Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    wirusy-co moge wykasowac

    IP: *.neoplus.adsl.tpnet.pl 20.11.05, 18:01
    Moj komputer opanowaly wirusy. Skorzystalam ze mks-vir skaner on-line i
    wyrzuilo mi, ze nastepujace pliki sa zainfekowane. Niestety nie wiem, czy
    moge to usunac, czy sa to jakies wazne pliki, ktore wplyna na dzialnosc
    komputera. Bardzo prosze o pomoc. A wklejam jeszcze hijacka.

    Zawirusowane pliki to:
    c:\svc.exe
    c:\WINDOWS\loadnew.exe
    c:\WINDOWS\CERES.DLL
    C:\WINDOWS\6vq53rek.exe
    C:\WINDOWS\tool1.exe
    C:\WINDOWS\msxmidi.exe
    C:\WINDOWS\SYSTEM\16no6qli.exe
    C:\WINDOWS\SYSTEM\sun42784.dll
    C:\WINDOWS\SYSTEM\newdial.exe
    C:\WINDOWS\SYSTEM\newdial1.exe
    C:\WINDOWS\SYSTEM\shex.exe
    C:\WINDOWS\TEMP\onhcaomd.exe
    C:\WINDOWS\TEMP\msldf.exe
    C:\WINDOWS\TEMP\11110000.exe
    C:\WINDOWS\Downloaded Program Files\gdnPL10.exe
    C:\WINDOWS\inet20096\services.exe
    C:\WINDOWS\inet20096\alg.exe
    C:\WINDOWS\inet20096\skiller.exe
    C:\WINDOWS\inet20096\iexplore.exe
    C:\WINDOWS\inet20096\explorer.exe
    C:\WINDOWS\inet20096\socks.exe
    C:\Program Files\Media Access\MediaAccC.dll
    C:\Program Files\Media Access\MediaAccK.exe
    C:\Program Files\Media Access\MediaAccess.exe


    I z hijacka
    Logfile of HijackThis v1.99.1
    Scan saved at 17:50:33, on 05-11-20
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\INET20096\WINLOGON.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\SYSTEM\SXGTKBAR.EXE
    C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\E_S10IC2.EXE
    C:\PROGRAM FILES\WANADOO\TASKBARICON.EXE
    C:\WINDOWS\PULPIT\ANIA\ANTYWIR\AVGCTRL.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCK.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCESS.EXE
    C:\WINDOWS\SYSTEM\CTFMON.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\SPYGUARD\SPYWAREGUARD\SGMAIN.EXE
    C:\COREL\GRAPHICS8\PROGRAMS\MFINDEXER.EXE
    C:\PROGRAM FILES\SAGEM\SAGEM F@ST 800-840\DSLMON.EXE
    C:\PROGRAM FILES\SPYGUARD\SPYWAREGUARD\SGBHP.EXE
    C:\PROGRAM FILES\WANADOO\ESPACEWANADOO.EXE
    C:\PROGRAM FILES\WANADOO\COMCOMP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\PROGRAM FILES\WANADOO\WATCH.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\WINOA386.MOD
    C:\WINDOWS\SYSTEM\WINOA386.MOD
    C:\ANIA\WC\WINCMD32.EXE
    C:\PROGRAM FILES\MICROSOFT OFFICE2\OFFICE\WINWORD.EXE
    C:\WINDOWS\SYSTEM\WINOA386.MOD
    C:\WINDOWS\SYSTEM\WINOA386.MOD
    C:\WINDOWS\SYSTEM\WINOA386.MOD
    C:\WINDOWS\PULPIT\ANIA\GG\GG.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\PULPIT\HIJACKTHIS\HIJACKTHIS.EXE

    F1 - win.ini: run=C:\WINDOWS\INET20096\WINLOGON.EXE
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\PROGRAM FILES\ADOBE\ACROBAT 5.0 CE\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: Plugin Class - {56CD20F0-7C09-11D5-A768-0050042307CE} -
    C:\PLAYERIE\PLAYERIE.DLL
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-
    0B27DDD11DB2} - C:\PROGRAM FILES\SPYGUARD\SPYWAREGUARD\DLPROTECT.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
    c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
    files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
    powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\WINAMPa.exe"
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [EPSON Stylus C42 Series]
    C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C42
    Series" /O7 "EPUSB1:" /M "Stylus C42"
    O4 - HKLM\..\Run: [autoclk] autoclk.exe
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\TaskbarIcon.exe
    O4 - HKLM\..\Run: [AVGCtrl] "C:\WINDOWS\PULPIT\ANIA\ANTYWIR\AVGCTRL.EXE" /min
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
    Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [NetDy] C:\WINDOWS\VisualGuard.exe
    O4 - HKLM\..\Run: [Media Access] C:\PROGRAM FILES\MEDIA ACCESS\MediaAccK.exe
    O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\INET20096\WINLOGON.EXE
    O4 - HKLM\..\Run: [Microsoft standard protector] C:\WINDOWS\INET20096
    \SOCKS.EXE 20096
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
    powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [BCDetect] C:\WINDOWS\SYSTEM\BCDetect.exe defer
    O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common
    Files\EPSON\EBAPI\SAgent2.exe
    O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
    O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\INET20096\WINLOGON.EXE
    O4 - Startup: SpywareGuard.lnk = C:\Program
    Files\spyguard\SpywareGuard\sgmain.exe
    O4 - Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8
    \Programs\MFIndexer.exe
    O4 - Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
    \dslmon.exe
    O8 - Extra context menu item: &Google Search - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
    O8 - Extra context menu item: Backward Links - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
    O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O15 - Trusted IP range: 195.95.218.170
    O15 - Trusted IP range: 195.95.218.170 (HKLM)
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
    software-dl.real.com/19513cc46e506bfe0919/netzip/RdxIE601.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
    spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
    skaner.mks.com.pl/SkanerOnline.cab
    O18 - Filter: text/html - {11C31500-5A63-11D9-8705-4445E8D608B4} -
    C:\WINDOWS\SYSTEM\DJD.DLL
    O18 - Filter: text/plain - {11C31500-5A63-11D9-8705-4445E8D608B4} -
    C:\WINDOWS\SYSTEM\DJD.DLL

    Obserwuj wątek
      • Gość: k Re: wirusy-co moge wykasowac IP: *.warszawa.sdi.tpnet.pl 20.11.05, 18:20
        Usun to wszystko co podalas:
        c:\svc.exe
        c:\WINDOWS\loadnew.exe
        c:\WINDOWS\CERES.DLL
        C:\WINDOWS\6vq53rek.exe
        C:\WINDOWS\tool1.exe
        C:\WINDOWS\msxmidi.exe
        C:\WINDOWS\SYSTEM\16no6qli.exe
        C:\WINDOWS\SYSTEM\sun42784.dll
        C:\WINDOWS\SYSTEM\newdial.exe
        C:\WINDOWS\SYSTEM\newdial1.exe
        C:\WINDOWS\SYSTEM\shex.exe
        C:\WINDOWS\TEMP\onhcaomd.exe
        C:\WINDOWS\TEMP\msldf.exe
        C:\WINDOWS\TEMP\11110000.exe <- wywal wszystkie pliki z temp
        C:\WINDOWS\Downloaded Program Files\gdnPL10.exe
        C:\WINDOWS\inet20096\services.exe
        C:\WINDOWS\inet20096\alg.exe <- usun caly katalog inet20096
        C:\WINDOWS\inet20096\skiller.exe
        C:\WINDOWS\inet20096\iexplore.exe
        C:\WINDOWS\inet20096\explorer.exe
        C:\WINDOWS\inet20096\socks.exe
        C:\Program Files\Media Access\MediaAccC.dll
        C:\Program Files\Media Access\MediaAccK.exe
        C:\Program Files\Media Access\MediaAccess.exe

        Ale najpierw zakoncz procesy w alt+ctrl+del:
        C:\WINDOWS\INET20096\WINLOGON.EXE
        C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCK.EXE
        C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCESS.EXE

        W hijackthis usun:

        F1 - win.ini: run=C:\WINDOWS\INET20096\WINLOGON.EXE
        O4 - HKLM\..\Run: [NetDy] C:\WINDOWS\VisualGuard.exe <- usun plik
        O4 - HKLM\..\Run: [Media Access] C:\PROGRAM FILES\MEDIA ACCESS\MediaAccK.exe <-
        usun katalog media access.
        O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\INET20096\WINLOGON.EXE
        O4 - HKLM\..\Run: [Microsoft standard protector] C:\WINDOWS\INET20096
        \SOCKS.EXE 20096
        O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\INET20096\WINLOGON.EXE
        O15 - Trusted IP range: 195.95.218.170
        O15 - Trusted IP range: 195.95.218.170 (HKLM) <- w razie problemow z usunieciem
        uzyj tego:
        www.searchengines.pl/phpbb203/index.php?act=Attach&type=post&id=459
        O18 - Filter: text/html - {11C31500-5A63-11D9-8705-4445E8D608B4} -
        C:\WINDOWS\SYSTEM\DJD.DLL
        O18 - Filter: text/plain - {11C31500-5A63-11D9-8705-4445E8D608B4} -
        C:\WINDOWS\SYSTEM\DJD.DLL <- usun plik i uzyj tego:
        www.derbilk.de/SpSeHjfix109.zip
        Po wszystkim wklej nowy log.
        • Gość: zawirusowana Re: wirusy-co moge wykasowac IP: *.neoplus.adsl.tpnet.pl 20.11.05, 20:30
          Dziekuje za pomoc :-)
          Niestety nie moge zamknac tych programow za pomoca ctrl+alt+del. Klikam zakoncz
          zadanie, ale to sie nie zamyka :/
          Wklejam nowy log z hijacka

          Logfile of HijackThis v1.99.1
          Scan saved at 20:28:42, on 05-11-20
          Platform: Windows 98 SE (Win9x 4.10.2222A)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

          Running processes:
          C:\WINDOWS\SYSTEM\KERNEL32.DLL
          C:\WINDOWS\SYSTEM\MSGSRV32.EXE
          C:\WINDOWS\SYSTEM\DDHELP.EXE
          C:\WINDOWS\SYSTEM\mmtask.tsk
          C:\WINDOWS\SYSTEM\MPREXE.EXE
          C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
          C:\WINDOWS\EXPLORER.EXE
          C:\WINDOWS\TASKMON.EXE
          C:\WINDOWS\SYSTEM\SYSTRAY.EXE
          C:\WINDOWS\SYSTEM\SXGTKBAR.EXE
          C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
          C:\WINDOWS\LOADQM.EXE
          C:\WINDOWS\SYSTEM\E_S10IC2.EXE
          C:\PROGRAM FILES\WANADOO\TASKBARICON.EXE
          C:\WINDOWS\SYSTEM\SPOOL32.EXE
          C:\WINDOWS\PULPIT\ANIA\ANTYWIR\AVGCTRL.EXE
          C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
          C:\WINDOWS\SYSTEM\STIMON.EXE
          C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCK.EXE
          C:\WINDOWS\SYSTEM\CTFMON.EXE
          C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCESS.EXE
          C:\PROGRAM FILES\SPYGUARD\SPYWAREGUARD\SGMAIN.EXE
          C:\COREL\GRAPHICS8\PROGRAMS\MFINDEXER.EXE
          C:\PROGRAM FILES\SAGEM\SAGEM F@ST 800-840\DSLMON.EXE
          C:\WINDOWS\SYSTEM\WMIEXE.EXE
          C:\PROGRAM FILES\SPYGUARD\SPYWAREGUARD\SGBHP.EXE
          C:\WINDOWS\PULPIT\HIJACKTHIS\HIJACKTHIS.EXE

          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
          C:\PROGRAM FILES\ADOBE\ACROBAT 5.0 CE\READER\ACTIVEX\ACROIEHELPER.OCX
          O2 - BHO: Plugin Class - {56CD20F0-7C09-11D5-A768-0050042307CE} -
          C:\PLAYERIE\PLAYERIE.DLL
          O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-
          0B27DDD11DB2} - C:\PROGRAM FILES\SPYGUARD\SPYWAREGUARD\DLPROTECT.DLL
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
          c:\program files\google\googletoolbar1.dll
          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
          C:\WINDOWS\SYSTEM\MSDXM.OCX
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
          files\google\googletoolbar1.dll
          O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
          O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
          O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
          O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
          powrprof.dll,LoadCurrentPwrScheme
          O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
          O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\WINAMPa.exe"
          O4 - HKLM\..\Run: [LoadQM] loadqm.exe
          O4 - HKLM\..\Run: [EPSON Stylus C42 Series]
          C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C42
          Series" /O7 "EPUSB1:" /M "Stylus C42"
          O4 - HKLM\..\Run: [autoclk] autoclk.exe
          O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
          O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\TaskbarIcon.exe
          O4 - HKLM\..\Run: [AVGCtrl] "C:\WINDOWS\PULPIT\ANIA\ANTYWIR\AVGCTRL.EXE" /min
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
          Files\Real\Update_OB\realsched.exe" -osboot
          O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
          O4 - HKLM\..\Run: [Media Access] C:\PROGRAM FILES\MEDIA ACCESS\MediaAccK.exe
          O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
          powrprof.dll,LoadCurrentPwrScheme
          O4 - HKLM\..\RunServices: [BCDetect] C:\WINDOWS\SYSTEM\BCDetect.exe defer
          O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common
          Files\EPSON\EBAPI\SAgent2.exe
          O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
          O4 - Startup: SpywareGuard.lnk = C:\Program
          Files\spyguard\SpywareGuard\sgmain.exe
          O4 - Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8
          \Programs\MFIndexer.exe
          O4 - Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
          O8 - Extra context menu item: &Google Search - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
          O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
          O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
          O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
          O8 - Extra context menu item: Backward Links - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
          O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
          O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
          O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
          software-dl.real.com/19513cc46e506bfe0919/netzip/RdxIE601.cab
          O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
          skaner.mks.com.pl/SkanerOnline.cab
          • Gość: Kolobos Re: wirusy-co moge wykasowac IP: *.warszawa.sdi.tpnet.pl 20.11.05, 21:08
            Nacisnij F8 podczas startu komputera i wybierz Tryb Ms-Dos, przejdz do:
            C:\PROGRAM FILES\MEDIA ACCESS\
            I usunac wszystkie pliki.

            Do katalogu przechodzisz:
            cd C:\nazwakatalogu
            a kasujesz:
            del nazwapliku.exe
            Oczywiscie nazwy wpisz takie jak masz u siebie.

            Nastepnie uruchom windows i usun wpis:
            O4 - HKLM\..\Run: [Media Access] C:\PROGRAM FILES\MEDIA ACCESS\MediaAccK.exe

            Reszta wyglada ok.
            • Gość: zawirusowana Re: wirusy-co moge wykasowac IP: *.neoplus.adsl.tpnet.pl 20.11.05, 22:26
              Dziekuje, mam nadzieje, ze teraz bedzie ok.

              Logfile of HijackThis v1.99.1
              Scan saved at 22:22:49, on 05-11-20
              Platform: Windows 98 SE (Win9x 4.10.2222A)
              MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

              Running processes:
              C:\WINDOWS\SYSTEM\KERNEL32.DLL
              C:\WINDOWS\SYSTEM\MSGSRV32.EXE
              C:\WINDOWS\SYSTEM\DDHELP.EXE
              C:\WINDOWS\SYSTEM\mmtask.tsk
              C:\WINDOWS\SYSTEM\MPREXE.EXE
              C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
              C:\WINDOWS\EXPLORER.EXE
              C:\WINDOWS\TASKMON.EXE
              C:\WINDOWS\SYSTEM\SYSTRAY.EXE
              C:\WINDOWS\SYSTEM\SXGTKBAR.EXE
              C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
              C:\WINDOWS\LOADQM.EXE
              C:\WINDOWS\SYSTEM\E_S10IC2.EXE
              C:\PROGRAM FILES\WANADOO\TASKBARICON.EXE
              C:\WINDOWS\PULPIT\ANIA\ANTYWIR\AVGCTRL.EXE
              C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
              C:\WINDOWS\SYSTEM\STIMON.EXE
              C:\WINDOWS\SYSTEM\CTFMON.EXE
              C:\PROGRAM FILES\SPYGUARD\SPYWAREGUARD\SGMAIN.EXE
              C:\COREL\GRAPHICS8\PROGRAMS\MFINDEXER.EXE
              C:\WINDOWS\SYSTEM\SPOOL32.EXE
              C:\PROGRAM FILES\SAGEM\SAGEM F@ST 800-840\DSLMON.EXE
              C:\WINDOWS\SYSTEM\WMIEXE.EXE
              C:\PROGRAM FILES\SPYGUARD\SPYWAREGUARD\SGBHP.EXE
              C:\PROGRAM FILES\WANADOO\ESPACEWANADOO.EXE
              C:\PROGRAM FILES\WANADOO\COMCOMP.EXE
              C:\WINDOWS\SYSTEM\TAPISRV.EXE
              C:\PROGRAM FILES\WANADOO\WATCH.EXE
              C:\WINDOWS\SYSTEM\RNAAPP.EXE
              C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
              C:\WINDOWS\PULPIT\HIJACKTHIS\HIJACKTHIS.EXE

              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
              C:\PROGRAM FILES\ADOBE\ACROBAT 5.0 CE\READER\ACTIVEX\ACROIEHELPER.OCX
              O2 - BHO: Plugin Class - {56CD20F0-7C09-11D5-A768-0050042307CE} -
              C:\PLAYERIE\PLAYERIE.DLL
              O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-
              0B27DDD11DB2} - C:\PROGRAM FILES\SPYGUARD\SPYWAREGUARD\DLPROTECT.DLL
              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
              c:\program files\google\googletoolbar1.dll
              O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
              C:\WINDOWS\SYSTEM\MSDXM.OCX
              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
              files\google\googletoolbar1.dll
              O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
              O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
              O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
              O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
              powrprof.dll,LoadCurrentPwrScheme
              O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
              O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\WINAMPa.exe"
              O4 - HKLM\..\Run: [LoadQM] loadqm.exe
              O4 - HKLM\..\Run: [EPSON Stylus C42 Series]
              C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C42
              Series" /O7 "EPUSB1:" /M "Stylus C42"
              O4 - HKLM\..\Run: [autoclk] autoclk.exe
              O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
              O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\TaskbarIcon.exe
              O4 - HKLM\..\Run: [AVGCtrl] "C:\WINDOWS\PULPIT\ANIA\ANTYWIR\AVGCTRL.EXE" /min
              O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
              Files\Real\Update_OB\realsched.exe" -osboot
              O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
              O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
              powrprof.dll,LoadCurrentPwrScheme
              O4 - HKLM\..\RunServices: [BCDetect] C:\WINDOWS\SYSTEM\BCDetect.exe defer
              O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common
              Files\EPSON\EBAPI\SAgent2.exe
              O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
              O4 - Startup: SpywareGuard.lnk = C:\Program
              Files\spyguard\SpywareGuard\sgmain.exe
              O4 - Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8
              \Programs\MFIndexer.exe
              O4 - Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
              O8 - Extra context menu item: &Google Search - res://C:\PROGRAM
              FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
              O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM
              FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
              O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM
              FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
              O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM
              FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
              O8 - Extra context menu item: Backward Links - res://C:\PROGRAM
              FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
              O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM
              FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
              O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
              O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
              software-dl.real.com/19513cc46e506bfe0919/netzip/RdxIE601.cab
              O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
              skaner.mks.com.pl/SkanerOnline.cab
              • Gość: k Re: wirusy-co moge wykasowac IP: *.warszawa.sdi.tpnet.pl 21.11.05, 01:39
                Juz wyglada ok.
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.
    Wybrane treści z serwisu Sport.pl są dostępne po wykupieniu płatnej subskrypcji