Prosze o sprawdzenie log'a (koleżanki)

[zciwo]

Norton wykrywa “Alemond”

Logfile of HijackThis v1.99.1 Scan saved at 15:28:13, on 2004-02-02 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\mssearchnet.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Media Access\MediaAccK.exe C:\temp\salm.exe C:\Program Files\Media Access\MediaAccess.exe C:\WINDOWS\System32\P2P Networking\P2P Networking.exe C:\Program Files\Kazaa\kazaa.exe C:\program files\altnet\points manager\points manager.exe C:\Program Files\Common Files\CMEII\CMESys.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Internet Optimizer\optimize.exe C:\WINDOWS\System32\ft00m4l0.exe C:\Program Files\Vbxmc\Gltxn.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\j?vaw.exe C:\Program Files\eooe\rwoc.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Documents and Settings\User\Pulpit\hijack\hijack1.99.1\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {6386271F-BED8-E924-F369-E72B54CE8992} - C:\WINDOWS\System32\lcbotav.dll R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O1 - Hosts: 64.92.170.148 bankone.com O1 - Hosts: 64.92.170.148 halifax.com O1 - Hosts: 64.92.170.148 http://www.halifax.com O1 - Hosts: 64.92.170.148 halifax.co.uk O1 - Hosts: 64.92.170.148 http://www.halifax.co.uk O1 - Hosts: 64.92.170.148 http://www.bankofamerica.com O1 - Hosts: 64.92.170.148 bankofamerica.com O1 - Hosts: 64.92.170.148 http://www.lloydstsb.com O1 - Hosts: 64.92.170.148 lloydstsb.com O1 - Hosts: 64.92.170.148 http://www.lloydstsb.co.uk O1 - Hosts: 64.92.170.148 lloydstsb.co.uk O1 - Hosts: 64.92.170.148 http://www.credem.it O1 - Hosts: 64.92.170.148 credem.it O1 - Hosts: 64.92.170.148 http://www.creval.it O1 - Hosts: 64.92.170.148 creval.it O1 - Hosts: 64.92.170.148 http://www.gruppocarige.it O1 - Hosts: 64.92.170.148 gruppocarige.it O1 - Hosts: 64.92.170.148 http://www.rasbank.it O1 - Hosts: 64.92.170.148 rasbank.it O1 - Hosts: 64.92.170.148 http://www.bancagenerali.it O1 - Hosts: 64.92.170.148 bancagenerali.it O1 - Hosts: 64.92.170.148 http://www.garanti.com.tr O1 - Hosts: 64.92.170.148 garanti.com.tr O1 - Hosts: 64.92.170.148 http://www.kocbank.com.tr O1 - Hosts: 64.92.170.148 kocbank.com.tr O1 - Hosts: 64.92.170.148 http://www.disbank.com.tr O1 - Hosts: 64.92.170.148 disbank.com.tr O1 - Hosts: 64.92.170.148 http://www.cassarimini.it O1 - Hosts: 64.92.170.148 cassarimini.it O1 - Hosts: 64.92.170.148 http://www.unicredit.it O1 - Hosts: 64.92.170.148 unicredit.it O1 - Hosts: 64.92.170.148 http://www.chase.com O1 - Hosts: 64.92.170.148 chase.com O1 - Hosts: 64.92.170.148 http://www.southtrust.com O1 - Hosts: 64.92.170.148 southtrust.com O1 - Hosts: 64.92.170.148 http://www.wachovia.com O1 - Hosts: 64.92.170.148 wachovia.com O1 - Hosts: 64.92.170.148 http://www.wellsfargo.com O1 - Hosts: 64.92.170.148 wellsfargo.com O2 - BHO: (no name) - {6386271F-BED8-E924-F369-E72B54CE8992} - C:\WINDOWS\System32\lcbotav.dll O2 - BHO: HomepageBHO - {e9ccf15d-4c68-4b5a-9e9a-8e12e4bd39bd} - C:\WINDOWS\System32\hp4C27.tmp (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing) O3 - Toolbar: RX Toolbar - {25D8BACF-3DE2-4B48-AE22-D659B8D835B0} - C:\Program Files\RXToolBar\RXToolBar.dll (file missing) O3 - Toolbar: SecurityToolbar - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - C:\Program Files\Security Toolbar\Security Toolbar.dll O4 - HKLM…\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM…\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM…\Run: [HP Software Update] “C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” O4 - HKLM…\Run: [HP Component Manager] “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe” O4 - HKLM…\Run: [ccApp] “C:\Program Files\Common Files\Symantec Shared\ccApp.exe” O4 - HKLM…\Run: [sSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM…\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM…\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM…\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM…\Run: [salm] c:\temp\salm.exe O4 - HKLM…\Run: [security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe O4 - HKLM…\Run: [jgt] C:\WINDOWS\jgt.exe O4 - HKLM…\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM…\Run: [KAZAA] C:\Program Files\Kazaa\kazaa.exe /SYSTRAY O4 - HKLM…\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s O4 - HKLM…\Run: [CMESys] “C:\Program Files\Common Files\CMEII\CMESys.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe” O4 - HKLM…\Run: [internet Optimizer] “C:\Program Files\Internet Optimizer\optimize.exe” O4 - HKLM…\Run: [ft00m4l0] C:\WINDOWS\System32\ft00m4l0.exe O4 - HKLM…\Run: [Tesig] C:\Program Files\Vbxmc\Gltxn.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [Eqdbacd] C:\WINDOWS\System32\j?vaw.exe O4 - HKCU…\Run: [180ClientStubInstall] “C:\DOCUME~1\User\USTAWI~1\Temp\zang.exe” O4 - HKCU…\Run: [Cocc] “C:\Program Files\eooe\rwoc.exe” -vt mt O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Picture Package Menu.lnk = ? O4 - Global Startup: Picture Package VCD Maker.lnk = ? O4 - Global Startup: WorldAntiSpy.lnk = C:\Program Files\WorldAntiSpy\WorldAntiSpy.exe O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Microsoft AntiSpyware helper - {58A1CCBE-2578-48AD-8C40-22D312A610C6} - (no file) (HKCU) O9 - Extra ‘Tools’ menuitem: Microsoft AntiSpyware helper - {58A1CCBE-2578-48AD-8C40-22D312A610C6} - (no file) (HKCU) O15 - Trusted Zone: *.blazefind.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted IP range: 67.19.185.246 (HKLM) O16 - DPF: {0D62A517-E7C6-4E1F-A577-07D4AC549A48} (Progetto1.int_ver32) - http://advnt01.com/dialer/int_ver32b.CAB O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Media … dge-c7.cab O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {1D80D445-38C7-1341-7FC9-290A3C8FC79D} - http://69.31.82.26/1/rdgPL1649.exe O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTickets … refid=3548 O16 - DPF: {CDCBE0F1-D13A-4F86-A963-3A272D3ABA7E} (VacPro.internazionale_ver15) - http://advnt01.com/dialer/internazionale_ver15.CAB O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} (VacPro.internazionale_ver11) - http://66.194.38.28/dialer/internazionale_ver11.CAB O17 - HKLM\System\CCS\Services\Tcpip…{5E066E0F-3FFD-4F5B-BB20-F4F4B8990354}: NameServer = 192.168.0.1 O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

[Gutek]

R3 - URLSearchHook: (no name) - {6386271F-BED8-E924-F369-E72B54CE8992} - C:\WINDOWS\System32\lcbotav.dll R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O1 - Hosts: 64.92.170.148 bankone.com O1 - Hosts: 64.92.170.148 halifax.com O1 - Hosts: 64.92.170.148 http://www.halifax.com O1 - Hosts: 64.92.170.148 halifax.co.uk O1 - Hosts: 64.92.170.148 http://www.halifax.co.uk O1 - Hosts: 64.92.170.148 http://www.bankofamerica.com O1 - Hosts: 64.92.170.148 bankofamerica.com O1 - Hosts: 64.92.170.148 http://www.lloydstsb.com O1 - Hosts: 64.92.170.148 lloydstsb.com O1 - Hosts: 64.92.170.148 http://www.lloydstsb.co.uk O1 - Hosts: 64.92.170.148 lloydstsb.co.uk O1 - Hosts: 64.92.170.148 http://www.credem.it O1 - Hosts: 64.92.170.148 credem.it O1 - Hosts: 64.92.170.148 http://www.creval.it O1 - Hosts: 64.92.170.148 creval.it O1 - Hosts: 64.92.170.148 http://www.gruppocarige.it O1 - Hosts: 64.92.170.148 gruppocarige.it O1 - Hosts: 64.92.170.148 http://www.rasbank.it O1 - Hosts: 64.92.170.148 rasbank.it O1 - Hosts: 64.92.170.148 http://www.bancagenerali.it O1 - Hosts: 64.92.170.148 bancagenerali.it O1 - Hosts: 64.92.170.148 http://www.garanti.com.tr O1 - Hosts: 64.92.170.148 garanti.com.tr O1 - Hosts: 64.92.170.148 http://www.kocbank.com.tr O1 - Hosts: 64.92.170.148 kocbank.com.tr O1 - Hosts: 64.92.170.148 http://www.disbank.com.tr O1 - Hosts: 64.92.170.148 disbank.com.tr O1 - Hosts: 64.92.170.148 http://www.cassarimini.it O1 - Hosts: 64.92.170.148 cassarimini.it O1 - Hosts: 64.92.170.148 http://www.unicredit.it O1 - Hosts: 64.92.170.148 unicredit.it O1 - Hosts: 64.92.170.148 http://www.chase.com O1 - Hosts: 64.92.170.148 chase.com O1 - Hosts: 64.92.170.148 http://www.southtrust.com O1 - Hosts: 64.92.170.148 southtrust.com O1 - Hosts: 64.92.170.148 http://www.wachovia.com O1 - Hosts: 64.92.170.148 wachovia.com O1 - Hosts: 64.92.170.148 http://www.wellsfargo.com O1 - Hosts: 64.92.170.148 wellsfargo.com O2 - BHO: (no name) - {6386271F-BED8-E924-F369-E72B54CE8992} - C:\WINDOWS\System32\lcbotav.dll O2 - BHO: HomepageBHO - {e9ccf15d-4c68-4b5a-9e9a-8e12e4bd39bd} - C:\WINDOWS\System32\hp4C27.tmp (file missing) O3 - Toolbar: RX Toolbar - {25D8BACF-3DE2-4B48-AE22-D659B8D835B0} - C:\Program Files\RXToolBar\RXToolBar.dll (file missing) O3 - Toolbar: SecurityToolbar - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - C:\Program Files\Security Toolbar\Security Toolbar.dll O4 - HKLM…\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM…\Run: [salm] c:\temp\salm.exe O4 - HKLM…\Run: [security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe O4 - HKLM…\Run: [jgt] C:\WINDOWS\jgt.exe O4 - HKLM…\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM…\Run: [KAZAA] C:\Program Files\Kazaa\kazaa.exe /SYSTRAY O4 - HKLM…\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s O4 - HKLM…\Run: [CMESys] “C:\Program Files\Common Files\CMEII\CMESys.exe” O4 - HKLM…\Run: [internet Optimizer] “C:\Program Files\Internet Optimizer\optimize.exe” O4 - HKLM…\Run: [ft00m4l0] C:\WINDOWS\System32\ft00m4l0.exe O4 - HKLM…\Run: [Tesig] C:\Program Files\Vbxmc\Gltxn.exe O4 - HKCU…\Run: [Eqdbacd] C:\WINDOWS\System32\j?vaw.exe O4 - HKCU…\Run: [180ClientStubInstall] “C:\DOCUME~1\User\USTAWI~1\Temp\zang.exe” O4 - HKCU…\Run: [Cocc] “C:\Program Files\eooe\rwoc.exe” -vt mt O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe O4 - Global Startup: WorldAntiSpy.lnk = C:\Program Files\WorldAntiSpy\WorldAntiSpy.exe O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Microsoft AntiSpyware helper - {58A1CCBE-2578-48AD-8C40-22D312A610C6} - (no file) (HKCU) O9 - Extra ‘Tools’ menuitem: Microsoft AntiSpyware helper - {58A1CCBE-2578-48AD-8C40-22D312A610C6} - (no file) (HKCU) O15 - Trusted Zone: *.blazefind.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted IP range: 67.19.185.246 (HKLM) O16 - DPF: {0D62A517-E7C6-4E1F-A577-07D4AC549A48} (Progetto1.int_ver32) - http://advnt01.com/dialer/int_ver32b.CAB O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Media … dge-c7.cab O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {1D80D445-38C7-1341-7FC9-290A3C8FC79D} - http://69.31.82.26/1/rdgPL1649.exe O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTickets … refid=3548 O16 - DPF: {CDCBE0F1-D13A-4F86-A963-3A272D3ABA7E} (VacPro.internazionale_ver15) - http://advnt01.com/dialer/internazionale_ver15.CAB O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} (VacPro.internazionale_ver11) - http://66.194.38.28/dialer/internazionale_ver11.CAB O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll

1. Wyłączyć Przywracanie systemu w XP TU

2. Zastartować do trybu awaryjnego bez internetu(opis w linku wyżej).

3. Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked. Wpisy zostaną usunięte. Dodatkowo O15 może będzie stawiać opór więc ściągnij KillTrusted 0.7

4. Skasować z dysku pliki i foldery, które podkreśliłem na czerwono

5. Dokończyć skanerami online - Scanery do wyboru

6. Pokazać nowy log

Wpis R3 nie usuwasz hijackiem tylko usuniesz Registrar Lite, opis masz TUTAJ

Usuwanie SpyAxe oraz strone wczesniej Usuwanie WorldAntiSpy

Masz plik “z pytajnikiem” - j?vaw.exe , jak usunąć zobacz TU