Dodaj do ulubionych

Prośba o sprawdzenie loga

IP: *.stk.net.pl 16.02.06, 22:05
Złapałem jakieś dziadostwo.
Prosze o pomoc
Oto log:
Logfile of HijackThis v1.99.0
Scan saved at 21:58:12, on 2006-02-16
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\explorer.exe
D:\WINDOWS\runservice.exe
D:\WINDOWS\inet20010\services.exe
D:\Program Files\D-Tools\daemon.exe
D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
D:\WINDOWS\system32\mpcsvc.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\rundll32.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\Documents and Settings\damian\Pulpit\HijackThis.exe
D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini:
Shell=explorer.exe
"D:\Program Files\Common
Files\Microsoft Shared\Web Folders\ibm00001.exe"
F3 - REG:win.ini: run=D:\WINDOWS\inet20010\services.exe
O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} -
D:\WINDOWS\inet20010\3.01.00.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -
lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_05
\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nuZTVaSOo] D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [Internet Optimizer] "D:\Program Files\Internet
Optimizer\optimize.exe"
O4 - HKLM\..\Run: [2jNKA5] "D:\DOCUME~1\damian\USTAWI~1
\Temp\cxtpls_loader.exe" /PC=CP.IST2 /SHUN /UNAR="/CTUN"
O4 - HKLM\..\Run: [Kojrqnbf] C:\Program Files\Ncisu\Ctxb.exe
O4 - HKLM\..\Run: [nuZTV÷h$vůőš/‚˛‘ĆßD:\Program Files\ISTsvc\istsvc.exe]
D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [Áł#  é"h'ţ9ÓśU3rŲWD:\Program Files\ISTsvc\istsvc.exe]
D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [BearShare] "D:\Program
Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd8.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban8.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames.exe
O4 - HKLM\..\Run: [PayTime] D:\WINDOWS\system32\paytime.exe
O4 - HKLM\..\Run: [xp_system] D:\WINDOWS\inet20010\services.exe
O4 - HKLM\..\Run: [SiS Mpc Service] D:\WINDOWS\system32\mpcsvc.exe
O4 - HKLM\..\Run: [ćüy-Żł] D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [IST Service] D:\Program Files\ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [InstantTray] D:\Program Files\Pinnacle\Shared
Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program
Files\dvd\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Shell] "D:\Program Files\Common Files\Microsoft Shared\Web
Folders\ibm00001.exe"
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [xp_system] D:\WINDOWS\inet20010\services.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Google Search - res://d:\program
files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program
files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program
files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program
files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\Program
Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program
Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with Star Downloader - D:\Program
Files\Star Downloader\sdie.htm
O8 - Extra context menu item: Similar Pages - res://d:\program
files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program
files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -
C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-
0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} -
www.azebar.com/install/azesearch.cab
O18 - Filter: text/html - {F59D1A59-E68F-4AF2-A3CC-D685EF8C28E8} - D:\DOCUME~1
\damian\USTAWI~1\Temp\e.eee
O21 - SSODL: DCOM Server - {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} -
D:\WINDOWS\system32\dcom_14.dll
O23 - Service: InstallDriver Table Manager - Macrovision Corporation -
D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service - Unknown - D:\WINDOWS\runservice.exe

Obserwuj wątek
    • barracuda7110 Re: Prośba o sprawdzenie loga 16.02.06, 22:20
      Śmietnik :/
      to wywal:
      > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
      > c:\secure32.html
      > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
      > searchbar.findthewebsiteyouneed.com
      > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
      > searchbar.findthewebsiteyouneed.com
      > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
      > searchbar.findthewebsiteyouneed.com
      > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
      > c:\secure32.html
      > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
      > searchbar.findthewebsiteyouneed.com
      > R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      > c:\secure32.html
      > R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      > searchbar.findthewebsiteyouneed.com
      > R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      > c:\secure32.html
      > R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      > c:\secure32.html
      Usuń plik secure32.html z dysku.
      Tu masz sposób na usunięcie paytime:
      www.bleepingcomputer.com/forums/topic16400.html
      Odinstaluj internet optimizer i usuń katalog z dysku
      > O4 - HKLM\..\Run: [nuZTVaSOo] D:\WINDOWS\rohdhf.exe
      > O4 - HKLM\..\Run: [Internet Optimizer] "D:\Program Files\Internet
      > Optimizer\optimize.exe"
      > O4 - HKLM\..\Run: [Kojrqnbf] C:\Program Files\Ncisu\Ctxb.exe
      > O4 - HKLM\..\Run: [nuZTV÷h$vůőš/‚˛‘ĆßD:\Program Files\ISTsvc\ists
      > vc.exe]
      > D:\WINDOWS\rohdhf.exe
      > O4 - HKLM\..\Run: [Áł# é"h'ţ9ÓśU3rŲWD:\Program Files\ISTsvc\istsvc.exe]
      > D:\WINDOWS\rohdhf.exe
      co to za bzdety???? Powywalaj wszystko i usuń pliki z dysku.

      > O4 - HKCU\..\Run: [Shell] "D:\Program Files\Common Files\Microsoft Shared\Web
      > Folders\ibm00001.exe"
      > O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe

      Masz taki burdel w logu, że głowa mała :/. Obawiam się, że trochę rzeczy mogłem
      ominąć.

      --
      Konfucjusz mówi: Obraz nie Windows, sam się nie zawiesi.
    • kolobos Re: Prośba o sprawdzenie loga 16.02.06, 22:22
      > Złapałem jakieś dziadostwo.

      I to nie jedno...

      W menadzerze zadan zakoncz:
      D:\WINDOWS\runservice.exe
      D:\WINDOWS\inet20010\services.exe
      D:\WINDOWS\system32\mpcsvc.exe
      D:\WINDOWS\system32\dllcache\IExplore.exe
      D:\WINDOWS\system32\dllcache\IExplore.exe
      D:\WINDOWS\system32\dllcache\IExplore.exe
      D:\WINDOWS\system32\dllcache\IExplore.exe
      D:\WINDOWS\system32\dllcache\IExplore.exe

      W hijackthis:
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
      c:\secure32.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
      searchbar.findthewebsiteyouneed.com
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
      searchbar.findthewebsiteyouneed.com
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
      searchbar.findthewebsiteyouneed.com
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
      c:\secure32.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
      searchbar.findthewebsiteyouneed.com
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      c:\secure32.html
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      searchbar.findthewebsiteyouneed.com
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      c:\secure32.html <- usun plik
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      c:\secure32.html
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      F2 - REG:system.ini:
      Shell=explorer.exe
      "D:\Program Files\Common
      Files\Microsoft Shared\Web Folders\ibm00001.exe"
      F3 - REG:win.ini: run=D:\WINDOWS\inet20010\services.exe
      O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} -
      D:\WINDOWS\inet20010\3.01.00.dll
      O4 - HKLM\..\Run: [nuZTVaSOo] D:\WINDOWS\rohdhf.exe
      O4 - HKLM\..\Run: [Internet Optimizer] "D:\Program Files\Internet
      Optimizer\optimize.exe" <- odinstaluj i usun katalog Ineternet...
      O4 - HKLM\..\Run: [2jNKA5] "D:\DOCUME~1\damian\USTAWI~1
      \Temp\cxtpls_loader.exe" /PC=CP.IST2 /SHUN /UNAR="/CTUN"
      O4 - HKLM\..\Run: [Kojrqnbf] C:\Program Files\Ncisu\Ctxb.exe <- usun katalog
      ncisu
      O4 - HKLM\..\Run: [nuZTV÷h$vůőš/‚˛‘ĆßD:\Program Files\ISTsvc\istsvc.exe]
      D:\WINDOWS\rohdhf.exe
      O4 - HKLM\..\Run: [Áł# é"h'ţ9ÓśU3rŲWD:\Program Files\ISTsvc\istsvc.exe]
      D:\WINDOWS\rohdhf.exe
      O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd8.exe <- usun plik
      O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban8.exe <- usun plik
      O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames.exe <- usun plik
      O4 - HKLM\..\Run: [PayTime] D:\WINDOWS\system32\paytime.exe <- usun plik
      O4 - HKLM\..\Run: [xp_system] D:\WINDOWS\inet20010\services.exe
      O4 - HKLM\..\Run: [SiS Mpc Service] D:\WINDOWS\system32\mpcsvc.exe <- ten
      O4 - HKLM\..\Run: [ćüy-Żł] D:\WINDOWS\rohdhf.exe <- usun plik
      O4 - HKLM\..\Run: [IST Service] D:\Program Files\ISTsvc\istsvc.exe <- usun
      katalog ISTsvc
      O4 - HKCU\..\Run: [Shell] "D:\Program Files\Common Files\Microsoft Shared\Web
      Folders\ibm00001.exe" <- usun plik
      O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe <- usun plik
      O4 - HKCU\..\Run: [xp_system] D:\WINDOWS\inet20010\services.exe <- usun katalog
      inet20010
      O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} -
      www.azebar.com/install/azesearch.cab
      O18 - Filter: text/html - {F59D1A59-E68F-4AF2-A3CC-D685EF8C28E8} - D:\DOCUME~1
      \damian\USTAWI~1\Temp\e.eee <- usun wszystkie pliki z temp
      O21 - SSODL: DCOM Server - {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} -
      D:\WINDOWS\system32\dcom_14.dll
      Usun usluge:
      O23 - Service: LicCtrl Service - Unknown - D:\WINDOWS\runservice.exe
      Start->Uruchom->sc stop "LicCtrl Service"
      sc delete "LicCtrl Service"
      Nastepnie usun plik runservice.exe

      Zrob skan tym:
      ftp://download.hirekmedia.hu/ssfsetup1_0.exe <- zrob update przed skanowaniem,
      po przeskanowaniu odinstaluj.
      download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po
      przeskanowaniu odinstaluj.
      securityresponse.symantec.com/avcenter/FxIstbar.exe
      Po wszystkim wklej nowy log z NOWEGO hijackthis (1.99.1).
      • Gość: Juvefan Re: Prośba o sprawdzenie loga IP: *.stk.net.pl 17.02.06, 14:03


        Logfile of HijackThis v1.99.1
        Scan saved at 14:02:13, on 2006-02-17
        Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        D:\WINDOWS\System32\smss.exe
        D:\WINDOWS\SYSTEM32\winlogon.exe
        D:\WINDOWS\system32\services.exe
        D:\WINDOWS\system32\lsass.exe
        D:\WINDOWS\system32\svchost.exe
        D:\WINDOWS\System32\svchost.exe
        D:\WINDOWS\system32\spoolsv.exe
        D:\WINDOWS\Explorer.EXE
        D:\Program Files\D-Tools\daemon.exe
        D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
        C:\Program Files\dvd\InstantCDDVD\InstantWrite\iwctrl.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        D:\Documents and Settings\damian\Pulpit\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = onet.pl/
        O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -
        lang 1033
        O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_05
        \bin\jusched.exe
        O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause
        O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -
        atboottime
        O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe
        O4 - HKCU\..\Run: [InstantTray] D:\Program Files\Pinnacle\Shared
        Files\InstantCDDVD\PCLETray.exe
        O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program
        Files\dvd\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
        O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
        O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
        O8 - Extra context menu item: &Google Search - res://d:\program
        files\google\GoogleToolbar1.dll/cmsearch.html
        O8 - Extra context menu item: &Translate English Word - res://d:\program
        files\google\GoogleToolbar1.dll/cmwordtrans.html
        O8 - Extra context menu item: Backward Links - res://d:\program
        files\google\GoogleToolbar1.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program
        files\google\GoogleToolbar1.dll/cmcache.html
        O8 - Extra context menu item: Download All by FlashGet - C:\Program
        Files\FlashGet\jc_all.htm
        O8 - Extra context menu item: Download using FlashGet - C:\Program
        Files\FlashGet\jc_link.htm
        O8 - Extra context menu item: Download with Star Downloader - D:\Program
        Files\Star Downloader\sdie.htm
        O8 - Extra context menu item: Similar Pages - res://d:\program
        files\google\GoogleToolbar1.dll/cmsimilar.html
        O8 - Extra context menu item: Translate Page into English - res://d:\program
        files\google\GoogleToolbar1.dll/cmtrans.html
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
        D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
        00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
        O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -
        C:\PROGRA~1\FLASHGET\flashget.exe
        O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-
        0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
        D:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
        00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
        O20 - Winlogon Notify: Controls Folder - D:\WINDOWS\system32\k208lcdu1f08.dll
        (file missing)
        O20 - Winlogon Notify: hpprintx - hpprintx.dll (file missing)
        O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
        Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
        \IDriverT.exe

        • kolobos Re: Prośba o sprawdzenie loga 17.02.06, 14:28
          Usun:
          O20 - Winlogon Notify: Controls Folder - D:\WINDOWS\system32\k208lcdu1f08.dll
          (file missing)
          O20 - Winlogon Notify: hpprintx - hpprintx.dll (file missing)
          O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

          Widze, ze masz look2me, sprobuj usunac tym:
          www.simplytech.it/L2MRemover/index_e.htm
          www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/Killme.shtml
          Jezeli to nie pomoze to usun recznie:
          www.searchengines.pl/phpbb203/index.php?
          showtopic=12510&st=30&p=109496&#entry114917
          Lub wklej log z l2mfix na ich forum.

          • Gość: Juvefan Re: Prośba o sprawdzenie loga IP: *.stk.net.pl 17.02.06, 14:44
            I jak??

            Logfile of HijackThis v1.99.1
            Scan saved at 14:43:53, on 2006-02-17
            Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

            Running processes:
            D:\WINDOWS\System32\smss.exe
            D:\WINDOWS\SYSTEM32\winlogon.exe
            D:\WINDOWS\system32\services.exe
            D:\WINDOWS\system32\lsass.exe
            D:\WINDOWS\system32\svchost.exe
            D:\WINDOWS\System32\svchost.exe
            D:\WINDOWS\system32\spoolsv.exe
            D:\Program Files\D-Tools\daemon.exe
            D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
            C:\Program Files\dvd\InstantCDDVD\InstantWrite\iwctrl.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            D:\WINDOWS\explorer.exe
            D:\Documents and Settings\damian\Pulpit\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
            v4.windowsupdate.microsoft.com/
            O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -
            lang 1033
            O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_05
            \bin\jusched.exe
            O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
            O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause
            O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -
            atboottime
            O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe
            O4 - HKCU\..\Run: [InstantTray] D:\Program Files\Pinnacle\Shared
            Files\InstantCDDVD\PCLETray.exe
            O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program
            Files\dvd\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
            O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
            O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
            O8 - Extra context menu item: &Google Search - res://d:\program
            files\google\GoogleToolbar1.dll/cmsearch.html
            O8 - Extra context menu item: &Translate English Word - res://d:\program
            files\google\GoogleToolbar1.dll/cmwordtrans.html
            O8 - Extra context menu item: Backward Links - res://d:\program
            files\google\GoogleToolbar1.dll/cmbacklinks.html
            O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program
            files\google\GoogleToolbar1.dll/cmcache.html
            O8 - Extra context menu item: Download All by FlashGet - C:\Program
            Files\FlashGet\jc_all.htm
            O8 - Extra context menu item: Download using FlashGet - C:\Program
            Files\FlashGet\jc_link.htm
            O8 - Extra context menu item: Download with Star Downloader - D:\Program
            Files\Star Downloader\sdie.htm
            O8 - Extra context menu item: Similar Pages - res://d:\program
            files\google\GoogleToolbar1.dll/cmsimilar.html
            O8 - Extra context menu item: Translate Page into English - res://d:\program
            files\google\GoogleToolbar1.dll/cmtrans.html
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
            D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
            O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
            00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
            O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -
            C:\PROGRA~1\FLASHGET\flashget.exe
            O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-
            0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
            D:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
            00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
            Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
            \IDriverT.exe

Popularne wątki

Nie pamiętasz hasła

lub ?

 

Nie masz jeszcze konta? Zarejestruj się

Nakarm Pajacyka