Service -> Computer Software -> Wysyłanie danych w sieć. Mam jakiegoś wirusa.
Author
Message
network1
Poziom 19
Poziom 19


Joined: 11 Jan 2006
Posts: 660
Location: WYS MAZ/ BIAŁYSTOK
Post#1 Post from the author of the topic 26 Jan 2007 12:53   

wysylanie danych w siec
Witam,
Mam neostrade 512 i zalapalem jakiegos wirusa przeskanowalem kompa mks vir, avast i bitdefender v10 i dalej to samo a mianowicie ciagle są wysylane jakies dane z mojego komputera w siec

Wysyłanie danych w sieć. Mam jakiegoś wirusa.

zrobilem rowniez to co jest napisane na tej stronce i tez dalej nic

http://www.searchengines.pl/phpbb203/index.php?showtopic=79209

macie jakies pomysly??
Back to top
   
spectrum7glr
Poziom 13
Poziom 13


Joined: 05 Feb 2006
Posts: 120
Location: polska
Post#2 26 Jan 2007 13:17   

Re: wysylanie danych w siec
A jekiego masz firewalla? Jaki system ?
Back to top
   
Google

Google Adsense
Post# 26 Jan 2007 13:17   



Back to top
   
network1
Poziom 19
Poziom 19


Joined: 11 Jan 2006
Posts: 660
Location: WYS MAZ/ BIAŁYSTOK
Post#3 Post from the author of the topic 26 Jan 2007 13:28   

Re: wysylanie danych w siec
windows xp a firewalla nie wiem ;P
i co przed chwilą zauwazylem ze przy kazdym skanowaniu w kazdym folderze jest jakis wirus mks niby pousuwał ale w bitdefender znowu te same wirusy pokazuje

Dodano po 4 [minuty]:

Logfile of HijackThis v1.99.1
Scan saved at 13:27:28, on 2007-01-26
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\System32\urdvxc.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdlite.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\MAROKOM\USTAWI~1\Temp\Rar$EX00.387\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/search/index.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.allegro.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/search/index.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.3.102.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://bezpieczenstwo.onet.pl/skaner/ArcaOnline.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164625821645
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6ABE4BC3-7253-418E-85E8-F334A73154D3} (CSmartClient Object) - http://www.smart-clip.com/activex/SmartClip.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164625804961
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_28.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8BA2D7CB-C4E9-4B2E-8BE6-53002B80A05C}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Back to top
   
Google

Google Adsense
Post# Post from the author of the topic 26 Jan 2007 13:28   



Back to top
   
Radek102
Poziom 18
Poziom 18


Joined: 25 Nov 2004
Posts: 503
Location: Świecie
Post#4 26 Jan 2007 13:33   

Re: wysylanie danych w siec
C:\WINDOWS\System32\urdvxc.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/search/index.html?src=ssb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/search/index.html?src=ssb
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)
Wywal
I zainstaluj PS 2
Back to top
   
network1
Poziom 19
Poziom 19


Joined: 11 Jan 2006
Posts: 660
Location: WYS MAZ/ BIAŁYSTOK
Post#5 Post from the author of the topic 26 Jan 2007 13:35   

Re: wysylanie danych w siec
to jest raport z bitdefendera


bitdefender.txt
 Description:
 n/a

Download
 Filename:  bitdefender.txt
 Contents:  
 Filesize:  70.01 KB
 Punkty:  0.00
Back to top
   
Google

Google Adsense
Post# Post from the author of the topic 26 Jan 2007 13:35   



Back to top
   
network1
Poziom 19
Poziom 19


Joined: 11 Jan 2006
Posts: 660
Location: WYS MAZ/ BIAŁYSTOK
Post#6 Post from the author of the topic 26 Jan 2007 13:52   

Re: wysylanie danych w siec
radek a mozesz podac mi link do PS 2 ?

nadal nie moge usunać jednej rzeczy z hijacka to jest log


Logfile of HijackThis v1.99.1
Scan saved at 13:47:59, on 2007-01-26
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\MAROKOM\USTAWI~1\Temp\Rar$EX00.506\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.allegro.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.3.102.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://bezpieczenstwo.onet.pl/skaner/ArcaOnline.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164625821645
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6ABE4BC3-7253-418E-85E8-F334A73154D3} (CSmartClient Object) - http://www.smart-clip.com/activex/SmartClip.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164625804961
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_28.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8BA2D7CB-C4E9-4B2E-8BE6-53002B80A05C}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
[size=12][size=18]O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)[/size][/size]
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
Back to top
   
paweliw
Poziom 24
Poziom 24


Joined: 24 Apr 2003
Posts: 4473
Location: Bydgoszcz
Post#7 26 Jan 2007 21:10   

Re: wysylanie danych w siec
Wpisu:
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)
nie usuniesz normalnie bo to usługa.
Wpisz w Start->Uruchom:
sc stop MSWindows Enter
sc delete MSWindows Enter
Następnie usuń plik C:\WINDOWS\System32\urdvxc.exe (jak nie normalnie to przy użyciu Pocket KillBox-opcja Delete on reboot).

Wyłącz przywracanie systemu, usuń wszystkie pliki tymczasowe (także internetowe).
Użyj Windows Worms Doors Cleanera i zamknij nim porty (zmień znaczki z disable na enable) i reset komputera.

Przeskanuj system tym:
Skaner online Xscan
AVG Anti-Spyware-ewido anti-spyware <- zrób update przed skanowaniem, po skanowaniu odinstaluj.

Radzę też przeskanować system skanerem on-line Bitdefender-a (wolny ale dokładny)

Zbiorczy pakiet poprawek SP2 do Windowsa XP jest do pobrania ze stron Microsoftu. Polecam również zainstalować conajmniej łatki krytyczne do Internet Explorera i systemu Windows (po SP2).

Radzę też odinstalować całą aplikację Neostrady (zostają tylko sterowniki modemu) i utworzyć nowe połączenie modemowe (szerokopasmowe). Opisy masz np. tutaj:
Instalacja usługi neostrada
Graficzny opis tworzenia nowego połączenia w Windows XP
Back to top
   
network1
Poziom 19
Poziom 19


Joined: 11 Jan 2006
Posts: 660
Location: WYS MAZ/ BIAŁYSTOK
Post#8 Post from the author of the topic 26 Jan 2007 21:18   

Re: wysylanie danych w siec
poprostu jestem w szoku
dziekowka paweliw
jakbys mial kiedys jakis problem z GSM zapraszam na serwisanci
Back to top
   
Post new topic  This topic is locked      Main Page -> Forum Index -> Computer Service -> Computer Software -> Wysyłanie danych w sieć. Mam jakiegoś wirusa.
Page 1 of 1
Similar topics
Mam wirusa- Virus.Win32.Virut.a (15)
mam wirusa i nie mogę go wywalić (18)
Proszę o pomoc!Mam wirusa (4)
czy mam wirusa na porcie (11)
Nie działa sieć po usunięciu wirusa (WIN XP) (24)
Sądzę że mam jakiegoś wirusa, prawodopodobnie jako smss.exe (5)
Sądzę że mam jakiegoś wirusa, chyba w svchost.exe (2)
mam wirusa w mp3 i chcę go usunąć.. (15)
Chyba mam wirusa, proszę o pomoc (1)
Mam wirusa i komputer źle chodzi (15)

Page generation time: 0.068 seconds


FAQ || Administrator || Moderators || Widgets and banners || Contact
elektroda.pl topic RSS feed