Mój pierwszy log, proszę o sprawdzenie


(Szcurek) #1
Logfile of HijackThis v1.99.1

Scan saved at 14:48:32, on 2005-10-11

Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)


Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

D:\WINDOWS\Explorer.EXE

D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

D:\WINDOWS\system32\LEXBCES.EXE

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\system32\LEXPPS.EXE

E:\Program Files\ArcaVir\Bin\NetMonSv.exe

E:\Program Files\ArcaVir\Bin\avmonsv.exe

E:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

D:\WINDOWS\SOUNDMAN.EXE

D:\WINDOWS\System32\LXSUPMON.EXE

D:\PROGRA~1\Wanadoo\TaskbarIcon.exe

D:\Program Files\Java\jre1.5.0_02\bin\jusched.exe

D:\Program Files\Common Files\Real\Update_OB\realsched.exe

D:\Program Files\Common Files\Symantec Shared\ccApp.exe

E:\Program Files\ArcaVir\Bin\ABmenu.exe

E:\Program Files\Skype\Phone\Skype.exe

E:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

D:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe

E:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe

E:\Program Files\Privoxy\privoxy.exe

D:\WINDOWS\System32\PGPsdkServ.exe

E:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

D:\WINDOWS\System32\svchost.exe

D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

E:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe

E:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe

D:\WINDOWS\System32\wuauclt.exe

D:\Program Files\Wanadoo\EspaceWanadoo.exe

D:\Program Files\Wanadoo\ComComp.exe

D:\Program Files\Wanadoo\Watch.exe

E:\Program Files\ArcaVir\Bin\arcascan.exe

E:\Program Files\Mozilla\FireFox\firefox.exe

E:\PROGRA~1\Mozilla\THUNDE~1\THUNDE~1.EXE

D:\Program Files\Miranda IM\miranda32.exe

D:\Documents and Settings\Grześ\Pulpit\hijackthis\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400011&utm_content=leftnav&utm_source=wdz1&utm_medium=bund&utm_campaign=wdz0605a

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.accoona.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.accoona.com/search?q=%s

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada Plus wita Cie w Internecie

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Popup Free - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - (no file)

O2 - BHO: Accoona Search Assistant - {944864A5-3916-46E2-96A9-A2E84F3F1208} - D:\Program Files\Accoona\ASearchAssist.dll

O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - D:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [LXSUPMON] D:\WINDOWS\System32\LXSUPMON.EXE RUN

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [WOOWATCH] D:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] D:\PROGRA~1\Wanadoo\TaskbarIcon.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_02\bin\jusched.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [ABmenu] E:\Program Files\ArcaVir\Bin\ABmenu.exe

O4 - HKCU\..\Run: [STYLEXP] D:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide

O4 - HKCU\..\Run: [Skype] "E:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - Global Startup: DSLMON.lnk = D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

O4 - Global Startup: Microtek Scanner Finder.lnk = D:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe

O4 - Global Startup: PGPtray.lnk = ?

O4 - Global Startup: Privoxy.lnk = E:\Program Files\Privoxy\privoxy.exe

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE

O17 - HKLM\System\CCS\Services\Tcpip\..\{30F206E3-8E8A-4D5C-B856-BD25A8201317}: NameServer = 194.204.152.34 217.98.63.164

O17 - HKLM\System\CS1\Services\Tcpip\..\{30F206E3-8E8A-4D5C-B856-BD25A8201317}: NameServer = 194.204.152.34 217.98.63.164

O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit sp. z o.o. - E:\Program Files\ArcaVir\Bin\NetMonSv.exe

O23 - Service: ArcaVir Monitor (ArcaMonSvc) - ArcaBit - E:\Program Files\ArcaVir\Bin\avmonsv.exe

O23 - Service: ArcaScan - ArcaBit - E:\Program Files\ArcaVir\Bin\arcascan.exe

O23 - Service: arcaserv - ArcaBit Sp. z o. o. - E:\Program Files\ArcaVir\bin\arcaserv.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - E:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation - D:\WINDOWS\System32\PGPsdkServ.exe

O23 - Service: Speed Disk service - Symantec Corporation - E:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

O23 - Service: StyleXPService - Unknown owner - D:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Z góry dzięki!


(Gutek) #2

wpisy usuń hijackiem w trybie awaryjnym i odinstaluj Accoona , a potem ręcznie usuń folder :stuck_out_tongue: