Prosze o sprawdzenie loga

[123123]

Logfile of HijackThis v1.99.1 Scan saved at 13:09:00, on 2005-11-30 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\csrss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\System32\RUNDLL32.EXE D:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe D:\program files\180search assistant\180sa.exe D:\Program Files\Internet Optimizer\optimize.exe D:\Program Files\Media Gateway\MediaGateway.exe D:\WINDOWS\System32\ctfmon.exe D:\PROGRA~1\WHATPU~1\WHATPU~1.EXE D:\WINDOWS\ATKKBService.exe D:\WINDOWS\kl.exe D:\WINDOWS\tool2.exe d:\windows\system32\mdms.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\System32\paytime.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\System32\rundll32.exe D:\WINDOWS\inet20003\services.exe D:\WINDOWS\inet20003\mm.exe D:\WINDOWS\System32\dllcache\IExplore.exe C:\Program Files\SpySheriff\SpySheriff.exe D:\Program Files\Internet Explorer\iexplore.exe D:\WINDOWS\System32\taskmgr.exe D:\WINDOWS\System32\sox1.exe D:\Program Files\FlashGet\flashget.exe D:\WINDOWS\explorer.exe D:\Program Files\WinRAR\WinRAR.exe D:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\Rar$EX00.875\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) F2 - REG:system.ini: Shell=explorer.exe “D:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe” F3 - REG:win.ini: run=D:\WINDOWS\inet20003\services.exe O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - D:\WINDOWS\nem220.dll O2 - BHO: - {1E6CE4CD-161B-4847-B8BF-E2EF72299D69} - D:\WINDOWS\System32\ib4.dll O2 - BHO: SABHO - {21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} - d:\program files\180search assistant\180sahook.dll O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - D:\WINDOWS\inet20003\3.00.11.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [PRONoMgrWired] D:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM…\Run: [sunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe O4 - HKLM…\Run: [180sa] d:\program files\180search assistant\180sa.exe O4 - HKLM…\Run: [internet Optimizer] “D:\Program Files\Internet Optimizer\optimize.exe” O4 - HKLM…\Run: [qroxmz] D:\WINDOWS\qroxmz.exe O4 - HKLM…\Run: [Media Gateway] D:\Program Files\Media Gateway\MediaGateway.exe O4 - HKLM…\Run: [sysMemory manager] d:\windows\system32\mdms.exe O4 - HKLM…\Run: [PayTime] D:\WINDOWS\System32\paytime.exe O4 - HKLM…\Run: [xp_system] D:\WINDOWS\inet20003\services.exe O4 - HKLM…\Run: [WindowsProxyService] D:\WINDOWS\System32\sox1.exe O4 - HKCU…\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “D:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [WhatPulse] D:\PROGRA~1\WHATPU~1\WHATPU~1.EXE O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O4 - HKCU…\Run: [shell] “D:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe” O4 - HKCU…\Run: [PayTime] D:\WINDOWS\System32\paytime.exe O4 - HKCU…\Run: [xp_system] D:\WINDOWS\inet20003\services.exe O4 - HKCU…\Run: [spySheriff] C:\Program Files\SpySheriff\SpySheriff.exe O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O16 - DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) - https://w3s.webmoney.ru/WMAcceptor.dll O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://217.73.66.1/minidialler/mddl/PL/ … eeded_.exe O20 - Winlogon Notify: Mixer - D:\WINDOWS\SYSTEM32\sndmix.dll O20 - Winlogon Notify: Shell Extensions - D:\WINDOWS\system32\irsmsnap.dll O20 - Winlogon Notify: ssldr - D:\WINDOWS\SYSTEM32\ssldr32.dll O21 - SSODL: SysTray.Exsl - {6368D5FC-6F5C-4f5b-B164-E67214F67859} - D:\WINDOWS\System32\defiggmd.dll O21 - SSODL: SysTray.Exgl - {636821FC-6F5C-2f1b-B164-E67214F678E2} - D:\WINDOWS\System32\fledfnbi.dll O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - D:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe

explorer.exe wyłaczanie co 1minute i 23 sec

Bardzo bym prosił o pomoc

przepraszam za bledy nie uzywam polkich znaków (wyjatek)

[Gutek]

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) F2 - REG:system.ini: Shell=explorer.exe “D:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe” F3 - REG:win.ini: run=D:\WINDOWS\inet20003\services.exe O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - D:\WINDOWS\nem220.dll O2 - BHO: - {1E6CE4CD-161B-4847-B8BF-E2EF72299D69} - D:\WINDOWS\System32\ib4.dll O2 - BHO: SABHO - {21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} - d:\program files\180search assistant\180sahook.dll O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - D:\WINDOWS\inet20003\3.00.11.dll O4 - HKLM…\Run: [180sa] d:\program files\180search assistant\180sa.exe O4 - HKLM…\Run: [internet Optimizer] “D:\Program Files\Internet Optimizer\optimize.exe” O4 - HKLM…\Run: [qroxmz] D:\WINDOWS\qroxmz.exe O4 - HKLM…\Run: [Media Gateway] D:\Program Files\Media Gateway\MediaGateway.exe O4 - HKLM…\Run: [sysMemory manager] d:\windows\system32\mdms.exe O4 - HKLM…\Run: [PayTime] D:\WINDOWS\System32\paytime.exe O4 - HKLM…\Run: [xp_system] D:\WINDOWS\inet20003\services.exe O4 - HKLM…\Run: [WindowsProxyService] D:\WINDOWS\System32\sox1.exe O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O4 - HKCU…\Run: [shell] “D:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe” O4 - HKCU…\Run: [PayTime] D:\WINDOWS\System32\paytime.exe O4 - HKCU…\Run: [xp_system] D:\WINDOWS\inet20003\services.exe O4 - HKCU…\Run: [spySheriff] C:\Program Files\SpySheriff\SpySheriff.exe O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://217.73.66.1/minidialler/mddl/PL/ … eeded_.exe O20 - Winlogon Notify: ssldr - D:\WINDOWS\SYSTEM32\ssldr32.dll O21 - SSODL: SysTray.Exsl - {6368D5FC-6F5C-4f5b-B164-E67214F67859} - D:\WINDOWS\System32\defiggmd.dll O21 - SSODL: SysTray.Exgl - {636821FC-6F5C-2f1b-B164-E67214F678E2} - D:\WINDOWS\System32\fledfnbi.dll

1. Wyłączyć Przywracanie systemu w XP TU

2. Zastartować do trybu awaryjnego bez internetu(opis w linku wyżej).

3. Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked. Wpisy zostaną usunięte.

4. Skasować z dysku pliki i foldery, które podkreśliłem na czerwono

5. Dokończyć skanerami online - Scanery do wyboru

6. Pokazać nowy log

Wpis R3 nie usuwasz hijackiem tylko usuniesz Registrar Lite, opis masz TUTAJ

Poczytaj SpySheriff i Usuwanie Trojan.Repsamo oraz Usuwanie VX2.BetterInternet i daj log nr 1 z narzędzia L2Mfix