Prosze sprawdzcie mojego loga (wszystko się wlecze)

dzioucha · 28 Maj 2006 12:39

Logfile of HijackThis v1.99.1 Scan saved at 14:36:06, on 2006-05-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\SYSTEM32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE D:\WINDOWS\system32\drivers\CDAC11BA.EXE D:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe D:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe D:\Program Files\AutoCAD 2005\Autodesk Network License Manager\lmgrd.exe D:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE D:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe D:\Program Files\F-Secure\Common\FSMA32.EXE D:\Program Files\F-Secure\Anti-Virus\fssm32.exe D:\WINDOWS\system32\drivers\KodakCCS.exe D:\Program Files\F-Secure\Common\FSMB32.EXE D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\system32\ScsiAccess.EXE D:\Program Files\F-Secure\Common\FCH32.EXE D:\Program Files\AutoCAD 2005\Autodesk Network License Manager\adskflex.exe D:\Program Files\F-Secure\Common\FAMEH32.EXE D:\Program Files\F-Secure\Anti-Virus\fsqh.exe D:\Program Files\F-Secure\Anti-Virus\fsrw.exe D:\Program Files\F-Secure\Common\FNRB32.EXE D:\Program Files\F-Secure\FWES\Program\fsdfwd.exe D:\Program Files\F-Secure\Common\FIH32.EXE D:\Program Files\F-Secure\Anti-Virus\fsav32.exe D:\WINDOWS\Explorer.EXE D:\PROGRA~1\Wanadoo\TaskbarIcon.exe D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe D:\WINDOWS\PowerS.exe D:\Program Files\F-Secure\Common\FSM32.EXE D:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\QuickTime\qttask.exe D:\Program Files\Winamp\winampa.exe D:\Program Files\Messenger\msmsgs.exe D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe D:\Program Files\Gadu-Gadu\gg.exe D:\eMule\emule.exe D:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe D:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe D:\Program Files\F-Secure\FSGUI\fsguidll.exe D:\Program Files\Wanadoo\EspaceWanadoo.exe D:\Program Files\Wanadoo\ComComp.exe D:\Program Files\Wanadoo\Watch.exe D:\Program Files\Opera\Opera.exe D:\Documents and Settings\Anka\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gadu-gadu.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=D:\WINDOWS\regedit /s D:\pav.reg,D:\WINDOWS\system32\pavdr.exe,D:\WINDOWS\system32\userinit.exe, O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM…\Run: [WOOWATCH] D:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] D:\PROGRA~1\Wanadoo\TaskbarIcon.exe O4 - HKLM…\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [RemoteControl] “D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [sunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [PowerS] D:\WINDOWS\PowerS.exe O4 - HKLM…\Run: [F-Secure Manager] “D:\Program Files\F-Secure\Common\FSM32.EXE” /splash O4 - HKLM…\Run: [F-Secure TNB] “D:\Program Files\F-Secure\TNB\TNBUtil.exe” /CHECKALL /WAITFORSW O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [QuickTime Task] “D:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [bearShare] “D:\Program Files\BearShare\BearShare.exe” /pause O4 - HKCU…\Run: [MSMSGS] “D:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [AltoMB_service] D:\Program Files\AltoSoftware\AltoMemoryBooster\AltoMBsrv.exe O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe” O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart O4 - Startup: Rejestrowanie produktów Corela.lnk = C:\Program Files\Corel\Graphics9\Register\Remind32.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = D:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: DSLMON.lnk = D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: F-Secure Automatic Update.lnk = D:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe O4 - Global Startup: KODAK Software Updater.lnk = D:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = D:\Program Files\Common Files\Autodesk Shared\acstart16.exe O8 - Extra context menu item: &Block this popup - D:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\F-Secure\Anti-Spyware\ieshield.dll O9 - Extra ‘Tools’ menuitem: IE Shield… - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\F-Secure\Anti-Spyware\ieshield.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_15.cab O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_63.cab O16 - DPF: {4539348E-01D7-11D5-9A39-0080C8D85044} (GameDesire Slots 90th) - http://67.15.101.3/g_bin/pl/slots90_2_0_0_24.cab O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) - O17 - HKLM\System\CCS\Services\Tcpip…{9FCAA261-0B19-4CF9-A4D3-B414C2C01345}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “D:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing) O20 - AppInit_DLLs: 68bxp7rn51w.dll O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing) O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - D:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE O23 - Service: C-DillaCdaC11BA - Macrovision - D:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - D:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - D:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - D:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: FLEXlm Service 1 - Macrovision Corporation - D:\Program Files\AutoCAD 2005\Autodesk Network License Manager\lmgrd.exe O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - D:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - D:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: ScsiAccess - Unknown owner - D:\WINDOWS\system32\ScsiAccess.EXE

kuz5 · 28 Maj 2006 12:52

Ciachnij:

Hmm może to być VX2

Użyj Look2Me-Destroyer a następnie daj log nr 1 z narzedzia L2Mfix