Od kilku dni mam pewien problem:
Gdy włączam komputer, co jakiś czas wyskakuje mi błąd.
Potem AntySpyware “wyczuwa”, że “ktoś” chce zmienić stronę główną w IE7.
W procesach pojawiły mi się dwa nowe procesy:
psimrel.exe
i zgxqjozg.exe.
Gdy je zakańczam, po chwili znów się załączają.
Jeśli chcę włączyć jakąś stronę, co jakiś czas włącza mi się jakaś strona z reklamą spyware.
http://softwarereferral.com/jump.php?wm … Ojg5&lid=2>
Oto log:
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\All Users\Dane aplikacji\vuhanylc\xslipslw.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\zgxqjozg.exe
c:\program files\panda software\panda antivirus 2007\WebProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\psimreal.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm … Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: sgoblxtm - {1F8A048D-9A0B-4565-A3D0-2A2E6B44592A} - C:\WINDOWS\sgoblxtm.dll (file missing)
O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM…\Run: [skyTel] SkyTel.EXE
O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM…\Run: [nwiz] nwiz.exe /install
O4 - HKLM…\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM…\Run: [APVXDWIN] “C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE” /s
O4 - HKLM…\Run: [HP Component Manager] “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”
O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM…\Run: [GrooveMonitor] “D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe”
O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM…\Run: [a8365f0b] rundll32.exe “C:\WINDOWS\system32\tfqlrgtt.dll”,b
O4 - HKLM…\RunOnce: [spybotDeletingA81] command /c del “C:\WINDOWS\system32\tfqlrgtt.dll_old”
O4 - HKLM…\RunOnce: [spybotDeletingC1279] cmd /c del “C:\WINDOWS\system32\tfqlrgtt.dll_old”
O4 - HKLM…\RunOnce: [spybotDeletingA2453] command /c del “C:\WINDOWS\system32\xxyvwXRJ.dll_old”
O4 - HKLM…\RunOnce: [spybotDeletingC9906] cmd /c del “C:\WINDOWS\system32\xxyvwXRJ.dll_old”
O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray
O4 - HKCU…\Run: [ldqtvamh] C:\WINDOWS\system32\zgxqjozg.exe
O4 - HKCU…\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU…\Run: [phfjkguy] C:\WINDOWS\system32\hyvyzmzu.exe
O4 - HKCU…\RunOnce: [spybotDeletingB3739] command /c del “C:\WINDOWS\system32smp\msrc.exe”
O4 - HKCU…\RunOnce: [spybotDeletingB8050] command /c del “C:\Program Files\MyGlobalSearch\bar\History\search”
O4 - HKCU…\RunOnce: [spybotDeletingD1005] cmd /c del “C:\Program Files\MyGlobalSearch\bar\History\search”
O4 - HKCU…\RunOnce: [spybotDeletingB5880] command /c del “C:\Program Files\BearShare\BSidle.dll”
O4 - HKCU…\RunOnce: [spybotDeletingD6037] cmd /c del “C:\Program Files\BearShare\BSidle.dll”
O4 - HKCU…\RunOnce: [spybotDeletingB6265] command /c del “C:\Program Files\BearShare\proinstall2.ini”
O4 - HKCU…\RunOnce: [spybotDeletingD4133] cmd /c del “C:\Program Files\BearShare\proinstall2.ini”
O4 - HKCU…\RunOnce: [spybotDeletingB7633] command /c del “C:\Program Files\BearShare\Webstats.bat”
O4 - HKCU…\RunOnce: [spybotDeletingD6280] cmd /c del “C:\Program Files\BearShare\Webstats.bat”
O4 - HKCU…\RunOnce: [spybotDeletingB9793] command /c del “C:\Program Files\BearShare\Webstats.exe”
O4 - HKCU…\RunOnce: [spybotDeletingD923] cmd /c del “C:\Program Files\BearShare\Webstats.exe”
O4 - HKCU…\RunOnce: [spybotDeletingB3635] command /c del “C:\Program Files\BearShare\db\Hostiles-Chat.txt”
O4 - HKCU…\RunOnce: [spybotDeletingD7988] cmd /c del “C:\Program Files\BearShare\db\Hostiles-Chat.txt”
O4 - HKCU…\RunOnce: [spybotDeletingB3139] command /c del “C:\WINDOWS\system32\tfqlrgtt.dll_old”
O4 - HKLM…\Policies\Explorer\Run: [iaSp3sQv0h] C:\Documents and Settings\All Users\Dane aplikacji\vuhanylc\xslipslw.exe
O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)
O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)
O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)
O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s … wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip…{A820469A-53A0-45A0-9519-1FB2F6A17D6B}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: dsktbwfe - {2CDEE52C-A278-4AC7-AD81-7037BA0DADA4} - C:\WINDOWS\dsktbwfe.dll
O21 - SSODL: ogxtsepr - {3965A238-B71B-43A9-9528-BD3A1531FBE7} - C:\WINDOWS\ogxtsepr.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm
Z góry dziękuję i pozdrawiam.
Mam nadzieję, że pomożecie.