Sprawdzenie loga z Hijack This

[Gość: EOo]

[Gość: Kolobos]

Nastepny pirat bez aktualizacji, zalosne...

Odinstaluj Pande.

W hijackthis:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
searchbar.findthewebsiteyouneed.com
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no
file)
F2 - REG:system.ini:
Shell=explorer.exe
"C:\Program Files\Common
Files\Microsoft Shared\Web Folders\ibm00001.exe"
O1 - Hosts: 213.222.11.6 auto.search.msn.com
O1 - Hosts: 213.222.11.6 ieautosearch
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} -
C:\WINDOWS\nem220.dll (file missing)
O2 - BHO: (no name) - {775577A1-EB65-C59F-3FE6-B04EDEF39DEF} -
C:\WINDOWS\System32\ljnaee.dll <- usun plik
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} -
C:\WINDOWS\wsem303.dll (file missing)
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media
Gateway\MediaGateway.exe <- odinstaluj i usun katalog
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet
Optimizer\optimize.exe" <- odinstaluj i usun katalog
O4 - HKLM\..\Run: [Jkigudu] C:\Program Files\Fnkmx\Otwzf.exe <- kasujesz katalog
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools
Service\AdTools.exe <- kasujesz caly katalog
O4 - HKLM\..\Run: [SysMemory manager] c:\windows\system32\mdms.exe <- opis
usuwania masz po wpisaniu na google mdms.exe na drugiej stronie w wynikach
jeden z pierwszych linkow (na stronie symantec'a)
O4 - HKLM\..\Run: [msresearch] C:\WINDOWS\tool3.exe <- kasujesz
O4 - HKLM\..\Run: [load32] C:\WINDOWS\System32\winldra.exe <- kasujesz
O4 - HKLM\..\Run: [sp2update] C:\windows\sp2update00.exe <- kasujesz
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe


O4 - HKCU\..\Run: [Srojjr] C:\WINDOWS\System32\w?aclt.exe <- kasujesz plik
O4 - HKCU\..\Run: [Ouds] C:\Program Files\irrr\otrt.exe <- usuwasz katalog
O4 - HKCU\..\Run: [Shell] msupdate32.exe -run "C:\Program Files\Common
Files\Microsoft Shared\Web Folders\ibm00001.exe" <- usuwasz msupdate32.exe oraz
ibm0000*
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
00aa003c157a} - C:\WINDOWS\web\related.htm
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 81.222.131.59
O15 - Trusted IP range: 81.222.131.59 (HKLM)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms-
its:mhtml:file://c:\nosuklc.mht!http://kazaalite.pl/stats/loud.chm::/Bridge-
c139.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) -
<a href="


download.microsoft.com/download/8/1/5/815d2d60-49b5-44dc-ae35-fca2f2c6f0cc/MicrosoftAntiSpywareInstall.exe
download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po
przeskanowaniu odinstaluj.
Zamknij porty tym:
www.firewallleaktester.com/tools/wwdc.exe

I wklej nowy log, oczywiscie przegladarke zmien na jakas inna bo ten "system" o
ile mozna tak nazwac ten piracki syf, nie nadaje sie do korzystania z internetu!