zlob.DNSchanger jak sobie z nim poradzic?

[kornik911 (Maciek Urlik)]

witam. ostatnio zauwazylem pewne problemy z dzialaniem niektorych aplikacji np. nie loguje mi sie automatycznie poczta tak jak to bylo do niedawna. przeskanowalem kompa avastem i nic. spybot znalazl “zlob.DNSchanger” wiec usunalem spybot’em to cos ale kazde przeszukiwanie spybotem znowu znajduje “zlob.DNSchanger”.Mam pytania: co to jest ale najwazniejsze jak sie go pozbyc. korzystam z winXP.z gory dziekuje za pomoc.

[Fighter (Goldenkeylogger)]

Log z Hijack

http://forum.dobreprogramy.pl/viewtopic.php?t=36654

[kornik911 (Maciek Urlik)]

pierwszy raz to robie wiec przepraszam za ewentualne nieporozumienia.to wszystko co sie zrobilo :o

Logfile of HijackThis v1.99.1

Scan saved at 21:48:28, on 2007-07-07

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Microsoft SQL Server\MSSQL$MPSYSTEM\Binn\sqlservr.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\Google\Gmail Notifier\gnotify.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE

C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Właściciel\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM…\Run: [nwiz] nwiz.exe /installquiet /nodetect

O4 - HKLM…\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM…\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM…\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe

O4 - HKLM…\Run: [stmRst] C:\WINDOWS\StmClean.exe

O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe”

O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

O4 - HKLM…\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe

O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra ‘Tools’ menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s … wflash.cab

O17 - HKLM\System\CCS\Services\Tcpip…{08766F03-0B43-4DD0-AC68-55EBF2BDE64F}: NameServer = 85.255.115.101,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip…{27B92A02-D1D2-4F64-AFAF-6BD2B6E4D44B}: NameServer = 85.255.115.101,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip…{5EF4A4A1-7DB4-4451-8028-C6581E875C01}: NameServer = 85.255.115.101,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip…{753268C0-A692-4C09-8C9E-443FAF3302AB}: NameServer = 85.255.115.101,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip…{E56E44AB-6F29-4FE4-815C-45961E27FC07}: NameServer = 85.255.115.101,85.255.112.110

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

O17 - HKLM\System\CS1\Services\Tcpip…{08766F03-0B43-4DD0-AC68-55EBF2BDE64F}: NameServer = 85.255.115.101,85.255.112.110

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

O17 - HKLM\System\CS2\Services\Tcpip…{08766F03-0B43-4DD0-AC68-55EBF2BDE64F}: NameServer = 85.255.115.101,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

prosze o pomoc co dalej zrobic

[Fighter (Goldenkeylogger)]

Użyj Fixwareout

wg tej porady

http://www.searchengines.pl/phpbb203/Za … ntry225444

Oraz fix

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

[kornik911 (Maciek Urlik)]

a co z kodem

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

bo podobno z activex sie to bierze

Złączono Posta : 08.07.2007 (Nie) 1:11

zrobilem kilka razy to co pisales ale nadal spybot wykrywa zlob.DNSchanger’a

Złączono Posta : 08.07.2007 (Nie) 1:12

a to aktualny log juz po tym wszystkim co mowiles zebym zrobil

Logfile of HijackThis v1.99.1

Scan saved at 01:11:50, on 2007-07-08

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Microsoft SQL Server\MSSQL$MPSYSTEM\Binn\sqlservr.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\Google\Gmail Notifier\gnotify.exe

C:\WINDOWS\system32\rundll32.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE

C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Właściciel\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM…\Run: [nwiz] nwiz.exe /installquiet /nodetect

O4 - HKLM…\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM…\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM…\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe

O4 - HKLM…\Run: [stmRst] C:\WINDOWS\StmClean.exe

O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe”

O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

O4 - HKLM…\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe

O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra ‘Tools’ menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s … wflash.cab

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[anon94597501]

Jeżeli chodzi o Hijack to kosmetycznie usuń to, jak nie wiesz co to jest:

O4 - HKLM\..\Run: [StmRst] C:\WINDOWS\StmClean.exe

Ale nie rozwiąże to problemu, logi są czyste.

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

To jest czysty wpis, i nie szkodzi Twemu systemowi :-o

Ponadto uważam, że powinieneś użyć:

Opis ComboFix - przeczytaj pierwszy post mówiący o ComboFix, zapodaj z niego log, i Silent Runners.

[Gutek]

Daj log z Combofix

Uwaga: Jak wklejasz loga to obejmuj go znacznikiem (tagiem) CODE lub QUOTE

[kornik911 (Maciek Urlik)]

nie wiem czy o to chodzilo ale prosze, to jest co co zrobil combofix(nie wiem czy o to chodzilo z tymi znacznikami):

“Waciciel” - 2007-07-08 13:42:53 - ComboFix 07-07-07.3 - Dodatek Service Pack 2 ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\WACICI~1\Pulpit.\internet explorer.lnk ((((((((((((((((((((((((( Files Created from 2007-06-08 to 2007-07-08 ))))))))))))))))))))))))))))))) 2007-07-08 13:42 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-07 22:26 9,763 --a------ C:\dnsbak.reg 2007-07-07 03:11 2007-07-07 03:11 2007-07-01 22:33 4,194,304 --a------ C:\DOCUME~1\WACICI~1\ntuser.dat 2007-07-01 13:43 2007-06-29 16:19 2007-06-29 16:19 2007-06-29 16:10 2007-06-29 16:09 2007-06-29 16:07 2007-06-29 16:06 2007-06-29 16:06 2007-06-29 14:33 95,872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-06-29 14:33 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-06-29 14:33 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-06-29 14:33 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-06-29 14:33 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-06-29 14:33 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-06-29 14:33 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-06-29 14:33 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-06-29 14:32 2007-06-21 02:09 2007-06-19 23:11 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll 2007-06-19 23:11 309,616 --a------ C:\WINDOWS\system32\wmv8dmod.dll 2007-06-19 23:01 2007-06-19 20:21 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-06-19 20:21 208,248 --a------ C:\WINDOWS\system32\muweb.dll 2007-06-19 12:15 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2007-06-19 12:15 30,512 --a------ C:\WINDOWS\system32\mdimon.dll 2007-06-19 12:14 2007-06-19 12:13 2007-06-19 12:11 2007-06-19 12:11 2007-06-19 12:11 2007-06-15 18:04 2007-06-15 18:03 2007-06-15 14:33 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-06-12 14:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-06-12 14:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-06-12 14:51 43,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-06-12 14:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-06-12 14:51 2007-06-10 00:25 2007-06-09 23:35 2007-06-09 22:48 2007-06-09 22:47 5,120 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-06-09 22:47 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2007-06-09 22:47 2007-06-09 22:47 2007-06-09 22:47 2007-06-09 18:00 2,933 --a------ C:\WINDOWS\mozver.dat 2007-06-09 18:00 0 --a------ C:\WINDOWS\nsreg.dat 2007-06-09 17:57 2007-06-09 17:37 2007-06-09 17:37 2007-06-09 17:37 2007-06-09 17:37 2007-06-09 12:25 2007-06-09 12:24 174,592 --a------ C:\WINDOWS\system32\framedyn.dll 2007-06-09 12:23 94,000 --a------ C:\WINDOWS\system32\drivers\ss_mdm.sys 2007-06-09 12:23 8,304 --a------ C:\WINDOWS\system32\drivers\ss_mdfl.sys 2007-06-09 12:23 6,144 --a------ C:\WINDOWS\system32\drivers\ss_cmnt.sys 2007-06-09 12:23 6,144 --a------ C:\WINDOWS\system32\drivers\ss_cm.sys 2007-06-09 12:23 58,320 --a------ C:\WINDOWS\system32\drivers\ss_bus.sys 2007-06-09 12:23 5,808 --a------ C:\WINDOWS\system32\drivers\ss_whnt.sys 2007-06-09 12:23 5,808 --a------ C:\WINDOWS\system32\drivers\ss_wh.sys 2007-06-09 12:23 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2007-06-09 12:23 2007-06-09 12:11 2007-06-09 12:10 2007-06-09 12:10 2007-06-09 01:01 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2007-06-09 01:01 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2007-06-09 01:01 2007-06-09 01:01 2007-06-09 00:34 2007-06-09 00:34 2007-06-09 00:30 90,112 --------- C:\WINDOWS\system32\s2sqlprs.dll 2007-06-09 00:30 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-06-09 00:30 509,328 --------- C:\WINDOWS\system32\crviewer.dll 2007-06-09 00:30 5,550,080 --------- C:\WINDOWS\system32\craxdrt.dll 2007-06-09 00:30 270,336 --------- C:\WINDOWS\system32\p2sodbc.dll 2007-06-09 00:30 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-06-09 00:30 2007-06-09 00:26 33,340 --------- C:\WINDOWS\system32\dbmsqlgc.dll 2007-06-09 00:26 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-06-09 00:26 24,576 --------- C:\WINDOWS\system32\dbmsgnet.dll 2007-06-09 00:26 2007-06-09 00:24 274,432 --a------ C:\WINDOWS\system32\IscDbc.dll 2007-06-09 00:24 262,144 --a------ C:\WINDOWS\system32\OdbcJdbcMT.dll 2007-06-09 00:24 253,952 --a------ C:\WINDOWS\system32\OdbcJdbc.dll 2007-06-09 00:24 155,648 --a------ C:\WINDOWS\system32\OdbcJdbcSetup.dll 2007-06-08 14:51 2007-06-08 14:51 2007-06-08 14:50 2007-06-08 14:35 2007-06-08 14:30 2007-06-08 14:30 2007-06-08 13:13 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-08 11:29:39 94,900 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-08 11:29:39 512,720 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-08 01:53:22 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-06-19 21:01:15 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-06-07 11:27:05 -------- d-----w C:\Program Files\totalcmd 2007-06-06 20:47:23 -------- d-----w C:\DOCUME~1\WACICI~1\DANEAP~1\Help 2007-05-31 15:19:18 -------- d-----w C:\Program Files\MSBuild 2007-05-31 15:15:55 -------- d-----w C:\Program Files\Reference Assemblies 2007-05-31 12:32:54 -------- d-----w C:\Program Files\Messenger 2007-05-31 11:57:56 -------- d-----w C:\Program Files\CONEXANT 2007-05-31 11:43:44 -------- d-----w C:\Program Files\NetWaiting 2007-05-31 11:22:17 -------- d-----w C:\Program Files\WIDCOMM 2007-05-31 10:56:30 -------- d-----w C:\Program Files\Hewlett-Packard 2007-05-31 10:55:32 -------- d-----w C:\Program Files\Synaptics 2007-05-31 10:55:26 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-31 10:38:31 -------- d-----w C:\Program Files\Intel 2007-05-31 10:29:13 -------- d-----w C:\Program Files\DIFX 2007-05-31 10:28:45 -------- d-----w C:\Program Files\HP 1.3MP Webcam 2007-05-31 00:58:29 -------- d-----w C:\Program Files\Common Files\ODBC 2007-05-31 00:58:26 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-05-30 16:07:41 -------- d-----w C:\Program Files\microsoft frontpage 2007-05-30 16:07:25 0 --sha-r C:\MSDOS.SYS 2007-05-30 16:07:25 0 --sha-r C:\IO.SYS 2007-05-30 16:07:25 0 ----a-w C:\CONFIG.SYS 2007-05-30 16:07:25 0 ----a-w C:\AUTOEXEC.BAT 2007-05-30 16:06:30 -------- d–h--w C:\Program Files\WindowsUpdate 2007-05-30 16:06:29 -------- d-----w C:\Program Files\Usługi online 2007-05-30 16:05:40 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-05-30 16:05:29 -------- d-----w C:\Program Files\Movie Maker 2007-05-30 16:05:00 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-05-30 16:04:32 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-05-30 16:04:23 -------- d-----w C:\Program Files\Windows NT 2007-05-30 15:32:33 1,548,288 ----a-w C:\WINDOWS\system32\sfcfiles.dll 2007-05-30 15:32:09 277,784 ----a-w C:\WINDOWS\system32\drivers\iaStor.sys 2007-05-30 15:32:06 991,744 ----a-w C:\WINDOWS\system32\syssetup.dll 2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-10-22 23:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{22BF413B-C6D2-4d91-82A9-A0F997BA588C}] 2007-05-28 14:52 722472 --a------ C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{AA58ED58-01DD-4d91-8333-CF10577473F7}] 2007-06-08 00:09 2403392 -ra------ c:\program files\google\googletoolbar1.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] 2007-07-01 22:15 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “nwiz”=“nwiz.exe” [2006-09-27 17:10 C:\WINDOWS\system32\nwiz.exe] “hpWirelessAssistant”="%ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2007-01-12 14:36] “QlbCtrl”="%ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [] “High Definition Audio Property Page Shortcut”=“CHDAudPropShortcut.exe” [2006-07-26 22:44 C:\WINDOWS\system32\CHDAudPropShortcut.exe] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] “Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-05-11 03:06] “{0228e555-4f9c-4e35-a3ec-b109a192b4c2}”=“C:\Program Files\Google\Gmail Notifier\gnotify.exe” [2005-07-15 23:48] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2006-03-02 14:00] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-07-01 22:15] ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-08 13:44:43 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-08 13:45:10 C:\ComboFix-quarantined-files.txt … 2007-07-08 13:45 code — E O F —

[Gutek]

Zobacz jak wklejać LOGI

Pozdrawiam Gutek2222

Skan AVG Anti-Spyware 7.5 po update

[kornik911 (Maciek Urlik)]

dzieki Gutek2222, zrobie co piszesz. odnosnie loga to chyba wszystko zrobilem.1chyba objalem go znacznikiem code (nie wiem czy o to chodzi bo nie robilem tego wczesniej), 2. powod to ciagle znajdowany przez spybot’a zlob.DNSchanger, 3. ten wlasnie powod, 4. to combofix, 5 caly log. przepraszam jesli cos mimio wszystko zrobilem nie tak.dziekuje za pomoc, mam nadzieje ze sie uda

[Gutek]

Pokazałem wyżej jak loga obejmuje się znacznikiem (tagiem) CODE lub QUOTE

Daj raport z AVG Anti-Spyware 7.5

[kornik911 (Maciek Urlik)]

Prosze o to ten raport

AVG Anti-Spyware - Scan Report

---

• Created at: 14:58:53 2007-07-08

• Scan result:

C:\System Volume Information_restore{276E4517-9B62-446F-BF18-4F764B968F88}\RP44\A0006844.exe -> Downloader.Zlob : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@metacafe.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@2.adbrite[1].txt -> TrackingCookie.Adbrite : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@3.adbrite[1].txt -> TrackingCookie.Adbrite : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@4.adbrite[2].txt -> TrackingCookie.Adbrite : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@adbrite[2].txt -> TrackingCookie.Adbrite : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@com[1].txt -> TrackingCookie.Com : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@connextra[1].txt -> TrackingCookie.Connextra : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@hotlog[2].txt -> TrackingCookie.Hotlog : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@idot[1].txt -> TrackingCookie.Idot : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@ivwbox[2].txt -> TrackingCookie.Ivwbox : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@stat.onestat[2].txt -> TrackingCookie.Onestat : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@overture[1].txt -> TrackingCookie.Overture : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@paycounter[2].txt -> TrackingCookie.Paycounter : No action taken.

:mozilla.65:C:\Documents and Settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\a4ajtl0u.default\cookies.txt -> TrackingCookie.Paypal : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@www.paypal[1].txt -> TrackingCookie.Paypal : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@real[1].txt -> TrackingCookie.Real : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@realmedia[2].txt -> TrackingCookie.Realmedia : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@edge.ru4[1].txt -> TrackingCookie.Ru4 : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@site.skype[1].txt -> TrackingCookie.Skype : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@skype[1].txt -> TrackingCookie.Skype : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@specificclick[2].txt -> TrackingCookie.Specificclick : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@tacoda[2].txt -> TrackingCookie.Tacoda : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@trafic[1].txt -> TrackingCookie.Trafic : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@m.webtrends[1].txt -> TrackingCookie.Webtrends : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@clickthrough.wegcash[2].txt -> TrackingCookie.Wegcash : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@free.wegcash[2].txt -> TrackingCookie.Wegcash : No action taken.

C:\Documents and Settings\Właściciel\Cookies\właściciel@yadro[1].txt -> TrackingCookie.Yadro : No action taken.

::Report end

[Gutek]

Wyłącz i włącz przywracanie systemu

[kornik911 (Maciek Urlik)]

dziekuje wszystkim za pomoc.wyglada na to ze sie udalo.usunalem go AVG Anti-spyware wyglada ze go nie ma.mam tylko jeszcze jedna prosbe.moglby mi ktos sprawdzic loga?oto on:

Logfile of HijackThis v1.99.1

Scan saved at 02:02:15, on 2007-07-09

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Microsoft SQL Server\MSSQL$MPSYSTEM\Binn\sqlservr.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\Google\Gmail Notifier\gnotify.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Documents and Settings\Właściciel\Pulpit\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect

O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [INTERNATIONAL] International*

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

jeszcze raz dziekuje i pozdrawiam

[Gutek]

Log ok - Optymalizacja Autostartu