Gość: kkkkk
IP: *.lama.net.pl
28.01.05, 21:42
Logfile of HijackThis v1.99.0
Scan saved at 21:43:50, on 2005-01-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.ex e
C:\WINDOWS\system32\services.ex e
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\av gamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\av gupsvc.exe
C:\WINDOWS\System32\CTsvcCDA.ex e
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.ex e
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\CTHELPER.EX E
C:\PROGRA~1\Grisoft\AVGFRE~1\av gcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\av gemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\ mwsoemon.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 7.0\Monitor.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Internet Explorer\iexplore.exe
D:\programy\commander\TOTALCMD. EXE
C:\DOCUME~1\kp\USTAWI~1\Temp\_t c\HIJACK~1.EXE
R1 - HKCU\Software\Microsoft\Interne t Explorer,SearchURL = super-
spider.com/sp.htm?id=191
R1 - HKCU\Software\Microsoft\Interne t Explorer\Main,Search Bar = super-
spider.com/sp.htm?id=191
R0 - HKCU\Software\Microsoft\Interne t Explorer\Main,Start Page =
www.o2.pl/
R0 - HKLM\Software\Microsoft\Interne t Explorer\Main,Start Page =
info.local.pl
R1 - HKCU\Software\Microsoft\Interne t Explorer\Search,SearchAssistant =
super-spider.com/sp.htm?id=191
R1 - HKCU\Software\Microsoft\Interne t Explorer\Main,Start Page_bak =
info.local.pl/
R0 - HKLM\Software\Microsoft\Interne t Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Interne t Explorer\Toolbar,LinksFolderNam e = Łącza
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04 FD64497} - (no
file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F5 69A31D} -
C:\Program Files\MyWebSearch\SrchAstt\1.bi n\MWSSRCAS.DLL
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: MultimppObj Class - {002EB272-2590-4693-B166-FBD5D9 B6FEA6} - (no
file)
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-
5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bi n\MWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D 6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper .ocx
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4 475CCA} - C:\Program
Files\MyWebSearch\bar\1.bin\MWS BAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF1057 7473F7} -
c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027 A5CD4F} -
C:\WINDOWS\Downloaded Program Files\googlenav.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.e xe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32
\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32
\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program
Files\Creative\SBLive\PROGRAM\A DGJDet.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\av gcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\av gemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1
\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Program Files\Ulead
Systems\Ulead Photo Explorer 7.0\Monitor.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1
\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program
Files\MyWebSearch\bar\1.bin\MWS OEMON.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft
Office\Office\FINDFAST.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program
Files\MyWebSearch\bar\1.bin\MWS OEMON.EXE
O4 - Global Startup: Uruchamianie pakietu Office.lnk = C:\Program
Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded
Program Files\googlenav.dll/cmsearch.ht ml
O8 - Extra context menu item: &Search -
bar.mywebsearch.com/menusearch.html?p=ZNxmk04486PL
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded
Program Files\googlenav.dll/cmbacklinks .html
O8 - Extra context menu item: Cac&hed Snapshot of Page -
res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.htm l
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded
Program Files\googlenav.dll/cmsimilar.h tml
O8 - Extra context menu item: Translate into English - res://C:\Program
Files\Google\GoogleToolbar1.dll /cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F 795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.greg-search.com
O16 - DPF: ING Bank Online -
ssl.bsk.com.pl/bskonl/component/INGOnl.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8 E6BAD6} -
public.windupdates.com/get_file.php?bt=ie&p=638c04efabf4090ab4c5fc024154ef69cf9247c4e1075281a08feba11106d93954c17e
e672280f19f68d33f6d9199b6b680eb c2a50847f30f0b8bb2a24ea33ea35f4 :f992a2588cd0115
0ad693e854e5c9a60
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E4168 4E07BB} -
ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.8.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC 6651A8} (Cult3D ActiveX Player) -
www.cult3d.com/download/cult.cab
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B7 06892F} (Installer Class) -
www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086 395495} (Google Activate) -
toolbar.google.pl/data/pl/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A 75F53B} (GSDACtl Class) -
launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0 FCC122} (AcDcToday Control) -
file://D:\programy\autocad\AcDcToday.ocx
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD1 22C339} -
w