proszę o pomoc i sprawdzenie loga!!!

Gość: grzechu82 IP: *.icpnet.pl 28.11.04, 20:38

Proszę o pomoc i sprawdzenie loga. Władował mi się na kompa jakiś syf i nie
wiem jak się tego pozbyć. np. jakiś INTERNET OPTIMIZER

Logfile of HijackThis v1.98.2
Scan saved at 20:37:05, on 2004-11-28
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
d:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\SYSCFG16.EXE
C:\WINDOWS\System32\explorer.exe
D:\Program Files\Spyware Doctor\spydoctor.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
D:\Gadu-Gadu\gg.exe
c:\windows\gfjh.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\rundll32.exe
d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\Web_Rebates\WebRebates1.exe
C:\Program Files\Web_Rebates\WebRebates0.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\instalki\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
www.couldnotfind.com/search_page.html?&account_id=155574
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
www.couldnotfind.com/search_page.html?&account_id=155574
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.onet.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
www.couldnotfind.com/search_page.html?&account_id=155574
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
C:\WINDOWS\about.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no
file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} -
C:\WINDOWS\nem220.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-
Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32
\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Windows System Configuration] C:\WINDOWS\SYSCFG16.EXE
O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINDOWS\SYSCFG16.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -
lang 1033
O4 - HKLM\..\Run: [Microsoft Update Machine] explorer.exe
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet
Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\RunServices: [Microsoft Update Machine] explorer.exe
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware
Doctor\spydoctor.exe" /Q
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "d:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Microsoft Update Machine] explorer.exe
O4 - HKCU\..\RunOnce: [DeleteSlotchBar] rundll32.exe
advpack.dll,DelNodeRunDLL32 "C:\Program Files\ISTbar\istbar.dll"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Web Rebates - file://C:\Program
Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient
Class) -
messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) -
www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097531807776
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) -
launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient
Class) -
messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer
Class) - www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
messenger.zone.msn.com/binary/ZIntro.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) -
messenger.zone.msn.com/binary/Chess.cab31267.cab

Obserwuj wątek

Gość: grzechu82 Re: HiJack log _ startuplist IP: *.icpnet.pl 29.11.04, 13:50

Wszystko zrobione

Mam nadzieje, że teraz już wszystko będzie w porządku. Mam jeszcze jedno
pytanie. Przy włączaniu explorera pojawia się komunikat " Obecne ustawienia
zabezpieczeń uniemożliwiają uruchomienie formantów ActiveX na tej stronie.
Strona może działać niepoprawnie" Gdzie mogę zmienić te zabezpieczenia?

Oto startuplist

StartupList report, 2004-11-29, 13:47:09
StartupList version: 1.52.2
Started from : D:\instalki\hijackthis\HijackThis.EXE
Detected: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
d:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\System32\explorer.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Gadu-Gadu\gg.exe
C:\WINDOWS\System32\wuauclt.exe
D:\instalki\hijackthis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Menu Start\Programy\Autostart]
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SiSUSBRG = C:\WINDOWS\SiSUSBrg.exe
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
NeroCheck = C:\WINDOWS\System32\NeroCheck.exe
Share-to-Web Namespace Daemon = C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
HPDJ Taskbar Utility = C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
avast! = d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
DAEMON Tools-1033 = "D:\Program Files\D-Tools\daemon.exe" -lang 1033
SunJavaUpdateSched = C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
Microsoft Update Machine = explorer.exe
Windows System Configuration = C:\WINDOWS\SYSCFG16.EXE
Windows DLL Loader = C:\WINDOWS\SYSCFG16.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

Microsoft Update Machine = explorer.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
Gadu-Gadu = "D:\Gadu-Gadu\gg.exe" /tray
Microsoft Update Machine = explorer.exe

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Enumerating Download Program Files:

[{0000000A-9980-0010-8000-00AA00389B71}]
CODEBASE = download.microsoft.com/download/8/B/E/8BE028EC-F134-4AA0-84AB-
64F76D6B9842/wmsp9dmo.cab

[Checkers Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\msgrchkr.dll
CODEBASE = messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
CODEBASE =
messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE =
v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097531807776

[GSDACtl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\gsda.dll
CODEBASE = launch.gamespyarcade.com/software/launch/alaunch.cab

[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll
CODEBASE =
messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
CODEBASE = www.pandasoftware.com/activescan/as5/asinst.cab

[ZoneIntro Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ZIntro.ocx
CODEBASE = messenger.zone.msn.com/binary/ZIntro.cab31267.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[ZoneChess Object]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\Chess.ocx
CODEBASE = messenger.zone.msn.com/binary/Chess.cab31267.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 6 566 bytes
Report generated in 0,050 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Drzewko
Od najstarszego
Od najnowszego

netsec Re: proszę o pomoc i sprawdzenie loga!!! 28.11.04, 22:03

Odinstaluj INTERNET OPTIMIZER w dodaj usuń/programy i inne syfy. Po tym wklej
nowy log z Hijack.
- Gość: grzechu82 Re: proszę o pomoc i sprawdzenie loga!!! IP: *.icpnet.pl 28.11.04, 22:17
  
  Usunąłem co się dało, ale częśc włazi ponownie, np. dress a turkey, istbar i
  nie mogę wywalić SideFind. przez dodaj/usuń programy wywaliłem ale nadal jest w
  program files i gdy chce z tamtad usunąc to pojawia się komunikat, że nie można
  usunąć pliku sfbho.dll. Odmowa dostępu
  Logfile of HijackThis v1.98.2
  Scan saved at 22:04:34, on 2004-11-28
  Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\System32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  d:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
  C:\WINDOWS\SYSCFG16.EXE
  C:\WINDOWS\System32\explorer.exe
  D:\Program Files\Spyware Doctor\spydoctor.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
  D:\Gadu-Gadu\gg.exe
  C:\WINDOWS\System32\svchost.exe
  D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
  D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
  C:\WINDOWS\system32\rundll32.exe
  d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Windows TaskAd\WinTaskAd.exe
  C:\Program Files\Windows TaskAd\WinSched.exe
  D:\Program Files\Winamp\winamp.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  D:\instalki\hijackthis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
  www.onet.pl/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  C:\WINDOWS\about.htm
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
  www.onet.pl/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
  O1 - Hosts: 69.20.16.183 auto.search.msn.com
  O1 - Hosts: 69.20.16.183 search.netscape.com
  O1 - Hosts: 69.20.16.183 ieautosearch
  O1 - Hosts: 69.20.16.183 ieautosearch
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
  C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
  O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
  Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
  O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-
  Packard\HP Share-to-Web\hpgs2wnd.exe
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32
  \spool\drivers\w32x86\3\hpztsb05.exe
  O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [Windows System Configuration] C:\WINDOWS\SYSCFG16.EXE
  O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINDOWS\SYSCFG16.EXE
  O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -
  lang 1033
  O4 - HKLM\..\Run: [Microsoft Update Machine] explorer.exe
  O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
  O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet
  Optimizer\optimize.exe"
  O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
  O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows TaskAd\WinTaskAd.exe
  O4 - HKLM\..\RunServices: [Microsoft Update Machine] explorer.exe
  O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware
  Doctor\spydoctor.exe" /Q
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
  Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe
  O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray
  O4 - HKCU\..\Run: [Skype] "d:\Program
  Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [Microsoft Update Machine] explorer.exe
  O4 - HKCU\..\RunOnce: [DeleteSlotchBar] rundll32.exe
  advpack.dll,DelNodeRunDLL32 "C:\Program Files\ISTbar\istbar.dll"
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
  Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
  res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
  C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
  00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
  messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
  messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
  O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
  public.windupdates.com/get_file.php?bt=ie&p=eddd67abc5eab3e725458d5ea46d8e54c62fa63900132220f4bf97f69b7e1ca55a7b2d6e
  9f3f36c6ca56c5b74027ffc9537d067d:951a7772ff0773eb980b2162844c01b2
  O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) -
  www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
  v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097531807776
  O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) -
  launch.gamespyarcade.com/software/launch/alaunch.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
  messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
  www.pandasoftware.com/activescan/as5/asinst.cab
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
  messenger.zone.msn.com/binary/ZIntro.cab31267.cab
  O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) -
  messenger.zone.msn.com/binary/Chess.cab31267.cab
  - netsec Re: proszę o pomoc i sprawdzenie loga!!! 29.11.04, 09:52
    
    Odinstaluj Spyware Doctor,180solutions,Wind addtools,Power Scan i inne syfy.
    
    Ściągnij nowy CWShredder 2.0
    cwshredder.net/bin/CWSInstall.exe
    Wyłącz przywracanie systemu:
    support.microsoft.com/default.aspx?scid=kb;pl;310405
    Uruchom komputer w trybie awaryjnym:
    support.microsoft.com/default.aspx?scid=KB;PL;315222
    Po uruchomieniu komputera w trybie awaryjnym, nie otwieraj Internet Explorera.
    
    Uwaga! Przy starcie do awaryjnego dostaniesz pytanie o wybór konta. NIE wybieraj
    konta Administratora tylko swoje własne imienne, bo na tym profilu jest syf. Po
    uruchomieniu komputera w trybie awaryjnym, nie otwieraj Internet Explorera.
    
    Uruchom ponownie HiJackThis wykonaj SCAN i zaznacz(haczykiem) te pozycje:
    
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    C:\WINDOWS\about.htm
    O1 - Hosts: 69.20.16.183 auto.search.msn.com
    O1 - Hosts: 69.20.16.183 search.netscape.com
    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 ieautosearch
    O4 - HKLM\..\Run: [Windows System Configuration] C:\WINDOWS\SYSCFG16.EXE
    O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINDOWS\SYSCFG16.EXE
    O4 - HKLM\..\Run: [Microsoft Update Machine] explorer.exe
    O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
    O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet
    Optimizer\optimize.exe"
    O4 - HKLM\..\Run: [Power Scan] C:\Program Files\ Power Scan\powerscan.exe
    O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows TaskAd\WinTaskAd.exe
    O4 - HKLM\..\RunServices: [Microsoft Update Machine] explorer.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware
    Doctor\spydoctor.exe" /Q
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
    Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Microsoft Update Machine] explorer.exe
    O4 - HKCU\..\RunOnce: [DeleteSlotchBar] rundll32.exe
    advpack.dll,DelNodeRunDLL32 "C:\Program Files\ISTbar\istbar.dll"
    O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
    public.windupdates.com/get_file.php?bt=ie&p=eddd67abc5eab3e725458d5ea46d8e54c62fa63900132220f4bf97f69b7e1ca55a7b2d6e
    9f3f36c6ca56c5b74027ffc9537d067d:951a7772ff0773eb980b2162844c01b2
    O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) -
    www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
    
    Po zaznaczeniu wykonaj FIX CHECKED i potwierdź TAK/OK.
    
    W Panel Sterowania => Opcje Internetowe usuń
    Tymczasowe pliki Internetowe (Wszystkie) i Cooki.
    
    Odinstaluj w Panelu sterowania Dodaj/Usuń programy wszystkie
    programy, co do których nie masz pewności, że Ci są potrzebne.
    Szczególnie zwróć uwagę na programy z Search w nazwie.
    
    Uruchom CWShredder i wykonaj Fix.
    
    Upewnij się, że opcja Pokaż wszystkie pliki w Eksploratorze Windows jest
    włączona.
    
    a. Kliknij przycisk Start, kliknij polecenie Mój komputer, kliknij menu
    Narzędzia, a następnie kliknij polecenie Opcje folderów. Kliknij kartę
    Widok.
    
    b. W sekcji Ustawienia zaawansowane kliknij pozycję Pokaż ukryte pliki i
    foldery.
    
    c. W sekcji Ustawienia zaawansowane kliknij, aby wyczyścić pole wyboru
    Ukryj chronione pliki systemu operacyjnego (zalecane).
    
    Otwórz Mój Komputer wpisz w pasku adresu %TEMP%.
    Przejdziesz do folderu TEMP. Skasuj w nim wszystkie pliki, które uda się
    skasować.
    
    Uruchom komputer w normalnym trybie.
    
    Ściągnij i zainstaluj Ad-Aware SE Personal Edition v1.05
    Pobieranie najnowszej wersji:
    www.download.com/3000-2144-10045910.html
    Przeskanuj Ad-Aware cały system.
    W celu zapewnienia maksymalnej skuteczności, należy
    przed skanowaniem wykonać aktualizacje bazy wykrywania.
    W trakcie uruchamiania skanowania, należy w zakładce
    "Preparing System Scan" wybrać "Perform full system scan".
    Po zakończeniu skanowania pojawi się lista obiektów do
    usunięcia. Każdą z pozycji należy zaznaczyć(haczykiem) lub prawym klawiszem
    myszki można wybrać z menu kontekstowego zaznaczyć wszystkie (Select All
    Objects).Po zaznaczeniu wszystkich pozycji należy kliknąć Next,
    w ten sposób zaznaczone obiekty zostaną usunięte.
    Po zakończeniu uruchom komputer ponownie.
    
    Dodatkowo zainstaluj Jave Sun:
    java.sun.com/webapps/download/AutoDL?BundleId=9723
    Zainstaluj wszystkie krytyczne poprawki z www.windowsupdate.com
    Tu masz info jak to wykonać:
    www.microsoft.com/poland/security/protect/windowsxp/updates.aspx
    Po tym wklej nowy log z startuplist.
    W tym celu uruchom ponownie HiJackThis przejdź do
    Config później do Misc Tools i kliknij Generate StartupList log.
    Program zapyta czy wygenerować listę, potwierdź a zawartość listy wklej na forum.
    
    Dla porównania w oddzielnym poście wklej również nowy log z HiJackThis.
    - Gość: Grzechu82 Re: proszę o pomoc i sprawdzenie loga!!! IP: *.icpnet.pl 29.11.04, 11:00
      
      Zrobiłem według twojej instrukcji.
      Tutaj jest log z startuplist
      
      StartupList report, 2004-11-29, 10:59:25
      StartupList version: 1.52.2
      Started from : D:\instalki\hijackthis\HijackThis.EXE
      Detected: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
      Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
      * Using default options
      ==================================================
      
      Running processes:
      
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\System32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\WINDOWS\system32\rundll32.exe
      d:\Program Files\Alwil Software\Avast4\ashServ.exe
      D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
      D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\WINDOWS\SYSCFG16.EXE
      C:\WINDOWS\System32\explorer.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      D:\Gadu-Gadu\gg.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\WINDOWS\System32\msiexec.exe
      D:\instalki\hijackthis\HijackThis.exe
      
      --------------------------------------------------
      
      Listing of startup folders:
      
      Shell folders Common Startup:
      [C:\Documents and Settings\All Users\Menu Start\Programy\Autostart]
      Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      
      --------------------------------------------------
      
      Checking Windows NT UserInit:
      
      [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
      UserInit = C:\WINDOWS\system32\userinit.exe,
      
      --------------------------------------------------
      
      Autorun entries from Registry:
      HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      
      SiSUSBRG = C:\WINDOWS\SiSUSBrg.exe
      Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd
      ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      NeroCheck = C:\WINDOWS\System32\NeroCheck.exe
      Share-to-Web Namespace Daemon = C:\Program Files\Hewlett-Packard\HP Share-to-
      Web\hpgs2wnd.exe
      HPDJ Taskbar Utility = C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
      avast! = d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      DAEMON Tools-1033 = "D:\Program Files\D-Tools\daemon.exe" -lang 1033
      SunJavaUpdateSched = C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      Microsoft Update Machine = explorer.exe
      Windows System Configuration = C:\WINDOWS\SYSCFG16.EXE
      
      --------------------------------------------------
      
      Autorun entries from Registry:
      HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
      
      Microsoft Update Machine = explorer.exe
      
      --------------------------------------------------
      
      Autorun entries from Registry:
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run
      
      MsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      Gadu-Gadu = "D:\Gadu-Gadu\gg.exe" /tray
      Microsoft Update Machine = explorer.exe
      
      --------------------------------------------------
      
      Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
      
      Shell=*INI section not found*
      SCRNSAVE.EXE=*INI section not found*
      drivers=*INI section not found*
      
      Shell & screensaver key from Registry:
      
      Shell=Explorer.exe
      SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
      drivers=*Registry value not found*
      
      Policies Shell key:
      
      HKCU\..\Policies: Shell=*Registry key not found*
      HKLM\..\Policies: Shell=*Registry value not found*
      
      --------------------------------------------------
      
      Enumerating Download Program Files:
      
      [{0000000A-9980-0010-8000-00AA00389B71}]
      CODEBASE = download.microsoft.com/download/8/B/E/8BE028EC-F134-4AA0-84AB-
      64F76D6B9842/wmsp9dmo.cab
      
      [Checkers Class]
      InProcServer32 = C:\WINDOWS\Downloaded Program Files\msgrchkr.dll
      CODEBASE = messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      
      [MessengerStatsClient Class]
      InProcServer32 = C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
      CODEBASE =
      messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      [WUWebControl Class]
      InProcServer32 = C:\WINDOWS\System32\wuweb.dll
      CODEBASE =
      v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097531807776
      
      [GSDACtl Class]
      InProcServer32 = C:\WINDOWS\Downloaded Program Files\gsda.dll
      CODEBASE = launch.gamespyarcade.com/software/launch/alaunch.cab
      
      [MessengerStatsClient Class]
      InProcServer32 = C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll
      CODEBASE =
      messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
      [ActiveScan Installer Class]
      InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
      CODEBASE = www.pandasoftware.com/activescan/as5/asinst.cab
      
      [ZoneIntro Class]
      InProcServer32 = C:\WINDOWS\Downloaded Program Files\ZIntro.ocx
      CODEBASE = messenger.zone.msn.com/binary/ZIntro.cab31267.cab
      
      [Shockwave Flash Object]
      InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
      CODEBASE = download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
      
      [ZoneChess Object]
      InProcServer32 = C:\WINDOWS\Downloaded Program Files\Chess.ocx
      CODEBASE = messenger.zone.msn.com/binary/Chess.cab31267.cab
      
      --------------------------------------------------
      
      Enumerating ShellServiceObjectDelayLoad items:
      
      PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
      CDBurn: C:\WINDOWS\system32\SHELL32.dll
      WebCheck: C:\WINDOWS\System32\webcheck.dll
      SysTray: C:\WINDOWS\System32\stobject.dll
      
      --------------------------------------------------
      End of report, 6 526 bytes
      Report generated in 0,020 seconds
      
      Command line options:
      /verbose - to add additional info on each section
      /complete - to include empty sections and unsuspicious data
      /full - to include several rarely-important sections
      /force9x - to include Win9x-only startups even if running on WinNT
      /forcent - to include WinNT-only startups even if running on Win9x
      /forceall - to include all Win9x and WinNT startups, regardless of platform
      /history - to list version history only
    - Gość: grzechu82 Re: proszę o pomoc i sprawdzenie loga!!! IP: *.icpnet.pl 29.11.04, 11:01
      
      tutaj log z HiJack This
      
      Logfile of HijackThis v1.98.2
      Scan saved at 10:59:12, on 2004-11-29
      Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
      
      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\System32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\WINDOWS\system32\rundll32.exe
      d:\Program Files\Alwil Software\Avast4\ashServ.exe
      D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
      D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\WINDOWS\SYSCFG16.EXE
      C:\WINDOWS\System32\explorer.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      D:\Gadu-Gadu\gg.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\WINDOWS\System32\msiexec.exe
      D:\instalki\hijackthis\HijackThis.exe
      
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
      www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
      www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,CustomizeSearch =
      ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
      www.onet.pl/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
      www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
      www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
      www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
      www.onet.pl/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
      C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
      O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
      O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
      Panel\atiptaxx.exe
      O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
      O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-
      Packard\HP Share-to-Web\hpgs2wnd.exe
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32
      \spool\drivers\w32x86\3\hpztsb05.exe
      O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -
      lang 1033
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05
      \bin\jusched.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
      Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
      Office\Office10\OSA.EXE
      O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
      res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no
      file)
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
      00401C608501} - (no file)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
      C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
      00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
      messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
      messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
      v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097531807776
      O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) -
      launch.gamespyarcade.com/software/launch/alaunch.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
      messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
      www.pandasoftware.com/activescan/as5/asinst.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
      messenger.zone.msn.com/binary/ZIntro.cab31267.cab
      O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) -
      messenger.zone.msn.com/binary/Chess.cab31267.cab
      - netsec Re: HiJack log _ startuplist 29.11.04, 12:31
        
        Usuń w HiJack te śmieci:
        
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no
        file)
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
        00401C608501} - (no file)
        
        Następnie w trybie awaryjnym znajdź i usuń plik explorer.exe
        
        Uwaga!!!! Identyczną zazwę ma plik systemowy znajduje się w:
        C:\WINDOWS i C:\WINDOWS\ServicePackFiles\i386.
        Pliki o tej nazwie w innych folderach to śmieci.
        Jeśli nie jesteś pewny czy właściwy plik usuwasz, to mien mu nazwę na np.
        explorer.old
        Znajdź i usuń plik SYSCFG16.EXE
        
        Przed tymi operacjami upewnij się czy w Opcje folderów masz włączone pokazywanie
        ukrytych plików i folderów.
        
        Po tym uruchom normalnie komputer i wklej startuplist.
        
        Gość: grzechu82 Re: HiJack log _ startuplist IP: *.icpnet.pl 29.11.04, 13:50
        
        Wszystko zrobione
        
        Mam nadzieje, że teraz już wszystko będzie w porządku. Mam jeszcze jedno
        pytanie. Przy włączaniu explorera pojawia się komunikat " Obecne ustawienia
        zabezpieczeń uniemożliwiają uruchomienie formantów ActiveX na tej stronie.
        Strona może działać niepoprawnie" Gdzie mogę zmienić te zabezpieczenia?
        
        Oto startuplist
        
        StartupList report, 2004-11-29, 13:47:09
        StartupList version: 1.52.2
        Started from : D:\instalki\hijackthis\HijackThis.EXE
        Detected: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
        Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
        * Using default options
        ==================================================
        
        Running processes:
        
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\System32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\WINDOWS\system32\spoolsv.exe
        d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        d:\Program Files\Alwil Software\Avast4\ashServ.exe
        D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
        C:\WINDOWS\System32\svchost.exe
        D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
        D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
        C:\WINDOWS\System32\explorer.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        D:\Gadu-Gadu\gg.exe
        C:\WINDOWS\System32\wuauclt.exe
        D:\instalki\hijackthis\HijackThis.exe
        
        --------------------------------------------------
        
        Listing of startup folders:
        
        Shell folders Common Startup:
        [C:\Documents and Settings\All Users\Menu Start\Programy\Autostart]
        Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
        
        --------------------------------------------------
        
        Checking Windows NT UserInit:
        
        [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
        UserInit = C:\WINDOWS\system32\userinit.exe,
        
        --------------------------------------------------
        
        Autorun entries from Registry:
        HKLM\Software\Microsoft\Windows\CurrentVersion\Run
        
        SiSUSBRG = C:\WINDOWS\SiSUSBrg.exe
        Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd
        ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        NeroCheck = C:\WINDOWS\System32\NeroCheck.exe
        Share-to-Web Namespace Daemon = C:\Program Files\Hewlett-Packard\HP Share-to-
        Web\hpgs2wnd.exe
        HPDJ Taskbar Utility = C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
        avast! = d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        DAEMON Tools-1033 = "D:\Program Files\D-Tools\daemon.exe" -lang 1033
        SunJavaUpdateSched = C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
        Microsoft Update Machine = explorer.exe
        Windows System Configuration = C:\WINDOWS\SYSCFG16.EXE
        Windows DLL Loader = C:\WINDOWS\SYSCFG16.EXE
        
        --------------------------------------------------
        
        Autorun entries from Registry:
        HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
        
        Microsoft Update Machine = explorer.exe
        
        --------------------------------------------------
        
        Autorun entries from Registry:
        HKCU\Software\Microsoft\Windows\CurrentVersion\Run
        
        MsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
        Gadu-Gadu = "D:\Gadu-Gadu\gg.exe" /tray
        Microsoft Update Machine = explorer.exe
        
        --------------------------------------------------
        
        Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
        
        Shell=*INI section not found*
        SCRNSAVE.EXE=*INI section not found*
        drivers=*INI section not found*
        
        Shell & screensaver key from Registry:
        
        Shell=Explorer.exe
        SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
        drivers=*Registry value not found*
        
        Policies Shell key:
        
        HKCU\..\Policies: Shell=*Registry key not found*
        HKLM\..\Policies: Shell=*Registry value not found*
        
        --------------------------------------------------
        
        Enumerating Download Program Files:
        
        [{0000000A-9980-0010-8000-00AA00389B71}]
        CODEBASE = download.microsoft.com/download/8/B/E/8BE028EC-F134-4AA0-84AB-
        64F76D6B9842/wmsp9dmo.cab
        
        [Checkers Class]
        InProcServer32 = C:\WINDOWS\Downloaded Program Files\msgrchkr.dll
        CODEBASE = messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
        
        [MessengerStatsClient Class]
        InProcServer32 = C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
        CODEBASE =
        messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
        [WUWebControl Class]
        InProcServer32 = C:\WINDOWS\System32\wuweb.dll
        CODEBASE =
        v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097531807776
        
        [GSDACtl Class]
        InProcServer32 = C:\WINDOWS\Downloaded Program Files\gsda.dll
        CODEBASE = launch.gamespyarcade.com/software/launch/alaunch.cab
        
        [MessengerStatsClient Class]
        InProcServer32 = C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll
        CODEBASE =
        messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        [ActiveScan Installer Class]
        InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
        CODEBASE = www.pandasoftware.com/activescan/as5/asinst.cab
        
        [ZoneIntro Class]
        InProcServer32 = C:\WINDOWS\Downloaded Program Files\ZIntro.ocx
        CODEBASE = messenger.zone.msn.com/binary/ZIntro.cab31267.cab
        
        [Shockwave Flash Object]
        InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
        CODEBASE = download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
        
        [ZoneChess Object]
        InProcServer32 = C:\WINDOWS\Downloaded Program Files\Chess.ocx
        CODEBASE = messenger.zone.msn.com/binary/Chess.cab31267.cab
        
        --------------------------------------------------
        
        Enumerating ShellServiceObjectDelayLoad items:
        
        PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
        CDBurn: C:\WINDOWS\system32\SHELL32.dll
        WebCheck: C:\WINDOWS\System32\webcheck.dll
        SysTray: C:\WINDOWS\System32\stobject.dll
        
        --------------------------------------------------
        End of report, 6 566 bytes
        Report generated in 0,050 seconds
        
        Command line options:
        /verbose - to add additional info on each section
        /complete - to include empty sections and unsuspicious data
        /full - to include several rarely-important sections
        /force9x - to include Win9x-only startups even if running on WinNT
        /forcent - to include WinNT-only startups even if running on Win9x
        /forceall - to include all Win9x and WinNT startups, regardless of platform
        /history - to list version history only
        
        Gość: grzechu82 Re: HiJack log _ startuplist IP: *.icpnet.pl 29.11.04, 15:30
        
        usunąłem cały syf, ale ponownie się władował: Inetrnet Optimize, ISTbat, ISTsvc,
        PoweScan, SideFind, InterMute.
        Już nie wiem jak się tego pozbyć. Proszę o radę
        
        Gość: grzechu82 Re: HiJack log _ startuplist IP: *.icpnet.pl 29.11.04, 15:43
        
        władowało się wszystko ponownie, m.in. pliki syscfg16.exe i explorer.exe.
        dodatkowo na pulpit ładują mi się jakieś skróty Free Casino, Online Auctions i
        Online Dating.
        Można się tego jakoś ostatecznie pozbyć?
        
        netsec Re: HiJack log _ startuplist 29.11.04, 16:04
        
        Dobra, wklej raz jeszcze aktualny log z HiJack.
        Przed tym odinstaluj śmieci w dodaj/usuń.
        
        Gość: grzechu82 Re: HiJack log _ startuplist IP: *.icpnet.pl 29.11.04, 16:19
        
        aktualny log
        
        Logfile of HijackThis v1.98.2
        Scan saved at 16:18:52, on 2004-11-29
        Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
        
        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\System32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        d:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\system32\rundll32.exe
        D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
        D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
        C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        D:\Gadu-Gadu\gg.exe
        D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
        D:\Program Files\Spyware Doctor\spydoctor.exe
        C:\WINDOWS\System32\explorer.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        c:\windows\gfjh.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        D:\instalki\hijackthis\HijackThis.exe
        
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.onet.pl/
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
        www.onet.pl/
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
        O1 - Hosts: 69.20.16.183 auto.search.msn.com
        O1 - Hosts: 69.20.16.183 search.netscape.com
        O1 - Hosts: 69.20.16.183 ieautosearch
        O1 - Hosts: 69.20.16.183 ieautosearch
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
        C:\WINDOWS\System32\msdxm.ocx
        O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
        O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
        O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
        Panel\atiptaxx.exe
        O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
        O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-
        Packard\HP Share-to-Web\hpgs2wnd.exe
        O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32
        \spool\drivers\w32x86\3\hpztsb05.exe
        O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -
        lang 1033
        O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05
        \bin\jusched.exe
        O4 - HKLM\..\Run: [Microsoft Update Machine] explorer.exe
        O4 - HKLM\..\RunServices: [Microsoft Update Machine] explorer.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
        Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray
        O4 - HKCU\..\Run: [Microsoft Update Machine] explorer.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
        Office\Office10\OSA.EXE
        O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
        res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
        C:\Program Files\Messenger\MSMSGS.EXE
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
        00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
        messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
        O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
        messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
        v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097531807776
        O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) -
        launch.gamespyarcade.com/software/launch/alaunch.cab
        O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (SL Control) -
        static.topconverting.com/activex/sl.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
        messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
        www.pandasoftware.com/activescan/as5/asinst.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
        messenger.zone.msn.com/binary/ZIntro.cab31267.cab
        O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) -
        messenger.zone.msn.com/binary/Chess.cab31267.cab
        
        netsec Re: HiJack log _ startuplist2 30.11.04, 10:24
        
        Wyłącz przywracanie systemu:
        Uruchom komputer w trybie awaryjnym:
        Po uruchomieniu komputera w trybie awaryjnym, nie otwieraj Internet Explorera.
        
        Uwaga! Przy starcie do awaryjnego dostaniesz pytanie o wybór konta. NIE wybieraj
        konta Administratora tylko swoje własne imienne, bo na tym profilu jest syf. Po
        uruchomieniu komputera w trybie awaryjnym, nie otwieraj Internet Explorera.
        
        Uruchom ponownie HiJackThis wykonaj SCAN i zaznacz(haczykiem) te pozycje:
        
        O1 - Hosts: 69.20.16.183 auto.search.msn.com
        O1 - Hosts: 69.20.16.183 search.netscape.com
        O1 - Hosts: 69.20.16.183 ieautosearch
        O1 - Hosts: 69.20.16.183 ieautosearch
        O4 - HKLM\..\Run: [Microsoft Update Machine] explorer.exe
        O4 - HKLM\..\RunServices: [Microsoft Update Machine] explorer.exe
        O4 - HKCU\..\Run: [Microsoft Update Machine] explorer.exe
        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
        messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
        O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
        messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
        O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) -
        launch.gamespyarcade.com/software/launch/alaunch.cab
        O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (SL Control) -
        static.topconverting.com/activex/sl.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
        messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
        messenger.zone.msn.com/binary/ZIntro.cab31267.cab
        O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) -
        messenger.zone.msn.com/binary/Chess.cab31267.cab
        
        Po zaznaczeniu wykonaj FIX CHECKED i potwierdź TAK/OK.
        
        W Panel Sterowania => Opcje Internetowe usuń
        Tymczasowe pliki Internetowe (Wszystkie) i Cooki.
        
        Ponownie odinstaluj w Panelu sterowania Dodaj/Usuń programy wszystkie
        programy, co do których nie masz pewności, że Ci są potrzebne.
        
        Uruchom CWShredder i wykonaj Fix.
        
        Upewnij się, że opcja Pokaż wszystkie pliki w Eksploratorze Windows jest
        włączona.
        
        Odszukaj wszystkie pliki o nazwie explorer.exe i we właściwościach pliku sprawdź
        w zakładce Wersja, które z nich są oryginalnymi plikami Microsoft.
        Śmieci usuń.
        
        Otwórz Mój Komputer wpisz w pasku adresu %TEMP%.
        Przejdziesz do folderu TEMP. Skasuj w nim wszystkie pliki, które uda się
        skasować.
        
        Wyloguj się z Twojego konta imiennego i przeloguj się (będąc dalej w trybie
        awaryjnym) na konto Administrator. Sprawdź wpisy w HiJack, i wykonaj czynności
        identyczne jak na Twoim imiennym koncie.
        
        Po tym uruchom komputer w normalny sposób.
        
        Zainstaluj alternatywną przeglądarkę www, Firefox www.firefox.pl
        Jest bezpieczniejsza od Internet Explorer’a nawet od wersji z SP2 i mniej
        obciąża system.
        
        Po wszystkim włącz przywracanie systemu i zaktualizuj system o wszystkie
        krytyczne poprawki. Najlepiej będzie jeśli zaktualizujesz system o Serwis Pack 2
        + dodatkowo zainstalujesz firewall.
        Tutaj masz więcej na ten temat:
        www.microsoft.com/poland/security/protect/windowsxp/choose.aspx
        Proponuje używać darmowy SpywareBlaster v3.2:
        www.javacoolsoftware.com/spywareblaster.html
        Po wszystkim wklej nowy HiJack log.
        
        Gość: grzechu82 Re: HiJack log _ startuplist2 IP: *.icpnet.pl 30.11.04, 11:47
        
        Wczoraj walczyłem z tym syfem cały dzień, bezskutecznie - kilkakrotnie wszystko
        się odnawiało. Aż tu dzisiaj rano włączam komputer i HiJacka i były tylko Hosty,
        reszta zniknęła.
        Wykonałem Twoje instrukcje i usunąłem syf. Mam nadzieję, że już teraz będzie
        wszystko OK, jednak zaczekam jeszcze troche ze świętowaniem, czy aby na pewno
        syf nie pojawi się napewno. Serdecznie dziękuje za pomoc.
        Oto najnowszy log:
        
        Logfile of HijackThis v1.98.2
        Scan saved at 11:47:20, on 2004-11-30
        Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
        
        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\System32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\WINDOWS\system32\spoolsv.exe
        d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        d:\Program Files\Alwil Software\Avast4\ashServ.exe
        D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
        d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
        D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
        C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        D:\Gadu-Gadu\gg.exe
        C:\WINDOWS\System32\wuauclt.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\WINDOWS\system32\NOTEPAD.EXE
        D:\instalki\hijackthis\HijackThis.exe
        
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
        C:\WINDOWS\System32\msdxm.ocx
        O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
        O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
        O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
        Panel\atiptaxx.exe
        O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
        O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program
        Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
        O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
        C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
        O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe"
        -lang 1033
        O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
        Files\Java\j2re1.4.2_05\bin\jusched.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
        Office\Office10\OSA.EXE
        O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
        res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
        C:\Program Files\Messenger\MSMSGS.EXE
        O9 - Extra 'Tools' menuitem: Windows Messenger -
        {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
        v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097531807776
        O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) -
        launch.gamespyarcade.com/software/launch/alaunch.cab
        O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
        www.pandasoftware.com/activescan/as5/asinst.cab
        
        netsec Re: HiJack log _ startuplist2 30.11.04, 14:19
        
        Oczyść dysk: support.microsoft.com/kb/310312/PL/
        i aktualizacje zainstaluj :)

Najnowsze z forum Wirusy, trojany, spyware

Zaloguj się