chciałyśmy to sprawdzić

[Gość: ela i agnieszka]

oto nasz scan z hijacka, czy wszystko z nim w porządku???:
Logfile of HijackThis v1.99.1
Scan saved at 11:23:13, on 2005-10-18
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\program files\180searchassistant\salm.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WINDOWS\diwkolh.exe
C:\WINDOWS\system32\msxct.exe
C:\WINDOWS\system32\qbt2ipk0.exe
C:\Program Files\Vvwjg\Sccwvqi.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\UCZE1~1\USTAWI~1\Temp\Katalog tymczasowy 4 dla
hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no
file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} -
C:\WINDOWS\nem220.dll
O2 - BHO: SABHO - {21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} - c:\program
files\180searchassistant\salmhook.dll
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} -
C:\WINDOWS\wsem303.dll
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} -
C:\Program Files\SideFind\sfbho.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} -
C:\WINDOWS\system32\msbe.dll
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} -
C:\Program Files\YourSiteBar\ysb.dll
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [salm] c:\program files\180searchassistant\salm.exe
O4 - HKLM\..\Run: [jcdolov] C:\WINDOWS\jcdolov.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet
Optimizer\optimize.exe"
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [2KdT] C:\WINDOWS\diwkolh.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye
Network\bin\bargains.exe
O4 - HKLM\..\Run: [msxct] msxct.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
O4 - HKLM\..\Run: [qbt2ipk0] C:\WINDOWS\system32\qbt2ipk0.exe
O4 - HKLM\..\Run: [Kltaw] C:\Program Files\Vvwjg\Sccwvqi.exe
O4 - HKLM\..\Run: [Áł# é"h'ţ9ÓśU3rŲWC:\Program Files\ISTsvc\istsvc.exe]
C:\WINDOWS\diwkolh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04
\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} -
C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -
static.windupdates.com/cab/MediaAccess/ie/bridge-c6.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) -
www.ysbweb.com/ist/softwares/v4.0/ysb_1002952.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) -
www.180searchassistant.com/180saax.cab

[Gość: Kolobos]

Bardzo daleko od w porzadku ;-)

Messengera mozna odinstalowac:
Start->Uruchom->Wpisz polecenie
RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove

W menadzerze zadan zakoncz te procesy (prawoklik na pasku start i menadzer
zadan):
C:\Program Files\Media Access\MediaAccK.exe
C:\program files\180searchassistant\salm.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WINDOWS\diwkolh.exe
C:\WINDOWS\system32\msxct.exe
C:\WINDOWS\system32\qbt2ipk0.exe
C:\Program Files\Vvwjg\Sccwvqi.exe
C:\Program Files\BullsEye Network\bin\bargains.exe

W hijackthis do kasacji:

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no
file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} -
C:\WINDOWS\nem220.dll <- usun plik z dysku
O2 - BHO: SABHO - {21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} - c:\program
files\180searchassistant\salmhook.dll <- odinstaluj/usun katalog 180searchassi..
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} -
C:\WINDOWS\wsem303.dll <- usun plik
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} -
C:\Program Files\SideFind\sfbho.dll <- odinstaluj i usun katalog SideFind
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} -
C:\WINDOWS\system32\msbe.dll <- usun plik
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} -
C:\Program Files\YourSiteBar\ysb.dll <- odinstaluj/usun katalog YourSiteBar
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe <-
odinstaluj/usun katalog Media Access
O4 - HKLM\..\Run: [salm] c:\program files\180searchassistant\salm.exe
O4 - HKLM\..\Run: [jcdolov] C:\WINDOWS\jcdolov.exe <- usun plik
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet
Optimizer\optimize.exe" <- odinstaluj/usun katalog Internet Optimizer
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe <- uzyj tego:
securityresponse.symantec.com/avcenter/FxIstbar.exe i usun katalog ISTsvc
O4 - HKLM\..\Run: [2KdT] C:\WINDOWS\diwkolh.exe <- usun plik
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye
Network\bin\bargains.exe <- odinstaluj/usun katalog BullsEye...
O4 - HKLM\..\Run: [msxct] msxct.exe <- usun plik
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe <-
usun katalog Power Scan
O4 - HKLM\..\Run: [qbt2ipk0] C:\WINDOWS\system32\qbt2ipk0.exe <- usun plik
O4 - HKLM\..\Run: [Kltaw] C:\Program Files\Vvwjg\Sccwvqi.exe <- usun katalog
Vvwjg
O4 - HKLM\..\Run: [Áł# é"h'ţ9ÓśU3rŲWC:\Program Files\ISTsvc\istsvc.exe]
C:\WINDOWS\diwkolh.exe <- usun plik
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} -
C:\Program Files\SideFind\sidefind.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -
static.windupdates.com/cab/MediaAccess/ie/bridge-c6.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) -
www.ysbweb.com/ist/softwares/v4.0/ysb_1002952.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) -
www.180searchassistant.com/180saax.cab

Przeskanuj system tym:
download.microsoft.com/download/8/1/5/815d2d60-49b5-44dc-ae35-fca2f2c6f0cc/MicrosoftAntiSpywareInstall.exe
download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po
przeskanowaniu odinstaluj.
Zamknij porty tym:
www.firewallleaktester.com/tools/wwdc.exe
Zainstaluj antyvirus i przeskanuj caly dysk:
www.avast.com/eng/avast_4_home.html
Po wszystkim wklej nowy log.