Problem z otwieraniem stron
gdy prubuje otworzyc jaka kolwiek strone pojawia mi sie komunikat
Access Blocked – Virus Warning!
You cannot access this site due to following reason:
Your computer was infected by Spyware or Adware Software.
This is dangerous software which disclose your personal
and transferred data and/or display unsolices advertising.
You can use this ADWARE/SPYWARE REMOVAL tools in
order to solve this problem and prevent futurer infection.
You can click Search to look for information on the Internet.
HTTP Error – Access Blocked
Jak to naprawic ?
Access Blocked – Virus Warning!
You cannot access this site due to following reason:
Your computer was infected by Spyware or Adware Software.
This is dangerous software which disclose your personal
and transferred data and/or display unsolices advertising.
You can use this ADWARE/SPYWARE REMOVAL tools in
order to solve this problem and prevent futurer infection.
You can click Search to look for information on the Internet.
HTTP Error – Access Blocked
Jak to naprawic ?
Odpowiedzi: 14
wszystko dziala BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO DZIEKUJE Bobi_robert no i oczywiscie piscasso :)
wszystko dziala BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO BARDZO DZIEKUJE Bobi_robert no i oczywiscie piscasso :)
Dobra wiec tak
Uruchom komputer w awaryjnym
Odpal HJT i sfixuj podane przeze mnie pozycje
Usun te biblioteke
Na koncu dodaj plik z mojego załacznika do rejestru
(rozpakuj oczywiscie najpierw)
PS: Podziekuj picasso :P
Uruchom komputer w awaryjnym
Odpal HJT i sfixuj podane przeze mnie pozycje
Usun te biblioteke
Na koncu dodaj plik z mojego załacznika do rejestru
(rozpakuj oczywiscie najpierw)
PS: Podziekuj picasso :P
nic to nie daje plik wtlbass32.dll za kazdym razem tworzy sie sam.
Wylacz przywracanie systemu
Wyrejestruj biblioteke:
wtlbass32.dll
Usun:
wtlbass32.dll
Wyrejestruj biblioteke:
wtlbass32.dll
Usun:
wtlbass32.dll
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
O2 – BHO: VDOMP Class – {A0ED918D–B8E6–4c3d–BD15–1DB1AE9A5DD3} – C:WINDOWSwtlbass32.dll
nic to jednak nie pomoglo teraz znowu wszystko wrocilo
tylko ze tym razem po usunieciu pliku wtlbass32.dll pijawia sie on natychmiast spowrotem. Co robic ?
log:
tylko ze tym razem po usunieciu pliku wtlbass32.dll pijawia sie on natychmiast spowrotem. Co robic ?
log:
Logfile of HijackThis v1.99.0
Scan saved at 08:06:55, on 2005–01–29
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSSystem32 vsvc32.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32usrbridg.exe
C:WINDOWSSystem32HPHipm11.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSExplorer.EXE
C:PROGRA~1DAPDAP.EXE
C:WINDOWSSystem32hphmon04.exe
C:Program FilesWinampwinampa.exe
C:PROGRA~1NEOSTR~1CnxMon.exe
C:Program FilesThomsonSpeedTouch USBDragdiag.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesNeostrada TPNeostradaTP.exe
C:Program FilesNeostrada TPComComp.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesNeostrada TPWatch.exe
C:Documents and SettingsSZkartPulpithijackthisHijackThis.exe
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL
O2 – BHO: DAPHelper Class – {0000CC75–ACF3–4cac–A0A9–DD3868E06852} – C:Program FilesDAPDAPBHO.dll
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0 CEReaderActiveXAcroIEHelper.ocx
O2 – BHO: VDOMP Class – {A0ED918D–B8E6–4c3d–BD15–1DB1AE9A5DD3} – C:WINDOWSwtlbass32.dll
O3 – Toolbar: DAP Bar – {62999427–33FC–4baf–9C9C–BCE6BD127F08} – C:Program FilesDAPDAPIEBar.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O4 – HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [DownloadAccelerator] C:PROGRA~1DAPDAP.EXE /STARTUP
O4 – HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSSystem32spooldriversw32x863hpztsb05.exe
O4 – HKLM..Run: [HPHmon04] C:WINDOWSSystem32hphmon04.exe
O4 – HKLM..Run: [HPHUPD04] "C:Program FilesHP Photosmart 11hphinstallUniPatchhphupd04.exe"
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe
O4 – HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe
O4 – HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 – HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" –atboottime
O4 – HKLM..Run: [WOOKIT] C:Program FilesNeostrada TPNeostradaTP.exe
O4 – HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 – Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavaj2re1.4.1_01in pjpi141_01.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavaj2re1.4.1_01in pjpi141_01.dll
O9 – Extra button: Run DAP – {669695BC–A811–4A9D–8CDF–BA8C795F261C} – C:PROGRA~1DAPDAP.EXE
O9 – Extra button: Badanie – {92780B25–18CC–41C8–B9BE–3C9C571A8263} – C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O17 – HKLMSystemCCSServicesTcpip..{52AC3910–E4B6–4C0F–89B7–780CEF227F34}: NameServer = 194.204.152.34 217.98.63.164
O23 – Service: NVIDIA Driver Helper Service – NVIDIA Corporation – C:WINDOWSSystem32 vsvc32.exe
O23 – Service: Pml Driver HPH11 – HP – C:WINDOWSSystem32HPHipm11.exe
O23 – Service: IrBridge User–Level Interface – Extended Systems, Inc. – C:WINDOWSsystem32usrbridg.exe
Mozesz juz wlaczyc. To zawsze jakies zabezpieczenie w razie problemow z systemem.
BARDZO DZIEKUJE TERAZ WSZYSTKO DZIAŁA POPRAWNIE
Czy moge juz wlaczyc przywracanie czy musi juz to tak zostac.?
Czy moge juz wlaczyc przywracanie czy musi juz to tak zostac.?
1. Zaznaczasz w HiJacku pozycje podane przez Bobiego i naciskasz FIX...
2. Wyszukjesz na dysku podane pliki i usuwasz jesli sa. Pamietaj o ich lokalizacji.
2. Wyszukjesz na dysku podane pliki i usuwasz jesli sa. Pamietaj o ich lokalizacji.
juz znalazlem wylaczenie przywracania ale co dalej ?
tzn czy moge usunac te logi przez HijackThis przez nacisniecie przycisku "FIX CHECKED"
tzn czy moge usunac te logi przez HijackThis przez nacisniecie przycisku "FIX CHECKED"
Jak wylaczyc przywracanie?
I jak usunąć z dysku to:
Reszte usuwam przez edycje rejestru ?
I jak usunąć z dysku to:
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://szukaj.wp.pl
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=138770
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=138770
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.onet.pl/
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
O2 – BHO: BHObj Class – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – C:WINDOWS em219.dll
O2 – BHO: TwaintecObj Class – {000020DD–C72E–4113–AF77–DD56626C6C42} – C:WINDOWS waintec.dll
O2 – BHO: (no name) – {83DE62E0–5805–11D8–9B25–00E04C60FAF2} – C:WINDOWS2_0_1browserhelper2.dll
O2 – BHO: VDOMP Class – {A0ED918D–B8E6–4c3d–BD15–1DB1AE9A5DD3} – C:WINDOWSwtlbass32.dll
02 – BHO: BAHelper Class – {A3FDD654–A057–4971–9844–4ED8E67DBBB8} – C:Program FilesSideFindsfbho.dll
O3 – Toolbar: SToolbar – {0E1230F8–EA50–42A9–983C–D22ABC2EED3B} – C:WINDOWSstoolbd.dll
O4 – HKLM..Run: [alchem] C:WINDOWSalchem.exe
O4 – HKLM..Run: [Scurity Center] C:WINDOWSsvchost.exe
O4 – HKLM..Run: [pR2cFEv] C:WINDOWSycgwapv.exe
O4 – HKLM..Run: [IST Service] C:Program FilesISTsvcistsvc.exe
O9 – Extra button: SideFind – {10E42047–DEB9–4535–A118–B3F6EC39B807} – C:Program FilesSideFindsidefind.dll
O13 – DefaultPrefix: http://ehttp.cc/?
O13 – WWW Prefix: http://ehttp.cc/?
O13 – WWW. Prefix: http://ehttp.cc/?
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://public.windupdates.com/get_file.php?bt=ie&p=580b654524d68b23906b34a03fd33a9de69f5f922a0754ee169442922e3e48cbd7605b04e0917847f89efa8e422ece1a819f5daf9328:5db0f34c35fd827de7642452ea30b3de
O18 – Filter: text/html – {45FF7AD0–7E65–45D1–BFAF–572D2938FBE8} – C:Documents and SettingsSzalonyUstawienia lokalneDane aplikacjimicrosoftinternet explorerV0.26.dat
Reszte usuwam przez edycje rejestru ?
Wylaczasz przywracanie
Usuwasz z dysku i loga:
Tego: R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
Usun edytujac rejestr w kluczu:
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks
usun: {CFBFAE00–17A6–11D0–99CB–00C04FD64497}_
z prawej
O4 – HKLM..Run: [Scurity Center] C:WINDOWSsvchost.exe >> do wywalenia, nie pomyl z systemowym
Usuwasz z dysku i loga:
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://szukaj.wp.pl
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=138770
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=138770
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.onet.pl/
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
O2 – BHO: BHObj Class – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – C:WINDOWS em219.dll
O2 – BHO: TwaintecObj Class – {000020DD–C72E–4113–AF77–DD56626C6C42} – C:WINDOWS waintec.dll
O2 – BHO: (no name) – {83DE62E0–5805–11D8–9B25–00E04C60FAF2} – C:WINDOWS2_0_1browserhelper2.dll
O2 – BHO: VDOMP Class – {A0ED918D–B8E6–4c3d–BD15–1DB1AE9A5DD3} – C:WINDOWSwtlbass32.dll
02 – BHO: BAHelper Class – {A3FDD654–A057–4971–9844–4ED8E67DBBB8} – C:Program FilesSideFindsfbho.dll
O3 – Toolbar: SToolbar – {0E1230F8–EA50–42A9–983C–D22ABC2EED3B} – C:WINDOWSstoolbd.dll
O4 – HKLM..Run: [alchem] C:WINDOWSalchem.exe
O4 – HKLM..Run: [Scurity Center] C:WINDOWSsvchost.exe
O4 – HKLM..Run: [pR2cFEv] C:WINDOWSycgwapv.exe
O4 – HKLM..Run: [IST Service] C:Program FilesISTsvcistsvc.exe
O9 – Extra button: SideFind – {10E42047–DEB9–4535–A118–B3F6EC39B807} – C:Program FilesSideFindsidefind.dll
O13 – DefaultPrefix: http://ehttp.cc/?
O13 – WWW Prefix: http://ehttp.cc/?
O13 – WWW. Prefix: http://ehttp.cc/?
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://public.windupdates.com/get_file.php?bt=ie&p=580b654524d68b23906b34a03fd33a9de69f5f922a0754ee169442922e3e48cbd7605b04e0917847f89efa8e422ece1a819f5daf9328:5db0f34c35fd827de7642452ea30b3de
O18 – Filter: text/html – {45FF7AD0–7E65–45D1–BFAF–572D2938FBE8} – C:Documents and SettingsSzalonyUstawienia lokalneDane aplikacjimicrosoftinternet explorerV0.26.dat
Tego: R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
Usun edytujac rejestr w kluczu:
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks
usun: {CFBFAE00–17A6–11D0–99CB–00C04FD64497}_
z prawej
O4 – HKLM..Run: [Scurity Center] C:WINDOWSsvchost.exe >> do wywalenia, nie pomyl z systemowym
Logfile of HijackThis v1.99.0
Scan saved at 12:19:07, on 2005–01–23
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSSystem32 vsvc32.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32usrbridg.exe
C:WINDOWSSystem32HPHipm11.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSExplorer.EXE
C:Program FilesNeostrada TPNeostradaTP.exe
C:WINDOWSSystem32devldr32.exe
C:Program FilesTlen.pl len.exe
C:Program FilesInternet Exploreriexplore.exe
C:PROGRA~1DAPDAP.EXE
C:Documents and SettingsSZkartPulpithijackthisHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://szukaj.wp.pl
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=138770
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=138770
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.onet.pl/
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL
O2 – BHO: BHObj Class – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – C:WINDOWS em219.dll
O2 – BHO: TwaintecObj Class – {000020DD–C72E–4113–AF77–DD56626C6C42} – C:WINDOWS waintec.dll
O2 – BHO: DAPHelper Class – {0000CC75–ACF3–4cac–A0A9–DD3868E06852} – C:Program FilesDAPDAPBHO.dll
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0 CEReaderActiveXAcroIEHelper.ocx
O2 – BHO: (no name) – {83DE62E0–5805–11D8–9B25–00E04C60FAF2} – C:WINDOWS2_0_1browserhelper2.dll
O2 – BHO: VDOMP Class – {A0ED918D–B8E6–4c3d–BD15–1DB1AE9A5DD3} – C:WINDOWSwtlbass32.dll
O2 – BHO: BAHelper Class – {A3FDD654–A057–4971–9844–4ED8E67DBBB8} – C:Program FilesSideFindsfbho.dll
O3 – Toolbar: DAP Bar – {62999427–33FC–4baf–9C9C–BCE6BD127F08} – C:Program FilesDAPDAPIEBar.dll
O3 – Toolbar: SToolbar – {0E1230F8–EA50–42A9–983C–D22ABC2EED3B} – C:WINDOWSstoolbd.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O4 – HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [DownloadAccelerator] C:PROGRA~1DAPDAP.EXE /STARTUP
O4 – HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSSystem32spooldriversw32x863hpztsb05.exe
O4 – HKLM..Run: [HPHmon04] C:WINDOWSSystem32hphmon04.exe
O4 – HKLM..Run: [HPHUPD04] "C:Program FilesHP Photosmart 11hphinstallUniPatchhphupd04.exe"
O4 – HKLM..Run: [alchem] C:WINDOWSalchem.exe
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [Scurity Center] C:WINDOWSsvchost.exe
O4 – HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe
O4 – HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe
O4 – HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 – HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" –atboottime
O4 – HKLM..Run: [pR2cFEv] C:WINDOWSycgwapv.exe
O4 – HKLM..Run: [IST Service] C:Program FilesISTsvcistsvc.exe
O4 – HKLM..Run: [TkBellExe] C:Program FilesCommon FilesRealUpdate_OBevntsvc.exe –osboot
O4 – HKLM..Run: [WOOKIT] C:Program FilesNeostrada TPNeostradaTP.exe
O4 – HKLM..Run: [MSConfig] C:WINDOWSPCHealthHelpCtrBinariesMSConfig.exe /auto
O4 – HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 – Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavaj2re1.4.1_01in pjpi141_01.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavaj2re1.4.1_01in pjpi141_01.dll
O9 – Extra button: SideFind – {10E42047–DEB9–4535–A118–B3F6EC39B807} – C:Program FilesSideFindsidefind.dll
O9 – Extra button: Run DAP – {669695BC–A811–4A9D–8CDF–BA8C795F261C} – C:PROGRA~1DAPDAP.EXE
O9 – Extra button: Badanie – {92780B25–18CC–41C8–B9BE–3C9C571A8263} – C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O13 – DefaultPrefix: http://ehttp.cc/?
O13 – WWW Prefix: http://ehttp.cc/?
O13 – WWW. Prefix: http://ehttp.cc/?
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://public.windupdates.com/get_file.php?bt=ie&p=580b654524d68b23906b34a03fd33a9de69f5f922a0754ee169442922e3e48cbd7605b04e0917847f89efa8e422ece1a819f5daf9328:5db0f34c35fd827de7642452ea30b3de
O16 – DPF: {91433D86–9F27–402C–B5E3–DEBDD122C339} – http://www.netvenda.com/sites/games–intl/pl/games4.cab
O17 – HKLMSystemCCSServicesTcpip..{52AC3910–E4B6–4C0F–89B7–780CEF227F34}: NameServer = 194.204.152.34 217.98.63.164
O18 – Filter: text/html – {45FF7AD0–7E65–45D1–BFAF–572D2938FBE8} – C:Documents and SettingsSzalonyUstawienia lokalneDane aplikacjimicrosoftinternet explorerV0.26.dat
O23 – Service: NVIDIA Driver Helper Service – NVIDIA Corporation – C:WINDOWSSystem32 vsvc32.exe
O23 – Service: Pml Driver HPH11 – HP – C:WINDOWSSystem32HPHipm11.exe
O23 – Service: IrBridge User–Level Interface – Extended Systems, Inc. – C:WINDOWSsystem32usrbridg.exe
Scan saved at 12:19:07, on 2005–01–23
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSSystem32 vsvc32.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32usrbridg.exe
C:WINDOWSSystem32HPHipm11.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSExplorer.EXE
C:Program FilesNeostrada TPNeostradaTP.exe
C:WINDOWSSystem32devldr32.exe
C:Program FilesTlen.pl len.exe
C:Program FilesInternet Exploreriexplore.exe
C:PROGRA~1DAPDAP.EXE
C:Documents and SettingsSZkartPulpithijackthisHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://szukaj.wp.pl
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=138770
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://default.home
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=138770
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.onet.pl/
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL
O2 – BHO: BHObj Class – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – C:WINDOWS em219.dll
O2 – BHO: TwaintecObj Class – {000020DD–C72E–4113–AF77–DD56626C6C42} – C:WINDOWS waintec.dll
O2 – BHO: DAPHelper Class – {0000CC75–ACF3–4cac–A0A9–DD3868E06852} – C:Program FilesDAPDAPBHO.dll
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0 CEReaderActiveXAcroIEHelper.ocx
O2 – BHO: (no name) – {83DE62E0–5805–11D8–9B25–00E04C60FAF2} – C:WINDOWS2_0_1browserhelper2.dll
O2 – BHO: VDOMP Class – {A0ED918D–B8E6–4c3d–BD15–1DB1AE9A5DD3} – C:WINDOWSwtlbass32.dll
O2 – BHO: BAHelper Class – {A3FDD654–A057–4971–9844–4ED8E67DBBB8} – C:Program FilesSideFindsfbho.dll
O3 – Toolbar: DAP Bar – {62999427–33FC–4baf–9C9C–BCE6BD127F08} – C:Program FilesDAPDAPIEBar.dll
O3 – Toolbar: SToolbar – {0E1230F8–EA50–42A9–983C–D22ABC2EED3B} – C:WINDOWSstoolbd.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O4 – HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [DownloadAccelerator] C:PROGRA~1DAPDAP.EXE /STARTUP
O4 – HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSSystem32spooldriversw32x863hpztsb05.exe
O4 – HKLM..Run: [HPHmon04] C:WINDOWSSystem32hphmon04.exe
O4 – HKLM..Run: [HPHUPD04] "C:Program FilesHP Photosmart 11hphinstallUniPatchhphupd04.exe"
O4 – HKLM..Run: [alchem] C:WINDOWSalchem.exe
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [Scurity Center] C:WINDOWSsvchost.exe
O4 – HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe
O4 – HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe
O4 – HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 – HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" –atboottime
O4 – HKLM..Run: [pR2cFEv] C:WINDOWSycgwapv.exe
O4 – HKLM..Run: [IST Service] C:Program FilesISTsvcistsvc.exe
O4 – HKLM..Run: [TkBellExe] C:Program FilesCommon FilesRealUpdate_OBevntsvc.exe –osboot
O4 – HKLM..Run: [WOOKIT] C:Program FilesNeostrada TPNeostradaTP.exe
O4 – HKLM..Run: [MSConfig] C:WINDOWSPCHealthHelpCtrBinariesMSConfig.exe /auto
O4 – HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 – Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavaj2re1.4.1_01in pjpi141_01.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavaj2re1.4.1_01in pjpi141_01.dll
O9 – Extra button: SideFind – {10E42047–DEB9–4535–A118–B3F6EC39B807} – C:Program FilesSideFindsidefind.dll
O9 – Extra button: Run DAP – {669695BC–A811–4A9D–8CDF–BA8C795F261C} – C:PROGRA~1DAPDAP.EXE
O9 – Extra button: Badanie – {92780B25–18CC–41C8–B9BE–3C9C571A8263} – C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O13 – DefaultPrefix: http://ehttp.cc/?
O13 – WWW Prefix: http://ehttp.cc/?
O13 – WWW. Prefix: http://ehttp.cc/?
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://public.windupdates.com/get_file.php?bt=ie&p=580b654524d68b23906b34a03fd33a9de69f5f922a0754ee169442922e3e48cbd7605b04e0917847f89efa8e422ece1a819f5daf9328:5db0f34c35fd827de7642452ea30b3de
O16 – DPF: {91433D86–9F27–402C–B5E3–DEBDD122C339} – http://www.netvenda.com/sites/games–intl/pl/games4.cab
O17 – HKLMSystemCCSServicesTcpip..{52AC3910–E4B6–4C0F–89B7–780CEF227F34}: NameServer = 194.204.152.34 217.98.63.164
O18 – Filter: text/html – {45FF7AD0–7E65–45D1–BFAF–572D2938FBE8} – C:Documents and SettingsSzalonyUstawienia lokalneDane aplikacjimicrosoftinternet explorerV0.26.dat
O23 – Service: NVIDIA Driver Helper Service – NVIDIA Corporation – C:WINDOWSSystem32 vsvc32.exe
O23 – Service: Pml Driver HPH11 – HP – C:WINDOWSSystem32HPHipm11.exe
O23 – Service: IrBridge User–Level Interface – Extended Systems, Inc. – C:WINDOWSsystem32usrbridg.exe
Wklej log z Hijack This (info: dział bezpieczenstwo, przyklejony temat)
Strona 1 / 1