syf w kompie

[ye-tik]

Logfile of HijackThis v1.99.1
Scan saved at 19:32:24, on 2006-03-29
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:/WINDOWS/System32/smss.exe
C:/WINDOWS/system32/winlogon.exe
C:/WINDOWS/system32/services.exe
C:/WINDOWS/system32/lsass.exe
C:/WINDOWS/system32/svchost.exe
C:/WINDOWS/System32/svchost.exe
C:/WINDOWS/system32/spoolsv.exe
C:/Program Files/Alwil Software/Avast4/aswUpdSv.exe
C:/Program Files/Alwil Software/Avast4/ashServ.exe
C:/Program Files/Executive Software/Diskeeper/DkService.exe
C:/WINDOWS/Explorer.EXE
C:/Program Files/Common Files/Microsoft Shared/VS7DEBUG/MDM.EXE
C:/WINDOWS/System32/nvsvc32.exe
C:/WINDOWS/System32/svchost.exe
C:/Program Files/Canon/CAL/CALMAIN.exe
C:/PROGRA~1/ALWILS~1/Avast4/ashDisp.exe
C:/PROGRA~1/NEOSTR~1/CnxMon.exe
C:/PROGRA~1/NEOSTR~1/TaskbarIcon.exe
C:/WINDOWS/System32/kernels8.exe
C:/WINDOWS/System32/RUNDLL32.EXE
C:/Program Files/Gadu-Gadu/gg.exe
C:/Windows/xpupdate.exe
C:/WINDOWS/System32/dlh9jkdq2.exe
C:/WINDOWS/System32/dlh9jkdq6.exe
C:/WINDOWS/System32/dlh9jkdq7.exe
C:/WINDOWS/System32/dlh9jkdq5.exe
C:/WINDOWS/System32/wbem/wmiapsrv.exe
C:/Program Files/Alwil Software/Avast4/ashWebSv.exe
C:/Program Files/Alwil Software/Avast4/ashMaiSv.exe
C:/PROGRA~1/NEOSTR~1/NeostradaTP.exe
C:/PROGRA~1/NEOSTR~1/ComComp.exe
C:/PROGRA~1/NEOSTR~1/Watch.exe
C:/Program Files/Internet Explorer/iexplore.exe
C:/Program Files/Internet Explorer/iexplore.exe
C:/Documents and Settings/Roksana/Pulpit/hijackthis/HijackThis.exe

R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://www.goole.pl
R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Window Title = Neostrada TP
R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:/PROGRA~1/NEOSTR~1/SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Program Files/Adobe/Acrobat 5.0 CE/Reader/ActiveX/AcroIEHelper.ocx
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:/Program Files/Yahoo!/Common/yiesrvc.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:/Program Files/Yahoo!/Companion/Installs/cpn/yt.dll
O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup
O4 - HKLM/../Run: [nwiz] nwiz.exe /install
O4 - HKLM/../Run: [avast!] C:/PROGRA~1/ALWILS~1/Avast4/ashDisp.exe
O4 - HKLM/../Run: [WooCnxMon] C:/PROGRA~1/NEOSTR~1/CnxMon.exe
O4 - HKLM/../Run: [WOOWATCH] C:/PROGRA~1/NEOSTR~1/Watch.exe
O4 - HKLM/../Run: [WOOTASKBARICON] C:/PROGRA~1/NEOSTR~1/TaskbarIcon.exe
O4 - HKLM/../Run: [DiskeeperSystray] "C:/Program Files/Executive Software/Diskeeper/DkIcon.exe"
O4 - HKLM/../Run: [System] C:/WINDOWS/System32/kernels8.exe
O4 - HKCU/../Run: [NvMediaCenter] RUNDLL32.EXE C:/WINDOWS/System32/NVMCTRAY..DLL,NvTaskbarInit
O4 - HKCU/../Run: [Gadu-Gadu] "C:/Program Files/Gadu-Gadu/gg.exe" /tray
O4 - HKCU/../Run: [Windows update loader] C:/Windows/xpupdate.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:/Program Files/Yahoo!/Common/ycsrch.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:/PROGRA~1/MICROS~2/OFFICE11/EXCEL.EXE/3000
O8 - Extra context menu item: Komentuj.pl - C:/Program Files/Komentuj.pl/komentuj.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:/Program Files/Yahoo!/Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:/Program Files/Yahoo!/Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:/Program Files/Yahoo!/Common/ycsms.htm
O9 - Extra button: (no name) - {0BA0801C-08CE-4ADD-AB4E-2F0BCD066F20} - C:/Program Files/Komentuj.pl/komentuj.html
O9 - Extra 'Tools' menuitem: Komentuj.pl - {0BA0801C-08CE-4ADD-AB4E-2F0BCD066F20} - C:/Program Files/Komentuj.pl/komentuj.html
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:/Program Files/Yahoo!/Common/yiesrvc.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:/PROGRA~1/MICROS~2/OFFICE11/REFIEBAR.DLL
O9 - Extra button: Komentuj.pl - {E039A097-9A7C-4BBE-9BF9-7DFE9093BB46} - C:/Program Files/Komentuj.pl/komentuj.html
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM/System/CCS/Services/Tcpip/../{CCADC401-B17C-479B-A467-9C3A00C3D93C}: NameServer = 194.204.152.34 217.98.63.164
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:/WINDOWS/System32/vbsys2.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:/Program Files/Alwil Software/Avast4/aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:/Program Files/Alwil Software/Avast4/ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:/Program Files/Alwil Software/Avast4/ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:/Program Files/Alwil Software/Avast4/ashWebSv.exe" /service (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:/Program Files/Canon/CAL/CALMAIN.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:/Program Files/Executive Software/Diskeeper/DkService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:/WINDOWS/System32/nvsvc32.exe

[Bieniol]

W trybie awaryjnym z wyłącząnym przywracaniem systemu usuwasz (wpisy Hijackiem, pliki/foldery na czerwono ręcznie z dysku):

C:/WINDOWS/System32/dlh9jkdq2.exe
C:/WINDOWS/System32/dlh9jkdq6.exe
C:/WINDOWS/System32/dlh9jkdq7.exe
C:/WINDOWS/System32/dlh9jkdq5.exe

O4 - HKLM/../Run: [System] C:/WINDOWS/System32/kernels8.exe
O4 - HKCU/../Run: [Windows update loader] C:/Windows/xpupdate.exe

O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:/WINDOWS/System32/vbsys2.dll

[jeff]

Bieniol

nie sprawdzamy log-a bez opisów i tagów. To tak w kwestii formalnej