proszę o sprawdzenie logów...

[daro215]

Ostatnimi czasy w IE przekierowywuje mnie na dziwne strony, choć strona startowa została bez zmian... wogole net od jakiegoś tygodnia strasznie pinguje i wysyła pakiety, chociaż nawet nie korzystam z internetu...

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 14:28:26, on 2007-07-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
D:\Program Files\BitComet\BitComet.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Program Files\Winamp\winamp.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Darek\Pulpit\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = w3cache.stk.net.pl:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{025711A9-C38F-4826-9E23-0D7717DEDDD4}: NameServer = 85.255.115.158,85.255.112.107
O17 - HKLM\System\CCS\Services\Tcpip\..\{4D96E680-AEE7-44C7-A9D0-529C70D44229}: NameServer = 85.255.115.158,85.255.112.107
O17 - HKLM\System\CCS\Services\Tcpip\..\{910DC4B0-C652-4C77-A211-686932CBB008}: NameServer = 85.255.115.158,85.255.112.107
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E3812E6-1933-4877-80DD-15201ED35B21}: NameServer = 85.255.115.158,85.255.112.107
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA5F8ED3-47E7-4B16-B119-4BB6446002FC}: NameServer = 85.255.115.158,85.255.112.107
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.158 85.255.112.107
O17 - HKLM\System\CS1\Services\Tcpip\..\{025711A9-C38F-4826-9E23-0D7717DEDDD4}: NameServer = 85.255.115.158,85.255.112.107
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.158 85.255.112.107
O17 - HKLM\System\CS2\Services\Tcpip\..\{025711A9-C38F-4826-9E23-0D7717DEDDD4}: NameServer = 85.255.115.158,85.255.112.107
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.158 85.255.112.107
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VRS Recording System Service (VRSService) - Unknown owner - C:\Program Files\NCH Swift Sound\VRS\vrs.exe" -service (file missing)

Ja sie na tym nie znam... wiec oddaje to w ręce specjalistów
Z góry dzięki za pomoc...

[wojtas]

Ściągnij program http://downloads.subratam.org/Fixwareout.exe i zastosuj go

potem nowe log z hijacka oraz z combofixa

[daro215]

ComboFix

Kod: Zaznacz wszystko

ComboFix 07-07-30.2 - "Darek" 2007-07-31 15:22:23.1 [GMT 2:00] - NTFS
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.Prawda
* Created a new restore point


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\Darek\Pulpit.\internet explorer.lnk
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\WINDOWS\xhelper.dll


(((((((((((((((((((((((((   Files Created from 2007-06-28 to 2007-07-31  )))))))))))))))))))))))))))))))


2007-07-31 15:22   51,200   --a------   C:\WINDOWS\nircmd.exe
2007-07-31 15:17   9,195   --a------   C:\dnsbak.reg
2007-07-27 22:12   <DIR>   d--------   C:\Downloads
2007-07-25 23:03   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles
2007-07-24 23:43   <DIR>   d--------   C:\Program Files\Theme Park World Fix
2007-07-24 22:40   68,888   --a------   C:\WINDOWS\system32\xinput1_3.dll
2007-07-24 22:40   62,744   --a------   C:\WINDOWS\system32\xinput1_2.dll
2007-07-24 22:40   251,672   --a------   C:\WINDOWS\system32\xactengine2_5.dll
2007-07-24 22:40   237,848   --a------   C:\WINDOWS\system32\xactengine2_4.dll
2007-07-24 22:40   236,824   --a------   C:\WINDOWS\system32\xactengine2_3.dll
2007-07-24 22:40   2,414,360   --a------   C:\WINDOWS\system32\d3dx9_31.dll
2007-07-24 22:40   15,128   --a------   C:\WINDOWS\system32\x3daudio1_1.dll
2007-07-14 12:06   <DIR>   d--------   C:\DOCUME~1\Darek\DANEAP~1\Media Player Classic
2007-07-14 12:05   73,728   --a------   C:\WINDOWS\system32\dpl100.dll
2007-07-14 12:05   593,920   --a------   C:\WINDOWS\system32\xvidcore.dll
2007-07-14 12:05   564,224   --a------   C:\WINDOWS\system32\x264vfw.dll
2007-07-14 12:05   3,596,288   --a------   C:\WINDOWS\system32\qt-dx331.dll
2007-07-14 12:05   217,088   --a------   C:\WINDOWS\system32\yv12vfw.dll
2007-07-14 12:05   180,224   --a------   C:\WINDOWS\system32\xvidvfw.dll
2007-07-14 12:05   10,752   --a------   C:\WINDOWS\system32\ff_vfw.dll
2007-07-14 11:41   448,512   --a------   C:\WINDOWS\system32\avformat-50.dll
2007-07-14 11:41   3,345,408   --a------   C:\WINDOWS\system32\avcodec-51.dll
2007-07-14 11:41   19,968   --a------   C:\WINDOWS\system32\avutil-49.dll
2007-07-14 11:41   <DIR>   d--------   C:\Program Files\Common Files\Eltima Shared
2007-07-14 11:41   <DIR>   d--------   C:\DOCUME~1\Darek\DANEAP~1\Eltima Software
2007-06-20 16:30   <DIR>   d---s----   C:\DOCUME~1\Danka\UserData
2007-06-13 14:44   225,280   --a------   C:\WINDOWS\system32\rewire.dll
2007-06-13 14:44   <DIR>   d--------   C:\Program Files\Image-Line
2007-06-11 13:32   63,488   --a------   C:\WINDOWS\system32\unam4ie.exe
2007-06-11 13:32   4,608   --a------   C:\WINDOWS\system32\w95inf32.dll
2007-06-11 13:32   38,160   --a------   C:\WINDOWS\system32\LMRTREND.dll
2007-06-11 13:32   2,272   --a------   C:\WINDOWS\system32\w95inf16.dll
2007-06-11 13:32   194,320   --a------   C:\WINDOWS\system32\qcut.dll
2007-06-11 13:32   182,032   --a------   C:\WINDOWS\system32\dxtmsft3.dll
2007-06-11 13:32   10,240   --a------   C:\WINDOWS\system32\vidx16.dll
2007-06-03 21:36   <DIR>   d---s----   C:\DOCUME~1\Darek\UserData


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-30 11:51   ---------   d--------   C:\DOCUME~1\Darek\DANEAP~1\Azureus
2007-07-29 12:31   ---------   d--------   C:\Program Files\NAPI-PROJEKT
2007-07-27 22:12   2560   --a------   C:\WINDOWS\system32\BitCometRes.dll
2007-07-27 21:59   ---------   d--------   C:\DOCUME~1\Darek\DANEAP~1\uTorrent
2007-06-26 11:09   163644   --a------   C:\WINDOWS\system32\drivers\secdrv.sys
2007-06-25 12:17   ---------   d--h-----   C:\Program Files\InstallShield Installation Information
2007-05-31 16:40   ---------   d--------   C:\DOCUME~1\Darek\DANEAP~1\NCH Swift Sound
2007-05-31 08:44   740442   --a------   C:\WINDOWS\system32\divx.dll
2007-05-30 16:38   ---------   d--------   C:\Program Files\WIBUKEY
2007-05-30 16:38   ---------   d--------   C:\Program Files\WIBU-SYSTEMS
2007-05-30 16:37   ---------   d--------   C:\Program Files\Motorola
2007-05-29 14:48   ---------   d--------   C:\Program Files\Winamp
2007-05-26 20:45   79   --a------   C:\WINDOWS\system32\sysogg.dll
2007-05-26 20:36   987136   --a------   C:\WINDOWS\system32\agsaamh.dll
2007-05-26 20:36   90112   --a------   C:\WINDOWS\system32\agsaami.dll
2007-05-26 20:36   610304   --a------   C:\WINDOWS\system32\agsaamg.dll
2007-05-26 20:36   46   --a------   C:\WINDOWS\system32\winitn.dll
2007-05-26 20:36   46   --a------   C:\WINDOWS\system32\kakle.dll
2007-05-26 20:36   372736   --a------   C:\WINDOWS\system32\agsaamc.dll
2007-05-26 20:36   331776   --a------   C:\WINDOWS\system32\agsaama.dll
2007-05-26 20:36   2535424   --a------   C:\WINDOWS\system32\agsaamj.dll
2007-05-26 20:36   237568   --a------   C:\WINDOWS\system32\lame_enc.dll
2007-05-26 20:36   1986560   --a------   C:\WINDOWS\system32\akll.dll
2007-05-26 20:36   196608   --a------   C:\WINDOWS\system32\maag.dll
2007-05-26 20:36   1245184   --a------   C:\WINDOWS\system32\bkll.dll
2007-05-26 20:36   1212416   --a------   C:\WINDOWS\system32\ckll.dll
2007-05-24 21:49   108144   --a------   C:\WINDOWS\system32\CmdLineExt.dll
2007-05-13 20:30   35363   --a------   C:\WINDOWS\system32\windrvNT.sys
2007-05-10 17:10   74230   --a------   C:\WINDOWS\system32\perfc015.dat
2007-05-10 17:10   448004   --a------   C:\WINDOWS\system32\perfh015.dat
2007-04-30 17:46   745600   --a------   C:\WINDOWS\system32\aswBoot.exe
2007-04-30 17:35   95872   --a------   C:\WINDOWS\system32\AVASTSS.scr


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
         C:\WINDOWS\xhelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-17 13:12]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-07-16 17:33:36]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BlueSoleil.lnk
backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Darek^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Darek\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Darek^Menu Start^Programy^Autostart^BitComet Acceleration Patch.lnk]
path=C:\Documents and Settings\Darek\Menu Start\Programy\Autostart\BitComet Acceleration Patch.lnk
backup=C:\WINDOWS\pss\BitComet Acceleration Patch.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AxonRun]
"C:\Program Files\NCH Swift Sound\Axon\axon.exe" -logon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearFlix]
"d:\Program Files\BearFlix\BearFlix.exe" /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
"C:\Program Files\BearShare\BearShare.exe" /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMSRun]
"C:\Program Files\NCH Swift Sound\IMS\ims.exe" -logon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RunDLL32.exe NvMCTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
d:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Red Swoosh]
C:\Program Files\RSSoft\RedSwoosh.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkRun]
"C:\Program Files\NCH Swift Sound\Talk\talk.exe" -logon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VRSRun]
"C:\Program Files\NCH Swift Sound\VRS\vrs.exe" -logon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"TapiSrv"=3 (0x3)
"IMSService"=2 (0x2)
"IDriverT"=3 (0x3)
"AxonService"=2 (0x2)
"Adobe LM Service"=3 (0x3)

R0 BTHidMgr;Bluetooth HID Manager Service;C:\WINDOWS\system32\Drivers\BTHidMgr.sys
R0 imagedrv;imagedrv;C:\WINDOWS\system32\Drivers\imagedrv.sys
R0 imagesrv;imagesrv;C:\WINDOWS\system32\DRIVERS\imagesrv.sys
R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys
R2 windrvNT;windrvNT;\??\C:\WINDOWS\system32\windrvNT.sys
R3 BlueletAudio;Bluetooth Audio Service;C:\WINDOWS\system32\DRIVERS\blueletaudio.sys
R3 BlueletSCOAudio;Bluetooth SCO Audio Service;C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys
R3 BT;Bluetooth PAN Network Adapter;C:\WINDOWS\system32\DRIVERS\btnetdrv.sys
R3 BTHidEnum;Bluetooth HID Enumerator;C:\WINDOWS\system32\DRIVERS\vbtenum.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 UsbCmxp;Scientific Atlanta WebSTAR 2000 series Cable Modem;C:\WINDOWS\system32\DRIVERS\sacmxp2.sys
R3 VComm;Virtual Serial port driver;C:\WINDOWS\system32\DRIVERS\VComm.sys
R3 VcommMgr;Bluetooth VComm Manager Service;C:\WINDOWS\system32\Drivers\VcommMgr.sys
R3 WMIBIOS;%WMIBIOS.ServiceName%;C:\WINDOWS\system32\Drivers\wmibios.sys
R3 WMIINFO;WMIINFO Driver;C:\WINDOWS\system32\Drivers\wmiinfo.sys
S0 NVStrap;NVStrap;C:\WINDOWS\system32\drivers\NVStrap.sys
S2 VRSService;VRS Recording System Service;"C:\Program Files\NCH Swift Sound\VRS\vrs.exe" -service
S3 Btcsrusb;Bluetooth USB For Bluetooth Service;C:\WINDOWS\system32\Drivers\btcusb.sys
S3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
S3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5b.sys
S3 NTSIM;NTSIM;\??\C:\WINDOWS\system32\ntsim.sys
S3 P2k;Motorola USB Device;C:\WINDOWS\system32\DRIVERS\P2k.sys
S3 RivaTuner32;RivaTuner32;\??\d:\Program Files\RivaTuner v2.01\RivaTuner32.sys
S3 usbser;Motorola USB Modem Driver;C:\WINDOWS\system32\DRIVERS\usbser.sys
S4 AxonService;Axon Service;"C:\Program Files\NCH Swift Sound\Axon\axon.exe" -service
S4 IMSService;IMS Telephone On-Hold Player Service;"C:\Program Files\NCH Swift Sound\IMS\ims.exe" -service


Hijack

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 15:26:43, on 2007-07-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Darek\Pulpit\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = w3cache.stk.net.pl:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VRS Recording System Service (VRSService) - Unknown owner - C:\Program Files\NCH Swift Sound\VRS\vrs.exe" -service (file missing)



[wojtas]

skasuj ten wpis:

O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll (file missing)

oraz ten plik"

C:\dnsbak.reg

[daro215]

dzięki bardzo za pomoc