czy ktos moglby rzucic okiem na mojedg scana?

[Gość: maciej]

Logfile of HijackThis v1.99.1
Scan saved at 18:41:42, on 18/02/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Symantec Shared\ccProxy.exe
C:\Program\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Delade filer\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program\Winamp\winampa.exe
C:\Program\Delade filer\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~2\Altnet\DOWNLO~1\asm.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Program\Delade filer\GMT\GMT.exe
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Anthony Anyadi\Application Data\anur.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Program\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Program\Internet Explorer\iexplore.exe
C:\Program\Real\RealPlayer\RealPlay.exe
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Anthony Anyadi\Lokala inställningar\Temporary
Internet Files\Content.IE5\SXYJCHMB\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
www.zpecialoffer.com/indexie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
www.zpecialoffer.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
10.0.0.6/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.styggapojken.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
www.zpecialoffer.com/indexie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
www.zpecialoffer.com/results.asp?keyword=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
Länkar
R3 - URLSearchHook: PerfectNavBHO Class - {A045DC85-FC44-45be-8A50-
E4F9C62C9A84} - C:\Program\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: BHO - {00000185-C745-43D2-44F1-01A1C789C738} - C:\Program\SB\Smart-
Browser\BHO.0.1.0.155.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} -
C:\WINDOWS\Downloaded Program Files\ycomp5_3_16_0.dll
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} -
C:\Program\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: WebSearch.WSearch - {1FF04B25-0A23-4A12-960C-73F8B9950436} -
C:\Program\WebSearch\Util\D6XEQ172.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -
C:\Program\NewDotNet\newdotnet6_38.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} -
C:\Program\Delade filer\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: PerfectNavBHO Class - {A045DC85-FC44-45be-8A50-E4F9C62C9A84} -
C:\Program\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: C:\WINDOWS\lbbho.dll - {A2361AC5-59C1-4296-BE6B-A798A70E4138} -
C:\WINDOWS\lbbho.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:\program\google\googletoolbar1.dll
O2 - BHO: ToolHelper - {BBBE1C1A-89F7-4AF6-ABD1-F8FBCFA47408} -
C:\Program\POPUPF~1\toolbar.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\WINDOWS\Downloaded Program Files\ycomp5_3_16_0.dll
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} -
C:\Program\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} -
C:\Program\Delade filer\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program\google\googletoolbar1.dll
O3 - Toolbar: PopupFree - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} -
C:\Program\PopupFree\toolbar.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 AmeCSA.cpl,RUN_DLL
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P
Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [KAZAA] C:\Program\Kazaa\Kazaa.exe /SYSTRAY
O4 - HKLM\..\Run: [updater] C:\Program\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points
Manager\Points Manager.exe -s
O4 - HKLM\..\Run: [CMESys] "C:\Program\Delade filer\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program\Delade filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program\Norton Internet
Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\Program\NEWDOT~1
\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Delade
filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [requester] "C:\WINDOWS\System32\requester.10.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [st-0sb0001] c:\program files\Webdialer\st-0sb0001[1].exe -m
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Hsus] C:\Documents and Settings\Anthony Anyadi\Application
Data\anur.exe
O4 - HKCU\..\Run: [ixplore] ""
O4 - Global Startup: GStartup.lnk = C:\Program\Delade filer\GMT\GMT.exe
O8 - Extra context menu item: &Google Search -
res://c:\program\google\GoogleToolbar1.dll/cmsearch.html
O8 -

[cnjry]

> O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\Program\NEWDOT~1
> \NEWDOT~2.DLL,NewDotNetStartup -s

Sporo tego nie chcialo mi sie kopiowac
Jesli mozesz to znmien antywirusa bo te co masz to jest lichy
Polecam NOD32
Przegladarke IE zmien na firefox
zainstaluj spybot i ad-aware i uruchom skanowanie tymi programami i zamiesc loga
jeszcze raz bo yebie mi sie w oczach bo masz tego az tyle

[neder]

aleś Ty delikatny...:)
poza tym log nie jest caly.
pzdr.

[Gość: maciej]

czy antywirusa nod 32 sciagne z sieci?
a przegladrke a firefoxa i ad awara

[Gość: maciej]

a moglibyscie jeszcze sprawdzic? dwa to cos za malo...:)

[Gość: Maja]

Ad-aware jak najbardziej ściągniesz z sieci:
www.lavasoftusa.com/software/adaware/
Firefoxa też, ale to później. Najpierw przeskanuj ad-aware, usuń wszystko, co ci
pokaże i znów wklej loga.

[Gość: piecyk gazowy]

Do usunięcia:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
www.zpecialoffer.com/indexie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
www.zpecialoffer.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
10.0.0.6/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.styggapojken.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*www.yahoo.com/ex
t/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
www.zpecialoffer.com/indexie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
www.zpecialoffer.com/results.asp?keyword=%s

R3 - URLSearchHook: PerfectNavBHO Class - {A045DC85-FC44-45be-8A50-
E4F9C62C9A84} - C:\Program\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: BHO - {00000185-C745-43D2-44F1-01A1C789C738} - C:\Program\SB\Smart-
Browser\BHO.0.1.0.155.dll

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} -
C:\Program\MyWay\myBar\1.bin\MYBAR.DLL

O2 - BHO: WebSearch.WSearch - {1FF04B25-0A23-4A12-960C-73F8B9950436} -
C:\Program\WebSearch\Util\D6XEQ172.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -
C:\Program\NewDotNet\newdotnet6_38.dll

O2 - BHO: PerfectNavBHO Class - {A045DC85-FC44-45be-8A50-E4F9C62C9A84} -
C:\Program\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: C:\WINDOWS\lbbho.dll - {A2361AC5-59C1-4296-BE6B-A798A70E4138} -
C:\WINDOWS\lbbho.dll

O2 - BHO: ToolHelper - {BBBE1C1A-89F7-4AF6-ABD1-F8FBCFA47408} -
C:\Program\POPUPF~1\toolbar.dll

O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} -
C:\Program\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} -
C:\Program\Delade filer\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: PopupFree - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} -
C:\Program\PopupFree\toolbar.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe

O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P
Networking.exe /AUTOSTART

O4 - HKLM\..\Run: [updater] C:\Program\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points
Manager\Points Manager.exe -s
O4 - HKLM\..\Run: [CMESys] "C:\Program\Delade filer\CMEII\CMESys.exe"

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\Program\NEWDOT~1
\NEWDOT~2.DLL,NewDotNetStartup -s

O4 - HKLM\..\Run: [requester] "C:\WINDOWS\System32\requester.10.exe"

O4 - HKCU\..\Run: [st-0sb0001] c:\program files\Webdialer\st-0sb0001[1].exe -m

O4 - HKCU\..\Run: [Hsus] C:\Documents and Settings\Anthony Anyadi\Application
Data\anur.exe
O4 - HKCU\..\Run: [ixplore] ""
O4 - Global Startup: GStartup.lnk = C:\Program\Delade filer\GMT\GMT.exe


Poza tym, jak zauważyła Pani Neder, log jest niekompletny.

do piecyka gazowego

[Gość: maciej]

dzieki wam wszystkim za bezinteresowna pomoc a szczegolnie tobie piecyku
gazowy. to juz nie pierwszy raz jak mi pomagasz (drugi konkretnie) . dzieki raz
jeszcze i niech moc bedzie z toba.
maciej

a teraz wyglada tak:

[Gość: maciej]

Logfile of HijackThis v1.99.1
Scan saved at 16:26:21, on 19/02/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Symantec Shared\ccProxy.exe
C:\Program\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program\Delade filer\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program\Winamp\winampa.exe
C:\Program\Delade filer\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program\Delade filer\GMT\GMT.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Program\Messenger\msmsgs.exe
C:\Program\Real\RealPlayer\realplay.exe
C:\Documents and Settings\Anthony Anyadi\Mina dokument\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} -
C:\WINDOWS\Downloaded Program Files\ycomp5_3_16_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} -
C:\Program\Delade filer\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:\program\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 AmeCSA.cpl,RUN_DLL
O4 - HKLM\..\Run: [KAZAA] C:\Program\Kazaa\Kazaa.exe /SYSTRAY
O4 - HKLM\..\Run: [ccApp] "C:\Program\Delade filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program\Norton Internet
Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Delade
filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\Program\NEWDOT~1
\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [st-0sb0001] c:\program files\Webdialer\st-0sb0001[1].exe -m
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ixplore] ""
O4 - Global Startup: GStartup.lnk = C:\Program\Delade filer\GMT\GMT.exe
O8 - Extra context menu item: &Google Search -
res://c:\program\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://c:\program\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://c:\program\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages -
res://c:\program\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://c:\program\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} -
C:\Program\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-
00010333D0AD} - C:\Program\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: PopupFree - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} -
C:\Program\PopupFree\toolbar.dll
O9 - Extra 'Tools' menuitem: PopupFree - {77FBF9B8-1D37-4FF2-9CED-
192D8E3ABA6F} - C:\Program\PopupFree\toolbar.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\Program\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=www.styggapojken.com
O16 - DPF: Yahoo! Chat -
us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) -
secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) -
us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
software-dl.real.com/24f3fdd52cbb0091e502/netzip/RdxIE601.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) -
www.live365.com/players/play365.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) -
us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_16_0.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation -
C:\Program\Delade filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation -
C:\Program\Delade filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect-tjänst (navapsvc) - Symantec
Corporation - C:\Program\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program\Norton Internet
Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
C:\Program\DELADE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe

[Gość: Maja]

Trochę ci jeszcze paskudztw zostało. Zainstalowałeś już ad-aware i zrobiłeś skan?

[Gość: maciej]

tak i to jest po skanie!

[Gość: piecyk gazowy]

Odinstaluj NewDot (czy coś takiego).

Do wyrzucenia (najlepiej robić to w trybie awaryjnym - safe mode):

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\Program\NEWDOT~1
\NEWDOT~2.DLL,NewDotNetStartup -s

O4 - HKCU\..\Run: [st-0sb0001] c:\program files\Webdialer\st-0sb0001[1].exe -m

O4 - HKCU\..\Run: [ixplore] ""
O4 - Global Startup: GStartup.lnk = C:\Program\Delade filer\GMT\GMT.exe

O9 - Extra button: PopupFree - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} -
C:\Program\PopupFree\toolbar.dll
O9 - Extra 'Tools' menuitem: PopupFree - {77FBF9B8-1D37-4FF2-9CED-
192D8E3ABA6F} - C:\Program\PopupFree\toolbar.dll

O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

O14 - IERESET.INF: START_PAGE_URL=www.styggapojken.com

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

[netsec]

Deinstalator New.net wymaga podłączenia do Internetu, czyli usuwanie należy
wykonywać w normalnym trybie pracy ;)
Najpierw trzeba odinstalować z systemu syf który zainstalował tego szpiega :)

[Gość: maciej]

czolem, nie moge znalezc i odinstalowac net. costam.teraz scan wyglada tak :

Logfile of HijackThis v1.99.1
Scan saved at 15:11:15, on 20/02/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Symantec Shared\ccProxy.exe
C:\Program\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program\Delade filer\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program\Winamp\winampa.exe
C:\Program\Delade filer\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program\Delade filer\GMT\GMT.exe
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Program\Real\RealPlayer\realplay.exe
C:\Program\Messenger\msmsgs.exe
C:\Documents and Settings\Anthony Anyadi\Lokala inställningar\Temporary
Internet Files\Content.IE5\G0GXS7Q1\HijackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.netster.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} -
C:\WINDOWS\Downloaded Program Files\ycomp5_3_16_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} -
C:\Program\Delade filer\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:\program\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 AmeCSA.cpl,RUN_DLL
O4 - HKLM\..\Run: [KAZAA] C:\Program\Kazaa\Kazaa.exe /SYSTRAY
O4 - HKLM\..\Run: [ccApp] "C:\Program\Delade filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program\Norton Internet
Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Delade
filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P
Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\Program\NEWDOT~1
\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [st-0sb0001] c:\program files\Webdialer\st-0sb0001[1].exe -m
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ixplore] ""
O4 - Global Startup: GStartup.lnk = C:\Program\Delade filer\GMT\GMT.exe
O8 - Extra context menu item: &Google Search -
res://c:\program\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://c:\program\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://c:\program\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages -
res://c:\program\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://c:\program\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} -
C:\Program\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-
00010333D0AD} - C:\Program\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: PopupFree - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} -
C:\Program\PopupFree\toolbar.dll
O9 - Extra 'Tools' menuitem: PopupFree - {77FBF9B8-1D37-4FF2-9CED-
192D8E3ABA6F} - C:\Program\PopupFree\toolbar.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\Program\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=www.styggapojken.com
O16 - DPF: Yahoo! Chat -
us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) -
secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) -
us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
software-dl.real.com/24f3fdd52cbb0091e502/netzip/RdxIE601.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) -
www.live365.com/players/play365.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) -
us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_16_0.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation -
C:\Program\Delade filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation -
C:\Program\Delade filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect-tjänst (navapsvc) - Symantec
Corporation - C:\Program\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corp

[Gość: piecyk gazowy]

Log jest niekompletny.

Uruchom system w trybie awaryjnym i usuń następujące pozycje (zaznaczasz i
wciskasz Fix Checked):

O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P
Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\Program\NEWDOT~1
\NEWDOT~2.DLL,NewDotNetStartup -s

O4 - HKCU\..\Run: [st-0sb0001] c:\program files\Webdialer\st-0sb0001[1].exe -m

O4 - HKCU\..\Run: [ixplore] ""
O4 - Global Startup: GStartup.lnk = C:\Program\Delade filer\GMT\GMT.exe

O9 - Extra button: PopupFree - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} -
C:\Program\PopupFree\toolbar.dll
O9 - Extra 'Tools' menuitem: PopupFree - {77FBF9B8-1D37-4FF2-9CED-
192D8E3ABA6F} - C:\Program\PopupFree\toolbar.dll

O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

O14 - IERESET.INF: START_PAGE_URL=www.styggapojken.com

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

[Gość: maciej]

co to znaczy, ze log jest niekompletny? zaznaczam i przenosze wszystko co mi
hijacked wyswietli.

[Gość: neder]

ale zwróć uwagę na to, że nie wszystko się w poście mieści - urywa Ci

[Gość: piecyk gazowy]

Przy wklejaniu proponuję pominąć sekcję "Running processes".