Dodatkowo moźesz zamieścić podgląd dziennika NAV ze skanowania.

uruchom:

xcleaner_free
spycleaner
spybot_search&destroy(+update)
spy.sweeper
cwsshredder'a

wszystko znajdziesz na www.ftp.idg.pl

powodzenia!

Wylaczyles podejrzane procesy w Task managerze ? Usun w HJ i z dysku pliki exe, dll, sp.html, odbc.ini:

C:WINDOWSsystem32 etrh32.exe
C:WINDOWSODBC.INI:emdda
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSnsap.dll/sp.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSnsap.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = about:blank
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSnsap.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSnsap.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSnsap.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSnsap.dll/sp.html#37049
R3 – Default URLSearchHook is missing
O2 – BHO: (no name) – {8BC61747–3461–EFEE–D05D–964D875677AB} – C:WINDOWSsystem32atlnu32.dll
O4 – HKLM..Run: [javajz.exe] C:WINDOWSsystem32javajz.exe
O4 – HKLM..Run: [netrh32.exe] C:WINDOWSsystem32 etrh32.exe
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O18 – Protocol: icoo – {4A8DADD4–5A25–4D41–8599–CB7458766220} – (no file)

Ponadto sprawdz czy nie masz i jesli sa, usun:
c:winntsystem32 as otepad.vbs, c:winntsystem32go.vbs

P.S. Dolacz do posta zrzut zakladki Procesy w Task managerze.

usunalem w awaryjnym z wylaczonym przywracaniem sys wszystko zrobilem jak w poscie wyzej a nastepnie norton wykryl 26 virow z czego 12 nie dalo sie uunac ani poddac kwarantannie:((( przesylam loga z hijacka ktorego zrobilem teraz ale wczesniej 2 razy usowalem te same pliki
Logfile of HijackThis v1.98.0
Scan saved at 20:29:18, on 2004–08–23
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesWinampwinampa.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesJavaj2re1.4.2_05injusched.exe
C:WINDOWSsystem32 etrh32.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesUlead SystemsUlead Photo Express 4.0 SECalCheck.exe
D:herosRegisterSODRemind32.exe
C:Program FilesNorton AntiVirus avapsvc.exe
C:WINDOWSODBC.INI:emdda
C:Program FilesGadu–Gadugg.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSSystem32wuauclt.exe
C:Documents and SettingsTomekUstawienia lokalneTempKatalog tymczasowy 3 dla hijackthis.zipHijackThis.exe

R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSnsap.dll/sp.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSnsap.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = about:blank
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSnsap.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSnsap.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSnsap.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSnsap.dll/sp.html#37049
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – Default URLSearchHook is missing
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0 CEReaderActiveXAcroIEHelper.ocx
O2 – BHO: (no name) – {8BC61747–3461–EFEE–D05D–964D875677AB} – C:WINDOWSsystem32atlnu32.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:Program FilesNorton AntiVirusNavShExt.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:Program FilesNorton AntiVirusNavShExt.dll
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [NeroCheck] C:WINDOWSSystem32NeroCheck.exe
O4 – HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_05injusched.exe
O4 – HKLM..Run: [javajz.exe] C:WINDOWSsystem32javajz.exe
O4 – HKLM..Run: [netrh32.exe] C:WINDOWSsystem32 etrh32.exe
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 – Startup: H3 The Shadow of Death(TM).lnk = D:herosRegisterSODRemind32.exe
O4 – Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:Program FilesUlead SystemsUlead Photo Express 4.0 SECalCheck.exe
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra button: Badanie – {92780B25–18CC–41C8–B9BE–3C9C571A8263} – C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O17 – HKLMSystemCCSServicesTcpip..{A0B94974–C12D–44E1–B12A–03843DB8F119}: NameServer = 195.116.5.3
O18 – Protocol: icoo – {4A8DADD4–5A25–4D41–8599–CB7458766220} – (no file)

Fix :

R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = about:search
R3 – Default URLSearchHook is missing
O2 – BHO: (no name) – {D83BDA67–495F–DD27–4634–7E43FDC68512} – C:WINDOWSwinhs32.dll
O4 – HKLM..Run: [SyncUpd] regedit.exe –s C:WINDOWSsysreg.reg
O4 – HKLM..Run: [ntlx32.exe] C:WINDOWSsystem32 tlx32.exe
O4 – HKLM..Run: [sdklk32.exe] C:WINDOWSsdklk32.exe
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerRestrictions present
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O7 – HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, DisableRegedit=1
O15 – Trusted Zone: *.05p.com
O15 – Trusted Zone: *.clickspring.net
O15 – Trusted Zone: *.mt–download.com
O15 – Trusted Zone: *.my–internet.info
O15 – Trusted Zone: *.scoobidoo.com
O15 – Trusted Zone: *.searchmiracle.com
O18 – Protocol: icoo – {4A8DADD4–5A25–4D41–8599–CB7458766220} – (no file)

Wyłącz przywracanie systemu (Me,XP),
Zakończ w Task`u procesy jeśli są :

sdklk32.exe
ntlx32.exe

Wyszukaj zaznaczając ukryte pliki i katalogi i usuń :

sdklk32.exe
ntlx32.exe
prhmy.dll
winhs32.dll
sysreg.reg

Sprawdz w opcjach przeglądarki czy nie znajdują się zaufane witryny :

*.05p.com
*.clickspring.net
*.mt–download.com
*my–internet.info
*.scoobidoo.com
*.searchmiracle.com

Jeśli tak to usuń.

Włącz przywracanie.

C:WINDOWSODBC.INI:emdda dokładnie nie wiem czego dotyczą te ustawienia konfiguracyjne,ale jak występuje w tasku to zakończ.
Wyszukaj i zanalizuj.

oto log z hijacka:

Logfile of HijackThis v1.98.0
Scan saved at 12:33:54, on 2004–08–23
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesNorton AntiVirus avapsvc.exe
C:Program FilesWinampwinampa.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesJavaj2re1.4.2_05injusched.exe
C:WINDOWSsdklk32.exe
C:Program FilesGadu–Gadugg.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesUlead SystemsUlead Photo Express 4.0 SECalCheck.exe
D:herosRegisterSODRemind32.exe
C:WINDOWSODBC.INI:emdda
C:WINDOWSSystem32wuauclt.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Documents and SettingsTomekUstawienia lokalneTempKatalog tymczasowy 1 dla hijackthis.zipHijackThis.exe

R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = about:blank
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32prhmy.dll/sp.html#37049
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = about:search
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – Default URLSearchHook is missing
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0 CEReaderActiveXAcroIEHelper.ocx
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:Program FilesNorton AntiVirusNavShExt.dll
O2 – BHO: (no name) – {D83BDA67–495F–DD27–4634–7E43FDC68512} – C:WINDOWSwinhs32.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:Program FilesNorton AntiVirusNavShExt.dll
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [NeroCheck] C:WINDOWSSystem32NeroCheck.exe
O4 – HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_05injusched.exe
O4 – HKLM..Run: [SyncUpd] regedit.exe –s C:WINDOWSsysreg.reg
O4 – HKLM..Run: [ntlx32.exe] C:WINDOWSsystem32 tlx32.exe
O4 – HKLM..Run: [sdklk32.exe] C:WINDOWSsdklk32.exe
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 – Startup: H3 The Shadow of Death(TM).lnk = D:herosRegisterSODRemind32.exe
O4 – Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:Program FilesUlead SystemsUlead Photo Express 4.0 SECalCheck.exe
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerRestrictions present
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O7 – HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, DisableRegedit=1
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra button: Badanie – {92780B25–18CC–41C8–B9BE–3C9C571A8263} – C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O15 – Trusted Zone: *.05p.com
O15 – Trusted Zone: *.clickspring.net
O15 – Trusted Zone: *.mt–download.com
O15 – Trusted Zone: *.my–internet.info
O15 – Trusted Zone: *.scoobidoo.com
O15 – Trusted Zone: *.searchmiracle.com
O17 – HKLMSystemCCSServicesTcpip..{A0B94974–C12D–44E1–B12A–03843DB8F119}: NameServer = 195.116.5.3
O18 – Protocol: icoo – {4A8DADD4–5A25–4D41–8599–CB7458766220} – (no file)

przeskanowalem nortonem w awaryjnym i pozostalo jakies 5 virow. a po przeskanowaniu programem ad–aware wykryl mi 33 zagrozone obiekty!ktore poddaem kwarantannie ale problem pozostaje:(

Przeskanuj kompa programem HiJackThis, wklej log ze skanowania i ... są tu fachowcy, którzy ci poradzą, co masz usunąć :wink:

co do plikow probowałes w awaryjnym badz z konsoli
badz zkillować procesy i wtedy probowac usunać
jesli chodzi o strone startowa to dzial bezpieczenstwo
co do programow na anty spyware to rowniez bezpieczenstwo