Prośba o sprawdzenie loga

[Gość: Juvefan]

Złapałem jakieś dziadostwo.
Prosze o pomoc
Oto log:
Logfile of HijackThis v1.99.0
Scan saved at 21:58:12, on 2006-02-16
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\explorer.exe
D:\WINDOWS\runservice.exe
D:\WINDOWS\inet20010\services.exe
D:\Program Files\D-Tools\daemon.exe
D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
D:\WINDOWS\system32\mpcsvc.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\rundll32.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\Documents and Settings\damian\Pulpit\HijackThis.exe
D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini:
Shell=explorer.exe
"D:\Program Files\Common
Files\Microsoft Shared\Web Folders\ibm00001.exe"
F3 - REG:win.ini: run=D:\WINDOWS\inet20010\services.exe
O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} -
D:\WINDOWS\inet20010\3.01.00.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -
lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_05
\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nuZTVaSOo] D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [Internet Optimizer] "D:\Program Files\Internet
Optimizer\optimize.exe"
O4 - HKLM\..\Run: [2jNKA5] "D:\DOCUME~1\damian\USTAWI~1
\Temp\cxtpls_loader.exe" /PC=CP.IST2 /SHUN /UNAR="/CTUN"
O4 - HKLM\..\Run: [Kojrqnbf] C:\Program Files\Ncisu\Ctxb.exe
O4 - HKLM\..\Run: [nuZTV÷h$vůőš/‚˛‘ĆßD:\Program Files\ISTsvc\istsvc.exe]
D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [Áł# é"h'ţ9ÓśU3rŲWD:\Program Files\ISTsvc\istsvc.exe]
D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [BearShare] "D:\Program
Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd8.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban8.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames.exe
O4 - HKLM\..\Run: [PayTime] D:\WINDOWS\system32\paytime.exe
O4 - HKLM\..\Run: [xp_system] D:\WINDOWS\inet20010\services.exe
O4 - HKLM\..\Run: [SiS Mpc Service] D:\WINDOWS\system32\mpcsvc.exe
O4 - HKLM\..\Run: [ćüy-Żł] D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [IST Service] D:\Program Files\ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [InstantTray] D:\Program Files\Pinnacle\Shared
Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program
Files\dvd\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Shell] "D:\Program Files\Common Files\Microsoft Shared\Web
Folders\ibm00001.exe"
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [xp_system] D:\WINDOWS\inet20010\services.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Google Search - res://d:\program
files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program
files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program
files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program
files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\Program
Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program
Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with Star Downloader - D:\Program
Files\Star Downloader\sdie.htm
O8 - Extra context menu item: Similar Pages - res://d:\program
files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program
files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -
C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-
0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} -
www.azebar.com/install/azesearch.cab
O18 - Filter: text/html - {F59D1A59-E68F-4AF2-A3CC-D685EF8C28E8} - D:\DOCUME~1
\damian\USTAWI~1\Temp\e.eee
O21 - SSODL: DCOM Server - {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} -
D:\WINDOWS\system32\dcom_14.dll
O23 - Service: InstallDriver Table Manager - Macrovision Corporation -
D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service - Unknown - D:\WINDOWS\runservice.exe

[barracuda7110]

Śmietnik :/
to wywal:
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
> c:\secure32.html
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
> searchbar.findthewebsiteyouneed.com
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
> searchbar.findthewebsiteyouneed.com
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
> searchbar.findthewebsiteyouneed.com
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
> c:\secure32.html
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
> searchbar.findthewebsiteyouneed.com
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
> c:\secure32.html
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
> searchbar.findthewebsiteyouneed.com
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
> c:\secure32.html
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
> c:\secure32.html
Usuń plik secure32.html z dysku.
Tu masz sposób na usunięcie paytime:
www.bleepingcomputer.com/forums/topic16400.html
Odinstaluj internet optimizer i usuń katalog z dysku
> O4 - HKLM\..\Run: [nuZTVaSOo] D:\WINDOWS\rohdhf.exe
> O4 - HKLM\..\Run: [Internet Optimizer] "D:\Program Files\Internet
> Optimizer\optimize.exe"
> O4 - HKLM\..\Run: [Kojrqnbf] C:\Program Files\Ncisu\Ctxb.exe
> O4 - HKLM\..\Run: [nuZTV÷h$vůőš/‚˛‘ĆßD:\Program Files\ISTsvc\ists
> vc.exe]
> D:\WINDOWS\rohdhf.exe
> O4 - HKLM\..\Run: [Áł# é"h'ţ9ÓśU3rŲWD:\Program Files\ISTsvc\istsvc.exe]
> D:\WINDOWS\rohdhf.exe
co to za bzdety???? Powywalaj wszystko i usuń pliki z dysku.

> O4 - HKCU\..\Run: [Shell] "D:\Program Files\Common Files\Microsoft Shared\Web
> Folders\ibm00001.exe"
> O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe

Masz taki burdel w logu, że głowa mała :/. Obawiam się, że trochę rzeczy mogłem
ominąć.

[kolobos]

> Złapałem jakieś dziadostwo.

I to nie jedno...

W menadzerze zadan zakoncz:
D:\WINDOWS\runservice.exe
D:\WINDOWS\inet20010\services.exe
D:\WINDOWS\system32\mpcsvc.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\dllcache\IExplore.exe
D:\WINDOWS\system32\dllcache\IExplore.exe

W hijackthis:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
c:\secure32.html <- usun plik
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini:
Shell=explorer.exe
"D:\Program Files\Common
Files\Microsoft Shared\Web Folders\ibm00001.exe"
F3 - REG:win.ini: run=D:\WINDOWS\inet20010\services.exe
O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} -
D:\WINDOWS\inet20010\3.01.00.dll
O4 - HKLM\..\Run: [nuZTVaSOo] D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [Internet Optimizer] "D:\Program Files\Internet
Optimizer\optimize.exe" <- odinstaluj i usun katalog Ineternet...
O4 - HKLM\..\Run: [2jNKA5] "D:\DOCUME~1\damian\USTAWI~1
\Temp\cxtpls_loader.exe" /PC=CP.IST2 /SHUN /UNAR="/CTUN"
O4 - HKLM\..\Run: [Kojrqnbf] C:\Program Files\Ncisu\Ctxb.exe <- usun katalog
ncisu
O4 - HKLM\..\Run: [nuZTV÷h$vůőš/‚˛‘ĆßD:\Program Files\ISTsvc\istsvc.exe]
D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [Áł# é"h'ţ9ÓśU3rŲWD:\Program Files\ISTsvc\istsvc.exe]
D:\WINDOWS\rohdhf.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd8.exe <- usun plik
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban8.exe <- usun plik
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames.exe <- usun plik
O4 - HKLM\..\Run: [PayTime] D:\WINDOWS\system32\paytime.exe <- usun plik
O4 - HKLM\..\Run: [xp_system] D:\WINDOWS\inet20010\services.exe
O4 - HKLM\..\Run: [SiS Mpc Service] D:\WINDOWS\system32\mpcsvc.exe <- ten
O4 - HKLM\..\Run: [ćüy-Żł] D:\WINDOWS\rohdhf.exe <- usun plik
O4 - HKLM\..\Run: [IST Service] D:\Program Files\ISTsvc\istsvc.exe <- usun
katalog ISTsvc
O4 - HKCU\..\Run: [Shell] "D:\Program Files\Common Files\Microsoft Shared\Web
Folders\ibm00001.exe" <- usun plik
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe <- usun plik
O4 - HKCU\..\Run: [xp_system] D:\WINDOWS\inet20010\services.exe <- usun katalog
inet20010
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} -
www.azebar.com/install/azesearch.cab
O18 - Filter: text/html - {F59D1A59-E68F-4AF2-A3CC-D685EF8C28E8} - D:\DOCUME~1
\damian\USTAWI~1\Temp\e.eee <- usun wszystkie pliki z temp
O21 - SSODL: DCOM Server - {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} -
D:\WINDOWS\system32\dcom_14.dll
Usun usluge:
O23 - Service: LicCtrl Service - Unknown - D:\WINDOWS\runservice.exe
Start->Uruchom->sc stop "LicCtrl Service"
sc delete "LicCtrl Service"
Nastepnie usun plik runservice.exe

Zrob skan tym:
ftp://download.hirekmedia.hu/ssfsetup1_0.exe <- zrob update przed skanowaniem,
po przeskanowaniu odinstaluj.
download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po
przeskanowaniu odinstaluj.
securityresponse.symantec.com/avcenter/FxIstbar.exe
Po wszystkim wklej nowy log z NOWEGO hijackthis (1.99.1).

[Gość: Juvefan]

Logfile of HijackThis v1.99.1
Scan saved at 14:02:13, on 2006-02-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\D-Tools\daemon.exe
D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\dvd\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\damian\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = onet.pl/
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -
lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_05
\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKCU\..\Run: [InstantTray] D:\Program Files\Pinnacle\Shared
Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program
Files\dvd\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Google Search - res://d:\program
files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program
files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program
files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program
files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\Program
Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program
Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with Star Downloader - D:\Program
Files\Star Downloader\sdie.htm
O8 - Extra context menu item: Similar Pages - res://d:\program
files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program
files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -
C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-
0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: Controls Folder - D:\WINDOWS\system32\k208lcdu1f08.dll
(file missing)
O20 - Winlogon Notify: hpprintx - hpprintx.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
\IDriverT.exe

[kolobos]

Usun:
O20 - Winlogon Notify: Controls Folder - D:\WINDOWS\system32\k208lcdu1f08.dll
(file missing)
O20 - Winlogon Notify: hpprintx - hpprintx.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

Widze, ze masz look2me, sprobuj usunac tym:
www.simplytech.it/L2MRemover/index_e.htm
www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/Killme.shtml
Jezeli to nie pomoze to usun recznie:
www.searchengines.pl/phpbb203/index.php?
showtopic=12510&st=30&p=109496&#entry114917
Lub wklej log z l2mfix na ich forum.

[Gość: Juvefan]

I jak??

Logfile of HijackThis v1.99.1
Scan saved at 14:43:53, on 2006-02-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\D-Tools\daemon.exe
D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\dvd\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\explorer.exe
D:\Documents and Settings\damian\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
v4.windowsupdate.microsoft.com/
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -
lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_05
\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKCU\..\Run: [InstantTray] D:\Program Files\Pinnacle\Shared
Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program
Files\dvd\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Google Search - res://d:\program
files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program
files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program
files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program
files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\Program
Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program
Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with Star Downloader - D:\Program
Files\Star Downloader\sdie.htm
O8 - Extra context menu item: Similar Pages - res://d:\program
files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program
files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -
C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-
0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
\IDriverT.exe

[kolobos]

W logu nie widac ale to nie znaczy, ze nie ma.
Sprawdz czy w logu z l2mfix sa jakies slady po l2m, opis masz na stronie ktora
podalem.