HiJack Logfile - Pomóżcie

[Gość: +Immune+]

Proszę o sprawdzenie mojego logfile

Logfile of HijackThis v1.99.0
Scan saved at 16:19:53, on 2005-11-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
szukaj.wp.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.google.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada
TP
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} -
D:\Bartek\Programy\ICQToolbar\toolbaru.dll
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} -
C:\WINDOWS\wsem303.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} -
D:\Bartek\Programy\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet
Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [winupdt] RUNDLL32.EXE c:\windows\jhlvmmreg32.dll,_mainRD
O4 - HKLM\..\Run: [second] D:\Bartek\Damage Tools\l2mfix\second.bat
O8 - Extra context menu item: &ICQ Toolbar Search -
res://D:\Bartek\Programy\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -
D:\Bartek\Programy\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-
A2CD196348E9} - D:\Bartek\Programy\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -
static.windupdates.com/cab/MusicAccess/ie/bridge-c8.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) -
www.ysbweb.com/ist/softwares/v4.0/ysb_1002952.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4E6EB08-80CF-4255-9CDA-
6E9C7A4DBA90}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: Symantec Event Manager - Unknown - C:\Program Files\Common
Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Password Validation Service - Unknown - C:\Program
Files\Common Files\Symantec Shared\ccPwdSvc.exe (file missing)
O23 - Service: InCD Helper - Ahead Software AG - C:\Program
Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server - Lexmark International, Inc. -
C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Usługa Auto-Protect w programie Norton AntiVirus - Symantec
Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe

Dzięki za wszelką pomoc

[neder]

zamykasz odpowiednie procesy w menażerze zadan albo usuwasz w awaryjnym:
> internet optimizer -> poprzez dodaj/usuń programy,
> media access -> jw


w HJ usuwasz:
> O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} -
> C:\WINDOWS\wsem303.dll -> plik usuwasz z dysku
> O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet
> Optimizer\optimize.exe"
> O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
> O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -
> static.windupdates.com/cab/MusicAccess/ie/bridge-c8.cab
> O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) -
> www.ysbweb.com/ist/softwares/v4.0/ysb_1002952.cab

potem standardowo skan ewido:
download.ewido.net/ewido-setup.exe -> aktualizacja, skan potem
odinstalowywujesz,
+ MicrosoftAntispyware:
download.microsoft.com/download/8/1/5/815d2d60-49b5-44dc-ae35-fca2f2c6f0cc/MicrosoftAntiSpywareInstall.exe
-> to możesz zostawić.


restart i nowy log.

pzdr