sprawdzenie loga hijack

[Gość: baggio]

Logfile of HijackThis v1.99.1
Scan saved at 22:19:55, on 2006-01-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\VXNlcg\command.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Network\network.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kav.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Java\jre1.5.0_06\bin\javaw.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\eMule\emule.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Documents and Settings\User\Pulpit\hijackthis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
v4.windowsupdate.microsoft.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no
file)
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe"
runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive
Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [winsysupd] c:\windows\winsysupd3.exe
O4 - HKLM\..\Run: [winsysban] c:\windows\winsysban3.exe
O4 - HKLM\..\Run: [Microsoft System Support] spool.exe
O4 - HKLM\..\Run: [REGRUN] C:\DOCUME~1\User\USTAWI~1\Temp\TMP354.tmp\max.exe
O4 - HKLM\..\Run: [myupdates] c:\windows\myupdates.exe
O4 - HKLM\..\Run: [=NOI] c:\windows\mrjj.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet
Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Network] C:\Program Files\Network\network.exe
O4 - HKLM\..\Run: [KAV50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus
Personal Pro 5\kav.exe" -run -n PersonalPro -v 5.0.0.0
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"
-lang 1033
O4 - HKLM\..\RunServices: [Microsoft System Support] spool.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [quzi] C:\PROGRA~1\COMMON~1\quzi\quzim.exe
O4 - HKCU\..\Run: [Microsoft System Support] spool.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common
Files\Windows\mc-110-12-0000169.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program
Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI
Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
bezpieczenstwo.onet.pl/skaner/SkanerOnline.cab
O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\gp8sl3l71.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -
C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner -
C:\WINDOWS\VXNlcg\command.exe
O23 - Service: KLBLMain - Unknown owner - C:\Program Files\Kaspersky
Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe" -run bl -n PersonalPro -v
5.0.0.0 -ttsr 10000000 (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network
Monitor\netmon.exe
O23 - Service: spoolsvc32 - Unknown owner - C:\windows\system32\ser.exe

[Gość: k]

Syf!

W menadzerze zadan zakoncz:
C:\Program Files\Network\network.exe <- to samo tutaj

W hijackthis usun:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
v4.windowsupdate.microsoft.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
searchbar.findthewebsiteyouneed.com
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no
file)
O4 - HKLM\..\Run: [winsysupd] c:\windows\winsysupd3.exe <- usun plik
O4 - HKLM\..\Run: [winsysban] c:\windows\winsysban3.exe <- usun plik
O4 - HKLM\..\Run: [Microsoft System Support] spool.exe <- usun plik
O4 - HKLM\..\Run: [REGRUN] C:\DOCUME~1\User\USTAWI~1\Temp\TMP354.tmp\max.exe <-
usun wszystko z Temp
O4 - HKLM\..\Run: [myupdates] c:\windows\myupdates.exe <- usun plik
O4 - HKLM\..\Run: [=NOI] c:\windows\mrjj.exe <- usun plik
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet
Optimizer\optimize.exe" <- usun katalog Internet Optimizer
O4 - HKLM\..\Run: [Network] C:\Program Files\Network\network.exe <- usun
katalog network
O4 - HKLM\..\RunServices: [Microsoft System Support] spool.exe
O4 - HKCU\..\Run: [quzi] C:\PROGRA~1\COMMON~1\quzi\quzim.exe <- usun katalog
quzi
O4 - HKCU\..\Run: [Microsoft System Support] spool.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common
Files\Windows\mc-110-12-0000169.exe <- usun plik
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\gp8sl3l71.dll <-
tutaj masz look2me, heh
Usun uslugi:
O23 - Service: Command Service (cmdService) - Unknown owner -
C:\WINDOWS\VXNlcg\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network
Monitor\netmon.exe
O23 - Service: spoolsvc32 - Unknown owner - C:\windows\system32\ser.exe

Start->Uruchom->cmd i tam wpisz:
sc stop spoolsvc32
sc stop cmdService
sc stop "Network Monitor"
sc delete spoolsvc32
sc delete cmdService
sc delete "Network Monitor"

Oczywiscie wszystko rob w trybie awaryjnym.

Na koniec przeskanuj system tym:
ftp://download.hirekmedia.hu/ssfsetup1_0.exe <- zrob update przed skanowaniem,
po przeskanowaniu odinstaluj.
download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po
przeskanowaniu odinstaluj.
Zamknij porty w wwdc:
www.firewallleaktester.com/tools/wwdc.exe
Do tego:
www.simplytech.it/L2MRemover/index_e.htm
www.look2me.com/cgi-bin/UnInstaller
Jezeli to nie pomoze to usun l2m recznie:
www.searchengines.pl/phpbb203/index.php?
showtopic=12510&st=30&p=109496&#entry114917

Po wszystkim wklej nowy log z hijackthis.