kontrolne sprawdzanie

IP: *.interpc.pl 25.04.07, 19:04
Logfile of HijackThis v1.99.1
Scan saved at 19:00:03, on 2007-04-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ErrorSafe Free\WASmon.exe
C:\Program Files\ErrorSafe Free\uerscw.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ErrorSafe Free\uers.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WhenUSearch\Search.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\blokers\Pulpit\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-
E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare
MediaBar\MediaBar.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} -
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ChangerBHO Class - {0edc6c20-a31c-11db-8ab9-0800200c9a66} -
C:\WINDOWS\system32\avifilebs.dll
O2 - BHO: ChangerBHO Class - {1D4C7057-EAD2-44C6-AD18-9092905F28F1} -
C:\WINDOWS\system32\acctress.dll
O2 - BHO: SpoofBHO Class - {385066e0-23f3-11db-a98b-0800200c9a66} -
C:\WINDOWS\se_spoof.dll
O2 - BHO: ContextualAds Class - {3AAC4C68-AFC8-11DB-80EF-8AF955D89593} -
C:\Program Files\TrustIn Contextual\trustincontext.dll
O2 - BHO: WeeklyExecuter Class - {590FFB84-6A29-4797-9C0E-B15DF2C4CDCB} -
C:\WINDOWS\inetloader.dll
O2 - BHO: Clicker Class - {631f7200-642e-11db-bd13-0800200c9a66} -
C:\WINDOWS\system32\mscoriezb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -
C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} -
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} -
C:\Program Files\WhenUSearch\search.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1
\BEARSH~1\BEARSH~2\MediaBar.dll
O2 - BHO: ContextualAds Class - {FE6C16C4-16AD-47B6-B250-26AD1829E49A} -
C:\Program Files\TrustIn Contextual\trustincontext.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-
A37C9A5676A7} - C:\Program Files\Common Files\Symantec
Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} -
C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32
\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [was_check] C:\Program Files\ErrorSafe Free\WASmon.exe
O4 - HKLM\..\Run: [uerscw] C:\Program Files\ErrorSafe Free\uerscw.exe -c
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Error Safe] "C:\Program Files\Error Safe Free\ers.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ErrorSafeFree] C:\Program Files\ErrorSafe
Free\uers.exe /scan
O4 - HKCU\..\Run: [ErrorSafeGratis] "C:\Program Files\ErrorSafe
Free\uers.exe" /scan
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1
\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program
Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec
Corporation - C:\Program Files\Norton Internet Security\Norton
AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton
Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common
Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) -
Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

    • Gość: Kolobos Re: kontrolne sprawdzanie IP: *.escom.net.pl 25.04.07, 19:38
      Uzyj: siri.urz.free.fr/Fix/SmitfraudFix_En.php zrob to co masz
      opisane pod "Clean".

      W menadzerze zadan zakoncz:
      C:\Program Files\ErrorSafe Free\WASmon.exe
      C:\Program Files\ErrorSafe Free\uerscw.exe
      C:\Program Files\ErrorSafe Free\uers.exe
      C:\Program Files\WhenUSearch\Search.exe
      Oba katalogi usun z dysku.

      W hjt usun:
      R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-
      E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare
      MediaBar\MediaBar.dll
      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} -
      C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: ChangerBHO Class - {0edc6c20-a31c-11db-8ab9-0800200c9a66} -
      C:\WINDOWS\system32\avifilebs.dll <- plik usun z dysku.
      O2 - BHO: ChangerBHO Class - {1D4C7057-EAD2-44C6-AD18-9092905F28F1} -
      C:\WINDOWS\system32\acctress.dll <- i ten.
      O2 - BHO: SpoofBHO Class - {385066e0-23f3-11db-a98b-0800200c9a66} -
      C:\WINDOWS\se_spoof.dll <- i ten.
      O2 - BHO: ContextualAds Class - {3AAC4C68-AFC8-11DB-80EF-8AF955D89593} -
      C:\Program Files\TrustIn Contextual\trustincontext.dll <- i katalog Trust..
      O2 - BHO: WeeklyExecuter Class - {590FFB84-6A29-4797-9C0E-B15DF2C4CDCB} -
      C:\WINDOWS\inetloader.dll <- i ten plik
      O2 - BHO: Clicker Class - {631f7200-642e-11db-bd13-0800200c9a66} -
      C:\WINDOWS\system32\mscoriezb.dll <- i ten.
      O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} -
      C:\Program Files\WhenUSearch\search.dll
      O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1
      \BEARSH~1\BEARSH~2\MediaBar.dll
      O2 - BHO: ContextualAds Class - {FE6C16C4-16AD-47B6-B250-26AD1829E49A} -
      C:\Program Files\TrustIn Contextual\trustincontext.dll
      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
      C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} -
      C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
      O4 - HKLM\..\Run: [was_check] C:\Program Files\ErrorSafe Free\WASmon.exe
      O4 - HKLM\..\Run: [uerscw] C:\Program Files\ErrorSafe Free\uerscw.exe -c
      O4 - HKCU\..\Run: [Error Safe] "C:\Program Files\Error Safe Free\ers.exe" /min
      O4 - HKCU\..\Run: [ErrorSafeFree] C:\Program Files\ErrorSafe
      Free\uers.exe /scan
      O4 - HKCU\..\Run: [ErrorSafeGratis] "C:\Program Files\ErrorSafe
      Free\uers.exe" /scan

      Na koniec skan:
      www.pandasoftware.com/activescan/pol/activescan_principal.htm
      www.spywareinfo.com/xscan.php
      www.bitdefender.com/scan8/ie.html
      Po wszystkim wklej nowy log.
    • Gość: Kolobos Re: kontrolne sprawdzanie IP: *.escom.net.pl 25.04.07, 20:11
      Forum to nie smietnik jak zapewne Ci sie wydaje!
      Posty pisze sie w watkach (odpowiadajac na dany post), a nie gdzie popadnie robiac jeden wielki smietnik. Kazdy kolejny post ktory nie bedzie sie znajdowal w tym watku zostanie usuniety bez czytania!
    • kolobos Re: kontrolne sprawdzanie 25.04.07, 22:20
      Nie pisz tu wiecej do czasu az nie nauczyc sie korzystac z forum, mam juz dosc kasowania smietci ktorymi zapelniasz forum.
Pełna wersja