Prośba o sprawdzenie loga

[beer1952 (Obrotna1)]

Jeżeli to możliwe to też proszę o sprawdzenie loga

Logfile of HijackThis v1.99.1 Scan saved at 13:48:47, on 2005-12-25 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\SurfAccuracy\SAcc.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\Kawka.TELFANET\Ustawienia lokalne\Temp\wz6a70\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O4 - HKLM…\Run: [synchronization Manager] mobsync.exe /logon O4 - HKLM…\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM…\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM…\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM…\Run: [surfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\avgfwafu.dll O16 - DPF: {0D62A517-E7C6-4E1F-A577-07D4AC549A48} (Progetto1.int_ver32) - http://advnt01.com/dialer/pl_ver32n.CAB O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Media … ge-c18.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2A781DED-C22D-4153-9812-CEA98A32981C} (GameDesire Makao) - http://67.15.101.3/g_bin/pl/cardsmakao_2_0_0_18.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_20.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup … 1055409656 O16 - DPF: {7D30109B-DD2B-4339-BE80-1CD48723C2BC} (LiveX(v6.0)) - http://www.bydgoszcz.pl/live/cab/Live.cab O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installer … taller.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://82.146.224.245:85/activex/AxisCamControl.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/S … anager.ocx O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_36.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_22.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = telfanet.eu O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = telfanet.eu O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = telfanet.eu O23 - Service: ArcaVir Monitor (ArcaMonSvc) - Unknown owner - C:\Program Files\ArcaVir\Bin\avmonsv.exe (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: wtcvhkwyforr (lgzxapvd6) - Unknown owner - C:\WINNT\system32\cttlyrzq6.exe (file missing) O23 - Service: Miscrosoft Updates Service (MsUpdate) - Unknown owner - C:\WINNT\system32\msupd.exe (file missing) O23 - Service: bzyidlqcktib (MsUpdate6) - Unknown owner - C:\WINNT\system32\msupd6.exe (file missing) O23 - Service: hxorquxormkw (repggxrp6) - Unknown owner - C:\WINNT\system32\nrvystmw6.exe (file missing)

Z góry dziękuję.

====================================

Uwaga: Jak wklejasz loga to obejmuj go znacznikiem (tagiem) CODE lub QUOTE

Proponuje poczytać TEN temat i zobacz jaka jest prośba do userów wklejających loga.

Pozdrawiam kuz5

[Magik]

Post wydzielony jako osobny temat z innego topicu.

beer1952 , nie podpinaj się do cudzych tematów, bo sprawdzający będa mieć kłopot, a i ty możesz sie pogubić.

[beer1952 (Obrotna1)]

Sorry jestem nowa na tym forum i się jeszcze gubię.

[Gutek]

R3 - Default URLSearchHook is missing O4 - HKLM…\Run: [surfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe O16 - DPF: {0D62A517-E7C6-4E1F-A577-07D4AC549A48} (Progetto1.int_ver32) - http://advnt01.com/dialer/pl_ver32n.CAB O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Media … ge-c18.cab O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installer … taller.cab

1. Zastartować do trybu awaryjnego bez internetu(opis TU).

2. Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked. Wpisy zostaną usunięte.

3. Skasować z dysku i folder, który podkreśliłem na czerwono

4. Pokazać nowy log

O23 - Service: wtcvhkwyforr (lgzxapvd6) - Unknown owner - C:\WINNT\system32\cttlyrzq6.exe (file missing) O23 - Service: Miscrosoft Updates Service (MsUpdate) - Unknown owner - C:\WINNT\system32\msupd.exe (file missing) O23 - Service: bzyidlqcktib (MsUpdate6) - Unknown owner - C:\WINNT\system32\msupd6.exe (file missing) O23 - Service: hxorquxormkw (repggxrp6) - Unknown owner - C:\WINNT\system32\nrvystmw6.exe (file missing)

Start >>> Uruchom >>> services.msc >>> zatrzymaj i wyłącz wtcvhkwyforr, Miscrosoft Updates Service, bzyidlqcktib, hxorquxormkw po tym pliki ręcznie usuwasz