Witam, jestem rozpaczony, mam na kompie straszliwego wirusa, nie wiem co robić, pulpit zmienia się na jakiś Detected Spryware, na dysku c tam gdzie system tworzą się foldery, co oczywyiście zajmuje miejsce, komputer działa na pograniczu ;/ Zalaczam loga hijackthis, prosze o szybka odpowidz, a jeszcze jedno, jak już mam coś usunąć w HT to nacisnąc Fix checked? czy jak to się robi. Z góry dziękuję,
Krzysztof Nowak
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:38:35, on 2008-03-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSMixer.exe
Hrogram FilesWinampwinampa.exe
Crogram FilesCommon FilesAheadLibNMBgMonitor.exe
Crogram FilesMessengermsmsgs.exe
H:Nokia PC Suite 6PCSuite.exe
Crogram FilesKalendarz XPKalendarz.exe
Crogram FilesCommon FilesAheadLibNMIndexStoreSvr.exe
Crogram FilesRALINKRT2400 Wireless LAN CardInstallerWINXPRaConfig.exe
Crogram FilesCommon FilesAheadLibNMIndexingService.exe
Crogram FilesPC Connectivity SolutionServiceLayer.exe
Crogram FilesPC Connectivity SolutionTransportsNclUSBSrv.exe
Crogram FilesPC Connectivity SolutionTransportsNclRSSrv.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSexplorer.exe
Crogram FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSsystem32msiexec.exe
Crogram FilesCommon FilesiS3Anti-SpywareSZServer.exe
CROGRA~1MOZILL~1FIREFOX.EXE
Crogram FilesSTOPzilla!STOPzilla.exe
Crogram FilesTrend MicroHijackThisHijackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://search.bearshare.com/pl/
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - Crogram FilesSTOPzilla!SZSG.dll
O4 - HKLM..Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 -k
O4 - HKLM..Run: [WinampAgent] "hrogram FilesWinampwinampa.exe"
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [Gadu-Gadu] "Crogram FilesGadu-Gadugg.exe" /tray
O4 - HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "Crogram FilesCommon FilesAheadLibNMBgMonitor.exe"
O4 - HKCU..Run: [MSMSGS] "Crogram FilesMessengermsmsgs.exe" /background
O4 - HKCU..Run: [PC Suite Tray] "H:Nokia PC Suite 6PCSuite.exe" -onlytray
O4 - HKUSS-1-5-20..RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'USŁUGA SIECIOWA')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'Default user')
O4 - Global Startup: Kalendarz XP.lnk = Crogram FilesKalendarz XPKalendarz.exe
O4 - Global Startup: Raconfig.lnk = Crogram FilesRALINKRT2400 Wireless LAN CardInstallerWINXPRaConfig.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.6.0_03binssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.6.0_03binssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Crogram FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Crogram FilesMessengermsmsgs.exe
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O17 - HKLMSystemCCSServicesTcpip..{F9C670A3-D9CD-41CD-B1A1-4F0510246BD5}: NameServer = 194.204.159.1 194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - CROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - Crogram FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: NBService - Nero AG - Crogram FilesNeroNero 7Nero BackItUpNBService.exe
O23 - Service: NMIndexingService - Nero AG - Crogram FilesCommon FilesAheadLibNMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - Crogram FilesPC Connectivity SolutionServiceLayer.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - Crogram FilesCommon FilesiS3Anti-SpywareSZServer.exe
--
End of file - 4895 bytes
Krzysztof Nowak
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:38:35, on 2008-03-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSMixer.exe
Hrogram FilesWinampwinampa.exe
Crogram FilesCommon FilesAheadLibNMBgMonitor.exe
Crogram FilesMessengermsmsgs.exe
H:Nokia PC Suite 6PCSuite.exe
Crogram FilesKalendarz XPKalendarz.exe
Crogram FilesCommon FilesAheadLibNMIndexStoreSvr.exe
Crogram FilesRALINKRT2400 Wireless LAN CardInstallerWINXPRaConfig.exe
Crogram FilesCommon FilesAheadLibNMIndexingService.exe
Crogram FilesPC Connectivity SolutionServiceLayer.exe
Crogram FilesPC Connectivity SolutionTransportsNclUSBSrv.exe
Crogram FilesPC Connectivity SolutionTransportsNclRSSrv.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSexplorer.exe
Crogram FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSsystem32msiexec.exe
Crogram FilesCommon FilesiS3Anti-SpywareSZServer.exe
CROGRA~1MOZILL~1FIREFOX.EXE
Crogram FilesSTOPzilla!STOPzilla.exe
Crogram FilesTrend MicroHijackThisHijackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://search.bearshare.com/pl/
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - Crogram FilesSTOPzilla!SZSG.dll
O4 - HKLM..Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 -k
O4 - HKLM..Run: [WinampAgent] "hrogram FilesWinampwinampa.exe"
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [Gadu-Gadu] "Crogram FilesGadu-Gadugg.exe" /tray
O4 - HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "Crogram FilesCommon FilesAheadLibNMBgMonitor.exe"
O4 - HKCU..Run: [MSMSGS] "Crogram FilesMessengermsmsgs.exe" /background
O4 - HKCU..Run: [PC Suite Tray] "H:Nokia PC Suite 6PCSuite.exe" -onlytray
O4 - HKUSS-1-5-20..RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'USŁUGA SIECIOWA')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'Default user')
O4 - Global Startup: Kalendarz XP.lnk = Crogram FilesKalendarz XPKalendarz.exe
O4 - Global Startup: Raconfig.lnk = Crogram FilesRALINKRT2400 Wireless LAN CardInstallerWINXPRaConfig.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.6.0_03binssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Crogram FilesJavajre1.6.0_03binssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Crogram FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Crogram FilesMessengermsmsgs.exe
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O10 - Unknown file in Winsock LSP: crogram filescommon filesis3anti-spywareis3lsp.dll
O17 - HKLMSystemCCSServicesTcpip..{F9C670A3-D9CD-41CD-B1A1-4F0510246BD5}: NameServer = 194.204.159.1 194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - CROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - Crogram FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: NBService - Nero AG - Crogram FilesNeroNero 7Nero BackItUpNBService.exe
O23 - Service: NMIndexingService - Nero AG - Crogram FilesCommon FilesAheadLibNMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - Crogram FilesPC Connectivity SolutionServiceLayer.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - Crogram FilesCommon FilesiS3Anti-SpywareSZServer.exe
--
End of file - 4895 bytes