prośba o sprawdzenie loga

[Gość: kasia]

Logfile of HijackThis v1.99.1
Scan saved at 01:02:06, on 2005-03-30
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\piotr hrychorczuk\Pulpit\down load\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.searchmaid.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
www.searchmaid.com/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchmaid.com/bar/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
www.searchmaid.com/search.php?qq=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.searchmaid.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.searchmaid.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
www.searchmaid.com/search.php?qq=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchmaid.com/bar/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
www.searchmaid.com/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
www.searchmaid.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
www.searchmaid.com/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
www.searchmaid.com/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
www.searchmaid.com/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
www.searchmaid.com/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
www.searchmaid.com/search.php?qq=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
www.searchmaid.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
www.gazeta.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
www.searchmaid.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} -
C:\WINDOWS\SYSTEM\Loader.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program
Files\ISTbar\istbar.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: myfastaccess - {8C6685AB-43FF-4BF0-822C-03F03E0B47EA} -
C:\WINDOWS\system32\myfastaccess.dll
O3 - Toolbar: Virtual Maid - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} -
C:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL
O4 - HKLM\..\Run: [MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [Config Loader] scvhost.exe
O4 - HKLM\..\RunServices: [Windows Explorer] LSAS.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O8 - Extra context menu item: &RSDN Search - res://C:\PROGRA~1\VIRTUA~1
\VIRTUA~1.DLL/GoVM.dll.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Microsoft AntiSpyware helper - {9DECD409-7102-4C67-88ED-
D8B6356DFAFC} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {9DECD409-7102-
4C67-88ED-D8B6356DFAFC} - (no file) (HKCU)
O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) -
www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab
O16 - DPF: {12398DD6-40AA-4C40-A4EC-A42CFC0DE797} (Installer Class) -
www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {54E7E082-1DA6-412E-96B5-C290FCEF5329} -
install.serwis.pl/install2.exe
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} -
deposito.hostance.net/dialer/1044446.exe
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} -
deposito.hostance.net/dialer/605332.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum -
C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe

[Gość: Kolobos]

Uruchom hijackthis i zaznacz te wpisy:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.searchmaid.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
www.searchmaid.com/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchmaid.com/bar/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
www.searchmaid.com/search.php?qq=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.searchmaid.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.searchmaid.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
www.searchmaid.com/search.php?qq=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchmaid.com/bar/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
www.searchmaid.com/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
www.searchmaid.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
www.searchmaid.com/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
www.searchmaid.com/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
www.searchmaid.com/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
www.searchmaid.com/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
www.searchmaid.com/search.php?qq=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
www.searchmaid.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
www.searchmaid.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} -
C:\WINDOWS\SYSTEM\Loader.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program
Files\ISTbar\istbar.dll (file missing)
O3 - Toolbar: myfastaccess - {8C6685AB-43FF-4BF0-822C-03F03E0B47EA} -
C:\WINDOWS\system32\myfastaccess.dll
O3 - Toolbar: Virtual Maid - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} -
C:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL
O4 - HKLM\..\RunServices: [Config Loader] scvhost.exe
O4 - HKLM\..\RunServices: [Windows Explorer] LSAS.exe
O8 - Extra context menu item: &RSDN Search - res://C:\PROGRA~1\VIRTUA~1
\VIRTUA~1.DLL/GoVM.dll.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Microsoft AntiSpyware helper - {9DECD409-7102-4C67-88ED-
D8B6356DFAFC} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {9DECD409-7102-
4C67-88ED-D8B6356DFAFC} - (no file) (HKCU)
O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) -
www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab
O16 - DPF: {12398DD6-40AA-4C40-A4EC-A42CFC0DE797} (Installer Class) -
www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {54E7E082-1DA6-412E-96B5-C290FCEF5329} -
install.serwis.pl/install2.exe
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} -
deposito.hostance.net/dialer/1044446.exe
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} -
deposito.hostance.net/dialer/605332.exe

I Fix Checked, nastepnie uruchom ponownie komputer, zainstaluj sobie
antyvirus'a:
www.free-av.com/
Oraz SpywareBlaster i SpyBot S&D
www.javacoolsoftware.com/spywareblaster.html <- SpywareBlaster
www.safer-networking.org/pl/mirrors/index.html <- SpyBot S&D

Przeskanuj tym wszystkim system i wklej nowy log z hijackthis.

[Gość: kasia]

Logfile of HijackThis v1.99.1
Scan saved at 22:46:58, on 2005-03-30
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\piotr hrychorczuk\Pulpit\down load\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.searchmaid.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
www.searchmaid.com/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchmaid.com/bar/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
www.searchmaid.com/search.php?qq=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.searchmaid.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.searchmaid.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
www.searchmaid.com/search.php?qq=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchmaid.com/bar/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
www.searchmaid.com/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
www.searchmaid.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
www.searchmaid.com/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
www.searchmaid.com/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
www.searchmaid.com/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
www.searchmaid.com/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
www.searchmaid.com/search.php?qq=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
www.searchmaid.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
www.searchmaid.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: Virtual Maid - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} -
C:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility
Class) - security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum -
C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe

[Gość: Kolobos]

Sciagnij:
cwshredder.net/bin/CWShredder.exe
oraz:
www.derbilk.de/SpSeHjfix110.zip
Zamknij okna przegladarki i uruchom te programy.

Nastepnie sciagnij:
www.downloads.subratam.org/KillBox.zip
rozpakuj, uruchom, zaznacz delete on reboot i wklej sciezke do
C:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL i nacisnij czerwony przycisk z X

Na koniec uruchom hijackthis i zaznacz te wpisy:

> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
> www.searchmaid.com/
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
> www.searchmaid.com/search.php?qq=%s
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
> searchmaid.com/bar/index.html
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
> www.searchmaid.com/search.php?qq=%s
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
> www.searchmaid.com/
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
> www.searchmaid.com/
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
> www.searchmaid.com/search.php?qq=%s
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
> searchmaid.com/bar/index.html
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
> www.searchmaid.com/search.php?qq=%s
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
> www.searchmaid.com/
> R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
> www.searchmaid.com/search.php?qq=%s
> R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
> www.searchmaid.com/search.php?qq=%s
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
> www.searchmaid.com/search.php?qq=%s
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
> www.searchmaid.com/search.php?qq=%s
> R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
> www.searchmaid.com/search.php?qq=%s
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
> www.searchmaid.com/
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
> www.searchmaid.com/
> O3 - Toolbar: Virtual Maid - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} -
> C:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL

Fix Checked, reset i wklej nowy log.

chyba już jest ok

[Gość: kasia]

Logfile of HijackThis v1.99.1
Scan saved at 23:55:14, on 2005-03-30
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\piotr hrychorczuk\Pulpit\down load\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [MSN Messenger] C:\WINDOWS\System32\msmsgs.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility
Class) - security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum -
C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe

[Gość: Kolobos]

Nie jest juz chyba masz nowego trojana ;-)

F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
O4 - HKLM\..\Run: [MSN Messenger] C:\WINDOWS\System32\msmsgs.exe

Fix Checked i usun C:\WINDOWS\System32\msmsgs.exe

Reszta ok.

[Gość: kasia]

myślałem że jest dobrze ale co jakiś czas mi coś wyskakuje , więc wklejam
logo :) z góry dziękuje za pomoc.

Logfile of HijackThis v1.99.1
Scan saved at 21:08:20, on 2005-03-31
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\helper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\piotr hrychorczuk\Pulpit\down load\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.gazeta.pl/
F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility
Class) - security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe

[Gość: Kolobos]

Wyskakuje bo nie masz antyvirusa ani firewall'a wiec wszystko Ci sie co chwile
instaluje!

Zainstaluj sobie np. Zone Alarm ten darmowy, podczas instalacji wybierz ze
chcesz tylko firewall bez dodatkow, po instalacji odszukaj we wlasciwosciach
suwak od ustawien aplikacji i ustaw go na tryb uczenia sie.
Co do antyvirusa to np, Avast lub free-av.com itd
Do tego zainstaluj SpywareBlaster oraz SpyBot S&D <- po instalacji uaktywnij
ochrone przegladarki.
Wszystkie te programy znajdziesz na google.

Sciagnij tez killbox:
www.downloads.subratam.org/KillBox.zip
rozpakuj, uruchom, zaznacz delete on reboot i wklej do niego te sciezki do
plikow:
C:\WINDOWS\System32\helper.exe

A w hijackthis usun ten wpis:
F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe

Masz koniecznie zainstalowac firewall oraz antyvirusa, bez tego nie ma sensu w
ogole nic usuwac.