prosze o sprawdzenie loga

**Posty:** 18165 · przez **wojtas** 26 Kwi 2006, 13:27

Mam znowu jakies wirusy bo avast wykrywa ich barzdo duzo!!daje log do kontroli!!:
Logfile of HijackThis v1.99.1
Scan saved at 12:07:55, on 2006-04-26
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Kod: Zaznacz wszystko: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Alwil Software\Avast4a\aswUpdSv.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe D:\Program Files\Winamp\winampa.exe D:\PROGRA~1\ALWILS~1\Avast4a\ashDisp.exe D:\Program Files\Alwil Software\Avast4a\ashServ.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\EQBranch\EQBranch.exe d:\Program Files\ewido anti-malware\ewidoctrl.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe D:\Program Files\Alwil Software\Avast4a\ashWebSv.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe D:\Program Files\Alwil Software\Avast4a\ashMaiSv.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\PROGRA~1\NEOSTR~1\Watch.exe D:\Program Files\Winamp\winamp.exe D:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\wuauclt.exe D:\firefox\firefox.exe C:\Program Files\FCAdvice\FCAdvice.exe C:\Program Files\Internet Optimizer\optimize.exe c:\windows\mousepad14.exe c:\drsmartload1.exe D:\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_22.dll O2 - BHO: (no name) - {6001CDF7-6F45-471b-A203-0225615E35A7} - C:\WINDOWS\DH.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4a\ashDisp.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [keyboard] c:\windows\keyboard14.exe O4 - HKLM\..\Run: [mousepad] c:\windows\mousepad14.exe O4 - HKLM\..\Run: [newname] c:\windows\newname14.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [EQBranch] "C:\Program Files\EQBranch\EQBranch.exe" O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Pobierz z &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O17 - HKLM\System\CCS\Services\Tcpip\..\{20332EBC-0BAB-49FC-BE52-180E0EED3F1A}: NameServer = 194.204.152.34 217.98.63.164 O18 - Filter: text/html - {994D478A-45D0-4DB4-AE77-288B1E346E99} - C:\Program Files\FCAdvice\FCAdvice.dll O20 - AppInit_DLLs: Runner.dll,Runner.dll,gbjkbnof.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4a\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4a\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4a\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4a\ashWebSv.exe" /service (file missing) O23 - Service: ewido security suite control - ewido networks - d:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

**Posty:** 1665 · przez **SER** 26 Kwi 2006, 13:54

C:\Program Files\Internet Optimizer\optimize.exe
c:\windows\mousepad14.exe
c:\drsmartload1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com

O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_22.dll
O2 - BHO: (no name) - {6001CDF7-6F45-471b-A203-0225615E35A7} - C:\WINDOWS\DH.dll

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [keyboard] c:\windows\keyboard14.exe
O4 - HKLM\..\Run: [mousepad] c:\windows\mousepad14.exe
O4 - HKLM\..\Run: [newname] c:\windows\newname14.exe
O4 - HKCU\..\Run: [EQBranch] "C:\Program Files\EQBranch\EQBranch.exe"
O18 - Filter: text/html - {994D478A-45D0-4DB4-AE77-288B1E346E99} - C:\Program Files\FCAdvice\FCAdvice.dll

Usuwasz w trybie awaryjnym, z wyłączonym Przywracaniem Systemu. Dodatkowo pogrubione pliki ręcznie z dysku

---------------------

O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

Pobierasz program LSPFix -> http://www.cexx.org/LSPFix.exe

Uruchamiasz, zaznaczasz I'm know what I'm doing, następnie w okienku Keep zaznaczasz newdotnet7_22.dll i za pomocą strzałki (>>) przenosisz do okienka Remover i naciskasz Finish

-------------------------

O20 - AppInit_DLLs: Runner.dll,Runner.dll,gbjkbnof.dll

Nie wiem, co to jest ...

**Posty:** 18165 · przez **wojtas** 26 Kwi 2006, 14:23

daj loga po zabiegach:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:04:40, on 2006-04-26 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Alwil Software\Avast4a\aswUpdSv.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe D:\Program Files\Winamp\winampa.exe D:\Program Files\Alwil Software\Avast4a\ashServ.exe D:\PROGRA~1\ALWILS~1\Avast4a\ashDisp.exe C:\WINDOWS\System32\rundll32.exe D:\Program Files\Gadu-Gadu\gg.exe d:\Program Files\ewido anti-malware\ewidoctrl.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Program Files\Alwil Software\Avast4a\ashWebSv.exe D:\Program Files\Alwil Software\Avast4a\ashMaiSv.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe D:\Program Files\Winamp\winamp.exe C:\WINDOWS\System32\wuauclt.exe D:\firefox\firefox.exe D:\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4a\ashDisp.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Pobierz z &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{20332EBC-0BAB-49FC-BE52-180E0EED3F1A}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4a\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4a\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4a\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4a\ashWebSv.exe" /service (file missing) O23 - Service: ewido security suite control - ewido networks - d:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

**Posty:** 1665 · przez **SER** 26 Kwi 2006, 14:29

Czysto

**Posty:** 18165 · przez **wojtas** 26 Kwi 2006, 14:31

Ale na c w program files wyskoczyly mi takie pliki ktorych wtedy nie mialm

**Posty:** 1665 · przez **SER** 26 Kwi 2006, 14:32

W poprzednim poście mówiłem Ci, żebyś je usunął

Autor postu otrzymał pochwałę

**Posty:** 18165 · przez **wojtas** 26 Kwi 2006, 14:35

Usuwalem to co kazales!!ale to juz tez skasowalem!!chyba jest oki a chcesz jeszcze jakiegos loga do kontroli??

**Posty:** 1665 · przez **SER** 26 Kwi 2006, 14:47

wojtas19162 napisał(a):chcesz jeszcze jakiegos loga do kontroli??

Możesz jeszcze system przeskanować Ewido i dać wynik, ale nie musisz, jak już jest wszystko OK

**Posty:** 18165 · przez **wojtas** 26 Kwi 2006, 14:52

Dam jeszcze z Ewido:

Kod: Zaznacz wszystko: --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 13:33:35, 2006-04-26 + Report-Checksum: F0332A2C + Scan result: HKLM\SOFTWARE\Avenue Media -> Adware.InternetOptimizer : Cleaned with backup [1448] C:\WINDOWS\System32\gbjkbnof.dll -> Adware.Agent : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@ad.adocean[2].txt -> TrackingCookie.Adocean : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@idg.adocean[1].txt -> TrackingCookie.Adocean : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@my.adocean[1].txt -> TrackingCookie.Adocean : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@stat.onestat[1].txt -> TrackingCookie.Onestat : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup :mozilla.12:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup :mozilla.13:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup :mozilla.26:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.27:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.28:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.29:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.30:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.31:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.32:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.33:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.34:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.43:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.44:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.57:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup :mozilla.65:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.75:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.76:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup :mozilla.142:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.161:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup C:\Documents and Settings\MUCHA\Ustawienia lokalne\Temp\13.tmp -> Downloader.Agent.aio : Cleaned with backup C:\Documents and Settings\MUCHA\Ustawienia lokalne\Temp\14.tmp -> Downloader.Agent.aio : Cleaned with backup C:\Documents and Settings\MUCHA\Ustawienia lokalne\Temp\15.tmp -> Trojan.Small : Cleaned with backup C:\Documents and Settings\MUCHA\Ustawienia lokalne\Temp\19.tmp -> Trojan.Small : Cleaned with backup C:\Documents and Settings\MUCHA\Ustawienia lokalne\Temp\MONEY1.exe -> Downloader.Adload.t : Cleaned with backup C:\Documents and Settings\MUCHA\Ustawienia lokalne\Temp\Transpd.dll -> Adware.Agent : Cleaned with backup C:\Documents and Settings\MUCHA\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G2T475ER\nem220[1].dll -> Downloader.Dyfuca : Cleaned with backup C:\Documents and Settings\MUCHA\Ustawienia lokalne\Temporary Internet Files\Content.IE5\GRD3YERD\Installer[1].exe -> Adware.Look2Me : Cleaned with backup C:\Documents and Settings\MUCHA\Ustawienia lokalne\Temporary Internet Files\Content.IE5\GRD3YERD\MTE3NDI6ODoxNg[1].exe -> Downloader.Small.buy : Cleaned with backup C:\Documents and Settings\MUCHA\Ustawienia lokalne\Temporary Internet Files\Content.IE5\QBSD6BWP\MONEY1[1].exe -> Downloader.Adload.t : Cleaned with backup C:\Program Files\TheSearchAccelerator -> Adware.UCmore : Cleaned with backup C:\Program Files\TheSearchAccelerator\INSTALL.LOG -> Adware.UCmore : Cleaned with backup C:\Program Files\TheSearchAccelerator\logo.ico -> Adware.UCmore : Cleaned with backup C:\Program Files\TheSearchAccelerator\toolbar.cfg -> Adware.UCmore : Cleaned with backup C:\Program Files\TheSearchAccelerator\UNWISE.EXE -> Adware.UCmore : Cleaned with backup C:\WINDOWS\Installer.exe -> Adware.Look2Me : Cleaned with backup C:\WINDOWS\MTE3NDI6ODoxNg.exe -> Downloader.Small.buy : Cleaned with backup C:\WINDOWS\NDNuninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup C:\WINDOWS\NDNuninstall7_22.exe -> Adware.NewDotNet : Cleaned with backup C:\WINDOWS\nem220.dll -> Downloader.Dyfuca : Cleaned with backup C:\WINDOWS\system32\gbjkbnof.dll -> Adware.Agent : Cleaned with backup C:\WINDOWS\system32\Runner.dll -> Adware.CASClient : Cleaned with backup ::Report End

**Posty:** 8694 · przez **Red** 26 Kwi 2006, 14:56

wyczyścić koniecznie temp:Start do awaryjnego .
Start >>> Uruchom >>> cmd

Wpisz następujące komendy, każdą potwierdzając za pomocą ENTER:

RD /S /Q "C:\Documents and settings\MUCHA\Ustawienia lokalne\Temp"
RD /S /Q "C:\Documents and settings\MUCHA\Ustawienia lokalne\Temporary internet files"

i raz jeszcze daj log z ewido po przeskanowaniu ....

**Posty:** 1665 · przez **SER** 26 Kwi 2006, 15:00

Dodatkowo, jeśli będzie skasuj ręcznie folder

C:\Program Files\TheSearchAccelerator

**Posty:** 18165 · przez **wojtas** 26 Kwi 2006, 22:26

Red napisał(a):RD /S /Q "C:\Documents and settings\MUCHA\Ustawienia lokalne\Temporary internet files"

otoz tego nie moge zrobic z tym pierwszym mi sie udalo ale z tym na gorze nie!A oto log:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

Kod: Zaznacz wszystko: + Created on: 20:58:40, 2006-04-26 + Report-Checksum: 99B710A2 + Scan result: C:\Documents and Settings\MUCHA\Cookies\mucha@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup :mozilla.15:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.16:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.17:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.18:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup ::Report End

przez **Tom@szek** 26 Kwi 2006, 22:34

wojtas19162 napisał(a):RD /S /Q "C:\Documents and settings\MUCHA\Ustawienia lokalne\Temporary internet files"

Napisz dużymi literami Temporary Internet Files

**Posty:** 18165 · przez **wojtas** 27 Kwi 2006, 15:35

dalem to co kazales RED i Tom@szek!!a oto log:

Kod: Zaznacz wszystko: --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 14:12:22, 2006-04-27 + Report-Checksum: 850CCF3 + Scan result: C:\Documents and Settings\MUCHA\Cookies\mucha@gde.adocean[2].txt -> TrackingCookie.Adocean : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@hotlog[1].txt -> TrackingCookie.Hotlog : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@spylog[1].txt -> TrackingCookie.Spylog : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup C:\Documents and Settings\MUCHA\Cookies\mucha@yadro[2].txt -> TrackingCookie.Yadro : Cleaned with backup :mozilla.14:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup :mozilla.25:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.26:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.27:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.30:C:\Documents and Settings\MUCHA\Dane aplikacji\Mozilla\Firefox\Profiles\4cpsugn6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup ::Report End

**Posty:** 1665 · przez **SER** 27 Kwi 2006, 15:40

Zostały już tylko niegroźne ciasteczka od Firefox'a

Objawy ustąpiły :?:

**Posty:** 18165 · przez **wojtas** 27 Kwi 2006, 15:41

Tak avast nic naraznie nie wykrywa zadnych trojanow nic!!dzieks za pomoc!!wszystkim pzdr!!

**Posty:** 1665 · przez **SER** 27 Kwi 2006, 15:48

Zaktualizuj IE i zainstaluj SP2 (jeśli masz legalnego Windows'a), bo ostatnio bardzo często dajesz logi, z dużą ilością syfu

**Posty:** 18165 · przez **wojtas** 27 Kwi 2006, 15:49

SER napisał(a):Zaktualizuj IE

A jak to zrobic :?:

**Posty:** 566 · przez **Bieniol** 27 Kwi 2006, 17:14

Poczytaj TUTAJ --> interesuje Cie "Dodatek Service Pack 1 dla programu Microsoft Internet Explorer 6"

prosze o sprawdzenie loga

prosze o sprawdzenie loga

Kto jest na forum