Proszę o sprawdzenie loga

[Gość: beata]

Logfile of HijackThis v1.99.1
Scan saved at 19:30:37, on 2005-08-14
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Media Gateway\MediaGateway.exe
C:\DOCUME~1\test\USTAWI~1\Temp\sahagent-cdt1004.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\program files\internet explorer\iexplore.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\LeechGet 2004\LeechGet.exe
C:\Documents and Settings\test\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} -
C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program
Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Onet.pl AutoUpdate] "C:\Program Files\Common
Files\Onet.pl\NewAutoUpdate.exe" /updateexe
O4 - HKLM\..\Run: [tCuw0D] C:\WINDOWS\qaxel.exe
O4 - HKLM\..\Run: [bO˛
ůđ[×y-ŻŚ] C:\WINDOWS\qaxel.exe
O4 - HKLM\..\Run: [bO˛
ůđ!×y-ŻŚ] C:\WINDOWS\qaxel.exe
O4 - HKLM\..\Run: [bO˛
ůőö/ŘG%)ßfĎNbµľC:\Program Files\ISTsvc\istsvc.exe]
C:\WINDOWS\qaxel.exe
O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky
Anti-Virus Personal\kav.exe /minimize
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media
Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\test\USTAWI~1\Temp\sahagent-
cdt1004.exe run
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [180ClientStubInstall] "C:\Temp\180SA3013.exe"
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Analizuj za pomocą LeechGet - file://C:\Program
Files\LeechGet 2004\\Parser.html
O8 - Extra context menu item: Pobierz przez Net Transport - C:\Program
Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Pobierz używając kreatora LeechGet -
file://C:\Program Files\LeechGet 2004\\Wizard.html
O8 - Extra context menu item: Pobierz używając LeechGet - file://C:\Program
Files\LeechGet 2004\\AddUrl.html
O8 - Extra context menu item: Pobierz wszystko przez Net Transport -
C:\Program Files\Xi\NetTransport 2\NTAddList.html
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -
static.windupdates.com/cab/MediaAccessVerisign/ie/Bridge-c139.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - ms-
its:mhtml:file://c:\nosuxxxy.mht!
elitegate.de/script/ysb.chm::/ysb_regular.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) -
67.15.101.3/g_bin/pl/billard8_2_0_0_22.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
67.15.101.3/g_bin/pl/snooker_2_0_0_22.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32
\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky
Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

[Gość: T-800]

W Panelu sterowania odinstaluj Mysearchbar (czy jakoś tak), Media Gateway.

Do usunięcia (najlepiej w trybie awaryjnym):

> O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
> Files\MyWay\myBar\1.bin\MYBAR.DLL

> O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} -
> C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL

> O4 - HKLM\..\Run: [tCuw0D] C:\WINDOWS\qaxel.exe
> O4 - HKLM\..\Run: [bO˛
ůđ[×y-ŻŚ] C:\WINDOWS\qaxel.exe
> O4 - HKLM\..\Run: [bO˛
ůđ!×y-ŻŚ] C:\WINDOWS\qaxel.exe
> O4 - HKLM\..\Run: [bO˛
ůőö/ŘG%)ßfĎNbµľC:\Program Files\ISTsvc\istsvc.exe
> ]
> C:\WINDOWS\qaxel.exe

> O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media
> Gateway\MediaGateway.exe
> O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\test\USTAWI~1\Temp\sahagent-
> cdt1004.exe run

> O4 - HKCU\..\Run: [180ClientStubInstall] "C:\Temp\180SA3013.exe"

> O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -
> static.windupdates.com/cab/MediaAccessVerisign/ie/Bridge-c139.cab
> O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - ms-
> its:mhtml:file://c:\nosuxxxy.mht!
> elitegate.de/script/ysb.chm::/ysb_regular.cab

[m.gregor]

A gdzie aktualizacje? A gdzie antywirus? A firewall gryzie? Mozesz w sumie tego
nie usuwac bo bez tych 3 rzeczy i tak za 2 dni bedziesz miala to samo...

[Gość: beata]

Teraz log wygląda tak:

Logfile of HijackThis v1.99.1
Scan saved at 20:07:04, on 2005-08-14
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\program files\internet explorer\iexplore.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\test\Pulpit\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program
Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Onet.pl AutoUpdate] "C:\Program Files\Common
Files\Onet.pl\NewAutoUpdate.exe" /updateexe
O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-
Virus Personal\kav.exe /minimize
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Analizuj za pomocą LeechGet - file://C:\Program
Files\LeechGet 2004\\Parser.html
O8 - Extra context menu item: Pobierz przez Net Transport - C:\Program
Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Pobierz używając kreatora LeechGet -
file://C:\Program Files\LeechGet 2004\\Wizard.html
O8 - Extra context menu item: Pobierz używając LeechGet - file://C:\Program
Files\LeechGet 2004\\AddUrl.html
O8 - Extra context menu item: Pobierz wszystko przez Net Transport - C:\Program
Files\Xi\NetTransport 2\NTAddList.html
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) -
67.15.101.3/g_bin/pl/billard8_2_0_0_22.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
67.15.101.3/g_bin/pl/snooker_2_0_0_22.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32
\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky
Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

[Gość: T-800]

Wygląda czysto. Włącz zaporę:
www.microsoft.com/poland/athome/security/viruses/use_icf.mspx
i zaktualizuj system www.windowsupdate.com - dużo będzie do ściągania i
instalowania, bo masz praktycznie goły system.

[Gość: T-800]

I przeskanuj system Microsoft AntiSpyware
download.microsoft.com/download/8/1/5/815d2d60-49b5-44dc-ae35-fca2f2c6f0cc/MicrosoftAntiSpywareInstall.exe
i Ad-Aware
ftp://ftp.download.com/pub/win95/utilities/aawsepersonal.exe
i usuń wszystko to, co te programy znajdą. Przy MS AS zwróć uwagę, czy nie
czepia się normalnych programów (np. BitComet; bywa "nadgorliwy"), jeśli tak,
to zignoruj, resztę usuń.

[Gość: beata]

bardzo dziękuję za pomoc