Hijack This Logo

[Gość: bartek123]

Prosze o sprawdzenie loga. Co to jest Spy sheriff?

O to logo

[Gość: bartek123]

Logfile of HijackThis v1.99.1
Scan saved at 18:22:59, on 02-04-01
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2919.6304)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\KERNELS64.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\VXH8JKDQ2.EXE
C:\WINDOWS\SYSTEM\VXH8JKDQ6.EXE
C:\WINDOWS\SYSTEM\VXH8JKDQ7.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\INET20001\SERVICES.EXE
C:\PROGRAM FILES\MEDIAGATEWAY\MEDIAGATEWAY.EXE
C:\PROGRAM FILES\180SEARCH ASSISTANT\180SA.EXE
C:\WINDOWS\SMSS.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\WINSTALL.EXE
C:\WINSTALL.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\SYWSVCS.EXE
C:\PROGRAM FILES\SPYSHERIFF\SPYSHERIFF.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\PROGRAM FILES\WANADOO\ESPACEWANADOO.EXE
C:\PROGRAM FILES\WANADOO\COMCOMP.EXE
C:\PROGRAM FILES\WANADOO\WATCH.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\INET20001\MM4.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
D:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.neostrada.pl
F1 - win.ini: run=C:\WINDOWS\INET20001\SERVICES.EXE
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} -
C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\PROGRAM FILES\ADOBE\ACROBAT 6.0 CE\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} -
C:\WINDOWS\SYSTEM\ZOLKER011.DLL
O2 - BHO: - {1E6CE4CD-161B-4847-B8BF-E2EF72299D69} - C:\WINDOWS\SYSTEM\IB6.DLL
O2 - BHO: SABHO - {21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} - C:\PROGRAM
FILES\180SEARCH ASSISTANT\180SAHOOK.DLL
O3 - Toolbar: 180search Toolbar - {93CECBB2-6B1B-448D-91B9-72604EF70105} -
C:\PROGRAM FILES\180SEARCH ASSISTANT PROGRAMS\180SEARCH TOOLBAR\180ST.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe
O4 - HKLM\..\Run: [180sa] c:\program files\180search assistant\180sa.exe
O4 - HKLM\..\Run: [slgzap] C:\WINDOWS\slgzap.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\SYSTEM\kernels64.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\INET20001\SERVICES.EXE
O4 - HKLM\..\Run: [Microsoft Windows Session Manager Subsystem]
C:\WINDOWS\smss.exe
O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4
\ashServ.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\SYSTEM\kernels64.exe
O4 - HKLM\..\RunServices: [Shell] Explorer.exe C:\WINDOWS\SYSTEM\kernels64.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\INET20001\SERVICES.EXE
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\SYSTEM\sywsvcs.exe
O4 - HKCU\..\Run: [SpySheriff] C:\PROGRAM FILES\SPYSHERIFF\SpySheriff.exe
O4 - HKCU\..\RunServices: [aupd] C:\WINDOWS\SYSTEM\sywsvcs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) -
static.zangocash.com/cab/180solutions/ie/bridge-c567.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) -
www.180searchassistant.com/180saax.cab
O21 - SSODL: OLE Module - {203B1C4D9-BC71-8916-38AD-9DEA5D213614} -
C:\WINDOWS\SYSTEM\bre.dll

[Gość: k]

To jest LOG, a nie żadne logo...

alt+ctrl+del i zamknij:
C:\WINDOWS\SYSTEM\KERNELS64.EXE
C:\WINDOWS\SYSTEM\VXH8JKDQ2.EXE
C:\WINDOWS\SYSTEM\VXH8JKDQ6.EXE
C:\WINDOWS\SYSTEM\VXH8JKDQ7.EXE
C:\WINDOWS\INET20001\SERVICES.EXE
C:\PROGRAM FILES\MEDIAGATEWAY\MEDIAGATEWAY.EXE
C:\PROGRAM FILES\180SEARCH ASSISTANT\180SA.EXE
C:\WINDOWS\SMSS.EXE
C:\WINSTALL.EXE
C:\WINSTALL.EXE
C:\WINDOWS\SYSTEM\SYWSVCS.EXE
C:\PROGRAM FILES\SPYSHERIFF\SPYSHERIFF.EXE
C:\WINDOWS\INET20001\MM4.EXE
Wszystkie te pliki usun.

W hijackthis usun:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.neostrada.pl
F1 - win.ini: run=C:\WINDOWS\INET20001\SERVICES.EXE
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} -
C:\WINDOWS\SYSTEM\ZOLKER011.DLL <- usun plik
O2 - BHO: - {1E6CE4CD-161B-4847-B8BF-E2EF72299D69} - C:\WINDOWS\SYSTEM\IB6.DLL
<- usun plik
O2 - BHO: SABHO - {21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} - C:\PROGRAM
FILES\180SEARCH ASSISTANT\180SAHOOK.DLL
O3 - Toolbar: 180search Toolbar - {93CECBB2-6B1B-448D-91B9-72604EF70105} -
C:\PROGRAM FILES\180SEARCH ASSISTANT PROGRAMS\180SEARCH TOOLBAR\180ST.DLL
O4 - HKLM\..\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe
<- usun katalog Media..
O4 - HKLM\..\Run: [180sa] c:\program files\180search assistant\180sa.exe <-
usun katalog 180sea....
O4 - HKLM\..\Run: [slgzap] C:\WINDOWS\slgzap.exe <- usun plik
O4 - HKLM\..\Run: [System] C:\WINDOWS\SYSTEM\kernels64.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\INET20001\SERVICES.EXE
O4 - HKLM\..\Run: [Microsoft Windows Session Manager Subsystem]
C:\WINDOWS\smss.exe <- usun plik
O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\WINDOWS\winlogon.exe <-
usun plik
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\SYSTEM\kernels64.exe <- usun
plik
O4 - HKLM\..\RunServices: [Shell] Explorer.exe C:\WINDOWS\SYSTEM\kernels64.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe <- usun plik
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\INET20001\SERVICES.EXE <- usun katalog
inet20001
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\SYSTEM\sywsvcs.exe <- usun plik
O4 - HKCU\..\Run: [SpySheriff] C:\PROGRAM FILES\SPYSHERIFF\SpySheriff.exe <-
usun katalog spy....
O4 - HKCU\..\RunServices: [aupd] C:\WINDOWS\SYSTEM\sywsvcs.exe <- usun plik
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) -
static.zangocash.com/cab/180solutions/ie/bridge-c567.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) -
www.180searchassistant.com/180saax.cab
O21 - SSODL: OLE Module - {203B1C4D9-BC71-8916-38AD-9DEA5D213614} -
C:\WINDOWS\SYSTEM\bre.dll <- usun plik

Zmien przegladarke na Opere i NIE UZYWAJ WIECEJ IE!

Naprawa tapety:
www.searchengines.pl/phpbb203/index.php?showtopic=31936

Przeskanuj tez system przy pomocy SpyBot S&D.