Ostatnio avast! wykrył mi bardzo dużo wirusów, było to pewnie spowodowane zainstalowaniem jakiegoś programu p2p naszpikowanego trojanami i robakami. No i w Hijacku doszło pare dziwnych wpisów(tak mi się przynajmniej wydaje ) Więc proszę o sprawdzenie tego loga i wskazanie plików do usunięcia.
Logfile of HijackThis v1.99.1
Scan saved at 13:56:06, on 2006-04-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\RunDll32.exe
D:\programy\ALWILS~1\Avast4\ashDisp.exe
D:\WINDOWS\system32\rundll32.exe
C:\windows\mousepad15.exe
D:\programy\Free Download Manager\fdm.exe
D:\Program Files\EQBranch\EQBranch.exe
D:\programy\Alwil Software\Avast4\aswUpdSv.exe
D:\programy\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\HHVcdV5Sys\VC5SecS.exe
D:\programy\Alwil Software\Avast4\ashMaiSv.exe
D:\programy\Alwil Software\Avast4\ashWebSv.exe
D:\Program Files\Mozilla Firefox\firefox.exe
C:\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - D:\Program Files\NewDotNet\newdotnet7_22.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] D:\programy\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [webHancer Survey Companion] "D:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [New.net Startup] rundll32 D:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard15.exe
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad15.exe
O4 - HKLM\..\Run: [newname] C:\windows\newname15.exe
O4 - HKCU\..\Run: [Komunikator] "D:\programy\Tlen.pl\tlen.exe"
O4 - HKCU\..\Run: [Free Download Manager] D:\programy\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [filecroc] "D:\Program Files\FileCroc\FileCroc.exe" -h
O4 - HKCU\..\Run: [EQBranch] "D:\Program Files\EQBranch\EQBranch.exe"
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\programy\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz stronę WEB z Free Download Manager - file://D:\programy\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Pobierz wszystko z Free Download Manager - file://D:\programy\Free Download Manager\dlall.htm
O8 - Extra context menu item: Pobierz z Free Download Manager - file://D:\programy\Free Download Manager\dllink.htm
O8 - Extra context menu item: Pobierz zaznaczenie z Free Download Manager - file://D:\programy\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Subskrybuj w domyślnym agregatorze - D:\Documents and Settings\Łukasz\Dane aplikacji\RssBandit\iecontext_subscribefeed.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O20 - AppInit_DLLs: Runner.dll,Runner.dll,kmicdpkh.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\programy\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\programy\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\programy\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\programy\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: KlService - Unknown owner - D:\PROGRA~1\KEYLOG~1\KlEngine.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Virtual CD v5 Security service (VC5SecS) - H+H Software GmbH - D:\Program Files\HHVcdV5Sys\VC5SecS.exe
Zmieniłem temat na konkretny
Pozdrawiam Gutek2222