Intruz w kompie

[Gość: Kacha]

Co ja mam z tym zrobić?
Logfile of HijackThis v1.98.2
Scan saved at 10:20:33, on 2004-09-26
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup
Program\AudioDeck\AudioDeck.exe
C:\Program Files\VeriSign\NAVI\naviagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\XoftSpy\XoftSpy.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Monia\Ustawienia lokalne\Temp\HijackThis.exe

R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-
744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} -
C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} -
C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01
\bin\jusched.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies,
Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no
file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: i-Nav Pomoc - {CE000992-A58C-4441-8938-744CD72AB27F} -
idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra 'Tools' menuitem: i-Nav Pomoc - {CE000992-A58C-4441-8938-
744CD72AB27F} - idn.verisign-grs.com/plug-in/support/index.jsp (file
missing)
O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} -
C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O9 - Extra 'Tools' menuitem: i-Nav Ustawienia - {CE000996-A58C-4441-8938-
744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) -
www.cult3d.com/download/cult.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GINWORDS Class) -
gryonline.wp.pl/files/words_2_0_0_18.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GINSNOOKER Class) -
gryonline.wp.pl/files/snooker_2_0_0_6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD6B4EF-1617-4DE5-8C94-
AA2BE7BDBB7E}: NameServer = 217.28.150.195 195.117.35.16
O17 - HKLM\System\CS1\Services\Tcpip\..\{4DD6B4EF-1617-4DE5-8C94-
AA2BE7BDBB7E}: NameServer = 217.28.150.195 195.117.35.16

[Gość: Kacha]

Logfile of HijackThis v1.98.2
Scan saved at 10:53:33, on 2004-09-26
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup
Program\AudioDeck\AudioDeck.exe
C:\Program Files\VeriSign\NAVI\naviagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Monia\Ustawienia lokalne\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-
744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {8C8F3E5E-5471-40D8-B220-BE963A6BD7D3} -
C:\WINDOWS\System32\nihgd.dll
O2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} -
C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01
\bin\jusched.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware
Doctor\spydoctor.exe" /Q
O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA
Audio Driver Setup Program\AudioDeck\AudioDeck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no
file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: i-Nav Pomoc - {CE000992-A58C-4441-8938-744CD72AB27F} -
idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra 'Tools' menuitem: i-Nav Pomoc - {CE000992-A58C-4441-8938-
744CD72AB27F} - idn.verisign-grs.com/plug-in/support/index.jsp (file
missing)
O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} -
C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O9 - Extra 'Tools' menuitem: i-Nav Ustawienia - {CE000996-A58C-4441-8938-
744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) -
www.cult3d.com/download/cult.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GINWORDS Class) -
gryonline.wp.pl/files/words_2_0_0_18.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GINSNOOKER Class) -
gryonline.wp.pl/files/snooker_2_0_0_6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD6B4EF-1617-4DE5-8C94-AA2BE7BDBB7E}:
NameServer = 217.28.150.195 195.117.35.16
O17 - HKLM\System\CS1\Services\Tcpip\..\{4DD6B4EF-1617-4DE5-8C94-AA2BE7BDBB7E}:
NameServer = 217.28.150.195 195.117.35.16
O18 - Filter: text/html - {0CC42C05-5DD0-4F9D-95C5-0606DD88CE08} -
C:\WINDOWS\System32\nihgd.dll
O18 - Filter: text/plain - {0CC42C05-5DD0-4F9D-95C5-0606DD88CE08} -
C:\WINDOWS\System32\nihgd.dll

[netsec]

Gość portalu: Kacha napisał(a):

> Logfile of HijackThis v1.98.2
> Scan saved at 10:53:33, on 2004-09-26
> Platform: Windows XP (WinNT 5.01.2600)
> MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Ściągnij CWShredder 1.59.1
www.softpedia.com/public/cat/10/17/10-17-150.shtml
Sprawdź czy masz włączoną zaporę Internetową we właściwościach Twojego
połączenia do Internetu. Tu jest opis jak to wykonać
www.microsoft.com/poland/security/protect/windowsxp/firewall.aspx
Wyłącz przywracanie systemu (tylko XP i Me)
support.microsoft.com/default.aspx?scid=kb;pl;310405
Uruchom komputer w trybie awaryjnym:
support.microsoft.com/default.aspx?scid=KB;PL;315222
Po uruchomieniu komputera w trybie awaryjnym, nie otwieraj Internet Explorera.

Uruchom ponownie HijackThis wykonaj SCAN i zaznacz te pozycje:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-
744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O2 - BHO: (no name) - {8C8F3E5E-5471-40D8-B220-BE963A6BD7D3} -
C:\WINDOWS\System32\nihgd.dll
O2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} -
C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01
\bin\jusched.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware
Doctor\spydoctor.exe" /Q
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no
file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - (no file)
O9 - Extra button: i-Nav Pomoc - {CE000992-A58C-4441-8938-744CD72AB27F} -
idn.verisign-grs.com/plug-in/support/index.jsp (file
missing)
O9 - Extra 'Tools' menuitem: i-Nav Pomoc - {CE000992-A58C-4441-8938-
744CD72AB27F} - idn.verisign-grs.com/plug-in/support/index.jsp
(file
missing)
O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} -
C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O9 - Extra 'Tools' menuitem: i-Nav Ustawienia - {CE000996-A58C-4441-8938-
744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_0.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Filter: text/html - {0CC42C05-5DD0-4F9D-95C5-0606DD88CE08} -
C:\WINDOWS\System32\nihgd.dll
O18 - Filter: text/plain - {0CC42C05-5DD0-4F9D-95C5-0606DD88CE08} -
C:\WINDOWS\System32\nihgd.dll


Po zaznaczeniu wykonaj FIX CHECKED i potwierdź TAK/OK.

W Panel Sterowania =>Opcje Internetowe usuń
Tymczasowe pliki Internetowe (Wszystkie) i Cooki.

Odinstaluj w Panelu sterowania Dodaj/Usuń programy wszystkie
programy, co do których nie masz pewności, że Ci są potrzebne.

Uruchom CWShredder i wykonaj Fix.

Uruchom komputer w normalnym trybie.

Przeskanuj system Ad-aware SE 1.05
jest tu: www.download.com/3000-2144-10045910.html
Przy skanowaniu ad-aware wybierz opcje Perform full system scan.

Generalnie Twoje problemy biorą się z braku aktualizacji systemu i programu
antywirusowego.

Zaktualizuj system w www.windowsupdate.com o
wszystkie krytyczne poprawki. Tutaj masz więcej na ten temat
www.microsoft.com/poland/security/protect/windowsxp/updates.aspx
Najlepiej jeśli zainstalujesz SP2 dla XP.

Po wszystkim wklej nowy log z HiJackThis.

[Gość: Kacha]

Logfile of HijackThis v1.98.2
Scan saved at 22:20:14, on 2004-09-26
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VeriSign\NAVI\naviagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Monia\Ustawienia lokalne\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.wp.pl/
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD6B4EF-1617-4DE5-8C94-AA2BE7BDBB7E}:
NameServer = 217.28.150.195 195.117.35.16
O17 - HKLM\System\CS1\Services\Tcpip\..\{4DD6B4EF-1617-4DE5-8C94-AA2BE7BDBB7E}:
NameServer = 217.28.150.195 195.117.35.16



Dzieki za zainteresowanie i pomoc.

[netsec]

Gość portalu: Kacha napisał(a):

> Logfile of HijackThis v1.98.2
> Scan saved at 22:20:14, on 2004-09-26
> Platform: Windows XP (WinNT 5.01.2600)
> MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Jest OK. :-)
Jeśli nie zaktualizujesz systemu przynajmniej o Service Pack 1 dla XP +
wszystkie krytyczne poprawki z WindowsUpdate, to znów coś złapiesz. Najlepiej
zainstaluj SP2 dla XP.
Zainstaluj na stałe program antywirusowy np. Avast Home
Jest to bezpłatny program antywirusowy po polsku.
Wersję polską możesz ściągnąć stąd www.avast.com/eng/down_home.html
Przed instalacją zarejestruj się tu
www.avast.com/i_kat_207.php?lang=POL
Dzięki rejestracji otrzymasz mailem klucz rejestracyjny,
który umożliwi przez rok bezpłatną aktualizacje bazy wirusów

Dobrze będzie jeśli dodatkowo zainstalujesz firewall np. Outpost Firewall FREE
www.agnitum.com/download/outpost1.html

[Gość: bbb]

antyszpiega instalnij:)))

[Gość: Kacha]

Wielkie dzieki:)