do WCH

[Gość: ellllla]

Logfile of HijackThis v1.98.2
Scan saved at 21:04:51, on 2004-10-07
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp3\winampa.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\svchost32.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\użytki\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://best-
search.cc/search.php?v=6&aff=6211921
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://best-
search.cc/index.php?v=6&aff=6211921
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver=
{SUB_PVER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
O1 - Hosts: 81.211.105.69 lender-search.com
O1 - Hosts: 81.211.105.68 hot-searches.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_02
\bin\jusched.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch
Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update
Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program
Files\Roxio\WinOnCD\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [hpfsched] C:\WINDOWS\hpfsched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [wersds.exe] C:\WINDOWS\System32\doriot.exe
O4 - HKLM\..\Run: [arp] c:\windows\winsys\ARP.EXE
O4 - HKLM\..\Run: [neth] c:\windows\winsys\NETH.EXE
O4 - HKLM\..\Run: [FamilyKeyLogger] C:\Program Files\FamilyKeyLogge\cisvc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [svchost32] C:\WINDOWS\svchost32.exe
O4 - HKCU\..\Run: [wersds.exe] C:\WINDOWS\System32\doriot.exe
O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\winerdir.exe
O4 - HKCU\..\Run: [Dzieńdobry!] C:\Program Files\VSD Software\Dzieńdobry!
\dziendobry.exe /auto
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program
Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6
\NkvMon.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box -
C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://c:\program
files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program
files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program
files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\program
files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program
files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no
file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .mpg: C:\Program Files\Internet
Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cab
O16 - DPF: {14578416-1111-1111-1111-111111411123} - file://C:\Documents and
Settings\Właściciel\Moje dokumenty\Moje obrazy\fotos\1\calc.exe
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-
its:mhtml:file://C:\foo.mht!http://195.190.118.140/e9xr2.chm::/file.exe
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) -
http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) -
http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E33E8CE5-2832-4FEE-B256-
E9104F879399}: NameServer = 212.33.64.2,212.33.84.2
O18 - Filter: text/html - {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} -
C:\WINDOWS\System32\xplugin.dll

[Gość: wch]

Gość portalu: ellllla napisał(a):

Do wywalenia:

> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = best-
> search.cc/search.php?v=6&aff=6211921
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = best-
> search.cc/index.php?v=6&aff=6211921

> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
> www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
> www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
> www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
> www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver=
> {SUB_PVER}&ar=home

> R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
> Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*

> O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
> O1 - Hosts: 81.211.105.69 lender-search.com
> O1 - Hosts: 81.211.105.68 hot-searches.com

+++> O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_02
> \bin\jusched.exe

> O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
> Shared\ccApp.exe"
+++> O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
> Shared\ccRegVfy.exe"

+++> O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
> Files\Real\Update_OB\realsched.exe" -osboot
+++> O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -
> atboottime
+++> O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
> O4 - HKLM\..\Run: [wersds.exe] C:\WINDOWS\System32\doriot.exe
> O4 - HKLM\..\Run: [arp] c:\windows\winsys\ARP.EXE
> O4 - HKLM\..\Run: [neth] c:\windows\winsys\NETH.EXE
+++> O4 - HKLM\..\Run: [FamilyKeyLogger] C:\Program
Files\FamilyKeyLogge\cisvc.exe - MAMY DZIADA!!!

> O4 - HKCU\..\Run: [svchost32] C:\WINDOWS\svchost32.exe
> O4 - HKCU\..\Run: [wersds.exe] C:\WINDOWS\System32\doriot.exe
> O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\winerdir.exe

> O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no
> file)
> O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
> 00401C608501} - (no file)
> O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
> C:\WINDOWS\web\related.htm
> O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
> 00aa003c157a} - C:\WINDOWS\web\related.htm

> O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cab
> O16 - DPF: {14578416-1111-1111-1111-111111411123} - file://C:\Documents and
> Settings\Właściciel\Moje dokumenty\Moje obrazy\fotos\1\calc.exe - to dziwne
jakieś, jak nie wiesz co to, wywal
> O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-
> its:mhtml:file://C:\foo.mht!http://195.190.118.140/e9xr2.chm::/file.exe
> O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) -
> www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab

> O18 - Filter: text/html - {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} -
> C:\WINDOWS\System32\xplugin.dll