Proszę o sprawdzenie - Hijachthis

IP: *.neoplus.adsl.tpnet.pl 29.08.06, 10:08
Wyskakuje mi zawsze przy włączaniu przeglądarki dodatkowe oono, a w nim
znajdują sięoferty seksulane pań.

Oto co mi wyskoczyło po zeskanowaniu:

Logfile of HijackThis v1.99.1
Scan saved at 10:01:58, on 2006-08-29
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\SYSTEM32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Common Files\EPSON\eEBAPI\SAgent2.exe
E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
E:\WINDOWS\system32\ZONELABS\vsmon.exe
E:\WINDOWS\Explorer.EXE
E:\PROGRA~1\WANADOO\TaskbarIcon.exe
E:\Program Files\Analog Devices\SoundMAX\SMTray.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
E:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\WINDOWS\System32\ctfmon.exe
E:\Program Files\Tlen.pl\tlen.exe
E:\Program Files\Gadu-Gadu\gg.exe
E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
E:\Program Files\OpenOffice.ux.pl 2.0\program\soffice.exe
E:\Program Files\OpenOffice.ux.pl 2.0\program\soffice.BIN
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Documents and Settings\Rafał Dudziski\Pulpit\hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada
Plus wita Cie w Internecie
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} -
(no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
E:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program
Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
e:\program files\google\googletoolbar2.dll
O2 - BHO: Ars Plugin - {DABE0C57-5B57-4E2D-837A-08F290F7458E} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program
files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no
file)
O4 - HKLM\..\Run: [WOOWATCH] E:\PROGRA~1\WANADOO\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] E:\PROGRA~1\WANADOO\TaskbarIcon.exe
O4 - HKLM\..\Run: [Smapp] E:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Windowfdgfds DLL fgfdg Verifier] winsecure.exe
O4 - HKLM\..\Run: [Zone Labs Client] E:\Program Files\Zone
Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] E:\WINDOWS\System32
\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42
Series" /O5 "LPT1:" /M "Stylus C42"
O4 - HKLM\..\Run: [AdaptecDirectCD] "E:\Program Files\Adaptec\Easy CD Creator
5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [Windowfdgfds DLL fgfdg Verifier] winsecure.exe
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [Komunikator] E:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: OpenOffice.ux.pl 2.0.lnk = E:\Program Files\OpenOffice.ux.pl 2.0
\program\quickstart.exe
O4 - Global Startup: DSLMON.lnk = E:\Program Files\SAGEM\SAGEM F@st 800-840
\dslmon.exe
O8 - Extra context menu item: &Google Search - res://e:\program
files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://e:\program
files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://e:\program
files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program
files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://e:\program
files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://e:\program
files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
00aa003c157a} - E:\WINDOWS\web\related.htm
O15 - Trusted Zone: mks.com.pl
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {33331111-1131-1111-1111-611111193428} -
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) -
arcaonline.arcabit.com/ArcaOnline.cab
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) -
mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} (Gif89 Lite Class) -
83.18.116.37/xplugLite.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B5598D0-C682-4020-841E-
ABC82CB3A133}: NameServer = 194.204.152.34 217.98.63.164
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} -
E:\WINDOWS\System32\vbsys2.dll
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON
CORPORATION - E:\Program Files\Common Files\EPSON\eEBAPI\SAgent2.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. -
E:\WINDOWS\System32\ImapiRox.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) -
Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -
E:\WINDOWS\system32\ZONELABS\vsmon.exe
    • Gość: Kolobos Re: Proszę o sprawdzenie - Hijachthis IP: *.warszawa.sdi.tpnet.pl 29.08.06, 10:34
      > Wyskakuje mi zawsze przy włączaniu przeglądarki dodatkowe oono, a w nim
      > znajdują sięoferty seksulane pań.

      Wiec dlaczego uzywasz IE skoro masz piracki windows bez żadnych aktualizacji?

      Zamknij porty przy pomocy wwdc.exe , zmien przegladarke na Opere lub Firefox i nie uzywaj IE.

      Aplikacje od neostrady mozesz wywalic, opis recznego ustawienia masz w przyklejonym poscie.

      W hjt usun:
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada
      Plus wita Cie w Internecie
      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} -
      (no file)
      O2 - BHO: Ars Plugin - {DABE0C57-5B57-4E2D-837A-08F290F7458E} - (no file)
      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no
      file)
      O4 - HKLM\..\Run: [Windowfdgfds DLL fgfdg Verifier] winsecure.exe <- plik usun z dysku.
      O4 - HKLM\..\RunServices: [Windowfdgfds DLL fgfdg Verifier] winsecure.exe
      O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
      E:\WINDOWS\web\related.htm
      O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-
      00aa003c157a} - E:\WINDOWS\web\related.htm
      O16 - DPF: {33331111-1111-1111-1111-611111193423} -
      O16 - DPF: {33331111-1111-1111-1111-611111193429} -
      O16 - DPF: {33331111-1111-1111-1111-615111193427} -
      O16 - DPF: {33331111-1131-1111-1111-611111193428} -
      O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
      O16 - DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} (Gif89 Lite Class) -
      83.18.116.37/xplugLite.cab
      O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} -
      E:\WINDOWS\System32\vbsys2.dll <- plik usun z dysku.


      Na koniec zrob skan przy pomocy ewido.
Pełna wersja