czy to wirusy czy też może programy szpiegujące

[wibrator]

podaje log hijack przedewszystkim jak usunąć pozycje 010-hijacked.... Running processes:
C:/WINDOWS/System32/smss.exe
C:/WINDOWS/system32/winlogon.exe
C:/WINDOWS/system32/services.exe
C:/WINDOWS/system32/lsass.exe
C:/WINDOWS/system32/svchost.exe
C:/WINDOWS/System32/svchost.exe
C:/WINDOWS/system32/spoolsv.exe
C:/WINDOWS/Explorer.EXE
C:/WINDOWS/system32/nvsvc32.exe
C:/Program Files/Panda Software/Panda Antivirus Platinum/Firewall/PavFires.exe
C:/Program Files/Panda Software/Panda Antivirus Platinum/pavsrv51.exe
C:/Program Files/Panda Software/Panda Antivirus Platinum/AVENGINE.EXE
C:/PROGRA~1/DAP/DAP.EXE
C:/Program Files/D-Tools/daemon.exe
C:/WINDOWS/system32/rundll32.exe
C:/Program Files/Gadu-Gadu/gg.exe
C:/Program Files/WLAN/WConfig/WConfig.exe
C:/Program Files/Panda Software/Panda Antivirus Platinum/apvxdwin.exe
C:/Program Files/Panda Software/Panda Antivirus Platinum/Upgrader.exe
C:/Program Files/Internet Explorer/IEXPLORE.EXE
C:/Program Files/Panda Software/Panda Antivirus Platinum/pavProxy.exe
C:/Documents and Settings/wibrator/Pulpit/Uzdrowiciele/HijackThis.exe

R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400010&utm_content=leftnav&utm_source=efc&utm_medium=bund&utm_campaign=efc0605
R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://www.accoona.com
R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://www.google.pl/
R0 - HKLM/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400010&utm_content=leftnav&utm_source=efc&utm_medium=bund&utm_campaign=efc0605
R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName =
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:/Program Files/DAP/DAPIEBar.dll
O3 - Toolbar: Accoona - {364B6276-C6C1-40B6-A6D7-6C48871FD707} - C:/Program Files/Accoona/atoolbar.dll (file missing)
O4 - HKLM/../Run: [DownloadAccelerator] C:/PROGRA~1/DAP/DAP.EXE /STARTUP
O4 - HKLM/../Run: [SpeedOptimizer] C:/PROGRA~1/SPEEDO~1/SPO.EXE -s
O4 - HKLM/../Run: [DAEMON Tools-1033] "C:/Program Files/D-Tools/daemon.exe" -lang 1033
O4 - HKLM/../Run: [eDonkey2000] "C:/=GRY=/eDonkey2000/eDonkey2000.exe" -t
O4 - HKLM/../Run: [New.net Startup] rundll32 C:/PROGRA~1/NEWDOT~1/NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKCU/../Run: [Gadu-Gadu] "C:/Program Files/Gadu-Gadu/gg.exe" /tray
O4 - Startup: Skrót do WConfig.lnk = C:/Program Files/WLAN/WConfig/WConfig.exe
O8 - Extra context menu item: &Download with &DAP - C:/PROGRA~1/DAP/dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:/PROGRA~1/DAP/dapextie2.htm
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .kar: C:/Program Files/Internet Explorer/PLUGINS/npvmidi.dll
O15 - Trusted Zone: http://skaner.mks.com.pl
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLM/System/CCS/Services/Tcpip/../{FA08B4AC-1396-49EA-8080-058FF01FCA64}: NameServer = 194.204.152.34,194.204.159.1,213.76.136.18
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:/WINDOWS/system32/nvsvc32.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:/Program Files/Panda Software/Panda Antivirus Platinum/Firewall/PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:/Program Files/Panda Software/Panda Antivirus Platinum/pavsrv51.exe

uciesze się z każdej opini oraz wskazówek

Autor postu otrzymał pochwałę

[Tom@szek]

Jeśli chcesz pomocy - wklej pełnego log-a i zobacz ten topic - na pewno to ułatwi życie i Tobie i tym którzy Ci pomagają.
http://forum.programosy.pl/hijackthis-gtobsuga-i-umieszczanie-loga-vt9452.html

[wibrator]

przepraszam jeśli popełniłem błąd ale jest to mój pierwszy log na tym forum następny napewno będzie poprawny

[jeff]

przepraszam jeśli popełniłem błąd ale jest to mój pierwszy log na tym forum następny napewno będzie poprawny

chodzi o to żebyś wkleił loga całego wraz z nagłówkiem i objęty tagami Code lub Quote

[wibrator]

Logfile of HijackThis v1.99.1
Scan saved at 08:12:45, on 2005-11-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:/WINDOWS/System32/smss.exe
C:/WINDOWS/system32/winlogon.exe
C:/WINDOWS/system32/services.exe
C:/WINDOWS/system32/lsass.exe
C:/WINDOWS/system32/svchost.exe
C:/WINDOWS/System32/svchost.exe
C:/WINDOWS/Explorer.EXE
C:/WINDOWS/system32/spoolsv.exe
C:/WINDOWS/system32/nvsvc32.exe
C:/Program Files/Panda Software/Panda Antivirus Platinum/Firewall/PavFires.exe
C:/Program Files/Panda Software/Panda Antivirus Platinum/pavsrv51.exe
C:/Program Files/Panda Software/Panda Antivirus Platinum/AVENGINE.EXE
C:/Program Files/D-Tools/daemon.exe
C:/WINDOWS/system32/rundll32.exe
C:/Program Files/Gadu-Gadu/gg.exe
C:/Program Files/WLAN/WConfig/WConfig.exe
C:/Program Files/Panda Software/Panda Antivirus Platinum/apvxdwin.exe
C:/Program Files/eDonkey2000/edonkey2000.exe
C:/Program Files/Panda Software/Panda Antivirus Platinum/pavProxy.exe
C:/Documents and Settings/wibrator/Pulpit/Uzdrowiciele/HijackThis.exe

R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400010&utm_content=leftnav&utm_source=efc&utm_medium=bund&utm_campaign=efc0605
R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://www.accoona.com
R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://www.google.pl/
R0 - HKLM/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400010&utm_content=leftnav&utm_source=efc&utm_medium=bund&utm_campaign=efc0605
R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName =
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:/Program Files/DAP/DAPIEBar.dll
O3 - Toolbar: Accoona - {364B6276-C6C1-40B6-A6D7-6C48871FD707} - C:/Program Files/Accoona/atoolbar.dll (file missing)
O4 - HKLM/../Run: [DownloadAccelerator] C:/PROGRA~1/DAP/DAP.EXE /STARTUP
O4 - HKLM/../Run: [SpeedOptimizer] C:/PROGRA~1/SPEEDO~1/SPO.EXE -s
O4 - HKLM/../Run: [DAEMON Tools-1033] "C:/Program Files/D-Tools/daemon.exe" -lang 1033
O4 - HKLM/../Run: [MSConfig] C:/WINDOWS/PCHealth/HelpCtr/Binaries/MSConfig.exe /auto
O4 - HKLM/../Run: [New.net Startup] rundll32 C:/PROGRA~1/NEWDOT~1/NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKCU/../Run: [Gadu-Gadu] "C:/Program Files/Gadu-Gadu/gg.exe" /tray
O4 - Startup: Skrót do WConfig.lnk = C:/Program Files/WLAN/WConfig/WConfig.exe
O8 - Extra context menu item: &Download with &DAP - C:/PROGRA~1/DAP/dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:/PROGRA~1/DAP/dapextie2.htm
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .kar: C:/Program Files/Internet Explorer/PLUGINS/npvmidi.dll
O15 - Trusted Zone: http://skaner.mks.com.pl
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLM/System/CCS/Services/Tcpip/../{FA08B4AC-1396-49EA-8080-058FF01FCA64}: NameServer = 194.204.152.34,194.204.159.1,213.76.136.18
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:/WINDOWS/system32/nvsvc32.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:/Program Files/Panda Software/Panda Antivirus Platinum/Firewall/PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:/Program Files/Panda Software/Panda Antivirus Platinum/pavsrv51.exe

to jest cały log

[ Dodano: Dzisiaj o 8:42 ]
StartupList report, 2005-11-02, 08:32:38
StartupList version: 1.52.2
Started from : C:\Documents and Settings\wibrator\Pulpit\Uzdrowiciele\HijackThis.EXE
Detected: Windows XP Dodatek SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\WLAN\WConfig\WConfig.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\apvxdwin.exe
C:\Program Files\eDonkey2000\edonkey2000.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\Documents and Settings\wibrator\Pulpit\Uzdrowiciele\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\wibrator\Menu Start\Programy\Autostart]
Skrót do WConfig.lnk = C:\Program Files\WLAN\WConfig\WConfig.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

DownloadAccelerator = C:\PROGRA~1\DAP\DAP.EXE /STARTUP
SpeedOptimizer = C:\PROGRA~1\SPEEDO~1\SPO.EXE -s
DAEMON Tools-1033 = "C:\Program Files\D-Tools\daemon.exe" -lang 1033
MSConfig = C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
New.net Startup = rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Gadu-Gadu = "C:\Program Files\Gadu-Gadu\gg.exe" /tray

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = C:\WINDOWS\NOTEPAD.EXE "%1"

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=
SCRNSAVE.EXE=C:\WINDOWS\system32\BEACHI~1.SCR
drivers=

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\MAGICW~1.SCR
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Download Program Files:

[CKAVWebScan Object]
InProcServer32 = C:\WINDOWS\system32\Kaspersky Lab\Kaspersky On-line Scanner\kavwebscan.dll
CODEBASE = http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\macromed\Shockwave 10\Download.dll
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
CODEBASE = http://acs.pandasoftware.com/activescan/as5free/asinst.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[MainControl Class]
InProcServer32 = C:\WINDOWS\system32\SkanerOnline.dll
CODEBASE = http://skaner.mks.com.pl/SkanerOnline.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #4: C:\Program Files\NewDotNet\newdotnet6_38.dll
Protocol #1: C:\Program Files\NewDotNet\newdotnet6_38.dll
Protocol #2: C:\Program Files\NewDotNet\newdotnet6_38.dll
Protocol #14: C:\Program Files\NewDotNet\newdotnet6_38.dll
Protocol #15: C:\Program Files\NewDotNet\newdotnet6_38.dll

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll

--------------------------------------------------
End of report, 5 435 bytes
Report generated in 0,090 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
przepraszam za zamieszanie ale teraz domnie dotarło o co w tym chodzi

[jeff]

działasz w trybie awaryjnym z wyłączonym przywracaniem sysa. Zobacz w dodaj/usuń czy nie masz Accoona jak tak to odinstaluj - jak coś zostanie to wywalasz ręcznie folder, ponadto odinstaluj też NewDotNet

R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400010&utm_content=leftnav&utm_source=efc&utm_medium=bund&utm_campaign=efc0605
R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://www.accoona.com
R0 - HKLM/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400010&utm_content=leftnav&utm_source=efc&utm_medium=bund&utm_campaign=efc0605
O3 - Toolbar: Accoona - {364B6276-C6C1-40B6-A6D7-6C48871FD707} - C:/Program Files/Accoona/atoolbar.dll (file missing)
O4 - HKLM/../Run: [New.net Startup] rundll32 C:/PROGRA~1/NEWDOT~1/NEWDOT~1.DLL,NewDotNetStartup -s

usuwasz powyższe wpisy w Hijacku

To:

O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

usuwasz http://www.cexx.org/lspfix.htm

dajesz potem loga do kontroli

[ Dodano: Dzisiaj o 9:05 ]
cholera przegapiłem:

O15 - Trusted Zone: http://skaner.mks.com.pl

spróbuj skasować w Hijacku, jak nie da rady to użyj:

Kill Trusted:

http://www.searchengines.pl/phpbb203/index.php?s=5debf1bfeab0c89e54567f66c39699f0&act=Attach&type=post&id=459

[MUTOPOMPKA]

Cytat:
O15 - Trusted Zone: http://skaner.mks.com.pl


spróbuj skasować w Hijacku, jak nie da rady to użyj:

A tak z czystej ciekawości:
Po co ma kasowac ten wpis??? Przecież to stronka skanera Online formy MKS ???

[wibrator]

StartupList report, 2005-11-02, 09:44:34
StartupList version: 1.52.2
Started from : C:\Documents and Settings\wibrator\Pulpit\Uzdrowiciele\HijackThis.EXE
Detected: Windows XP Dodatek SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\WLAN\WConfig\WConfig.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\apvxdwin.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Upgrader.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\wibrator\Pulpit\Uzdrowiciele\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\wibrator\Menu Start\Programy\Autostart]
Skrót do WConfig.lnk = C:\Program Files\WLAN\WConfig\WConfig.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

DownloadAccelerator = C:\PROGRA~1\DAP\DAP.EXE /STARTUP
SpeedOptimizer = C:\PROGRA~1\SPEEDO~1\SPO.EXE -s
DAEMON Tools-1033 = "C:\Program Files\D-Tools\daemon.exe" -lang 1033
New.net Startup = rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Gadu-Gadu = "C:\Program Files\Gadu-Gadu\gg.exe" /tray

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = C:\WINDOWS\NOTEPAD.EXE "%1"

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=
SCRNSAVE.EXE=C:\WINDOWS\system32\BEACHI~1.SCR
drivers=

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\MAGICW~1.SCR
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Download Program Files:

[CKAVWebScan Object]
InProcServer32 = C:\WINDOWS\system32\Kaspersky Lab\Kaspersky On-line Scanner\kavwebscan.dll
CODEBASE = http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\macromed\Shockwave 10\Download.dll
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
CODEBASE = http://acs.pandasoftware.com/activescan/as5free/asinst.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[MainControl Class]
InProcServer32 = C:\WINDOWS\system32\SkanerOnline.dll
CODEBASE = http://skaner.mks.com.pl/SkanerOnline.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll

--------------------------------------------------
End of report, 4 965 bytes
Report generated in 0,070 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[jeff]

A tak z czystej ciekawości:
Po co ma kasowac ten wpis??? Przecież to stronka skanera Online formy MKS ???

faktycznie - moja pomyłka, zmyliło mnie to O15 - Trusted Zone. Chciałem dobrze, aż przedobrzyłem

wibrator wklej normalnie loga z Hijacka, Tom@szek podał Ci linka jak to się robi (pamiętaj o tagach Quote lub Code)

[wibrator]

Logfile of HijackThis v1.99.1
Scan saved at 10:16:13, on 2005-11-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\WLAN\WConfig\WConfig.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\apvxdwin.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Upgrader.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\wibrator\Pulpit\Uzdrowiciele\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400010&utm_content=leftnav&utm_source=efc&utm_medium=bund&utm_campaign=efc0605
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [SpeedOptimizer] C:\PROGRA~1\SPEEDO~1\SPO.EXE -s
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Skrót do WConfig.lnk = C:\Program Files\WLAN\WConfig\WConfig.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O12 - Plugin for .kar: C:\Program Files\Internet Explorer\PLUGINS\npvmidi.dll
O15 - Trusted Zone: http://skaner.mks.com.pl
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FA08B4AC-1396-49EA-8080-058FF01FCA64}: NameServer = 194.204.152.34,194.204.159.1,213.76.136.18
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe

sorry ale troche mnie zakręciło ipoprostu zgłupiałem

Autor postu otrzymał pochwałę

[Tom@szek]

Czy nie rozumiesz jak sie wstawia log-a
Zaznacz całego log-a lewą myszką i klikasz na przycisk po lewej stronie Code.
Jeszcze jedno ostrzeżenie i dostaniesz bana.

[jeff]

pozostało do skasowania w Hijacku w trybie awaryjnym z wyłączonym przywracaniem systemu:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400010&utm_content=leftnav&utm_source=efc&utm_medium=bund&utm_campaign=efc0605

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s

odpalasz LSPfix (link podałem poprzednio)

Przesuwasz na druga (prawa) strone tylko NEWDOT~1.DLL. Potwierdzasz ( I know what i am doing). Finish.
Potem w HJT kasujesz wpisy standardowo. NewDotNet z program files tez wylatuje!

[wibrator]

Serdeczne dzięki j_sn za cierpliwość,z tymi logami to rzeczywiście zgupiałem aż się boje wstawiać loga do kontroli,niewiem jak on do końca ma wyglądać

[jeff]

z tymi logami to rzeczywiście zgupiałem aż się boje wstawiać loga do kontroli,niewiem jak on do końca ma wyglądać

ano tak:



wklejasz loga - zaznaczasz wszystko (np Ctrl +A) i klikasz tak jak masz strzałki albo na Code albo na Quote

[wibrator]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 14:08:13, on 2005-11-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\WLAN\WConfig\WConfig.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\apvxdwin.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Program Files\eDonkey2000\edonkey2000.exe
C:\PROJEK~1\BESTPL~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\wibrator\Pulpit\Uzdrowiciele\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [SpeedOptimizer] C:\PROGRA~1\SPEEDO~1\SPO.EXE -s
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [eDonkey2000] "C:\Program Files\eDonkey2000\edonkey2000.exe" -t
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Skrót do WConfig.lnk = C:\Program Files\WLAN\WConfig\WConfig.exe
O12 - Plugin for .kar: C:\Program Files\Internet Explorer\PLUGINS\npvmidi.dll
O15 - Trusted Zone: http://skaner.mks.com.pl
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FA08B4AC-1396-49EA-8080-058FF01FCA64}: NameServer = 194.204.152.34,194.204.159.1,213.76.136.18
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe

[jeff]

no i jest ok