Zamulony strasznie komp

[blazej2]

Logfile of HijackThis v1.99.1 Scan saved at 20:49:10, on 2007-08-12 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchosts.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\system32\sysems.exe C:\Program Files\BearShare\BearShare.exe C:\WINDOWS\System32\mmdmm.exe C:\WINDOWS\System32\yltewinproho.exe C:\WINDOWS\system32\mdmdd.exe C:\WINDOWS\system32\mfceee.exe C:\WINDOWS\system32\helpsyss.exe C:\WINDOWS\system32\srvcc.exe C:\WINDOWS\System32\Rundll32.exe C:\Program Files\Common Files{F44399FF-02BF-1045-0803-000928000030}\Update.exe C:\WINDOWS\System32\ctfmon.exe C:\DOCUME~1\PAWE~1\MOJEDO~1\ECURIT~1\wuauboot.exe C:\Documents and Settings\Paweł\Dane aplikacji\a?sembly\r?ndll.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Web Buying\v1.6.8\webbuying.exe C:\Program Files\WinPop\winpop.exe C:\Program Files\D-Link AirPlus\AirPlus.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\Paweł\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.worldusa.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchgateway.net/search/%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: trafficninja.biz extension - {266A3562-AB67-480E-9F09-D54604FD817B} - C:\WINDOWS\System32\ninjaext.dll O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: (no name) - {488FA8BA-3A01-18FD-2973-3CB67F38F3CA} - C:\WINDOWS\System32\eppkvkud.dll O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll O2 - BHO: (no name) - {4ADCF8BD-3C01-4CA8-2973-3CB67F38F0C8} - C:\WINDOWS\System32\bifdg.dll O2 - BHO: 0 - {53BD5926-265B-428E-82AC-99DE75FA8D66} - C:\Program Files\Usługi online\lavuqahub.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7BE2DA25-94D3-4D9C-9A64-0AB1ED8C0FDD} - C:\Program Files\ComPlus Applications\hokewog.dll O2 - BHO: Related Page - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\System32\WinNB58.dll O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1{34439~1\Bar888.dll O2 - BHO: Plugin - {C318CD44-E327-4377-A28E-6EC16A921AE8} - C:\Program Files\Web Buying\v1.6.8\webbuying.dll O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing) O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1{34439~1\Bar888.dll O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\System32\WinNB58.dll O4 - HKLM…\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s O4 - HKLM…\Run: [sysmss] C:\WINDOWS\system32\sysems.exe O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [bearShare] “C:\Program Files\BearShare\BearShare.exe” /pause O4 - HKLM…\Run: [mmsass] mmdmm.exe O4 - HKLM…\Run: [{39-99-9F-FF-ZN}] C:\Documents and Settings\Paweł\Ustawienia lokalne\Temp\TIP2D002.exe P2D002 O4 - HKLM…\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe O4 - HKLM…\Run: [yltewinproho] C:\WINDOWS\System32\yltewinproho.exe O4 - HKLM…\Run: [melg3445] C:\WINDOWS\system32\mdmdd.exe O4 - HKLM…\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe O4 - HKLM…\Run: [sck121] C:\WINDOWS\system32\helpsyss.exe O4 - HKLM…\Run: [amsgupdate2] C:\WINDOWS\system32\amsng2.exe O4 - HKLM…\Run: [johnj3155] C:\WINDOWS\system32\srvcc.exe O4 - HKLM…\Run: [amsgupdate] C:\WINDOWS\system32\ams.exe O4 - HKLM…\RunServices: [mysvcig38] mysvcc.exe O4 - HKLM…\RunServices: [msvccc66] svcchosst.exe O4 - HKLM…\RunServices: [n] C:\WINDOWS\System32\n.exe O4 - HKLM…\RunServices: [awiufowau] C:\WINDOWS\System32\awiufowau.exe O4 - HKLM…\RunServices: [accit] C:\WINDOWS\System32\accit.exe O4 - HKLM…\RunServices: [c] C:\WINDOWS\System32\c.exe O4 - HKLM…\RunServices: [zwqmaiuy] C:\WINDOWS\System32\zwqmaiuy.exe O4 - HKLM…\RunServices: [trc] C:\WINDOWS\System32\trc.exe O4 - HKLM…\RunServices: [oyrvtlr] C:\WINDOWS\System32\oyrvtlr.exe O4 - HKLM…\RunServices: [fpyukyxyn] C:\WINDOWS\System32\fpyukyxyn.exe O4 - HKLM…\RunServices: [gwcnpthdb] C:\WINDOWS\System32\gwcnpthdb.exe O4 - HKLM…\RunServices: [gqjnkokhu] C:\WINDOWS\System32\gqjnkokhu.exe O4 - HKLM…\RunServices: [sqcwf] C:\WINDOWS\System32\sqcwf.exe O4 - HKLM…\RunServices: [djujjmv] C:\WINDOWS\System32\djujjmv.exe O4 - HKLM…\RunServices: [yltewinproho] C:\WINDOWS\System32\yltewinproho.exe O4 - HKLM…\RunServices: [jrhhmnm] C:\WINDOWS\System32\jrhhmnm.exe O4 - HKLM…\RunServices: [ny] C:\WINDOWS\System32\ny.exe O4 - HKLM…\RunServices: [tlq] C:\WINDOWS\System32\tlq.exe O4 - HKLM…\RunServices: [vthhln] C:\WINDOWS\System32\vthhln.exe O4 - HKLM…\RunServices: [mmsass] mmdmm.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Cmcl] “C:\DOCUME~1\PAWE~1\MOJEDO~1\ECURIT~1\wuauboot.exe” -vt yazb O4 - HKCU…\Run: [Fey] “C:\Documents and Settings\Paweł\Dane aplikacji\a?sembly\r?ndll.exe” 99001396 O4 - HKCU…\Run: [Komunikator] “C:\Program Files\Tlen.pl\tlen.exe” --confdir=home O4 - HKCU…\Run: [melg34] C:\WINDOWS\system32\mdmd.exe O4 - HKCU…\Run: [WebBuying] C:\Program Files\Web Buying\v1.6.8\webbuying.exe O4 - HKCU…\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe O4 - HKCU…\Run: [sysms] C:\1.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [sysmss] C:\WINDOWS\system32\sysems.exe O4 - HKCU…\Run: [ipWins] C:\Program Files\Ipwindows\ipwins.exe O4 - HKCU…\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe O4 - HKCU…\Run: [melg3445] C:\WINDOWS\system32\mdmdd.exe O4 - HKCU…\Run: [WinPop] C:\Program Files\WinPop\winpop.exe O4 - HKCU…\Run: [johnj3155] C:\WINDOWS\system32\srvcc.exe O4 - HKCU…\Run: [sck121] C:\WINDOWS\system32\helpsyss.exe O4 - HKCU…\Run: [amsgupdate2] C:\WINDOWS\system32\amsng2.exe O4 - HKCU…\Run: [amsgupdate] C:\WINDOWS\system32\ams.exe O4 - Startup: TA_Start.lnk = ? O4 - Global Startup: D-Link AirPlus.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O10 - Hijacked Internet access by WebHancer O10 - Hijacked Internet access by WebHancer O10 - Hijacked Internet access by WebHancer O15 - Trusted Zone: http://click.getmirar.com (HKLM) O15 - Trusted Zone: http://click.mirarsearch.com (HKLM) O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM) O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM) O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{05330F36-2291-4D74-8A3C-2432E1081028}: NameServer = 194.204.152.34,80.50.50.50 O17 - HKLM\System\CS1\Services\Tcpip…{05330F36-2291-4D74-8A3C-2432E1081028}: NameServer = 194.204.152.34,80.50.50.50 O17 - HKLM\System\CS2\Services\Tcpip…{05330F36-2291-4D74-8A3C-2432E1081028}: NameServer = 194.204.152.34,80.50.50.50 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: dxclib303562752.dll O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e mc-110-12-0000137 (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Print Spooler Service (reh4yu4p3) - Unknown owner - C:\WINDOWS\System32\yltewinproho.exe

[qrczak13]

Heh, ładnie masz syfu.

Pobierz Windows Worms Doors Cleaner, ustaw znaczki na zielono, Netbios może być na żółto.

Po użyciu narzędzia wymagany jest restart.

Pobierz LSP - FIX zaznacz " I know what I’m doing",

następnie w okienku Keep zaznacz bibliotekę webhdll.dll i za pomocą strzałki (>>) przenieś ją do okienka Remover i kliknij Finish i restart.

W trybie awaryjnym użyj VundoFix + FixVundo + VirtmundoBeGone

Odinstaluj w Dodaj/usuń programy > DeluxeCommunications

Po wykonaniu w/w daj log z ComboFix + opis zrobienia loga na samym dole.

[blazej2]

Poddałem się, ponieważ komp już prawie nie szedł już uruchomić. Format