Dodaj do ulubionych

comp infected by malware? prosze o spr. loga

IP: *.internetdsl.tpnet.pl 24.03.06, 15:25
hej,
uzywam firefox, kiedy wchodze na niektore strony (np. onet) automatycznie
przekierowywuje mnie na strone www.pc-aid.org/ i wyskakuje nast. komentarz:

Probably Your computer have been infected by malware and used to attack my site

Please check You computer for Trojans and/or other spyware to make sure your
private information is not stolen, and to avoid using your computer as a
"zombie" of spynet ("zombies" are used by hackers to attack other sites).
You can use following steps to make your internet work. Technical details are
at the end of this document.

SpyFighter - adware and spyware remover
To rescue Your computer please do the following:

1. Update Your Windows: open Windows Update and follow instructions
2. Download and install any Spyware or Adware remover, for example
SpyFighter or noAdware.
3. Install Antivirus, for example Micro-Antivirus - light and professional one.
4. Fix Your DNS Settings: Press
* Start ->
* Control Panel ->
* Network connections
For every connection click right mouse button and select Properties
Select TCP/IP and click Properties Remove all DNS servers and set it to
default.
5. Congratulations! You have a working internet connection. If You have any
problems, feel free to contact me:
Jeff < support at pc-aid.org>



oto moj log:

Logfile of HijackThis v1.99.1
Scan saved at 15:09:53, on 06-03-24
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\LG\SECURECELL\PLBKMON.EXE
C:\PROGRAM FILES\LG\SECURECELL\PL2515MON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRAM FILES\WINDOWS COMMANDER\WINCMD32.EXE
D:\HIPHOP\ANTYWIRY\HIJACKTHIS.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - URLSearchHook: (no name) - {30FD32BC-D133-8E9F-3BDD-BA17E06084E0} -
___.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [LG_PLUtil] C:\Program Files\LG\SecureCell\PLBkMon.exe
O4 - HKLM\..\Run: [LG_Remove] C:\Program Files\LG\SecureCell\PL2515Mon.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP -
C:\PROGRA~1\DAP\dapextie2.htm
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: komentator - sport.onet.pl/komentator.cab
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) -
www.bph.pl/pi/components/SignActivX.cab
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} -
212.239.40.78/cdo/pl/game.exe
O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d:
oo.mht!195.95.218.83/users/sale/web/axe/x.chm::/update.exe
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = fdssf
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 195.95.218.1,85.255.112.7

Obserwuj wątek
    • Gość: k Re: comp infected by malware? prosze o spr. loga IP: *.warszawa.sdi.tpnet.pl 24.03.06, 16:03
      Usun w hijackthis:
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      R3 - URLSearchHook: (no name) - {30FD32BC-D133-8E9F-3BDD-BA17E06084E0} -
      ___.dll (file missing)
      O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
      O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} -
      212.239.40.78/cdo/pl/game.exe
      O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d:
      oo.mht!195.95.218.83/users/sale/web/axe/x.chm::/update.exe
      O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = fdssf
      O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer =
      195.95.218.1,85.255.112.7 <- usun i ustaw dnsy takie jakie zaleca tpsa! Czyli:
      194.204.152.34 oraz 194.204.159.1 (chyba, ze dla dsl sa inne, na stronie tpsa
      powinno byc wszystko podane).

      Do tego zrob skan spysweeperem (link w przyklejonym).
      • Gość: retroname Re: comp infected by malware? prosze o spr. loga IP: *.internetdsl.tpnet.pl 24.03.06, 17:00
        wszystko gra, WIELKIE DZIEKI!

Nie masz jeszcze konta? Zarejestruj się


Nakarm Pajacyka