Dodaj do ulubionych

mogę prosić o sprwdzenie

IP: *.lama.net.pl 28.01.05, 21:42
Logfile of HijackThis v1.99.0
Scan saved at 21:43:50, on 2005-01-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.ex e
C:\WINDOWS\system32\services.ex e
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\av gamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\av gupsvc.exe
C:\WINDOWS\System32\CTsvcCDA.ex e
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.ex e
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\CTHELPER.EX E
C:\PROGRA~1\Grisoft\AVGFRE~1\av gcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\av gemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\ mwsoemon.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 7.0\Monitor.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Internet Explorer\iexplore.exe
D:\programy\commander\TOTALCMD. EXE
C:\DOCUME~1\kp\USTAWI~1\Temp\_t c\HIJACK~1.EXE

R1 - HKCU\Software\Microsoft\Interne t Explorer,SearchURL = super-
spider.com/sp.htm?id=191
R1 - HKCU\Software\Microsoft\Interne t Explorer\Main,Search Bar = super-
spider.com/sp.htm?id=191
R0 - HKCU\Software\Microsoft\Interne t Explorer\Main,Start Page =
www.o2.pl/
R0 - HKLM\Software\Microsoft\Interne t Explorer\Main,Start Page =
info.local.pl
R1 - HKCU\Software\Microsoft\Interne t Explorer\Search,SearchAssistant =
super-spider.com/sp.htm?id=191
R1 - HKCU\Software\Microsoft\Interne t Explorer\Main,Start Page_bak =
info.local.pl/
R0 - HKLM\Software\Microsoft\Interne t Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Interne t Explorer\Toolbar,LinksFolderNam e = Łącza
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04 FD64497} - (no
file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F5 69A31D} -
C:\Program Files\MyWebSearch\SrchAstt\1.bi n\MWSSRCAS.DLL
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: MultimppObj Class - {002EB272-2590-4693-B166-FBD5D9 B6FEA6} - (no
file)
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-
5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bi n\MWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D 6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper .ocx
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4 475CCA} - C:\Program
Files\MyWebSearch\bar\1.bin\MWS BAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF1057 7473F7} -
c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027 A5CD4F} -
C:\WINDOWS\Downloaded Program Files\googlenav.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.e xe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32
\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32
\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program
Files\Creative\SBLive\PROGRAM\A DGJDet.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\av gcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\av gemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1
\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Program Files\Ulead
Systems\Ulead Photo Explorer 7.0\Monitor.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1
\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program
Files\MyWebSearch\bar\1.bin\MWS OEMON.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft
Office\Office\FINDFAST.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program
Files\MyWebSearch\bar\1.bin\MWS OEMON.EXE
O4 - Global Startup: Uruchamianie pakietu Office.lnk = C:\Program
Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded
Program Files\googlenav.dll/cmsearch.ht ml
O8 - Extra context menu item: &Search -
bar.mywebsearch.com/menusearch.html?p=ZNxmk04486PL
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded
Program Files\googlenav.dll/cmbacklinks .html
O8 - Extra context menu item: Cac&hed Snapshot of Page -
res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.htm l
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded
Program Files\googlenav.dll/cmsimilar.h tml
O8 - Extra context menu item: Translate into English - res://C:\Program
Files\Google\GoogleToolbar1.dll /cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F 795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.greg-search.com
O16 - DPF: ING Bank Online -
ssl.bsk.com.pl/bskonl/component/INGOnl.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8 E6BAD6} -
public.windupdates.com/get_file.php?bt=ie&p=638c04efabf4090ab4c5fc024154ef69cf9247c4e1075281a08feba11106d93954c17e
e672280f19f68d33f6d9199b6b680eb c2a50847f30f0b8bb2a24ea33ea35f4 :f992a2588cd0115
0ad693e854e5c9a60
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E4168 4E07BB} -
ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.8.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC 6651A8} (Cult3D ActiveX Player) -
www.cult3d.com/download/cult.cab
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B7 06892F} (Installer Class) -
www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086 395495} (Google Activate) -
toolbar.google.pl/data/pl/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A 75F53B} (GSDACtl Class) -
launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0 FCC122} (AcDcToday Control) -
file://D:\programy\autocad\AcDcToday.ocx
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD1 22C339} -
w
Obserwuj wątek
    • Gość: Kolobos Re: mogę prosić o sprwdzenie IP: *.warszawa.sdi.tpnet.pl 28.01.05, 22:16
      Usun sam/sama:
      www.hijackthis.de/logfiles/e9a12630f9123b092adc1bd626ec04f9.html
      Co do tych z zoltymi znaczkami to zoabcz co to jest jak wiesz co to to zostaw,
      jak nie to poszukaj czegos o tym na google i ewentualnie tez usun :-)
    • Gość: piecyk gazowy Re: mogę prosić o sprwdzenie IP: *.tpnet.pl / *.tpnet.pl 28.01.05, 22:20
      Nie wszedł cały log. Odinstaluj w Panelu sterowania MyWebSearch czy jakoś tak...

      Do wyrzucenia:

      R1 - HKCU\Software\Microsoft\Interne t Explorer,SearchURL = super-
      spider.com/sp.htm?id=191
      R1 - HKCU\Software\Microsoft\Interne t Explorer\Main,Search Bar = super-
      spider.com/sp.htm?id=191

      R1 - HKCU\Software\Microsoft\Interne t Explorer\Search,SearchAssistant =
      super-spider.com/sp.htm?id=191

      R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04 FD64497} - (no
      file)
      R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F5 69A31D} -
      C:\Program Files\MyWebSearch\SrchAstt\1.bi n\MWSSRCAS.DLL
      F2 - REG:system.ini: Shell=explorer.exe
      O2 - BHO: MultimppObj Class - {002EB272-2590-4693-B166-FBD5D9 B6FEA6} - (no
      file)
      O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-
      5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bi n\MWSSRCAS.DLL

      O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4 475CCA} - C:\Program
      Files\MyWebSearch\bar\1.bin\MWS BAR.DLL

      O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE

      O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1
      \bar\1.bin\mwsoemon.exe

      O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1
      \bar\1.bin\mwsoemon.exe

      O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program
      Files\MyWebSearch\bar\1.bin\MWS OEMON.EXE

      O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program
      Files\MyWebSearch\bar\1.bin\MWS OEMON.EXE

      O8 - Extra context menu item: &Search -
      bar.mywebsearch.com/menusearch. html?p=ZNxmk04486PL

      O15 - Trusted Zone: *.greg-search.com

      O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8 E6BAD6} -
      public.windupdates.com/get_file .php?
      bt=ie&p=638c04efabf4090ab4c5fc0 24154ef69cf9247c4e1075281a08feb a11106d93954c17e
      e672280f19f68d33f6d9199b6b680eb c2a50847f30f0b8bb2a24ea33ea35f4 :f992a2588cd0115
      0ad693e854e5c9a60
      O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E4168 4E07BB} -
      ak.imgfarm.com/images/nocache/f unwebproducts/ei/SmileyCentralF WBInitialSetup1.0.
      0.8.cab

      O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B7 06892F} (Installer Class) -
      www.xxxtoolbar.com/ist/software s/v4.0/0006_regular.cab

      O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A 75F53B} (GSDACtl Class) -
      launch.gamespyarcade.com/softwa re/launch/alaunch.cab

      O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD1 22C339} -
      w


      I wklej nowego loga...
    • Gość: kkkk Re: mogę prosić o sprwdzenie IP: *.lama.net.pl 28.01.05, 22:41
      Logfile of HijackThis v1.99.0
      Scan saved at 22:44:05, on 2005-01-28
      Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.ex e
      C:\WINDOWS\system32\services.ex e
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\CTHELPER.EX E
      C:\PROGRA~1\Grisoft\AVGFRE~1\av gcc.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\av gemc.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\av gamsvr.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Ulead Systems\Ulead Photo Explorer 7.0\Monitor.exe
      C:\Program Files\Skype\Phone\Skype.exe
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\PROGRA~1\Grisoft\AVGFRE~1\av gupsvc.exe
      C:\WINDOWS\System32\CTsvcCDA.ex e
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\MsPMSPSv.ex e
      C:\Program Files\Internet Explorer\iexplore.exe
      D:\programy\commander\TOTALCMD. EXE
      C:\Program Files\Gadu-Gadu\gg.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\DOCUME~1\kp\USTAWI~1\Temp\_t c\HIJACK~1.EXE

      R0 - HKCU\Software\Microsoft\Interne t Explorer\Main,Start Page =
      www.o2.pl/
      R0 - HKLM\Software\Microsoft\Interne t Explorer\Main,Start Page =
      info.local.pl
      R1 - HKCU\Software\Microsoft\Interne t Explorer\Main,Start Page_bak =
      info.local.pl/
      R0 - HKLM\Software\Microsoft\Interne t Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Interne t Explorer\Toolbar,LinksFolderNam e = Łącza
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D 6BE0B3} -
      C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper .ocx
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF1057 7473F7} -
      c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027 A5CD4F} -
      C:\WINDOWS\Downloaded Program Files\googlenav.dll
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32
      \NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32
      \NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
      O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
      O4 - HKLM\..\Run: [Jet Detection] "C:\Program
      Files\Creative\SBLive\PROGRAM\A DGJDet.exe"
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\av gcc.exe /STARTUP
      O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\av gemc.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
      atboottime
      O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Program Files\Ulead
      Systems\Ulead Photo Explorer 7.0\Monitor.exe
      O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
      O4 - HKCU\..\Run: [Skype] "C:\Program
      Files\Skype\Phone\Skype.exe" /nosplash /minimized
      O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft
      Office\Office\FINDFAST.EXE
      O4 - Global Startup: Uruchamianie pakietu Office.lnk = C:\Program
      Files\Microsoft Office\Office\OSA.EXE
      O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded
      Program Files\googlenav.dll/cmsearch.ht ml
      O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded
      Program Files\googlenav.dll/cmbacklinks .html
      O8 - Extra context menu item: Cac&hed Snapshot of Page -
      res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.htm l
      O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded
      Program Files\googlenav.dll/cmsimilar.h tml
      O8 - Extra context menu item: Translate into English - res://C:\Program
      Files\Google\GoogleToolbar1.dll /cmtrans.html
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F 795683} -
      C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
      00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
      O16 - DPF: ING Bank Online - ssl.bsk.com.pl/bskonl/component/INGOnl.cab
      O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC 6651A8} (Cult3D ActiveX Player) -
      www.cult3d.com/download/cult.cab
      O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B7 06892F} (Installer Class) -
      www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
      O16 - DPF: {6CB5E471-C305-11D3-99A8-000086 395495} (Google Activate) -
      toolbar.google.pl/data/pl/big/1.1.62-big/GoogleNav.cab
      O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0 FCC122} (AcDcToday Control) -
      file://D:\programy\autocad\AcDcToday.ocx
      O16 - DPF: {AE563720-B4F5-11D4-A415-001083 02FDFD} (NOXLATE-BANR) -
      file://D:\programy\autocad\InstBanr.ocx
      O16 - DPF: {C6637286-300D-11D4-AE0A-001083 0243BD} (InstaFred) -
      file://D:\programy\autocad\InstFred.ocx
      O16 - DPF: {F281A59C-7B65-11D3-8617-001083 0243BD} (AcPreview Control) -
      file://D:\programy\autocad\AcPreview.ocx
      O18 - Filter: text/html - (no CLSID) - (no file)
      O20 - AppInit_DLLs: jub8u135x8z4.dll
      O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1
      \Grisoft\AVGFRE~1\avgamsvr.exe
      O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1
      \Grisoft\AVGFRE~1\avgupsvc.exe
      O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
      C:\WINDOWS\System32\CTsvcCDA.ex e
      O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation -
      C:\WINDOWS\system32\nvsvc32.exe



      mam nadziej ze nie skonociłam czegoc :-)
      • Gość: piecyk gazowy Re: mogę prosić o sprwdzenie IP: *.tpnet.pl / *.tpnet.pl 28.01.05, 23:16
        Do wyrzucenia:

        > O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE

        > O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B7 06892F} (Installer Class) -
        > www.xxxtoolbar.com/ist/software s/v4.0/0006_regular.cab

        > O18 - Filter: text/html - (no CLSID) - (no file)
        > O20 - AppInit_DLLs: jub8u135x8z4.dll


        > mam nadziej ze nie skonociłam czegoc :-)

        Ja też. ;-)

        Wklej nowego loga.

Nie masz jeszcze konta? Zarejestruj się


Nakarm Pajacyka