Proszę o sprawdzenie loga

[fortino]

Logfile of HijackThis v1.99.1 Scan saved at 14:34:07, on 2006-01-17 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\cisvc.exe C:\Program Files\Firebird\bin\fbguard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SOUNDMAN.EXE C:\PROGRA~1\DAP\DAP.EXE C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Wirtualna Polska\wpkontakt\wpkontakt.exe C:\Program Files\netPanel\NetPanel.exe C:\Program Files\MediaGateway\MediaGateway.exe C:\program files\zango\zango.exe D:\NetPumper\NetPumperIEProxy.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\JETWAY\PC-TV FM\RemoteCtl.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\PLANET\WL-8303\RtlWake.exe C:\Program Files\Wirtualna Polska\System syntezy mowy\rozmowy.exe C:\Program Files\Wirtualna Polska\System syntezy mowy\synteza_DDE_klient.exe C:\Program Files\Firebird\bin\fbserver.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\WINDOWS\System32\cidaemon.exe C:\Program Files\Avant Browser\avant.exe C:\Program Files\GoD\GoD.exe C:\Program Files\MarBit\ALLPlayer\ALLPlayer.exe D:\NetPumper\NetPumper.exe C:\WINDOWS\SYSTEM32\NET.exe C:\WINDOWS\SYSTEM32\NET.exe C:\WINDOWS\SYSTEM32\net1.exe C:\WINDOWS\SYSTEM32\net1.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\Waldi\USTAWI~1\Temp\Rar$EX15.623\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://presearchforyou.com/hp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://presearchforyou.com/hp.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file) O1 - Hosts: et Power][Tracking Service][Restricted Zone site] O2 - BHO: Peer2Mail Toolbar Helper - {4FB971C4-99FB-480d-BA3F-55B8263010FB} - C:\Program Files\Peer2Mail Toolbar\v2.0.0.0\Peer2Mail_Toolbar.dll O2 - BHO: Zango Search Assistant Helper - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\program files\zango\zangohook.dll O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\netPanel\IEHelper.dll O2 - BHO: (no name) - {CF5030C0-0219-ACA4-86FB-34E2061ADCFA} - C:\DOCUME~1\Waldi\DANEAP~1\GLOBAL~1\Long Math.exe O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Peer2Mail Toolbar - {43F2A7F9-06F6-48a5-B0DC-8530BF29CE66} - C:\Program Files\Peer2Mail Toolbar\v2.0.0.0\Peer2Mail_Toolbar.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP O4 - HKLM…\Run: [netPanel] “C:\Program Files\netPanel\Starter.exe” /path=“C:\Program Files\netPanel” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe O4 - HKLM…\Run: [KAZAA] “C:\Program Files\Kazaa Lite Rewolucja\kpp.exe” “C:\Program Files\Kazaa Lite Rewolucja\kazaalite.kpp” /SYSTRAY O4 - HKLM…\Run: [iCQ Lite] C:\Program Files\ICQ-PL\ICQLite.exe -minimize O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [DAEMON Tools-1033] “C:\Program Files\D-Tools\daemon.exe” -lang 1045 O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM…\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s O4 - HKLM…\Run: [load32] C:\WINDOWS\System32\winldra.exe O4 - HKLM…\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM…\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [wpkontakt] C:\Program Files\Wirtualna Polska\wpkontakt\wpkontakt.exe -autostart O4 - HKLM…\Run: [PrintPack dispatcher] “E:\Program Files\Software602\PrnPack.exe” /server O4 - HKLM…\Run: [LXBSCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBStime.dll,_RunDLLEntry@16 O4 - HKLM…\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe -startup O4 - HKLM…\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe O4 - HKLM…\Run: [zango] “c:\program files\zango\zango.exe” O4 - HKLM…\Run: [fkz] C:\WINDOWS\fkz.exe O4 - HKLM…\Run: [NetPumper] “D:\NetPumper\NetPumperIEProxy.exe” O4 - HKLM…\Run: [Cash 16 bags admin] C:\Documents and Settings\All Users\Dane aplikacji\GRID MULTI CASH 16\Itchwindow.exe O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKCU…\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKCU…\Run: [aupd] C:\WINDOWS\System32\symcsvc.exe O4 - HKCU…\Run: [spySheriff] C:\Program Files\SpySheriff\SpySheriff.exe O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [GoD] “C:\Program Files\GoD\GoD.exe” /tray O4 - HKCU…\Run: [GoDClient] “E:\Program Files\GoDClient\GoDClient.exe” /tray O4 - HKCU…\Run: [LANczat] C:\Program Files\LANczat\LANczat.exe O4 - HKCU…\Run: [4 Slow] C:\DOCUME~1\Waldi\DANEAP~1\PARTFI~1\wipe amen.exe O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE O4 - Startup: WinMySQLadmin.lnk = D:\FoxServ\mysql\bin\winmysqladmin.exe O4 - Startup: PopTray.lnk = C:\Program Files\PopTray\PopTray.exe O4 - Startup: Rozmowa.lnk = C:\Program Files\Wirtualna Polska\System syntezy mowy\rozmowy.exe O4 - Global Startup: PC-TV FM Remote Control.lnk = C:\Program Files\JETWAY\PC-TV FM\RemoteCtl.exe O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE O4 - Global Startup: PLANET WL-8303.lnk = ? O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.h … xdm480YYPL O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - C:\Program Files\Avant Browser\AddAllToADBlackList.htm O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program Files\Avant Browser\AddToADBlackList.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: Download with NetPumper - D:\NetPumper\AddUrl.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\project\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony… - C:\Program Files\Avant Browser\OpenAllLinks.htm O8 - Extra context menu item: Podświetl - C:\Program Files\Avant Browser\Highlight.htm O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll O9 - Extra button: Wyslij SMS’a - {215940F1-E7E0-4801-BEE3-44D045534106} - C:\Program Files\Common Files\moje.js O9 - Extra button: Print2PDF - {5B7027AD-AA6D-40df-8F56-9560F277D2A5} - C:\WINDOWS\System32\Print602.dll O9 - Extra ‘Tools’ menuitem: Print2PDF - {5B7027AD-AA6D-40df-8F56-9560F277D2A5} - C:\WINDOWS\System32\Print602.dll O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\project\OFFICE11\REFIEBAR.DLL O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted IP range: 67.19.178.84 O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/180so … e-c282.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fu … .0.8-2.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://promo.dollarrevenue.com/webmaste … ad312a.exe O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_19.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda … 5844226978 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar … /cabsa.cab O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_39.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab O16 - DPF: {DF777AB7-25B6-43D8-AFE4-940A4BF8CA5C} - ms-its:mhtml:file://C:\foo.mht!http://freeporncometome.com/k1234.chm::/k1234.exe O16 - DPF: {E23FABEE-12E3-33DA-DA12-195DAC123984} (GameDesire Mahjong) - http://67.15.101.3/g_bin/pl/mahjong_2_0_0_20.cab O17 - HKLM\System\CCS\Services\Tcpip…{59C98130-A336-49FA-996A-636D0D854910}: NameServer = 193.110.120.5,193.110.121.20 O17 - HKLM\System\CCS\Services\Tcpip…{DAE82B7B-EEA2-42BB-967A-7AB23EA5FF8A}: NameServer = 194.204.159.1,194.204.192.34 O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Wirtualna Polska\wpkontakt\url_wpmsg.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\bin\fbserver.exe

Proszę pomóżcie skaner ONLINE wykrył u mnie 120 szpiegów i i nie co mam pousuwać

[kuz5]

W Dodaj/Usun odinstaluj MediaGateway, SpySheriff, MyWebSearch

Usuń: (wszystko oczywiście robisz w trybie awaryjnym z wyłączonym przywracaniem systemu)

O1 - Hosts: et Power][Tracking Service][Restricted Zone site] O2 - BHO: Zango Search Assistant Helper - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\program files\zango\zangohook.dll O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\netPanel\IEHelper.dll O2 - BHO: (no name) - {CF5030C0-0219-ACA4-86FB-34E2061ADCFA} - C:\DOCUME~1\Waldi\DANEAP~1\GLOBAL~1\Long Math.exe O4 - HKLM…\Run: [netPanel] “C:\Program Files\netPanel\Starter.exe” /path=“C:\Program Files\netPanel” O4 - HKLM…\Run: [KAZAA] “C:\Program Files\Kazaa Lite Rewolucja\kpp.exe” “C:\Program Files\Kazaa Lite Rewolucja\kazaalite.kpp” /SYSTRAY O4 - HKLM…\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s O4 - HKLM…\Run: [load32] C:\WINDOWS\System32\winldra.exe O4 - HKLM…\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe O4 - HKLM…\Run: [zango] “c:\program files\zango\zango.exe” O4 - HKLM…\Run: [fkz] C:\WINDOWS\fkz.exe O4 - HKLM…\Run: [NetPumper] “D:\NetPumper\NetPumperIEProxy.exe” O4 - HKLM…\Run: [Cash 16 bags admin] C:\Documents and Settings\All Users\Dane aplikacji\GRID MULTI CASH 16\Itchwindow.exe O4 - HKCU…\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKCU…\Run: [aupd] C:\WINDOWS\System32\symcsvc.exe O4 - HKCU…\Run: [spySheriff] C:\Program Files\SpySheriff\SpySheriff.exe O4 - HKCU…\Run: [4 Slow] C:\DOCUME~1\Waldi\DANEAP~1\PARTFI~1\wipe amen.exe O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.h … xdm480YYPL O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted IP range: 67.19.178.84 O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/180so … e-c282.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fu … .0.8-2.cab O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://promo.dollarrevenue.com/webmaste … ad312a.exe

Pliki na czerwono usun ręcznie z dysku

Jeżeli wpisy 015 będą stawiać opór to usuń je narzędziem KillTrusted 0.7

Dodatkowo POCZYTAJ o usuwaniu fałszywej tapety

Proponuje odinstalowac DAPa oraz KAZZA

Uwaga: Jak wklejasz loga to obejmuj go znacznikiem (tagiem) CODE lub QUOTE

Proponuje poczytać TEN temat i zobacz jaka jest prośba do userów wklejających loga.