win32:trojan-gen. {other}

[Antytalent]

Witam.

Zwracam sie z uprzejmą prośbą o pomoc bo sam nie jestem w stanie sobie poradzić.
1. Zadomowił się u mnie Win32:Trojan-gen. {Other} i co kilka minut avast o tym komunikuje - usunięcie nic nie daje. Umiejscawia sie w róznych plikach, ostatnio w C:\WINDOWS\swuzz.dll.
2. W ostatnim czasie komputer bardzo "spowolniał" ok. 10-krotnie, szczególnie podczas ściągania plików.

To te najbardziej uprzykrzające niedogodności, z innymi może uda mi się żyć.

Ponieważ jestem mocno zaawansowany wiekowo i język czy też slang komputerowy jest mi obcy, uprzejmie proszę o przedstawienie sposobu postepowania w formie dla przedszkolaków (łopatologicznie).

Z góry serdecznie dziękuję za każda udzieloną formę pomocy.

Poniżej przedstawiam swój log, bo pewnie będzie niezbędny.

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 10:48:42, on 2006-02-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\appsr.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\setrysvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\semwltry.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe
C:\WINDOWS\system32\sdkyy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\Abc\USTAWI~1\Temp\Katalog tymczasowy 5 dla hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2EE72B4F-E40E-EFB8-15AA-4EB5AE709679} - (no file)
O2 - BHO: (no name) - {43E92535-41C0-42A6-6DD1-EC22B7AA19CC} - (no file)
O2 - BHO: (no name) - {66EF3492-6791-E464-2878-82061A226166} - (no file)
O2 - BHO: (no name) - {7561BD5A-4319-21D1-6A49-CBCE972E06E8} - (no file)
O2 - BHO: (no name) - {882631A5-5AE7-4F3B-DA2D-18C71F0FDF23} - (no file)
O2 - BHO: (no name) - {8C8EAD04-425B-319C-5458-9026C339B635} - (no file)
O2 - BHO: (no name) - {A49D52A9-DE08-47DE-6764-86D278A7683C} - (no file)
O2 - BHO: Class - {B13C0965-868F-283A-5E4E-C1B07A643E7A} - C:\WINDOWS\croj32.dll
O2 - BHO: (no name) - {BEFD1E91-36B1-6755-D849-210CC3AF2625} - (no file)
O2 - BHO: (no name) - {EC236CC0-5AF7-7707-E395-50D819B1C42A} - (no file)
O2 - BHO: (no name) - {F24066EC-902B-5FD0-38BE-FCBA8F762791} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKLM\..\Run: [winpv32.exe] C:\WINDOWS\winpv32.exe
O4 - HKLM\..\Run: [apibd.exe] C:\WINDOWS\apibd.exe
O4 - HKLM\..\Run: [syswt32.exe] C:\WINDOWS\system32\syswt32.exe
O4 - HKLM\..\Run: [appgi.exe] C:\WINDOWS\system32\appgi.exe
O4 - HKLM\..\Run: [d3cf32.exe] C:\WINDOWS\d3cf32.exe
O4 - HKLM\..\Run: [sysme32.exe] C:\WINDOWS\system32\sysme32.exe
O4 - HKLM\..\Run: [cras32.exe] C:\WINDOWS\system32\cras32.exe
O4 - HKLM\..\Run: [winij.exe] C:\WINDOWS\system32\winij.exe
O4 - HKLM\..\Run: [sdkdx32.exe] C:\WINDOWS\sdkdx32.exe
O4 - HKLM\..\Run: [ntkk32.exe] C:\WINDOWS\system32\ntkk32.exe
O4 - HKLM\..\Run: [sdkyy.exe] C:\WINDOWS\system32\sdkyy.exe
O4 - HKLM\..\Run: [apimc.exe] C:\WINDOWS\apimc.exe
O4 - HKLM\..\Run: [sdkte.exe] C:\WINDOWS\sdkte.exe
O4 - HKLM\..\Run: [mfcil32.exe] C:\WINDOWS\mfcil32.exe
O4 - HKLM\..\Run: [addjx32.exe] C:\WINDOWS\system32\addjx32.exe
O4 - HKLM\..\Run: [iprs32.exe] C:\WINDOWS\system32\iprs32.exe
O4 - HKLM\..\Run: [crjc32.exe] C:\WINDOWS\crjc32.exe
O4 - HKLM\..\Run: [sysrt32.exe] C:\WINDOWS\sysrt32.exe
O4 - HKLM\..\Run: [crst.exe] C:\WINDOWS\system32\crst.exe
O4 - HKLM\..\Run: [javapt.exe] C:\WINDOWS\javapt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_17.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_39.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_23.cab
O23 - Service: Network Security Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\appsr.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe
O23 - Service: SmartFinder Uninstall (SmartFinder_Uninstall) - Unknown owner - D:\SFUninstaller.exe"  service (file missing)

[Red]

wylacz przywracanie systemu ,wejdz w tryb awaryjny windowsa f8 i usuwasz

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {2EE72B4F-E40E-EFB8-15AA-4EB5AE709679} - (no file)
O2 - BHO: (no name) - {43E92535-41C0-42A6-6DD1-EC22B7AA19CC} - (no file)
O2 - BHO: (no name) - {66EF3492-6791-E464-2878-82061A226166} - (no file)
O2 - BHO: (no name) - {7561BD5A-4319-21D1-6A49-CBCE972E06E8} - (no file)
O2 - BHO: (no name) - {882631A5-5AE7-4F3B-DA2D-18C71F0FDF23} - (no file)
O2 - BHO: (no name) - {8C8EAD04-425B-319C-5458-9026C339B635} - (no file)
O2 - BHO: (no name) - {A49D52A9-DE08-47DE-6764-86D278A7683C} - (no file)
O2 - BHO: Class - {B13C0965-868F-283A-5E4E-C1B07A643E7A} - C:\WINDOWS\croj32.dll
O2 - BHO: (no name) - {BEFD1E91-36B1-6755-D849-210CC3AF2625} - (no file)
O2 - BHO: (no name) - {EC236CC0-5AF7-7707-E395-50D819B1C42A} - (no file)
O2 - BHO: (no name) - {F24066EC-902B-5FD0-38BE-FCBA8F762791} - (no file)
O4 - HKLM\..\Run: [winpv32.exe] C:\WINDOWS\winpv32.exe
O4 - HKLM\..\Run: [apibd.exe] C:\WINDOWS\apibd.exe
O4 - HKLM\..\Run: [syswt32.exe] C:\WINDOWS\system32\syswt32.exe
O4 - HKLM\..\Run: [appgi.exe] C:\WINDOWS\system32\appgi.exe
O4 - HKLM\..\Run: [d3cf32.exe] C:\WINDOWS\d3cf32.exe
O4 - HKLM\..\Run: [sysme32.exe] C:\WINDOWS\system32\sysme32.exe
O4 - HKLM\..\Run: [cras32.exe] C:\WINDOWS\system32\cras32.exe
O4 - HKLM\..\Run: [winij.exe] C:\WINDOWS\system32\winij.exe
O4 - HKLM\..\Run: [sdkdx32.exe] C:\WINDOWS\sdkdx32.exe
O4 - HKLM\..\Run: [ntkk32.exe] C:\WINDOWS\system32\ntkk32.exe
O4 - HKLM\..\Run: [sdkyy.exe] C:\WINDOWS\system32\sdkyy.exe
O4 - HKLM\..\Run: [apimc.exe] C:\WINDOWS\apimc.exe
O4 - HKLM\..\Run: [sdkte.exe] C:\WINDOWS\sdkte.exe
O4 - HKLM\..\Run: [mfcil32.exe] C:\WINDOWS\mfcil32.exe
O4 - HKLM\..\Run: [addjx32.exe] C:\WINDOWS\system32\addjx32.exe
O4 - HKLM\..\Run: [iprs32.exe] C:\WINDOWS\system32\iprs32.exe
O4 - HKLM\..\Run: [crjc32.exe] C:\WINDOWS\crjc32.exe
O4 - HKLM\..\Run: [sysrt32.exe] C:\WINDOWS\sysrt32.exe
O4 - HKLM\..\Run: [crst.exe] C:\WINDOWS\system32\crst.exe
O4 - HKLM\..\Run: [javapt.exe] C:\WINDOWS\javapt.exe

Usuwasz wpisy w hijacku a to co pogrubiłem recznie z dysku i dajesz log do kontroli

[Tom@szek]

Wyłącz pezywracanie system i start dop wawaryjnego.
Usuwasz wpisy w hijackthis później ręcznie [pgrubione z dysku.

C:\WINDOWS\appsr.exe
C:\WINDOWS\System32\setrysvc.exe
C:\WINDOWS\System32\semwltry.exe
C:\WINDOWS\system32\sdkyy.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\swuzz.dll/sp.html#21044%resultposition.net
R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {2EE72B4F-E40E-EFB8-15AA-4EB5AE709679} - (no file)
O2 - BHO: (no name) - {43E92535-41C0-42A6-6DD1-EC22B7AA19CC} - (no file)
O2 - BHO: (no name) - {66EF3492-6791-E464-2878-82061A226166} - (no file)
O2 - BHO: (no name) - {7561BD5A-4319-21D1-6A49-CBCE972E06E8} - (no file)
O2 - BHO: (no name) - {882631A5-5AE7-4F3B-DA2D-18C71F0FDF23} - (no file)
O2 - BHO: (no name) - {8C8EAD04-425B-319C-5458-9026C339B635} - (no file)
O2 - BHO: (no name) - {A49D52A9-DE08-47DE-6764-86D278A7683C} - (no file)
O2 - BHO: Class - {B13C0965-868F-283A-5E4E-C1B07A643E7A} - C:\WINDOWS\croj32.dll
O2 - BHO: (no name) - {BEFD1E91-36B1-6755-D849-210CC3AF2625} - (no file)
O2 - BHO: (no name) - {EC236CC0-5AF7-7707-E395-50D819B1C42A} - (no file)
O2 - BHO: (no name) - {F24066EC-902B-5FD0-38BE-FCBA8F762791} - (no file)

O4 - HKLM\..\Run: [winpv32.exe] C:\WINDOWS\winpv32.exe
O4 - HKLM\..\Run: [apibd.exe] C:\WINDOWS\apibd.exe
O4 - HKLM\..\Run: [syswt32.exe] C:\WINDOWS\system32\syswt32.exe
O4 - HKLM\..\Run: [appgi.exe] C:\WINDOWS\system32\appgi.exe
O4 - HKLM\..\Run: [d3cf32.exe] C:\WINDOWS\d3cf32.exe
O4 - HKLM\..\Run: [sysme32.exe] C:\WINDOWS\system32\sysme32.exe
O4 - HKLM\..\Run: [cras32.exe] C:\WINDOWS\system32\cras32.exe
O4 - HKLM\..\Run: [winij.exe] C:\WINDOWS\system32\winij.exe
O4 - HKLM\..\Run: [sdkdx32.exe] C:\WINDOWS\sdkdx32.exe
O4 - HKLM\..\Run: [ntkk32.exe] C:\WINDOWS\system32\ntkk32.exe
O4 - HKLM\..\Run: [sdkyy.exe] C:\WINDOWS\system32\sdkyy.exe
O4 - HKLM\..\Run: [apimc.exe] C:\WINDOWS\apimc.exe
O4 - HKLM\..\Run: [sdkte.exe] C:\WINDOWS\sdkte.exe
O4 - HKLM\..\Run: [mfcil32.exe] C:\WINDOWS\mfcil32.exe
O4 - HKLM\..\Run: [addjx32.exe] C:\WINDOWS\system32\addjx32.exe
O4 - HKLM\..\Run: [iprs32.exe] C:\WINDOWS\system32\iprs32.exe
O4 - HKLM\..\Run: [crjc32.exe] C:\WINDOWS\crjc32.exe
O4 - HKLM\..\Run: [sysrt32.exe] C:\WINDOWS\sysrt32.exe
O4 - HKLM\..\Run: [crst.exe] C:\WINDOWS\system32\crst.exe
O4 - HKLM\..\Run: [javapt.exe] C:\WINDOWS\javapt.exe

O23 - Service: Network Security Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\appsr.exe
O23 - Service: SmartFinder Uninstall (SmartFinder_Uninstall) - Unknown owner - D:\SFUninstaller.exe" service (file missing)

[Antytalent]

Witam ponownie.

Wykonałem to co nakazaliście z wyjątkiem usunięcia ręcznego następujących plików:

C:\WINDOWS\System32\semwltry.exe - bo ma on jakieś związek z moim modemem Sony Ericcson,

oraz poniższych , bo ich nie znalazłem (nie było ich):

O2 - BHO: Class - {B13C0965-868F-283A-5E4E-C1B07A643E7A} - C:\WINDOWS\croj32.dll
O4 - HKLM\..\Run: [winpv32.exe] C:\WINDOWS\winpv32.exe
O4 - HKLM\..\Run: [apibd.exe] C:\WINDOWS\apibd.exe
O4 - HKLM\..\Run: [syswt32.exe] C:\WINDOWS\system32\syswt32.exe
O4 - HKLM\..\Run: [appgi.exe] C:\WINDOWS\system32\appgi.exe
O4 - HKLM\..\Run: [d3cf32.exe] C:\WINDOWS\d3cf32.exe
O4 - HKLM\..\Run: [sysme32.exe] C:\WINDOWS\system32\sysme32.exe
O4 - HKLM\..\Run: [cras32.exe] C:\WINDOWS\system32\cras32.exe
O4 - HKLM\..\Run: [winij.exe] C:\WINDOWS\system32\winij.exe
O4 - HKLM\..\Run: [sdkdx32.exe] C:\WINDOWS\sdkdx32.exe
O4 - HKLM\..\Run: [ntkk32.exe] C:\WINDOWS\system32\ntkk32.exe
O4 - HKLM\..\Run: [sdkyy.exe] C:\WINDOWS\system32\sdkyy.exe
O4 - HKLM\..\Run: [mfcil32.exe] C:\WINDOWS\mfcil32.exe
O4 - HKLM\..\Run: [addjx32.exe] C:\WINDOWS\system32\addjx32.exe
Mój log po tych operacjach jest poniżej:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 17:10:25, on 2006-02-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe
C:\WINDOWS\system32\crum.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\addyy32.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\Abc\USTAWI~1\Temp\Katalog tymczasowy 7 dla hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {13B849C1-8710-E1DB-94A7-65402EF986A8} - C:\WINDOWS\system32\ipqj32.dll
O2 - BHO: (no name) - {2EE72B4F-E40E-EFB8-15AA-4EB5AE709679} - (no file)
O2 - BHO: (no name) - {43E92535-41C0-42A6-6DD1-EC22B7AA19CC} - (no file)
O2 - BHO: (no name) - {66EF3492-6791-E464-2878-82061A226166} - (no file)
O2 - BHO: (no name) - {7561BD5A-4319-21D1-6A49-CBCE972E06E8} - (no file)
O2 - BHO: (no name) - {882631A5-5AE7-4F3B-DA2D-18C71F0FDF23} - (no file)
O2 - BHO: (no name) - {8C8EAD04-425B-319C-5458-9026C339B635} - (no file)
O2 - BHO: (no name) - {A49D52A9-DE08-47DE-6764-86D278A7683C} - (no file)
O2 - BHO: (no name) - {B13C0965-868F-283A-5E4E-C1B07A643E7A} - (no file)
O2 - BHO: (no name) - {BEFD1E91-36B1-6755-D849-210CC3AF2625} - (no file)
O2 - BHO: (no name) - {EC236CC0-5AF7-7707-E395-50D819B1C42A} - (no file)
O2 - BHO: (no name) - {F24066EC-902B-5FD0-38BE-FCBA8F762791} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKLM\..\Run: [crum.exe] C:\WINDOWS\system32\crum.exe
O4 - HKLM\..\RunOnce: [addyy32.exe] C:\WINDOWS\addyy32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_17.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_39.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_23.cab
O23 - Service: Network Security Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\appsr.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe (file missing)
O23 - Service: SmartFinder Uninstall (SmartFinder_Uninstall) - Unknown owner - D:\SFUninstaller.exe"  service (file missing)      


[mafia435]

Z tego co widze to nie wiele usunełeś
Zrób to co napisali Red i Tom@szek.
Najpierw wpisy zachaczasz w hijackuthis i klikasz fix na dole.
Następnie te pliki co są pogrubione usuwasz ręcznie czyli znajdujesz plik i usuwasz i oprużniasz z kosza jak tam będą.

[Tom@szek]

W opcjach folderów zmień na - pokaż pliki systemowe i ukryte.

[Antytalent]

Zrobiłem wszystko ponownie i sytuacja sie nie zmieniła.
Nie znalazłem tych plików ani w ukrytych ani systemowych, ale też ich nie znajduję w logu więc chyba ich rzeczywiście nie ma.

Log identyczny jak w poprzednim poście.

Te w hijackthis zaczynające sie od 02- i 023- nie daja sie usunąć.

[Red]

do usuniecia:

R3 - Default URLSearchHook is missing
O2 - BHO: Class - {13B849C1-8710-E1DB-94A7-65402EF986A8} - C:\WINDOWS\system32\ipqj32.dll
O2 - BHO: (no name) - {2EE72B4F-E40E-EFB8-15AA-4EB5AE709679} - (no file)
O2 - BHO: (no name) - {43E92535-41C0-42A6-6DD1-EC22B7AA19CC} - (no file)
O2 - BHO: (no name) - {66EF3492-6791-E464-2878-82061A226166} - (no file)
O2 - BHO: (no name) - {7561BD5A-4319-21D1-6A49-CBCE972E06E8} - (no file)
O2 - BHO: (no name) - {882631A5-5AE7-4F3B-DA2D-18C71F0FDF23} - (no file)
O2 - BHO: (no name) - {8C8EAD04-425B-319C-5458-9026C339B635} - (no file)
O2 - BHO: (no name) - {A49D52A9-DE08-47DE-6764-86D278A7683C} - (no file)
O2 - BHO: (no name) - {B13C0965-868F-283A-5E4E-C1B07A643E7A} - (no file)
O2 - BHO: (no name) - {BEFD1E91-36B1-6755-D849-210CC3AF2625} - (no file)
O2 - BHO: (no name) - {EC236CC0-5AF7-7707-E395-50D819B1C42A} - (no file)
O2 - BHO: (no name) - {F24066EC-902B-5FD0-38BE-FCBA8F762791} - (no file)
O4 - HKLM\..\Run: [crum.exe] C:\WINDOWS\system32\crum.exe
O4 - HKLM\..\RunOnce: [addyy32.exe] C:\WINDOWS\addyy32.exe

to co ci pogrubiłem usuwasz recznie ,wpisy zaznaczasz w hijacku i fixujesz

Po wszystkim dajesz dwa logi:

z hijack this oraz:

otwierasz link>> http://www.silentrunners.org/Silent%20Runners.vbs >>zapisujesz jako na pulpicie>>klikasz dwa razy >>masz wybor i wybierasz no>>i czekasz troszke az wygeneruje sie cały log do konca
wrzucasz na forum

[Antytalent]

Wszystko wykonałem.
Zaznaczone pliki usunąłem.

Log z z hijackthis:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 21:30:42, on 2006-02-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\Abc\USTAWI~1\Temp\Katalog tymczasowy 10 dla hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {13B849C1-8710-E1DB-94A7-65402EF986A8} - (no file)
O2 - BHO: (no name) - {2EE72B4F-E40E-EFB8-15AA-4EB5AE709679} - (no file)
O2 - BHO: (no name) - {43E92535-41C0-42A6-6DD1-EC22B7AA19CC} - (no file)
O2 - BHO: (no name) - {66EF3492-6791-E464-2878-82061A226166} - (no file)
O2 - BHO: (no name) - {7561BD5A-4319-21D1-6A49-CBCE972E06E8} - (no file)
O2 - BHO: (no name) - {882631A5-5AE7-4F3B-DA2D-18C71F0FDF23} - (no file)
O2 - BHO: (no name) - {8C8EAD04-425B-319C-5458-9026C339B635} - (no file)
O2 - BHO: (no name) - {A49D52A9-DE08-47DE-6764-86D278A7683C} - (no file)
O2 - BHO: (no name) - {B13C0965-868F-283A-5E4E-C1B07A643E7A} - (no file)
O2 - BHO: (no name) - {BEFD1E91-36B1-6755-D849-210CC3AF2625} - (no file)
O2 - BHO: (no name) - {EC236CC0-5AF7-7707-E395-50D819B1C42A} - (no file)
O2 - BHO: (no name) - {F24066EC-902B-5FD0-38BE-FCBA8F762791} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_17.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_39.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_23.cab
O23 - Service: Network Security Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\appsr.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe (file missing)
O23 - Service: SmartFinder Uninstall (SmartFinder_Uninstall) - Unknown owner - D:\SFUninstaller.exe"  service (file missing)

Log z Silent Runners:

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision 43, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."]
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"]
"NBJ" = ""C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"RemoteControl" = "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" ["Cyberlink Corp."]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe"  -lang 1033" ["DAEMON'S HOME"]
"GCXX-Manager-Class" = ""C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup" ["Sony Ericsson"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Abc\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Startup items in "Abc" & "All Users" startup folders:
-----------------------------------------------------

C:\Documents and Settings\Abc\Menu Start\Programy\Autostart
"Webshots" -> shortcut to: "C:\Program Files\Webshots\Launcher.exe  /t" [null data]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 20
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\ = "&Badanie"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}"

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

INFECTION WARNING! The running services cannot be counted.
Presence of a spyware service is suspected.
The script has been forced to exit.



----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 221 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
  took 35 seconds.
---------- (total run time: 282 seconds)



[mafia435]

Nie wykasowałeś wszystkiego jeszcze z hijackthis.

[ Dodano: Dzisiaj o 21:58 ]
Podam ci przykład zobacz co masz jeszcze jak ty to usuwasz

Kod: Zaznacz wszystko

O2 - BHO: (no name) - {13B849C1-8710-E1DB-94A7-65402EF986A8} - (no file)
O2 - BHO: (no name) - {2EE72B4F-E40E-EFB8-15AA-4EB5AE709679} - (no file)
O2 - BHO: (no name) - {43E92535-41C0-42A6-6DD1-EC22B7AA19CC} - (no file)
O2 - BHO: (no name) - {66EF3492-6791-E464-2878-82061A226166} - (no file)
O2 - BHO: (no name) - {7561BD5A-4319-21D1-6A49-CBCE972E06E8} - (no file)
O2 - BHO: (no name) - {882631A5-5AE7-4F3B-DA2D-18C71F0FDF23} - (no file)
O2 - BHO: (no name) - {8C8EAD04-425B-319C-5458-9026C339B635} - (no file)
O2 - BHO: (no name) - {A49D52A9-DE08-47DE-6764-86D278A7683C} - (no file)
O2 - BHO: (no name) - {B13C0965-868F-283A-5E4E-C1B07A643E7A} - (no file)
O2 - BHO: (no name) - {BEFD1E91-36B1-6755-D849-210CC3AF2625} - (no file)
O2 - BHO: (no name) - {EC236CC0-5AF7-7707-E395-50D819B1C42A} - (no file)
O2 - BHO: (no name) - {F24066EC-902B-5FD0-38BE-FCBA8F762791} - (no file

[Red]

Wykonujesz:

Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop SmartFinder_Uninstall

sc delete SmartFinder_Uninstall


Nastepnie:

Start >>> Uruchom >>>wpisz komende>> services.msc >>> zatrzymaj i wyłącz Network Security Service(prawoklik na wpis--wlasciwosci--typ uruchamiania--wylaczony, potem:
Otwierasz HijackThis--- Misc Tools--- Delete NT Service--- wklepujesz Network Security Service>>> zawierdzasz. Nastepnie w hijacku usuwasz wpis 023


sciagasz :
http://www.bleepingcomputer.com/files/killbox.php

odpalasz Killboxa zaznacz opcję Delete on Reboot + All Files następnie w polu Full Path of File to Delete wklej scieżke:
C:\WINDOWS\appsr.exe wciskasz x
następnie program będzie pytał o restart-potwierdzasz

Czy wpisy 02 usuwasz w trybie awaryjnym???

Dajesz log ponownie do kontroli

[Antytalent]

wszystkie powyższe czynności wykonałem, sądzę, że z powodzeniem.
Niestety te wpisy 02 nie dają się usunąć.
Usuwam w trybie awaryjnym z wyłaczonym przywracaniem systemu, odznaczam je ptaszkami i naciskam Fix checked.
Dostaję jakiś komunikat, że pozycje BHO maja powiązanie z IExplorer i muszą być wszystkie okienka pozamykane, ale ja mam tylko okienko hijacka otwarte.

Log do kontroli:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 01:41:59, on 2006-02-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\Abc\USTAWI~1\Temp\Katalog tymczasowy 11 dla hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {13B849C1-8710-E1DB-94A7-65402EF986A8} - (no file)
O2 - BHO: (no name) - {2EE72B4F-E40E-EFB8-15AA-4EB5AE709679} - (no file)
O2 - BHO: (no name) - {43E92535-41C0-42A6-6DD1-EC22B7AA19CC} - (no file)
O2 - BHO: (no name) - {66EF3492-6791-E464-2878-82061A226166} - (no file)
O2 - BHO: (no name) - {7561BD5A-4319-21D1-6A49-CBCE972E06E8} - (no file)
O2 - BHO: (no name) - {882631A5-5AE7-4F3B-DA2D-18C71F0FDF23} - (no file)
O2 - BHO: (no name) - {8C8EAD04-425B-319C-5458-9026C339B635} - (no file)
O2 - BHO: (no name) - {A49D52A9-DE08-47DE-6764-86D278A7683C} - (no file)
O2 - BHO: (no name) - {B13C0965-868F-283A-5E4E-C1B07A643E7A} - (no file)
O2 - BHO: (no name) - {BEFD1E91-36B1-6755-D849-210CC3AF2625} - (no file)
O2 - BHO: (no name) - {EC236CC0-5AF7-7707-E395-50D819B1C42A} - (no file)
O2 - BHO: (no name) - {F24066EC-902B-5FD0-38BE-FCBA8F762791} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_17.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_39.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_23.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe (file missing)



[ Dodano: Dzisiaj o 22:55 ]
Witam.

Na razie wszystko działa bez zakłóceń. Niestety tych zapisów z 02 nie udało mi sie usunąć. Za pomoc serdecznie dziękuję.

Jeszcze tylko mam 2 pytania:

1. Czy po tych zabiegach ponownie zaznaczyć przywracanie systemu?

2. W jaki sposób nadać sobie uprawnienia do usunięcia Klucza rejestru HKEY_LOCAL_MACHINE:software\winhound.com\
Avast ciągle go wykazuje jako zarażony Malware.Psguard
, lecz nie usuwa.

Pozdrawiam.

[imperrator]

też mam Win32:Trojan-gen. {Other} jest w C:\DOCUME~1\Mateusz\USTAWI~1\Temp\ASFWHide

Logfile of HijackThis v1.99.1
Scan saved at 22:55:01, on 2007-05-03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\nvraidservice.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Program Files\PWN\Definicje\Bin\Starter.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\wbem\unsecapp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Winamp\winampa.exe
D:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe
E:\Program Files\Ashampoo\Ashampoo AntiSpyWare\AntiSpyWareGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
E:\Program Files\Ashampoo\Ashampoo AntiSpyWare\AntiSpyWareControl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
E:\Program Files\NGOATIOD172\ATT\atitray.exe
D:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
D:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Mateusz\USTAWI~1\Temp\Rar$EX00.859\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {F321218B-F47E-A9C8-D951-24074032ED0E} - syspanel.dll (file missing)
R3 - URLSearchHook: (no name) - {A66070E7-5766-DFF4-3429-94CF28C5A8FB} - SetupExeDll.dll (file missing)
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: XBTP05231 - {031F120A-BBAF-45d8-B306-375F2A6B9398} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Mario Forever Toolbar Helper - {8036D4D7-AAD3-4793-AB49-329E437155A8} - C:\Program Files\Mario Forever Toolbar\v2.0.0.3\Mario_Forever_Toolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - (no file)
O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-781cd0e19f00} - c:\program files\steganos internet anonym pro 7\siapro7iep.dll
O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - C:\Program Files\Mario Forever Toolbar\v2.0.0.3\Mario_Forever_Toolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\System32\nvraidservice.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [DemonStarter] C:\Program Files\PWN\Definicje\Bin\Starter.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Ashampoo FireWall] "D:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKLM\..\Run: [Ashampoo AntiSpyWare Guard] E:\Program Files\Ashampoo\Ashampoo AntiSpyWare\AntiSpyWareGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Anty_16BitNT Automatyczna Ochrona] C:\WINDOWS\Anty_16BitNT.exe AO
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SIAPRO7] "C:\Program Files\Steganos Internet Anonym Pro 7\SIAPRO7.exe" -boot
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKCU\..\Run: [Twoje TVN24] "C:\Program Files\Pasek TVN24\PasekTVN24.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Mateusz\Dane aplikacji\Mozilla\Firefox\Profiles\uixab9ud.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Mateusz\Dane aplikacji\Mozilla\Firefox\Profiles/uixab9ud.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"
O4 - Startup: ATI Tray Tools.lnk = E:\Program Files\NGOATIOD172\ATT\atitray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - D:\PROGRA~1\Agnitum\OUTPOS~1\TRASH.EXE (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - D:\PROGRA~1\Agnitum\OUTPOS~1\TRASH.EXE (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: d:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\ashampoo\ashampoo firewall\spi.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {112857FE-03FF-11D5-9A3F-0080C8D85044} (GameDesire Solitaires) - http://67.15.101.3/g_bin/pl/solitaire_2_0_0_20.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_17.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_67.cab
O16 - DPF: {4539348E-01D7-11D5-9A39-0080C8D85044} (GameDesire Slots 90th) - http://67.15.101.3/g_bin/pl/slots90_2_0_0_26.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqemea/pl/downloads/sysinfo.cab
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_19.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127659175546
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1128453907734
O16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) - http://67.15.101.3/g_bin/pl/demon_2_0_0_22.cab
O16 - DPF: {A1FE3DEF-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Pirate) - http://67.15.101.3/g_bin/pl/pirate_2_0_0_21.cab
O16 - DPF: {A8482EAF-A1F3-4934-AE3F-56EB195A50BF} (DeskUpdate - Activex Control) - http://support.fujitsu-siemens.de/DeskUpdate/isapi/activex.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.3/g_bin/pl/marbles_2_0_0_23.cab
O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} (GameDesire Darts Games) - http://67.15.101.3/g_bin/pl/darts_2_0_0_31.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - http://game01.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_24.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_24.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E98A7D3-7993-4325-80B5-AE8883E75FCE}: NameServer = 85.255.116.132,85.255.112.221
O17 - HKLM\System\CCS\Services\Tcpip\..\{917CA36F-4D65-4734-B561-011EE66D2616}: NameServer = 85.255.116.132,85.255.112.221
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe

proszę o pilną odpowiedź co mam zrobić

[wojtas]

imperrator zaloz swoj wlasny temat opisz problem jaki masz i obejmij logi w tagi

[imperrator]

co to znaczy logi w tagi?

[kidlerpl]

to oznacza, że twój log z hijacka ma być obłożony w :

coś takiego czyli tak zwany Quote

Kod: Zaznacz wszystko

albo w coś takiego czyli tak zwany code :)

[Red]

imperrator zaloz swoj wlasny temat

EOT