proźba o sprawdzenie loga ...
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:PROGRA~1AGNITUMTAUSCA~1.6 aumon.exe
D:SOFTWAREProgramyGadu–Gadugg.exe
D:SOFTWAREProgramyAntiVirenKitAVKService.exe
D:SOFTWAREProgramyAntiVirenKitAVKWCtl.exe
C:Program FilesWindows Media Playerwmplayer.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSsystem32?hkdsk.exe
C:Documents and SettingsWojtekUstawienia lokalneTemporary Internet FilesContent.IE5KXQZWHAFhijackthis[1].exe
R1 – HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = about:blank
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://bigbr.cc?u=2029 (obfuscated)
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://bigbr.cc?u=2029 (obfuscated)
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://thenewsearch.com/thenewsearch.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R1 – HKCUSoftwareMicrosoftInternet Explorer,Search = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKLMSoftwareMicrosoftInternet Explorer,Search = http://bigbr.cc?u=2029 (obfuscated)
R3 – URLSearchHook: (no name) – _{00A6FAF6–072E–44cf–8957–5838F569A31D} – (no file)
O2 – BHO: (no name) – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – (no file)
O2 – BHO: (no name) – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – D:SOFTWAREProgramyAcrobatReader6.0ReaderActiveXAcroIEHelper.dll
O2 – BHO: (no name) – {3F50F24E–4F29–4365–B15A–AC4CA04340FC} – C:WINDOWSSystem32hli.dll (file missing)
O2 – BHO: (no name) – {6BDF3754–B546–05C5–8756–115509F6723F} – C:WINDOWSSystem32uzsrhb.dll
O2 – BHO: (no name) – {A5366673–E8CA–11D3–9CD9–0090271D075B} – D:SOFTWAREPROGRAMYFLASHGETjccatch.dll (file missing)
O3 – Toolbar: FlashGet Bar – {E0E899AB–F487–11D5–8D29–0050BA6940E3} – D:SOFTWAREPROGRAMYFLASHGETfgiebar.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [sais] c:program files180solutionssais.exe
O4 – HKLM..Run: [BearShare] "C:Program FilesBearShareBearShare.exe" /pause
O4 – HKLM..Run: [ControlPanel] C:WINDOWSSystem32 wink64.exe internat.dll,LoadKeyboardProfile
O4 – HKLM..Run: [Tau Monitor] C:PROGRA~1AGNITUMTAUSCA~1.6 aumon.exe
O4 – HKLM..Run: [Jammer] C:PROGRA~1AGNITUMJAMMER~1.0Jammer.exe
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O4 – HKLM..Run: [zSPGuard] c:program filespjwspguardspguard.exe /s /r
O4 – HKCU..Run: [Gadu–Gadu] "D:SOFTWAREProgramyGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [Teou] C:Documents and SettingsWojtekDane aplikacjiatco.exe
O4 – HKCU..Run: [Csfs] C:WINDOWSSystem32?hkdsk.exe
O4 – Global Startup: MyWebSearch Email Plugin.lnk = C:Program FilesMyWebSearchar2.binMWSOEMON.EXE
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O8 – Extra context menu item: &Search – http://bar.mywebsearch.com/menusearch.html?p=ZNxmk142XXUS
O8 – Extra context menu item: Ściągnij przy pomocy FlashGet'a – D:SOFTWAREPROGRAMYFLASHGETjc_link.htm
O8 – Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a – D:SOFTWAREPROGRAMYFLASHGETjc_all.htm
O9 – Extra button: FlashGet (HKLM)
O9 – Extra 'Tools' menuitem: &FlashGet (HKLM)
O15 – Trusted Zone: *.blazefind.com
O15 – Trusted Zone: *.clickspring.net
O15 – Trusted Zone: *.flingstone.com
O15 – Trusted Zone: *.mt–download.com
O15 – Trusted Zone: *.my–internet.info
O15 – Trusted Zone: *.searchbarcash.com
O15 – Trusted Zone: *.searchmiracle.com
O15 – Trusted Zone: *.skoobidoo.com
O15 – Trusted Zone: *.slotch.com
O15 – Trusted Zone: *.windupdates.com
O15 – Trusted Zone: *.xxxtoolbar.com
O16 – DPF: {02BF25D5–8C17–4B23–BC80–D3488ABDDC6B} (QuickTime Object) – http://www.apple.com/qtactivex/qtplugin.cab
O16 – DPF: {11010101–1001–1111–1000–110112345678} – ms–its:mhtml:file://c: osuch.mht!http://69.50.173.250/all.chm::/all.exe
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://public.windupdates.com/get_file.php?bt=ie&p=230270dab455d0e176941480ba0fc85f2978d245429f93809c10f10b815c8a96c9ba5c54063f7603d4945ab86ee97ff22322f046:375a82d108ec2e9d584f880889783bc3
O16 – DPF: {1D4DB7D2–6EC9–47A3–BD87–1E41684E07BB} – http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.8.cab
O16 – DPF: {22222222–2222–2222–2222–222222222222} – file://c:x.cab
O16 – DPF: {3E339D3C–4B12–4E8C–A529–9CC4BEEAFD4F} (VacPro.russia_ver3) – http://www.advnt01.com/dialer/russia.CAB
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096489269857
O16 – DPF: {91433D86–9F27–402C–B5E3–DEBDD122C339} – http://www.netvenda.com/sites/games–intl/pl/games4.cab
O16 – DPF: {9AA73F41–EC64–489E–9A73–9CD52E528BC4} (ZoneAxRcMgr Class) – http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 – DPF: {9EB320CE–BE1D–4304–A081–4B4665414BEF} (MediaTicketsInstaller Control) – http://www.mt–download.com/MediaTicketsInstaller.cab
O16 – DPF: {B8BE5E93–A60C–4D26–A2DC–220313175592} (ZoneIntro Class) – http://zone.msn.com/binFramework/v10/ZIntro.cab27513.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {DF780F87–FF2B–4DF8–92D0–73DB16A1543A} (PopCapLoader Object) – http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cab
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab
O17 – HKLMSystemCCSServicesTcpip..{729EE8AB–F00A–456B–84D7–DFFA545BA712}: NameServer = 172.16.0.1,194.150.96.2
Odpowiedzi: 2
Tego sie pozbadz:
Ty instalowales ?
O4 – HKCU..Run: [Teou] C:Documents and SettingsWojtekDane aplikacjiatco.exe
C:WINDOWSsystem32?hkdsk.exe
R1 – HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = about:blank
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://bigbr.cc?u=2029 (obfuscated)
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://bigbr.cc?u=2029 (obfuscated)
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://thenewsearch.com/thenewsearch.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R1 – HKCUSoftwareMicrosoftInternet Explorer,Search = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKLMSoftwareMicrosoftInternet Explorer,Search = http://bigbr.cc?u=2029 (obfuscated)
R3 – URLSearchHook: (no name) – _{00A6FAF6–072E–44cf–8957–5838F569A31D} – (no file)
O2 – BHO: (no name) – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – (no file)
O2 – BHO: (no name) – {3F50F24E–4F29–4365–B15A–AC4CA04340FC} – C:WINDOWSSystem32hli.dll (file missing)
O2 – BHO: (no name) – {6BDF3754–B546–05C5–8756–115509F6723F} – C:WINDOWSSystem32uzsrhb.dll
O2 – BHO: (no name) – {A5366673–E8CA–11D3–9CD9–0090271D075B} – D:SOFTWAREPROGRAMYFLASHGETjccatch.dll (file missing)
O4 – HKLM..Run: [sais] c:program files180solutionssais.exe
O4 – HKLM..Run: [BearShare] "C:Program FilesBearShareBearShare.exe" /pause
O4 – HKLM..Run: [ControlPanel] C:WINDOWSSystem32 wink64.exe internat.dll,LoadKeyboardProfile
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O4 – HKCU..Run: [Csfs] C:WINDOWSSystem32?hkdsk.exe
O4 – Global Startup: MyWebSearch Email Plugin.lnk = C:Program FilesMyWebSearchar2.binMWSOEMON.EXE
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O8 – Extra context menu item: &Search – http://bar.mywebsearch.com/menusearch.html?p=ZNxmk142XXUS
O15 – Trusted Zone: *.blazefind.com
O15 – Trusted Zone: *.clickspring.net
O15 – Trusted Zone: *.flingstone.com
O15 – Trusted Zone: *.mt–download.com
O15 – Trusted Zone: *.my–internet.info
O15 – Trusted Zone: *.searchbarcash.com
O15 – Trusted Zone: *.searchmiracle.com
O15 – Trusted Zone: *.skoobidoo.com
O15 – Trusted Zone: *.slotch.com
O15 – Trusted Zone: *.windupdates.com
O15 – Trusted Zone: *.xxxtoolbar.com
O16 – DPF: {11010101–1001–1111–1000–110112345678} – ms–its:mhtml:file://c: osuch.mht!http://69.50.173.250/all.chm::/all.exe
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://public.windupdates.com/get_file.php?bt=ie&p=230270dab455d0e176941480ba0fc85f2978d245429f93809c10f10b815c8a96c9ba5c54063f7603d4945ab86ee97ff22322f046:375a82d108ec2e9d584f880889783bc3
O16 – DPF: {1D4DB7D2–6EC9–47A3–BD87–1E41684E07BB} – http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.8.cab
O16 – DPF: {22222222–2222–2222–2222–222222222222} – file://c:x.cab
O16 – DPF: {3E339D3C–4B12–4E8C–A529–9CC4BEEAFD4F} (VacPro.russia_ver3) – http://www.advnt01.com/dialer/russia.CAB
O16 – DPF: {91433D86–9F27–402C–B5E3–DEBDD122C339} – http://www.netvenda.com/sites/games–intl/pl/games4.cab
O16 – DPF: {9AA73F41–EC64–489E–9A73–9CD52E528BC4} (ZoneAxRcMgr Class) – http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 – DPF: {B8BE5E93–A60C–4D26–A2DC–220313175592} (ZoneIntro Class) – http://zone.msn.com/binFramework/v10/ZIntro.cab27513.cab
O16 – DPF: {DF780F87–FF2B–4DF8–92D0–73DB16A1543A} (PopCapLoader Object) – http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cab
Ty instalowales ?
O4 – HKCU..Run: [Teou] C:Documents and SettingsWojtekDane aplikacjiatco.exe
Wylacz Przywracanie
Wylacz proces:
?hkdsk.exe
Wywal najlepiej w awaryjnym
Najpierw pliki wymienione w logu nizej (oproznij recznie Temp)
Pozniej zaznacz te wpisy i Fix checked:
To rowniez zaznacz i fix:
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
Mozesz wlaczyc przywracanie
Wylacz proces:
?hkdsk.exe
Wywal najlepiej w awaryjnym
Najpierw pliki wymienione w logu nizej (oproznij recznie Temp)
Pozniej zaznacz te wpisy i Fix checked:
R1 – HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = about:blank
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://bigbr.cc?u=2029 (obfuscated)
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://bigbr.cc?u=2029 (obfuscated)
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = file://C:DOCUME~1WojtekUSTAWI~1Tempsp.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://thenewsearch.com/thenewsearch.html
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R1 – HKCUSoftwareMicrosoftInternet Explorer,Search = http://bigbr.cc?u=2029 (obfuscated)
R1 – HKLMSoftwareMicrosoftInternet Explorer,Search = http://bigbr.cc?u=2029 (obfuscated)
R3 – URLSearchHook: (no name) – _{00A6FAF6–072E–44cf–8957–5838F569A31D} – (no file)
O2 – BHO: (no name) – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – (no file)
O2 – BHO: (no name) – {3F50F24E–4F29–4365–B15A–AC4CA04340FC} – C:WINDOWSSystem32hli.dll (file missing)
O2 – BHO: (no name) – {6BDF3754–B546–05C5–8756–115509F6723F} – C:WINDOWSSystem32uzsrhb.dll
O2 – BHO: (no name) – {A5366673–E8CA–11D3–9CD9–0090271D075B} –
O4 – HKLM..Run: [sais] c:program files180solutionssais.exe
O4 – HKLM..Run: [ControlPanel] C:WINDOWSSystem32 wink64.exe internat.dll,LoadKeyboardProfile
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O4 – HKCU..Run: [Teou] C:Documents and SettingsWojtekDane aplikacjiatco.exe
O4 – HKCU..Run: [Csfs] C:WINDOWSSystem32?hkdsk.exe
O4 – Global Startup: MyWebSearch Email Plugin.lnk = C:Program FilesMyWebSearchar2.binMWSOEMON.EXE
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O8 – Extra context menu item: &Search – http://bar.mywebsearch.com/menusearch.html?p=ZNxmk142XXUS
D:SOFTWAREPROGRAMYFLASHGETjc_link.htm
O15 – Trusted Zone: *.blazefind.com
O15 – Trusted Zone: *.clickspring.net
O15 – Trusted Zone: *.flingstone.com
O15 – Trusted Zone: *.mt–download.com
O15 – Trusted Zone: *.my–internet.info
O15 – Trusted Zone: *.searchbarcash.com
O15 – Trusted Zone: *.searchmiracle.com
O15 – Trusted Zone: *.skoobidoo.com
O15 – Trusted Zone: *.slotch.com
O15 – Trusted Zone: *.windupdates.com
O15 – Trusted Zone: *.xxxtoolbar.com
O16 – DPF: {11010101–1001–1111–1000–110112345678} – ms–its:mhtml:file://c: osuch.mht!http://69.50.173.250/all.chm::/all.exe
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://public.windupdates.com/get_file.php?bt=ie&p=230270dab455d0e176941480ba0fc85f2978d245429f93809c10f10b815c8a96c9ba5c54063f7603d4945ab86ee97ff22322f046:375a82d108ec2e9d584f880889783bc3
O16 – DPF: {1D4DB7D2–6EC9–47A3–BD87–1E41684E07BB} – http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.8.cab
O16 – DPF: {22222222–2222–2222–2222–222222222222} – file://c:x.cab
O16 – DPF: {3E339D3C–4B12–4E8C–A529–9CC4BEEAFD4F} (VacPro.russia_ver3) – http://www.advnt01.com/dialer/russia.CAB
O16 – DPF: {91433D86–9F27–402C–B5E3–DEBDD122C339} – http://www.netvenda.com/sites/games–intl/pl/games4.cab
O16 – DPF: {9AA73F41–EC64–489E–9A73–9CD52E528BC4} (ZoneAxRcMgr Class) – http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 – DPF: {9EB320CE–BE1D–4304–A081–4B4665414BEF} (MediaTicketsInstaller Control) – http://www.mt–download.com/MediaTicketsInstaller.cab
O16 – DPF: {B8BE5E93–A60C–4D26–A2DC–220313175592} (ZoneIntro Class) – http://zone.msn.com/binFramework/v10/ZIntro.cab27513.cab
O16 – DPF: {DF780F87–FF2B–4DF8–92D0–73DB16A1543A} (PopCapLoader Object) – http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cab
To rowniez zaznacz i fix:
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
Mozesz wlaczyc przywracanie
Strona 1 / 1