Bardzo prosze o sprawdzenie loga i pomoc

[balik (Balik10)]

czy ktos moglby mi sprawdzic loga?nie moge zmienic strony startowej.kurcze mam ustawionego kerio a i tak mi cos sie napchalo do kompa.

[Gutek]

A gdzie log?

[kuz5]

Jak wygenerowac i wkleic loga na forum masz opisane TUTAJ (dostepne sa demonstracje)

[balik (Balik10)]

Logfile of HijackThis v1.99.1 Scan saved at 21:48:02, on 2005-10-17 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINNT\system32\svchost.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\WINNT\system32\rundll32.exe C:\WINNT\system32\paytime.exe C:\WINNT\system32\internat.exe C:\WINNT\system32\paytime.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 127.0.0.4 n-glx.s-redirect.com O1 - Hosts: 127.0.0.4 x.full-tgp.net O1 - Hosts: 127.0.0.4 counter.sexmaniack.com O1 - Hosts: 127.0.0.4 autoescrowpay.com O1 - Hosts: 127.0.0.4 http://www.autoescrowpay.com O1 - Hosts: 127.0.0.4 http://www.awmdabest.com O1 - Hosts: 127.0.0.4 http://www.sexfiles.nu O1 - Hosts: 127.0.0.4 awmdabest.com O1 - Hosts: 127.0.0.4 sexfiles.nu O1 - Hosts: 127.0.0.4 allforadult.com O1 - Hosts: 127.0.0.4 http://www.allforadult.com O1 - Hosts: 127.0.0.4 http://www.iframe.biz O1 - Hosts: 127.0.0.4 iframe.biz O1 - Hosts: 127.0.0.4 http://www.newiframe.biz O1 - Hosts: 127.0.0.4 newiframe.biz O1 - Hosts: 127.0.0.4 http://www.vesbiz.biz O1 - Hosts: 127.0.0.4 vesbiz.biz O1 - Hosts: 127.0.0.4 http://www.pizdato.biz O1 - Hosts: 127.0.0.4 pizdato.biz O1 - Hosts: 127.0.0.4 http://www.aaasexypics.com O1 - Hosts: 127.0.0.4 aaasexypics.com O1 - Hosts: 127.0.0.4 http://www.virgin-tgp.net O1 - Hosts: 127.0.0.4 virgin-tgp.net O1 - Hosts: 127.0.0.4 http://www.awmcash.biz O1 - Hosts: 127.0.0.4 awmcash.biz O1 - Hosts: 127.0.0.4 buldog-stats.com O1 - Hosts: 127.0.0.4 http://www.buldog-stats.com O1 - Hosts: 127.0.0.4 fregat.drocherway.com O1 - Hosts: 127.0.0.4 slutmania.biz O1 - Hosts: 127.0.0.4 http://www.slutmania.biz O1 - Hosts: 127.0.0.4 toolbarpartner.com O1 - Hosts: 127.0.0.4 http://www.toolbarpartner.com O1 - Hosts: 127.0.0.4 http://www.megapornix.com O1 - Hosts: 127.0.0.4 megapornix.com O1 - Hosts: 127.0.0.4 http://www.sp2fucked.biz O1 - Hosts: 127.0.0.4 sp2fucked.biz O1 - Hosts: 127.0.0.4 greg-tut.com O1 - Hosts: 127.0.0.4 http://www.greg-tut.com O1 - Hosts: 127.0.0.4 nylonsexy.com O1 - Hosts: 127.0.0.4 http://www.nylonsexy.com O1 - Hosts: 127.0.0.4 vparivalka.com O1 - Hosts: 127.0.0.4 http://www.vparivalka.com O1 - Hosts: 127.0.0.4 iframeprofit.com O1 - Hosts: 127.0.0.4 http://www.iframeprofit.com O1 - Hosts: 127.0.0.4 topsearch10.com O1 - Hosts: 127.0.0.4 http://www.topsearch10.com O1 - Hosts: 127.0.0.4 statscash.biz O1 - Hosts: 127.0.0.4 http://www.statscash.biz O1 - Hosts: 127.0.0.4 vxiframe.biz O1 - Hosts: 127.0.0.4 http://www.vxiframe.biz O1 - Hosts: 127.0.0.4 crazy-toolbar.com O1 - Hosts: 127.0.0.4 http://www.crazy-toolbar.com O1 - Hosts: 127.0.0.4 topcash.biz O1 - Hosts: 127.0.0.4 http://www.topcash.biz O1 - Hosts: 127.0.0.4 loadcash.biz O1 - Hosts: 127.0.0.4 http://www.loadcash.biz O1 - Hosts: 127.0.0.4 txiframe.biz O1 - Hosts: 127.0.0.4 http://www.txiframe.biz O1 - Hosts: 127.0.0.4 procounter.biz O1 - Hosts: 127.0.0.4 http://www.procounter.biz O1 - Hosts: 127.0.0.4 advadmin.biz O1 - Hosts: 127.0.0.4 http://www.advadmin.biz O1 - Hosts: 127.0.0.4 trafficbest.net O1 - Hosts: 127.0.0.4 http://www.trafficbest.net O1 - Hosts: 127.0.0.4 besthvac.com O1 - Hosts: 127.0.0.4 http://www.besthvac.com O1 - Hosts: 127.0.0.4 traff4.com O1 - Hosts: 127.0.0.4 http://www.traff4.com O1 - Hosts: 127.0.0.4 ambush-script.com O1 - Hosts: 127.0.0.4 http://www.ambush-script.com O1 - Hosts: 127.0.0.4 beehappyy.biz O1 - Hosts: 127.0.0.4 http://www.beehappyy.biz O1 - Hosts: 127.0.0.4 tracktraff.cc O1 - Hosts: 127.0.0.4 http://www.tracktraff.cc O1 - Hosts: 127.0.0.4 allcount.net O1 - Hosts: 127.0.0.4 http://www.allcount.net O1 - Hosts: 127.0.0.4 onedayoffer.biz O1 - Hosts: 127.0.0.4 http://www.onedayoffer.biz O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_90.dll O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O4 - HKLM…\Run: [synchronization Manager] mobsync.exe /logon O4 - HKLM…\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM…\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM…\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s O4 - HKLM…\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM…\Run: [PayTime] C:\WINNT\system32\paytime.exe O4 - HKCU…\Run: [internat.exe] internat.exe O4 - HKCU…\Run: [PayTime] C:\WINNT\system32\paytime.exe O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://C:\nosuch.mht!http://traffsale.biz/dl/adv403/x.chm::/load.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

sorki za szybko chcialem to zrobic hehehe!

[Gutek]

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html O1 - Hosts: 127.0.0.4 n-glx.s-redirect.com O1 - Hosts: 127.0.0.4 x.full-tgp.net O1 - Hosts: 127.0.0.4 counter.sexmaniack.com O1 - Hosts: 127.0.0.4 autoescrowpay.com O1 - Hosts: 127.0.0.4 http://www.autoescrowpay.com O1 - Hosts: 127.0.0.4 http://www.awmdabest.com O1 - Hosts: 127.0.0.4 http://www.sexfiles.nu O1 - Hosts: 127.0.0.4 awmdabest.com O1 - Hosts: 127.0.0.4 sexfiles.nu O1 - Hosts: 127.0.0.4 allforadult.com O1 - Hosts: 127.0.0.4 http://www.allforadult.com O1 - Hosts: 127.0.0.4 http://www.iframe.biz O1 - Hosts: 127.0.0.4 iframe.biz O1 - Hosts: 127.0.0.4 http://www.newiframe.biz O1 - Hosts: 127.0.0.4 newiframe.biz O1 - Hosts: 127.0.0.4 http://www.vesbiz.biz O1 - Hosts: 127.0.0.4 vesbiz.biz O1 - Hosts: 127.0.0.4 http://www.pizdato.biz O1 - Hosts: 127.0.0.4 pizdato.biz O1 - Hosts: 127.0.0.4 http://www.aaasexypics.com O1 - Hosts: 127.0.0.4 aaasexypics.com O1 - Hosts: 127.0.0.4 http://www.virgin-tgp.net O1 - Hosts: 127.0.0.4 virgin-tgp.net O1 - Hosts: 127.0.0.4 http://www.awmcash.biz O1 - Hosts: 127.0.0.4 awmcash.biz O1 - Hosts: 127.0.0.4 buldog-stats.com O1 - Hosts: 127.0.0.4 http://www.buldog-stats.com O1 - Hosts: 127.0.0.4 fregat.drocherway.com O1 - Hosts: 127.0.0.4 slutmania.biz O1 - Hosts: 127.0.0.4 http://www.slutmania.biz O1 - Hosts: 127.0.0.4 toolbarpartner.com O1 - Hosts: 127.0.0.4 http://www.toolbarpartner.com O1 - Hosts: 127.0.0.4 http://www.megapornix.com O1 - Hosts: 127.0.0.4 megapornix.com O1 - Hosts: 127.0.0.4 http://www.sp2fucked.biz O1 - Hosts: 127.0.0.4 sp2fucked.biz O1 - Hosts: 127.0.0.4 greg-tut.com O1 - Hosts: 127.0.0.4 http://www.greg-tut.com O1 - Hosts: 127.0.0.4 nylonsexy.com O1 - Hosts: 127.0.0.4 http://www.nylonsexy.com O1 - Hosts: 127.0.0.4 vparivalka.com O1 - Hosts: 127.0.0.4 http://www.vparivalka.com O1 - Hosts: 127.0.0.4 iframeprofit.com O1 - Hosts: 127.0.0.4 http://www.iframeprofit.com O1 - Hosts: 127.0.0.4 topsearch10.com O1 - Hosts: 127.0.0.4 http://www.topsearch10.com O1 - Hosts: 127.0.0.4 statscash.biz O1 - Hosts: 127.0.0.4 http://www.statscash.biz O1 - Hosts: 127.0.0.4 vxiframe.biz O1 - Hosts: 127.0.0.4 http://www.vxiframe.biz O1 - Hosts: 127.0.0.4 crazy-toolbar.com O1 - Hosts: 127.0.0.4 http://www.crazy-toolbar.com O1 - Hosts: 127.0.0.4 topcash.biz O1 - Hosts: 127.0.0.4 http://www.topcash.biz O1 - Hosts: 127.0.0.4 loadcash.biz O1 - Hosts: 127.0.0.4 http://www.loadcash.biz O1 - Hosts: 127.0.0.4 txiframe.biz O1 - Hosts: 127.0.0.4 http://www.txiframe.biz O1 - Hosts: 127.0.0.4 procounter.biz O1 - Hosts: 127.0.0.4 http://www.procounter.biz O1 - Hosts: 127.0.0.4 advadmin.biz O1 - Hosts: 127.0.0.4 http://www.advadmin.biz O1 - Hosts: 127.0.0.4 trafficbest.net O1 - Hosts: 127.0.0.4 http://www.trafficbest.net O1 - Hosts: 127.0.0.4 besthvac.com O1 - Hosts: 127.0.0.4 http://www.besthvac.com O1 - Hosts: 127.0.0.4 traff4.com O1 - Hosts: 127.0.0.4 http://www.traff4.com O1 - Hosts: 127.0.0.4 ambush-script.com O1 - Hosts: 127.0.0.4 http://www.ambush-script.com O1 - Hosts: 127.0.0.4 beehappyy.biz O1 - Hosts: 127.0.0.4 http://www.beehappyy.biz O1 - Hosts: 127.0.0.4 tracktraff.cc O1 - Hosts: 127.0.0.4 http://www.tracktraff.cc O1 - Hosts: 127.0.0.4 allcount.net O1 - Hosts: 127.0.0.4 http://www.allcount.net O1 - Hosts: 127.0.0.4 onedayoffer.biz O1 - Hosts: 127.0.0.4 http://www.onedayoffer.biz O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_90.dll O4 - HKLM…\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s O4 - HKLM…\Run: [PayTime] C:\WINNT\system32\paytime.exe O4 - HKCU…\Run: [PayTime] C:\WINNT\system32\paytime.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://C:\nosuch.mht!http://traffsale.biz/dl/adv403/x.chm::/load.exe

W trybie awaryjnym usun wpisy hijackiem i odinstaluj aplikacje, a ręcznie usun potem foldery

Dokończyć skanerami online - Scanery do wyboru

Użyj CWS.Systime Removal 3.5

LSP-Fix usuniesz wpisy 010 TU opis działania - dokładnie plik newdotnet6_90.dll

[balik (Balik10)]

dzienki wielki uratowalem kompa hehe