Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    proszę o sprawdzenie loga

    IP: *.neoplus.adsl.tpnet.pl 20.01.06, 19:37
    ostatnio pojawił mi się komunikat, że ktoś włamał sie do mojego komputera,
    chodzi dużo wolniej a w kwarantannie avasta siedzi ze 20 zarażonych plików -
    to tyle obserwacji laika. Prosze o sprawdzenie loga - z góry dziękuję.

    Logfile of HijackThis v1.99.1
    Scan saved at 19:27:30, on 06-01-20
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
    C:\WINDOWS\SYSTEM\MDM.EXE
    C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
    C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
    C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
    C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\SYSTEM\INTERNAT.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\ELABORATE BYTES\CLONECD\CLONECDTRAY.EXE
    C:\WINDOWS\SYSTEM\QTTASK.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
    C:\PROGRAM FILES\LOGITECH\ITOUCH\ITOUCH.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\MUSICMATCH\MUSICMATCH JUKEBOX\MM_TRAY.EXE
    C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
    C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
    C:\WINDOWS\SYSTEM\PAYTIME.EXE
    C:\WINDOWS\WINSYSBAN.EXE
    C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
    C:\PROGRAM FILES\SKYPE\PHONE\SKYPE.EXE
    C:\PROGRAM FILES\OLYMPUS\CAMEDIA MASTER 4.2\CM_CAMERA.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\NEOSTRADA TP\NEOSTRADATP.EXE
    C:\PROGRAM FILES\NEOSTRADA TP\COMCOMP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\PROGRAM FILES\NEOSTRADA TP\WATCH.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\PROGRAM FILES\GADU-GADU\GG.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\PULPIT\HIJACKTHIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    c:\secure32.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
    searchbar.findthewebsiteyouneed.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
    szukaj.wp.pl
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
    searchbar.findthewebsiteyouneed.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    c:\secure32.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    c:\secure32.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
    searchbar.findthewebsiteyouneed.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    c:\secure32.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    searchbar.findthewebsiteyouneed.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    c:\secure32.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    c:\secure32.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada
    TP
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} -
    C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
    F1 - win.ini: run=hpfsched
    O1 - Hosts: 127.0.0.5 makethemcry.com
    O1 - Hosts: 127.0.0.5 loudcash.com
    O1 - Hosts: 127.0.0.5 iframestat.com
    O1 - Hosts: 127.0.0.5 toolbarpartner.com
    O1 - Hosts: 127.0.0.5 hqcash.com
    O1 - Hosts: 127.0.0.5 verybigcash.com
    O1 - Hosts: 127.0.0.5 makethemcry.com
    O1 - Hosts: 127.0.0.5 moviepartnership.com
    O1 - Hosts: 127.0.0.5 callmachine.com
    O1 - Hosts: 127.0.0.5 regcash.com
    O1 - Hosts: 127.0.0.5 toolbarpartner.com
    O1 - Hosts: 127.0.0.5 klikrevenue.com
    O1 - Hosts: 127.0.0.5 p2dll.com
    O1 - Hosts: 127.0.0.5 t73.com
    O1 - Hosts: 127.0.0.5 www.makethemcry.com
    O1 - Hosts: 127.0.0.5 www.loudcash.com
    O1 - Hosts: 127.0.0.5 www.iframestat.com
    O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
    O1 - Hosts: 127.0.0.5 www.hqcash.com
    O1 - Hosts: 127.0.0.5 www.verybigcash.com
    O1 - Hosts: 127.0.0.5 www.makethemcry.com
    O1 - Hosts: 127.0.0.5 www.moviepartnership.com
    O1 - Hosts: 127.0.0.5 www.callmachine.com
    O1 - Hosts: 127.0.0.5 www.regcash.com
    O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
    O1 - Hosts: 127.0.0.5 www.klikrevenue.com
    O1 - Hosts: 127.0.0.5 www.p2dll.com
    O1 - Hosts: 127.0.0.5 www.t73.com
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
    c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
    C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
    files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [internat.exe] internat.exe
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
    powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
    C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Elaborate
    Bytes\CloneCD\CloneCDTray.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
    Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program
    Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH
    Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4
    \ASHWEBSV.EXE
    O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
    O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\SYSTEM\paytime.exe
    O4 - HKLM\..\Run: [winsysupd] C:\WINDOWS\WINSYSUPD.exe
    O4 - HKLM\..\Run: [winsysban] C:\WINDOWS\WINSYSBAN.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
    powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [Keyboard Manager] C:\Program Files\Netropa\One-
    touch Multimedia Keyboard\MMKeybd.exe
    O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
    O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4
    \ashServ.exe
    O4 - HKCU\..\Run: [Skype] "C:\PROGRAM
    FILES\SKYPE\PHONE\SKYPE.EXE" /nosplash /minimized
    O4 - HKCU\..\Run: [Shell] "C:\WINDOWS\SYSTEM\ibm00001.exe"
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
    Office\Office\OSA9.EXE
    O4 - Startup: CAMEDIA Master.lnk = C:\Program Files\OLYMPUS\CAMEDIA Master 4.2
    \CM_camera.exe
    O8 - Extra context menu item: &Google Search - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
    O8 - Extra context menu item: Backward Links - res://C:\PROGRAM
    FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbackli
    Obserwuj wątek
      • barracuda7110 Aaaale śmietnik :/ 20.01.06, 20:08
        To tniesz:
        > C:\WINDOWS\SYSTEM\PAYTIME.EXE

        > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
        > c:\secure32.html
        > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
        > searchbar.findthewebsiteyouneed.com
        > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
        > szukaj.wp.pl
        > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
        > searchbar.findthewebsiteyouneed.com
        > R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
        > c:\secure32.html
        • barracuda7110 Re: Aaaale śmietnik :/ 20.01.06, 20:11
          Ciąg dalszy, bo głupie forum nie chciało przyjąć posta :/

          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
          c:\secure32.html
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
          searchbar.findthewebsiteyouneed.com
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
          c:\secure32.html
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
          searchbar.findthewebsiteyouneed.com
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
          c:\secure32.html
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
          c:\secure32.html
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada
          TP

          O1 - Hosts: 127.0.0.5 makethemcry.com
          O1 - Hosts: 127.0.0.5 loudcash.com
          O1 - Hosts: 127.0.0.5 iframestat.com
          O1 - Hosts: 127.0.0.5 toolbarpartner.com
          O1 - Hosts: 127.0.0.5 hqcash.com
          O1 - Hosts: 127.0.0.5 verybigcash.com
          O1 - Hosts: 127.0.0.5 makethemcry.com
          O1 - Hosts: 127.0.0.5 moviepartnership.com
          O1 - Hosts: 127.0.0.5 callmachine.com
          O1 - Hosts: 127.0.0.5 regcash.com
          O1 - Hosts: 127.0.0.5 toolbarpartner.com
          O1 - Hosts: 127.0.0.5 klikrevenue.com
          O1 - Hosts: 127.0.0.5 p2dll.com
          O1 - Hosts: 127.0.0.5 t73.com
          O1 - Hosts: 127.0.0.5 www.makethemcry.com
          O1 - Hosts: 127.0.0.5 www.loudcash.com
          O1 - Hosts: 127.0.0.5 www.iframestat.com
          O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
          O1 - Hosts: 127.0.0.5 www.hqcash.com
          O1 - Hosts: 127.0.0.5 www.verybigcash.com
          O1 - Hosts: 127.0.0.5 www.makethemcry.com
          O1 - Hosts: 127.0.0.5 www.moviepartnership.com
          O1 - Hosts: 127.0.0.5 www.callmachine.com
          O1 - Hosts: 127.0.0.5 www.regcash.com
          O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
          O1 - Hosts: 127.0.0.5 www.klikrevenue.com
          O1 - Hosts: 127.0.0.5 www.p2dll.com
          O1 - Hosts: 127.0.0.5 www.t73.com
          O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\SYSTEM\paytime.exe
          O4 - HKLM\..\Run: [winsysupd] C:\WINDOWS\WINSYSUPD.exe
          O4 - HKLM\..\Run: [winsysban] C:\WINDOWS\WINSYSBAN.exe

          To nie jest śmieć ale możesz wywalić:
          O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
          Nie będą Ci się dublować ikony koło zegarka.
      • neder Re: proszę o sprawdzenie loga 20.01.06, 20:27
        jeszcze:
        > c:\secure32.html -> plik podobnie jak paytime wywalasz (killboxem, wklejasz
        ścieżkę w okienko, 'delete on reboot', restart po wykasowaniu wszystkiego)
        > > O4 - HKCU\..\Run: [Shell] "C:\WINDOWS\SYSTEM\ibm00001.exe" -> wpis w HJ
        usuwasz a plik ibm wywalasz (tez killboxem)

        Proponowałabym również pozbycia się paru zbędnych procesów z autostartu
        pzdr
        • Gość: ojka chyba nie wszystko mi sie udało:( IP: *.neoplus.adsl.tpnet.pl 21.01.06, 19:42
          Mam problem z usunięciem c:\secure32.html - "ręcznie" nie mogę znaleźć ścieżki
          dostępu a jak wklejam to się nie kasuje:(. Cyba ten log nie do końca tak miał
          wygłądać:(.Dzięki za zerknięcie

          Logfile of HijackThis v1.99.1
          Scan saved at 19:32:39, on 06-01-21
          Platform: Windows 98 SE (Win9x 4.10.2222A)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

          Running processes:
          C:\WINDOWS\SYSTEM\KERNEL32.DLL
          C:\WINDOWS\SYSTEM\MSGSRV32.EXE
          C:\WINDOWS\SYSTEM\MPREXE.EXE
          C:\WINDOWS\SYSTEM\mmtask.tsk
          C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
          C:\WINDOWS\SYSTEM\MDM.EXE
          C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
          C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
          C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
          C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
          C:\WINDOWS\EXPLORER.EXE
          C:\WINDOWS\SYSTEM\INTERNAT.EXE
          C:\WINDOWS\TASKMON.EXE
          C:\WINDOWS\SYSTEM\SYSTRAY.EXE
          C:\PROGRAM FILES\ELABORATE BYTES\CLONECD\CLONECDTRAY.EXE
          C:\WINDOWS\SYSTEM\QTTASK.EXE
          C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
          C:\PROGRAM FILES\LOGITECH\ITOUCH\ITOUCH.EXE
          C:\PROGRAM FILES\MUSICMATCH\MUSICMATCH JUKEBOX\MM_TRAY.EXE
          C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
          C:\WINDOWS\SYSTEM\DDHELP.EXE
          C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
          C:\PROGRAM FILES\SKYPE\PHONE\SKYPE.EXE
          C:\PROGRAM FILES\OLYMPUS\CAMEDIA MASTER 4.2\CM_CAMERA.EXE
          C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
          C:\WINDOWS\SYSTEM\WMIEXE.EXE
          C:\WINDOWS\SYSTEM\RPCSS.EXE
          C:\PROGRAM FILES\NEOSTRADA TP\NEOSTRADATP.EXE
          C:\PROGRAM FILES\NEOSTRADA TP\COMCOMP.EXE
          C:\WINDOWS\SYSTEM\TAPISRV.EXE
          C:\WINDOWS\SYSTEM\RNAAPP.EXE
          C:\PROGRAM FILES\NEOSTRADA TP\WATCH.EXE
          C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
          C:\PROGRAM FILES\GADU-GADU\GG.EXE
          C:\WINDOWS\PULPIT\HIJACKTHIS\HIJACKTHIS.EXE

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
          c:\secure32.html
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
          szukaj.wp.pl
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
          www.neostrada.pl
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
          c:\secure32.html
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
          c:\secure32.html
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
          c:\secure32.html
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
          c:\secure32.html
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
          R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} -
          C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
          F1 - win.ini: run=hpfsched
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
          C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
          c:\program files\google\googletoolbar1.dll
          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
          C:\WINDOWS\SYSTEM\MSDXM.OCX
          O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
          C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
          files\google\googletoolbar1.dll
          O4 - HKLM\..\Run: [internat.exe] internat.exe
          O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
          O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
          O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
          O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
          powrprof.dll,LoadCurrentPwrScheme
          O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
          C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Elaborate
          Bytes\CloneCD\CloneCDTray.exe"
          O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
          Files\Real\Update_OB\realsched.exe" -osboot
          O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program
          Files\Logitech\iTouch\iTouch.exe
          O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
          O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH
          Jukebox\mm_tray.exe
          O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
          O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
          O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
          powrprof.dll,LoadCurrentPwrScheme
          O4 - HKLM\..\RunServices: [Keyboard Manager] C:\Program Files\Netropa\One-touch
          Multimedia Keyboard\MMKeybd.exe
          O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
          O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4
          \ashServ.exe
          O4 - HKCU\..\Run: [Skype] "C:\PROGRAM
          FILES\SKYPE\PHONE\SKYPE.EXE" /nosplash /minimized
          O4 - HKCU\..\Run: [Shell] "C:\WINDOWS\SYSTEM\ibm00001.exe"
          O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
          Office\Office\OSA9.EXE
          O4 - Startup: CAMEDIA Master.lnk = C:\Program Files\OLYMPUS\CAMEDIA Master 4.2
          \CM_camera.exe
          O8 - Extra context menu item: &Google Search - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
          O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
          O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
          O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
          O8 - Extra context menu item: Backward Links - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
          O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM
          FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%
          \bdoscandel.exe (file missing)
          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 -
          {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
          O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
          software-dl.real.com/20f5b11526cb56b77121/netzip/RdxIE601.cab
          O16 - DPF: ppctlcab - ppupdates.ca.com/downloads/scanner/ppctlcab.cab
          O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13}
          (PPSDKActiveXScanner.MainScreen) -
          ppupdates.ca.com/downloads/scanner/axscanner.cab
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
          www.bitdefender.com/scan8/oscan8.cab
          O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility
          Class) - security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
          O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
          security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

          • Gość: k Re: chyba nie wszystko mi sie udało:( IP: *.warszawa.sdi.tpnet.pl 22.01.06, 22:39
            Usun w hijackthis te wpisy:

            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
            c:\secure32.html
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
            c:\secure32.html
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
            c:\secure32.html
            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
            c:\secure32.html
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
            c:\secure32.html
            O4 - HKCU\..\Run: [Shell] "C:\WINDOWS\SYSTEM\ibm00001.exe" <- usun plik z dysku.
            • Gość: ojka Dziekuję bardzo n/t IP: *.neoplus.adsl.tpnet.pl 23.01.06, 18:36
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.