Komputer muli =/

[zetz (Xeeq)]

o to logi z hijackthis:

Logfile of HijackThis v1.99.1 Scan saved at 23:33:28, on 2007-08-19 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE D:\Program Files\ArcaBit\ArcaVir\ABregmon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe D:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe D:\Program Files\ArcaBit\ArcaVir\AvMon.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\PSIService.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\ArcaBit\Common\TaskScheduler.exe D:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\DOCUME~1\Luiza\USTAWI~1\Temp\Rar$EX00.907\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: 208.73.212.12 lloydstsb.co.uk O1 - Hosts: 208.73.212.12 online.lloydstsb.co.uk O1 - Hosts: 208.73.212.12 http://www.lloydstsb.co.uk O1 - Hosts: 208.73.212.12 http://www.lloydstsb.com O1 - Hosts: 208.73.212.12 http://www.lloydstsb.com O1 - Hosts: 208.73.212.12 personal.barclays.co.uk O1 - Hosts: 208.73.212.12 barclays.co.uk O1 - Hosts: 208.73.212.12 ibank.barclays.co.uk O1 - Hosts: 208.73.212.12 http://www.barclays.co.uk O1 - Hosts: 208.73.212.12 http://www.nwolb.com O1 - Hosts: 208.73.212.12 nwolb.com O1 - Hosts: 208.73.212.12 hsbc.co.uk O1 - Hosts: 208.73.212.12 http://www.hsbc.co.uk O1 - Hosts: 208.73.212.12 abbey.com O1 - Hosts: 208.73.212.12 http://www.abbey.com O1 - Hosts: 208.73.212.12 http://www.abbey.co.uk O1 - Hosts: 208.73.212.12 abbey.co.uk O1 - Hosts: 208.73.212.12 cahoot.com O1 - Hosts: 208.73.212.12 http://www.cahoot.com O1 - Hosts: 208.73.212.12 http://www.cahoot.co.uk O1 - Hosts: 208.73.212.12 cahoot.co.uk O1 - Hosts: 208.73.212.12 http://www.co-operativebank.co.uk O1 - Hosts: 208.73.212.12 co-operativebank.co.uk O1 - Hosts: 208.73.212.12 http://www.co-operativebank.com O1 - Hosts: 208.73.212.12 co-operativebank.com O1 - Hosts: 208.73.212.12 welcome2.co-operativebankonline.co.uk O1 - Hosts: 208.73.212.12 welcome6.co-operativebankonline.co.uk O1 - Hosts: 208.73.212.12 welcome8.co-operativebankonline.co.uk O1 - Hosts: 208.73.212.12 welcome10.co-operativebankonline.co.uk O1 - Hosts: 208.73.212.12 http://www.smile.co.uk O1 - Hosts: 208.73.212.12 smile.co.uk O1 - Hosts: 208.73.212.12 http://www.cajamar.es O1 - Hosts: 208.73.212.12 cajamar.es O1 - Hosts: 208.73.212.12 http://www.cajamar.com O1 - Hosts: 208.73.212.12 cajamar.com O1 - Hosts: 208.73.212.12 http://www.unicaja.es O1 - Hosts: 208.73.212.12 unicaja.es O1 - Hosts: 208.73.212.12 http://www.unicaja.com O1 - Hosts: 208.73.212.12 unicaja.com O1 - Hosts: 208.73.212.12 http://www.caixagalicia.es O1 - Hosts: 208.73.212.12 caixagalicia.es O1 - Hosts: 208.73.212.12 http://www.caixagalicia.com O1 - Hosts: 208.73.212.12 caixagalicia.com O1 - Hosts: 208.73.212.12 activa.caixagalicia.es O1 - Hosts: 208.73.212.12 http://www.caixapenedes.es O1 - Hosts: 208.73.212.12 caixapenedes.es O1 - Hosts: 208.73.212.12 http://www.caixapenedes.com O1 - Hosts: 208.73.212.12 caixapenedes.com O1 - Hosts: 208.73.212.12 bancae.caixapenedes.com O1 - Hosts: 208.73.212.12 http://www.caixasabadell.es O1 - Hosts: 208.73.212.12 caixasabadell.es O1 - Hosts: 208.73.212.12 http://www.caixasabadell.net O1 - Hosts: 208.73.212.12 caixasabadell.net O1 - Hosts: 208.73.212.12 http://www.cajamadrid.es O1 - Hosts: 208.73.212.12 cajamadrid.es O1 - Hosts: 208.73.212.12 http://www.cajamadrid.com O1 - Hosts: 208.73.212.12 cajamadrid.com O1 - Hosts: 208.73.212.12 oi.cajamadrid.es O1 - Hosts: 208.73.212.12 http://www.ccm.es O1 - Hosts: 208.73.212.12 ccm.es O1 - Hosts: 208.73.212.12 http://www.haspa.de O1 - Hosts: 208.73.212.12 haspa.de O1 - Hosts: 208.73.212.12 ssl2.haspa.de O1 - Hosts: 208.73.212.12 http://www.dresdner-bank.de O1 - Hosts: 208.73.212.12 dresdner-bank.de O1 - Hosts: 208.73.212.12 http://www.dresdner-privat.de O1 - Hosts: 208.73.212.12 postbank.de O1 - Hosts: 208.73.212.12 http://www.postbank.de O1 - Hosts: 208.73.212.12 banking.postbank.de O1 - Hosts: 208.73.212.12 http://www.sparda-b.de O1 - Hosts: 208.73.212.12 sparda-b.de O1 - Hosts: 208.73.212.12 http://www.bankingonline.de O1 - Hosts: 208.73.212.12 http://www.raiffeisenbank-erding.de O1 - Hosts: 208.73.212.12 raiffeisenbank-erding.de O1 - Hosts: 208.73.212.12 http://www.vr-networld-ebanking.de O1 - Hosts: 208.73.212.12 vr-networld-ebanking.de O1 - Hosts: 208.73.212.12 http://www.bnhof.de O1 - Hosts: 208.73.212.12 bnhof.de O1 - Hosts: 208.73.212.12 http://www.deutsche-bank.de O1 - Hosts: 208.73.212.12 deutsche-bank.de O1 - Hosts: 208.73.212.12 meine.deutsche-bank.de O1 - Hosts: 208.73.212.12 http://www.citibank.de O1 - Hosts: 208.73.212.12 citibank.de O1 - Hosts: 208.73.212.12 http://www.dkb.de O1 - Hosts: 208.73.212.12 dkb.de O1 - Hosts: 208.73.212.12 http://www.sparkasse-regensburg.de O1 - Hosts: 208.73.212.12 sparkasse-regensburg.de O1 - Hosts: 208.73.212.12 http://www.berliner-bank.de O1 - Hosts: 208.73.212.12 berliner-bank.de O1 - Hosts: 208.73.212.12 http://www.berliner-sparkasse.de O1 - Hosts: 208.73.212.12 berliner-sparkasse.de O1 - Hosts: 208.73.212.12 http://www.wellsfargo.com O1 - Hosts: 208.73.212.12 wellsfargo.com O1 - Hosts: 208.73.212.12 http://www.bankofamerica.com O1 - Hosts: 208.73.212.12 bankofamerica.com O1 - Hosts: 208.73.212.12 http://www.usbank.com O1 - Hosts: 208.73.212.12 usbank.com O1 - Hosts: 208.73.212.12 http://www.bankone.com O1 - Hosts: 208.73.212.12 bankone.com O1 - Hosts: 208.73.212.12 http://www.citibank.com O1 - Hosts: 208.73.212.12 citibank.com O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\ivo\Expressivo\IH_iexplore.dll (file missing) O2 - BHO: MU Online Toolbar Helper - {D3138B39-C8A6-440B-9D42-50F766AEA8C7} - C:\Program Files\MU Online Toolbar\v3.2.0.0\MU_Online_Toolbar.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: MU Online Toolbar - {B9D1647F-A66A-4695-B249-07901A45FF59} - C:\Program Files\MU Online Toolbar\v3.2.0.0\MU_Online_Toolbar.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\ivo\Expressivo\IH_iexplore.dll (file missing) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [Windows Helper] C:\WINDOWS\System32\svchozt.exe O4 - HKLM…\Run: [abregmon] D:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM…\Run: [Google Inc] googletls.exe O4 - HKLM…\Run: [winsystems25] winsystems.exe O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [msconfig38] mssvcc.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [PFG Agent] C:\Program Files\PFG\PFG.exe O4 - HKLM…\Run: [XVGC Agent] C:\WINDOWS\System32\Sys32\XVGC.exe O4 - HKLM…\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM…\RunServices: [Windows ASN3 Services] jxbd.exe O4 - HKLM…\RunServices: [GoogleInc] googletls.exe O4 - HKLM…\RunServices: [MS Config] msdconfig.exe O4 - HKLM…\RunServices: [msconfig38] mssvcc.exe O4 - HKLM…\RunServices: [Google Inc] googletls.exe O4 - HKLM…\RunServices: [winsystems25] winsystems.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Google Inc] googletls.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [Desktop Architect] “C:\Program Files\Desktop Architect\datray.exe” -S O4 - HKCU…\Run: [Expressivo] “D:\Program Files\ivo\Expressivo\expressivo.exe” -t O4 - HKCU…\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe O4 - HKCU…\RunServices: [Google Inc] googletls.exe O4 - Startup: hamachi.lnk = D:\Program Files\Hamachi\hamachi.exe O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\xfire.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Administrator\Menu Start\Programy\IMVU\Run IMVU.lnk (file missing) O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_28.cab O17 - HKLM\System\CCS\Services\Tcpip…{A535AF2D-6EA2-4797-8280-DAE6F36B1A6C}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\ktdcr.dll (file missing) O20 - Winlogon Notify: TS_LogonListener - C:\WINDOWS\SYSTEM32\TS_LogonListener.dll O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - D:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: Apache - Unknown owner - d:\AppServ\Apache\Apache.exe" --ntservice (file missing) O23 - Service: ArcaBit.Core.Configurator - ArcaBit - D:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - D:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit sp. z o.o. - D:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: ArcaVir Antivirus Monitor Service (ArcaVirMonitor) - ArcaBit - D:\Program Files\ArcaBit\ArcaVir\AvMon.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MicroSoft Media Tools - Unknown owner - C:\WINDOWS\MSmedia.exe (file missing) O23 - Service: MySQL - Unknown owner - d:\AppServ\mysql\bin\mysqld-nt.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe

[Gutek]

O1 - Hosts: 208.73.212.12 lloydstsb.co.uk O1 - Hosts: 208.73.212.12 online.lloydstsb.co.uk O1 - Hosts: 208.73.212.12 http://www.lloydstsb.co.uk O1 - Hosts: 208.73.212.12 http://www.lloydstsb.com O1 - Hosts: 208.73.212.12 http://www.lloydstsb.com O1 - Hosts: 208.73.212.12 personal.barclays.co.uk O1 - Hosts: 208.73.212.12 barclays.co.uk O1 - Hosts: 208.73.212.12 ibank.barclays.co.uk O1 - Hosts: 208.73.212.12 http://www.barclays.co.uk O1 - Hosts: 208.73.212.12 http://www.nwolb.com O1 - Hosts: 208.73.212.12 nwolb.com O1 - Hosts: 208.73.212.12 hsbc.co.uk O1 - Hosts: 208.73.212.12 http://www.hsbc.co.uk O1 - Hosts: 208.73.212.12 abbey.com O1 - Hosts: 208.73.212.12 http://www.abbey.com O1 - Hosts: 208.73.212.12 http://www.abbey.co.uk O1 - Hosts: 208.73.212.12 abbey.co.uk O1 - Hosts: 208.73.212.12 cahoot.com O1 - Hosts: 208.73.212.12 http://www.cahoot.com O1 - Hosts: 208.73.212.12 http://www.cahoot.co.uk O1 - Hosts: 208.73.212.12 cahoot.co.uk O1 - Hosts: 208.73.212.12 http://www.co-operativebank.co.uk O1 - Hosts: 208.73.212.12 co-operativebank.co.uk O1 - Hosts: 208.73.212.12 http://www.co-operativebank.com O1 - Hosts: 208.73.212.12 co-operativebank.com O1 - Hosts: 208.73.212.12 welcome2.co-operativebankonline.co.uk O1 - Hosts: 208.73.212.12 welcome6.co-operativebankonline.co.uk O1 - Hosts: 208.73.212.12 welcome8.co-operativebankonline.co.uk O1 - Hosts: 208.73.212.12 welcome10.co-operativebankonline.co.uk O1 - Hosts: 208.73.212.12 http://www.smile.co.uk O1 - Hosts: 208.73.212.12 smile.co.uk O1 - Hosts: 208.73.212.12 http://www.cajamar.es O1 - Hosts: 208.73.212.12 cajamar.es O1 - Hosts: 208.73.212.12 http://www.cajamar.com O1 - Hosts: 208.73.212.12 cajamar.com O1 - Hosts: 208.73.212.12 http://www.unicaja.es O1 - Hosts: 208.73.212.12 unicaja.es O1 - Hosts: 208.73.212.12 http://www.unicaja.com O1 - Hosts: 208.73.212.12 unicaja.com O1 - Hosts: 208.73.212.12 http://www.caixagalicia.es O1 - Hosts: 208.73.212.12 caixagalicia.es O1 - Hosts: 208.73.212.12 http://www.caixagalicia.com O1 - Hosts: 208.73.212.12 caixagalicia.com O1 - Hosts: 208.73.212.12 activa.caixagalicia.es O1 - Hosts: 208.73.212.12 http://www.caixapenedes.es O1 - Hosts: 208.73.212.12 caixapenedes.es O1 - Hosts: 208.73.212.12 http://www.caixapenedes.com O1 - Hosts: 208.73.212.12 caixapenedes.com O1 - Hosts: 208.73.212.12 bancae.caixapenedes.com O1 - Hosts: 208.73.212.12 http://www.caixasabadell.es O1 - Hosts: 208.73.212.12 caixasabadell.es O1 - Hosts: 208.73.212.12 http://www.caixasabadell.net O1 - Hosts: 208.73.212.12 caixasabadell.net O1 - Hosts: 208.73.212.12 http://www.cajamadrid.es O1 - Hosts: 208.73.212.12 cajamadrid.es O1 - Hosts: 208.73.212.12 http://www.cajamadrid.com O1 - Hosts: 208.73.212.12 cajamadrid.com O1 - Hosts: 208.73.212.12 oi.cajamadrid.es O1 - Hosts: 208.73.212.12 http://www.ccm.es O1 - Hosts: 208.73.212.12 ccm.es O1 - Hosts: 208.73.212.12 http://www.haspa.de O1 - Hosts: 208.73.212.12 haspa.de O1 - Hosts: 208.73.212.12 ssl2.haspa.de O1 - Hosts: 208.73.212.12 http://www.dresdner-bank.de O1 - Hosts: 208.73.212.12 dresdner-bank.de O1 - Hosts: 208.73.212.12 http://www.dresdner-privat.de O1 - Hosts: 208.73.212.12 postbank.de O1 - Hosts: 208.73.212.12 http://www.postbank.de O1 - Hosts: 208.73.212.12 banking.postbank.de O1 - Hosts: 208.73.212.12 http://www.sparda-b.de O1 - Hosts: 208.73.212.12 sparda-b.de O1 - Hosts: 208.73.212.12 http://www.bankingonline.de O1 - Hosts: 208.73.212.12 http://www.raiffeisenbank-erding.de O1 - Hosts: 208.73.212.12 raiffeisenbank-erding.de O1 - Hosts: 208.73.212.12 http://www.vr-networld-ebanking.de O1 - Hosts: 208.73.212.12 vr-networld-ebanking.de O1 - Hosts: 208.73.212.12 http://www.bnhof.de O1 - Hosts: 208.73.212.12 bnhof.de O1 - Hosts: 208.73.212.12 http://www.deutsche-bank.de O1 - Hosts: 208.73.212.12 deutsche-bank.de O1 - Hosts: 208.73.212.12 meine.deutsche-bank.de O1 - Hosts: 208.73.212.12 http://www.citibank.de O1 - Hosts: 208.73.212.12 citibank.de O1 - Hosts: 208.73.212.12 http://www.dkb.de O1 - Hosts: 208.73.212.12 dkb.de O1 - Hosts: 208.73.212.12 http://www.sparkasse-regensburg.de O1 - Hosts: 208.73.212.12 sparkasse-regensburg.de O1 - Hosts: 208.73.212.12 http://www.berliner-bank.de O1 - Hosts: 208.73.212.12 berliner-bank.de O1 - Hosts: 208.73.212.12 http://www.berliner-sparkasse.de O1 - Hosts: 208.73.212.12 berliner-sparkasse.de O1 - Hosts: 208.73.212.12 http://www.wellsfargo.com O1 - Hosts: 208.73.212.12 wellsfargo.com O1 - Hosts: 208.73.212.12 http://www.bankofamerica.com O1 - Hosts: 208.73.212.12 bankofamerica.com O1 - Hosts: 208.73.212.12 http://www.usbank.com O1 - Hosts: 208.73.212.12 usbank.com O1 - Hosts: 208.73.212.12 http://www.bankone.com O1 - Hosts: 208.73.212.12 bankone.com O1 - Hosts: 208.73.212.12 http://www.citibank.com O1 - Hosts: 208.73.212.12 citibank.com O4 - HKLM…\Run: [Windows Helper] C:\WINDOWS\System32\svchozt.exe O4 - HKLM…\Run: [Google Inc] googletls.exe O4 - HKLM…\Run: [winsystems25] winsystems.exe O4 - HKLM…\Run: [msconfig38] mssvcc.exe O4 - HKLM…\Run: [PFG Agent] C:\Program Files\PFG\PFG.exe O4 - HKLM…\Run: [XVGC Agent] C:\WINDOWS\System32\Sys32\XVGC.exe O4 - HKLM…\RunServices: [Windows ASN3 Services] jxbd.exe O4 - HKLM…\RunServices: [GoogleInc] googletls.exe O4 - HKLM…\RunServices: [MS Config] msdconfig.exe O4 - HKLM…\RunServices: [msconfig38] mssvcc.exe O4 - HKLM…\RunServices: [Google Inc] googletls.exe O4 - HKLM…\RunServices: [winsystems25] winsystems.exe O4 - HKCU…\Run: [Google Inc] googletls.exe O4 - HKCU…\RunServices: [Google Inc]googletls.exe O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Administrator\Menu Start\Programy\IMVU\Run IMVU.lnk (file missing) O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\ktdcr.dll (file missing) O23 - Service: MicroSoft Media Tools - Unknown owner - C:\WINDOWS\MSmedia.exe (file missing)

w trybie awaryjnym usuń wpisy HJT, a pliki i foldery ręcznie

Daj log z ComboFix

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable. Po użyciu tego narzędzia wymagany jest reset sysa.