proszę o sprawdzenie loga

[lgrzeda]

mam problemy z programi spyware

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Winamp\Winampa.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Documents and Settings\aaa\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.neostrada.pl/
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program
Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [Windows ASN3 Services] yths.exe
O4 - HKLM\..\Run: [MS Host Manager] ivhost.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd5.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban5.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition
Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [Windows ASN3 Services] yths.exe
O4 - HKLM\..\RunServices: [MS Host Manager] ivhost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MS Host Manager] ivhost.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office\OSA9.EXE
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1009868057014
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1009849548498
O17 - HKLM\System\CCS\Services\Tcpip\..\{7978EBD2-2869-4829-A373-
3383586E27CE}: NameServer = 194.204.152.34 217.98.63.164
O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\system32\o048lahu1d48.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik
GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) -
H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition
Classic\avguard.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software -
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - C:\Program
Files\MKS\Bin\mksmonsv.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe

[kolobos]

:mam problemy z programi spyware

Wiec po co go instalujesz? Wklej poczatek log'a!

Zamknij porty w wwdc:
www.firewallleaktester.com/tools/wwdc.exe
Zmien przegladarke na Opere lub Firefox i nie uzywaj IE.

Wywal aplikacje od Neostrady:
forum.gazeta.pl/forum/72,2.html?f=34&w=15679891&a=15680440
W hijackthis usun:
O4 - HKLM\..\Run: [Windows ASN3 Services] yths.exe
O4 - HKLM\..\Run: [MS Host Manager] ivhost.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd5.exe <- usun plik
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban5.exe <- usun plik
O4 - HKLM\..\RunServices: [Windows ASN3 Services] yths.exe <- usun plik
O4 - HKLM\..\RunServices: [MS Host Manager] ivhost.exe
O4 - HKCU\..\Run: [MS Host Manager] ivhost.exe <- usun plik
O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\system32\o048lahu1d48.dll <-
masz look2me
Usun usluge:
O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - C:\Program
Files\MKS\Bin\mksmonsv.exe (file missing)

Start->Uruchom->sc stop MksVirMonSvc
oraz: sc delete MksVirMonSvc

Zrob skan tym:
ftp://download.hirekmedia.hu/ssfsetup1_0.exe <- zrob update przed skanowaniem,
po przeskanowaniu odinstaluj.
download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po
przeskanowaniu odinstaluj.

Sprawdz plik C:\WINDOWS\System32\Userinit.exe tym skanerem
virusscan.jotti.org/ i napisz co znalazl ale sama nic nie ruszaj.

Teraz look2me:
www.simplytech.it/L2MRemover/index_e.htm
securityresponse.symantec.com/avcenter/FxSpL2Me.exe
www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/Killme.shtml
Jezeli to nie pomoze to usun recznie:
www.searchengines.pl/phpbb203/index.php?
showtopic=12510&st=30&p=109496&#entry114917
(lub wklej log z l2mfix na ich forum to Ci pomoga).