prosze o sprawdzenie loga

[Gość: mysliwy]

Logfile of HijackThis v1.99.1
Scan saved at 13:03:37, on 2006-01-06
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\o55s2r0j.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SpywareDetectorSVC.exe
C:\WINDOWS\system32\SDSystemTray.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\SpywareDetector\SDMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\WINDOWS\system32\nvctrl.exe
C:\Documents and Settings\paweł.PROTEKTO-130LA6\Moje
dokumenty\[e-mail]\Nowy folder\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada
TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no
file)
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} -
C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: HomepageBHO - {27150f81-0877-42e9-af13-55e5a3439a26} -
C:\WINDOWS\system32\hpF955.tmp
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [yhyh] C:\WINDOWS\yhyh.exe
O4 - HKLM\..\Run: [o55s2r0j] C:\WINDOWS\system32\o55s2r0j.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SystemTraySD] C:\WINDOWS\system32\SDSystemTray.exe
O4 - HKLM\..\Run: [MonitorSD] C:\Program Files\SpywareDetector\SDMonitor.exe
O4 - HKLM\..\Run: [SDAutoLiveupdate] C:\WINDOWS\system32\LiveUpdateSD.exe -
AUTO
O4 - HKLM\..\Run: [SpyAxe] C:\Program Files\SpyAxe\spyaxe.exe /h
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
\dslmon.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - file://C:\DOCUME~1
\PAWE~1.PRO\USTAWI~1\Temp\bridge-c18.cab
O16 - DPF: {631FF594-EC25-4CFF-B869-402DF294E1D6} (Instalator oprogramowania
Onet.pl) - slimak.onet.pl/_m/kamerzysta/OnetInstalator012s.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111049467576
O17 - HKLM\System\CCS\Services\Tcpip\..\{B568CEE5-5582-494D-8234-
A89818866B74}: NameServer = 194.204.152.34 217.98.63.164
O20 - Winlogon Notify: SDNotify - C:\WINDOWS\SYSTEM32\SDNotify.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
\IDriverT.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner -
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file
missing)
O23 - Service: SpyDetectSVC - Max Secure Software - C:\WINDOWS\system32
\SpywareDetectorSVC.exe

[Gość: k]

Wywal aplikacje od neostrady:
forum.gazeta.pl/forum/72,2.html?f=34&w=15679891&a=15680440
Odinstaluj:
Max Spyware Detecor

W menadzerze zadan zakoncz:
C:\WINDOWS\system32\o55s2r0j.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\WINDOWS\system32\nvctrl.exe
Pliki usun.

Opis usuwania spyaxe tutaj:
www.searchengines.pl/phpbb203/index.php?showtopic=31936&st=15&p=211473&#entry211473
W hijackthis usun:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada
TP
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no
file)
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} -
C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: HomepageBHO - {27150f81-0877-42e9-af13-55e5a3439a26} -
C:\WINDOWS\system32\hpF955.tmp <- usun plik
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe <- usun plik
O4 - HKLM\..\Run: [yhyh] C:\WINDOWS\yhyh.exe <- usun plik
O4 - HKLM\..\Run: [o55s2r0j] C:\WINDOWS\system32\o55s2r0j.exe
O4 - HKLM\..\Run: [SpyAxe] C:\Program Files\SpyAxe\spyaxe.exe /h <- usun katalog SpyAxe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - file://C:\DOCUME~1
\PAWE~1.PRO\USTAWI~1\Temp\bridge-c18.cab
O20 - Winlogon Notify: SDNotify - C:\WINDOWS\SYSTEM32\SDNotify.dll
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner -
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file
missing) <- usun usluge -> Start->Uruchom->cmd -> sc stop PavPrSrv oraz sc delete PavPrSrv

Skan tym:
www.webroot.com/shoppingcart/tryme.php?bjpc=64011&vcode=DT02&WRSID=fa418c3f36c473de8c7d2176ac7ada66 <- zrob update przed skanowaniem, po przeskanowaniu odinstaluj.
download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po przeskanowaniu odinstaluj.
Zamknij porty w wwdc:
www.firewallleaktester.com/tools/wwdc.exe
Po wszystkim wklej nowy log.