Proźba o stprawdzenie loga :D

Simek · 27 Kwiecień 2005 14:58

Oto log! Zgóry wielkie ThX!

Logfile of HijackThis v1.99.1 Scan saved at 16:57:19, on 2005-04-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\PROGRA~1\PESTPA~1\CookiePatrol.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\hphmon05.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\WhatPulse\WhatPulse.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe c:\progra~1\intern~1\iexplore.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Gadu-Gadu\gg.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\Simek\Pulpit\Clean\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.muvwitxnmc.com/QjO/KUREMWQNT … eUUhCm.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pifdcihcyhekggojba.com/QjO/K … scSnI.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 80.51.49.4:8080 F2 - REG:system.ini: Shell=explorer.exe O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-2fe89c996183} - c:\program files\steganos internet anonym 7\sia7iep.dll O4 - HKLM…\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM…\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe O4 - HKLM…\Run: [gcasServ] “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe” O4 - HKLM…\Run: [AtiPTA] atiptaxx.exe O4 - HKLM…\Run: [] C:\WINDOWS\system32\ggupgrade.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [CloneCDTray] “C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe” /s O4 - HKLM…\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU…\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe O4 - HKCU…\Run: [view fast] C:\DOCUME~1\Simek\DANEAP~1\EGGSOP~1\Media Trans.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [] C:\WINDOWS\system32\ggupgrade.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: klamm.de - {EB52F380-B8AE-11d5-AE8E-52544025AABB} - http://www.klamm.de/?id=Simek (file missing) (HKCU) O9 - Extra ‘Tools’ menuitem: klamm.de - {EB52F380-B8AE-11d5-AE8E-52544025AABB} - http://www.klamm.de/?id=Simek (file missing) (HKCU) O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe

Magik · 27 Kwiecień 2005 15:00

Przeniesiony ze “Sprawdzone porady”

musg · 27 Kwiecień 2005 16:08

wylacz przywracanie systemu i usuwasz hijackiem:

dodatkowo sciagnij:

http://www.dobreprogramy.pl/index.php?dz=2&id=657&t=82

dalej zafixuj:

usuwasz:

recznie dodatkowo musisz usunac:ggupgrade.exe

to ciachnij kosmetycznie:

wszystko kosisz w trybie awaryjnym f8

dajesz raz jeszcze log

jezeli tego juz nie uzywasz(nie instalowales raczej) to rowniez usun

: