To chyba VX2 [log]

[mrx (Justa Szromek)]

Logfile of HijackThis v1.99.1 Scan saved at 15:22:56, on 2006-06-29 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\D-Tools\daemon.exe C:\PROGRA~1\COMMON~1\PPATCH~1\regsvr32.exe C:\WINDOWS\system32\MBOLS~1\WAUCLT~1.EXE C:\Program Files\AntiVirenKit\AVKService.exe C:\Program Files\AntiVirenKit\AVKWCtl.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\UF9TenJvbWVr\command.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Network Monitor\netmon.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\svchost.exe C:\Program Files\Opera\Opera.exe D:\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.1.5.1:8080 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*; R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {DD5E4451-FBBF-FD37-CB39-FBBAA83718C1} - C:\WINDOWS\System32\qah.dll R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) F3 - REG:win.ini: run=C:\WINDOWS\inet20010\winlogon.exe O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [siSSetCDfmt] C:\WINDOWS\System32\SetCDfmt.exe O4 - HKLM…\Run: [Lexmark X1100 Series] “C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe” O4 - HKLM…\Run: [xp_system] C:\WINDOWS\inet20010\winlogon.exe O4 - HKLM…\Run: [DAEMON Tools-1033] “C:\Program Files\D-Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [WinampAgent] “C:\Program Files\Winamp\Winampa.exe” O4 - HKLM…\Run: [keyboard] C:\kybrdc_2.exe O4 - HKLM…\Run: [defender] C:\dfndrc_2.exe O4 - HKLM…\Run: [newname] C:\nwnmc_2.exe O4 - HKCU…\Run: [xp_system] C:\WINDOWS\inet20010\winlogon.exe O4 - HKCU…\Run: [pifmgr] C:\WINDOWS\System32\pifmgr.exe O4 - HKCU…\Run: [XPAgent] C:\WINDOWS\System32\XPAgent.exe O4 - HKCU…\Run: [ilwo] “C:\PROGRA~1\COMMON~1\PPATCH~1\regsvr32.exe” -vt yazr O4 - HKCU…\Run: [Hfdojl] C:\WINDOWS\system32\MBOLS~1\WAUCLT~1.EXE O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab O17 - HKLM\System\CCS\Services\Tcpip…{A0445841-5B4C-42A7-8D68-685492178BD7}: NameServer = 217.8.168.244,157.25.5.18 O20 - AppInit_DLLs: C:\WINDOWS\System32\userinit.dll O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\ckmuid.dll (file missing) O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - (no file) O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\AntiVirenKit\AVKService.exe O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C:\Program Files\AntiVirenKit\AVKWCtl.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UF9TenJvbWVr\command.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Problem:

Na ekranie pojawiają mi się popup’y. I czasami po włączeniu komputera pokazuje sie popup i wiesza się pulpit(ale nie pasek narzędzi).

Pomocy! Jak to usunąć??

[InfinityToJa (Gblade)]

Ściągnij Windows Woorms Door Cleaner, odpal>>>zmień wszystkie znaczki z disable na enable>>>po użyciu narzedzia wymagany jest reset kompa.

start>>>uruchom>>>services.msc>>>zatrzymaj i wyłącz Command Service i Network Monitor

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R3 - URLSearchHook: (no name) - {DD5E4451-FBBF-FD37-CB39-FBBAA83718C1} - C:\WINDOWS\System32\qah.dll F3 - REG:win.ini: run=C:\WINDOWS\inet20010\winlogon.exe O4 - HKLM…\Run: [xp_system] C:\WINDOWS\inet20010\winlogon.exe O4 - HKLM…\Run: [keyboard] C:\kybrdc_2.exe O4 - HKLM…\Run: [defender] C:\dfndrc_2.exe O4 - HKLM…\Run: [newname] C:\nwnmc_2.exe O4 - HKCU…\Run: [xp_system] C:\WINDOWS\inet20010\winlogon.exe O4 - HKCU…\Run: [pifmgr] C:\WINDOWS\System32\pifmgr.exe O4 - HKCU…\Run: [XPAgent] C:\WINDOWS\System32\XPAgent.exe O4 - HKCU…\Run: [ilwo] “C:\PROGRA~1\COMMON~1\PPATCH~1\regsvr32.exe” -vt yazr O4 - HKCU…\Run: [Hfdojl] C:\WINDOWS\system32\MBOLS~1\WAUCLT~1.EXE O20 - AppInit_DLLs: C:\WINDOWS\System32\userinit.dll O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\ckmuid.dll (file missing) O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - (no file) O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UF9TenJvbWVr\command.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

1.Startujesz do trybu awaryjnego

2.Wyłanczasz przywracanie systemu (tylko Me/Xp)

3.Kasujesz wpisy w HijackThis

4.Kasujesz pogrubione pliki/foldery

5.Dajesz nowy log z hjt + log z Silent Runners

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) Otwórz edytor rejestestru, start>>>uruchom>>>regedit, przejdź do klucza HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks , skasuj _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} i wszystkie inne wpisy z kreseczką “_” .