prosze o sprawdzenie loga

[Gość: dered]

Logfile of HijackThis v1.99.1
Scan saved at 17:51:51, on 2006-06-13
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SmFjZWs\command.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Programy\D-Tools\daemon.exe
C:\Programy\Anti-Blaxx\Anti-Blaxx.exe
C:\defender23a.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Programy\Gadu-Gadu\gg.exe
D:\Gry\Steam\Steam.exe
E:\GammaAdjuster.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jacek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programy\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Programy\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [keyboard] C:\\keyboard25.exe
O4 - HKLM\..\Run: [defender] C:\\defender23a.exe
O4 - HKLM\..\Run: [newname] C:\\newname25.exe
O4 - HKLM\..\Run: [SWN2] C:\Programy\Spyware Nuker\swnxt.exe /h
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program
Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 -
HKLM\System\CCS\Services\Tcpip\..\{29A0AACF-6821-4AB7-A3E5-9B90D4B8DD24}:
NameServer = 212.191.170.2,212.51.192.2
O17 -
HKLM\System\CCS\Services\Tcpip\..\{BC244409-FC5E-444B-A9D6-0C7923AE0EDB}:
NameServer = 212.191.170.2,212.51.192.2,217.107.34.10
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = tvsat364.lodz.pl
O17 -
HKLM\System\CS1\Services\Tcpip\..\{29A0AACF-6821-4AB7-A3E5-9B90D4B8DD24}:
NameServer = 212.191.170.2,212.51.192.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = tvsat364.lodz.pl
O20 - AppInit_DLLs: C:\WINDOWS\system32\rundll.dll
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\l42slef71h2.dll
O23 - Service: Command Service (cmdService) - Unknown owner -
C:\WINDOWS\SmFjZWs\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network
Monitor\netmon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe

[Gość: k]

Z przyklejonego postu - usuwanie look2me oraz uslug.

Zakoncz:
C:\defender23a.exe <- plik usun.
E:\GammaAdjuster.exe <- czemu to tak luzem masz? jezeli tego uzywasz to nie
zamykaj.

W hjt usun:
O4 - HKLM\..\Run: [keyboard] C:\\keyboard25.exe
O4 - HKLM\..\Run: [defender] C:\\defender23a.exe
O4 - HKLM\..\Run: [newname] C:\\newname25.exe
O4 - HKLM\..\Run: [SWN2] C:\Programy\Spyware Nuker\swnxt.exe /h <- usun katalog
Spyware Nuker oraz wymienione pliki exe.
O20 - AppInit_DLLs: C:\WINDOWS\system32\rundll.dll <- plik usun z dysku.
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\l42slef71h2.dll

Uslugi do kasacji:
O23 - Service: Command Service (cmdService) - Unknown owner -
C:\WINDOWS\SmFjZWs\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network
Monitor\netmon.exe

Oba katalogi usuwasz z dyksu tj. SmF... oraz Network...

Do tego zrob skan przy pomocy ewido.