PomocY!!

IP: *.it-net.pl 20.12.04, 16:16
Logfile of HijackThis v1.99.0
Scan saved at 16:14:53, on 2004-12-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\DOCUME~1\Wioletta\USTAWI~1\Temp\Katalog tymczasowy 3 dla
hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
www.websearch.com/ie.aspx?tb_id=50193
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =
www.websearch.com/ie.aspx?tb_id=50193
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch =
res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
www.websearch.com/ie.aspx?tb_id=50193
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} -
C:\PROGRA~1\Toolbar\toolbar.dll (file missing)
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} -
C:\WINDOWS\localNRD.dll (file missing)
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} -
C:\WINDOWS\2_0_1browserhelper2.dll (file missing)
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1
\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1
\Toolbar\toolbar.dll (file missing)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} -
C:\PROGRA~1\FLASHGET\jccatch.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} -
C:\WINDOWS\system32\msbe.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} -
C:\PROGRA~1\FLASHGET\fgiebar.dll (file missing)
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} -
C:\PROGRA~1\Toolbar\toolbar.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [gbluiankfo] C:\WINDOWS\System32\kjhiki.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe
O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows
AdControl\WinAdCtl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda
Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus
Platinum\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [yrojgnkv] C:\WINDOWS\yrojgnkv.exe
O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows
TaskAd\WinTaskAd.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [eDonkey2000] C:\Program Files\eDonkey2000\eDonkey2000.exe -
t
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [saap] c:\progra~1\2findm~1\partner\saap.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye
Network\bin\bargains.exe
O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
O4 - HKLM\..\Run: [yvovsxir] C:\WINDOWS\yvovsxir.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec
Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1
\WinTools\WToolsA.exe /boot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1
\FLASHGET\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1
\FLASHGET\jc_link.htm
O8 - Extra context menu item: Web Rebates - file://C:\Program
Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -
C:\PROGRA~1\FLASHGET\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-
0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
public.windupdates.com/get_file.php?bt=ie&p=f32ea71f93289f61b4dbf30a04a6a1144dbe14cda02fcaaa9fafbced2952791a768a1a
41688817425fa5c9751a6be7b24046:f22d67e45739a8712f7edadac81f3fd5
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) -
www.errorguard.com/installation/Install.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer
Class) - www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1
\Toolbar\toolbar.dll (file missing)
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Panda anti-virus service - Unknown - C:\Program Files\Panda
Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton
AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1
\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing) I co mam
dalej zrobić.Prosze niech ktos napisze krok po kroku.Komputer prawie nie
odpowiada:/


    • Gość: piecyk gazowy Re: PomocY!! IP: *.tpnet.pl / *.tpnet.pl 20.12.04, 20:46
      Wykonaj skan, zaznacz poniższe pozycje i wciśnij Fix Checked. Potem jeszcze raz
      wygeneruj loga i wklej.

      > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
      > www.websearch.com/ie.aspx?tb_id=50193

      > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =
      > www.websearch.com/ie.aspx?tb_id=50193
      > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch =
      > res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
      > R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      > www.websearch.com/ie.aspx?tb_id=50193
      > R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      > res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
      > R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      > R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} -
      > C:\PROGRA~1\Toolbar\toolbar.dll (file missing)
      > O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} -
      > C:\WINDOWS\localNRD.dll (file missing)
      > O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} -
      > C:\WINDOWS\2_0_1browserhelper2.dll (file missing)
      > O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1
      > \COMMON~1\WinTools\WToolsB.dll
      > O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1
      > \Toolbar\toolbar.dll (file missing)

      > O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} -
      > C:\WINDOWS\system32\msbe.dll

      > O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} -
      > C:\PROGRA~1\Toolbar\toolbar.dll (file missing)

      > O4 - HKLM\..\Run: [gbluiankfo] C:\WINDOWS\System32\kjhiki.exe
      > O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
      > O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe
      > O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows
      > AdControl\WinAdCtl.exe
      > O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
      > atboottime

      > O4 - HKLM\..\Run: [yrojgnkv] C:\WINDOWS\yrojgnkv.exe
      > O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows
      > TaskAd\WinTaskAd.exe
      > O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
      > O4 - HKLM\..\Run: [eDonkey2000] C:\Program Files\eDonkey2000\eDonkey2000.exe -
      > t
      > O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
      > O4 - HKLM\..\Run: [saap] c:\progra~1\2findm~1\partner\saap.exe
      > O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye
      > Network\bin\bargains.exe
      > O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
      > O4 - HKLM\..\Run: [yvovsxir] C:\WINDOWS\yvovsxir.exe

      > O4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1
      > \WinTools\WToolsA.exe /boot

      > O8 - Extra context menu item: Web Rebates - file://C:\Program
      > Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm

      > O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
      > public.windupdates.com/get_file.php?
      bt=ie&p=f32ea71f93289f61b4dbf30a04a6a1144dbe14cda02fcaaa9fafbced2952791a768a1a
      > 41688817425fa5c9751a6be7b24046:f22d67e45739a8712f7edadac81f3fd5
      > O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) -
      > www.errorguard.com/installation/Install.cab

      > O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1
      > \Toolbar\toolbar.dll (file missing)

      > O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)

      Masz Nortona i Pandę? KONIECZNIE odinstaluj jeden program.
    • Gość: zuzka16 Re: PomocY!! IP: *.it-net.pl 20.12.04, 21:27
      Dzięki za pomoć komp dziala :) A to nowy log:Logfile of HijackThis v1.99.0
      Scan saved at 21:27:11, on 2004-12-20
      Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\SYSTEM32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Gadu-Gadu\gg.exe
      C:\Program Files\Norton AntiVirus\SAVScan.exe
      C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\DOCUME~1\Wioletta\USTAWI~1\Temp\Katalog tymczasowy 8 dla
      hijackthis.zip\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
      www.google.pl/
      O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1
      \FLASHGET\jccatch.dll (file missing)
      O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
      Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} -
      C:\PROGRA~1\FLASHGET\fgiebar.dll (file missing)
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
      C:\Program Files\Norton AntiVirus\NavShExt.dll
      O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
      Shared\ccApp.exe"
      O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec
      Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
      O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1
      \FLASHGET\jc_all.htm
      O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1
      \FLASHGET\jc_link.htm
      O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -
      C:\PROGRA~1\FLASHGET\flashget.exe (file missing)
      O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-
      0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe (file missing)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
      C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
      00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
      www.pandasoftware.com/activescan/as5/asinst.cab
      O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
      skaner.mks.com.pl/SkanerOnline.cab
      O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program
      Files\Common Files\Symantec Shared\ccEvtMgr.exe
      O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program
      Files\Common Files\Symantec Shared\ccPwdSvc.exe
      O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program
      Files\Common Files\Symantec Shared\ccSetMgr.exe
      O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton
      AntiVirus\SAVScan.exe
      O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1
      \COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
      O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
      Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

      • Gość: piecyk gazowy Re: PomocY!! IP: *.tpnet.pl / *.tpnet.pl 20.12.04, 21:51
        Czysto. Jeśli nie używasz FlashGeta (a mam wrażenie, że nie), to usuń wszystkie
        pozycje z nim związane, bo są zbędne.

        To chyba wszystko. Pozdrawiam.
Pełna wersja