Logfile of HijackThis v1.99.0
Scan saved at 02:19:25, on 2005-02-11
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesAVPersonalAVGUARD.EXE
C:Program FilesAVPersonalAVWUPSRV.EXE
C:WINDOWSsystem32
tgx32.exe
C:WINDOWSSystem32soft.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesQuickTimeqttask.exe
C:Program FilesAVPersonalAVGNT.EXE
C:Program FilesCommon FilesRealUpdate_OB
ealsched.exe
C:WINDOWSsystem32appcg.exe
C:windowssystem32evpeit.exe
C:WINDOWSSystem32jfdjkswf.exe
C:WINDOWSSystem32dddd.exe
C:WINDOWSisrvsdesktop.exe
C:WINDOWSSystem32ctfmon.exe
C:WINDOWSsystem32svphost.exe
C:WINDOWSSystem32??chost.exe
C:Documents and SettingsgregDane aplikacjiudps.exe
C:Program FilesGadu-Gadugg.exe
C:Program FileseMuleemule.exe
C:windowssystem32calc.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesInternet Exploreriexplore.exe
D:instalkihijackthisodHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar =
res://C:WINDOWSsystem32xbteq.dll/sp.html#93256R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page =
res://C:WINDOWSsystem32xbteq.dll/sp.html#93256R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = about:blank
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL =
res://C:WINDOWSsystem32xbteq.dll/sp.html#93256R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar =
res://C:WINDOWSsystem32xbteq.dll/sp.html#93256R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page =
res://C:WINDOWSsystem32xbteq.dll/sp.html#93256R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
res://C:WINDOWSsystem32xbteq.dll/sp.html#93256R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
res://C:WINDOWSsystem32xbteq.dll/sp.html#93256R3 - Default URLSearchHook is missing
F3 - REG:win.ini: run=C:WINDOWSSystem32soft.exe
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: googl.de
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts:
www.googl.deO1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts: google.se
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O1 - Hosts: The requested URL /ip.txt was not found on this server.<P>
O1 - Hosts: </BODY></HTML>
O1 - Hosts:
www.googl.atO1 - Hosts: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
O1 - Hosts: <HTML><HEAD>
O1 - Hosts: <TITLE>404 Not Found</TITLE>
O1 - Hosts: </HEAD><BODY>
O1 - Hosts: <H1>Not Found</H1>
O2 - BHO: ViewSource Class - {00000000-0000-0000-0000-000000000000} - C:WINDOWSSYSTEMMSXSLAB.DLL
O2 - BHO: (no name) - {826C58CD-E09F-AE4D-CBCE-70D975833F7E} - (no file)
O2 - BHO: (no name) - {AF5960F8-3CBB-D88A-7529-172F8B6B82A2} - (no file)
O2 - BHO: (no name) - {C8CD041C-091F-DF8F-452B-B10122D789B7} - C:WINDOWSsystem32atlmz.dll
O2 - BHO: (no name) - {DAA75053-2CC7-DDF8-7C6F-F6FD0A5CB7CA} - (no file)
O2 - BHO: ohb - {4D568F0F-8AC9-40AB-88B7-415134C78777} - C:WINDOWSsystem32winb2s32.dll
O2 - BHO: ohb - {CB5B2BC6-F957-4D8A-BE67-83F3EC58BA01} - C:WINDOWSsystem32dsktrf.dll
O3 - Toolbar: Begin2Search.com Bar - {52FE5233-367C-4EFB-BDD7-0BE4D212C107} - C:WINDOWSsystem32winb2s32.dll
R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:WINDOWSDownloaded Program Files
undlg32.dll
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:WINDOWSDownloaded Program Files
undlg32.dll
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:WINDOWSDownloaded Program Files
undlg32.dll
O4 - HKLM..Run: [Windows Automation] mslaugh.exe
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [AVGCtrl] C:Program FilesAVPersonalAVGNT.EXE /min
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB
ealsched.exe" -osboot
O4 - HKLM..Run: [Windows ControlAd] C:Program FilesWindows ControlAdWinCtlAd.exe
O4 - HKLM..Run: [appcg.exe] C:WINDOWSsystem32appcg.exe
O4 - HKLM..Run: [tibs5] C:WINDOWSSystem32 ibs5.exe
O4 - HKLM..Run: [Web Service] C:WINDOWSSystem32sm.exe
O4 - HKLM..Run: [ffis] C:WINDOWSisrvsffisearch.exe
O4 - HKLM..Run: [evpeit] c:windowssystem32evpeit.exe
O4 - HKLM..Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer
O4 - HKLM..Run: [ ] C:WINDOWSsystem32userinit.exe
O4 - HKLM..Run: [sais] c:program files180solutionssais.exe
O4 - HKLM..Run: [apiuk32.exe] C:WINDOWSsystem32apiuk32.exe
O4 - HKLM..Run: [antiware] C:windowssystem32elitehln32.exe
O4 - HKLM..Run: [jfdjkswf] C:WINDOWSSystem32jfdjkswf.exe
O4 - HKLM..Run: [Windows Service] C:WINDOWSSystem32dddd.exe
O4 - HKLM..Run: [Desktop Search] C:WINDOWSisrvsdesktop.exe
O4 - HKLM..RunOnce: [ntgx32.exe] C:WINDOWSsystem32
tgx32.exe
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 - HKCU..Run: [svphost.exe] C:WINDOWSsystem32svphost.exe
O4 - HKCU..Run: [Ubsj] C:WINDOWSSystem32??chost.exe
O4 - HKCU..Run: [Aidr] C:Documents and SettingsgregDane aplikacjiudps.exe
O4 - HKCU..Run: [Web Service] C:WINDOWSSystem32sm.exe
O4 - HKCU..Run: [Windows Service] C:WINDOWSSystem32dddd.exe
O4 - HKCU..Run: [Gadu-Gadu] "C:Program FilesGadu-Gadugg.exe" /tray
O4 - HKCU..Run: [eMuleAutoStart] C:Program FileseMuleemule.exe -AutoStart
O4 - HKLM..Run: [Windows SyncroAd] C:PROGRAM FILESWINDOWS SYNCROADSYNCROAD.EXE
O4 - HKLM..Run: [Windows AdControl] C:Program FilesWindows AdControlWinAdCtl.exe
O4 - HKLM..Run: [Windows AdTools] C:Program FilesWindows AdToolsWinAdTools.exe
O4 - HKLM..Run: [Windows TaskAd] C:Program FilesWindows TaskAdWinTaskAd.exe
O4 - HKLM..Run: [Windows AdService] C:Program FilesWindows AdServiceWinAdServ.exe
O4 - HKLM..Run: [Windows ControlAd] C:Program FilesWindows ControlAdWinCtlAd.exe
O4 - HKLM..Run: [Windows ServeAd] C:Program FilesWindows ServeAdWinServAd.exe
O4 - HKLM..Run: [DeskAd Service] C:Program FilesDeskAd ServiceDeskAdServ.exe
O4 - HKLM..Run: [Windows AdStatus] C:Program FilesWindows AdStatusWinStat.exe
O4 - HKLM..Run: [AdTools Service] C:Program FilesAdTools ServiceAdTools.exe
O4 - HKLM..Run: [Windows FormatAd] C:Program FilesWindows FormatAdWinForm.exe
O4 - HKCU..Run: [Ysxr] C:WINDOWSSystem32??chost.exe
O4 - HKCU..Run: [Slu] C:WINDOWSSystem32??chost.exe
O4 - HKCU..Run: [Lqjogrt] C:WINDOWSSystem32??plorer.exe
O4 - HKCU..Run: [Upwzxru] C:WINDOWSSystem32??plorer.exe
O4 - HKCU..Run: [Mcbqh] C:WINNTsystem32 ?skmgr.exe
O4 - HKCU..Run: [ÿ_zskwxfpzbyp[xeps]mi50inkrwksz_] d:windowssystem32\_zskwrkni05im]spex[pybzpfxw.exe
O4 - HKCU..Run: [WhenUSave] "C:Program FilesSaveSave.exe"
O4 - HKCU..Run: [SurfSideKick 3] C:Program FilesSurfSideKick 3Ssk.exe
O4 - HKCU..Run: [AXVenore] "C:Program FilesAXVenoreAXVenore.exe"
O4 - HKCU..Run: [PECarlin] "C:Program FilesPECarlinPECarlin.exe"
O4 - HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~2.DLL,ClientStartup -s
O8 - Extra context menu item: &Google Search -
res://C:Program FilesGooglegoogletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links -
res://C:Program FilesGooglegoogletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page -
res://C:Program FilesGooglegoogletoolbar.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages -
res://C:Program FilesGooglegoogletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:Program FilesGooglegoogletoolbar.dll/cmtrans.html
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.addictivetechnologies.net
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.f1organizer.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.pizdato.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.vse-moe.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O16 - DPF: v3cab -
http://searchmiracle.com/cab/1.cabO16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) -
http://static.topconverting.com/activex/loader2.ocxO17 - HKLMSystemCCSServicesTcpip..{10CD7263-28E8-404C-A427-388106DCC27E}: NameServer = 10.0.0.2
O17 - HKLMSystemCS1ServicesTcpip..{10CD7263-28E8-404C-A427-388106DCC27E}: NameServer = 10.0.0.2
O17 - HKLMSystemCS2ServicesTcpip..{10CD7263-28E8-404C-A427-388106DCC27E}: NameServer = 10.0.0.2
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - (no file)
O20 - Winlogon Notify: artm_newreg - D:Documents and SettingsAll UsersDokumentySettingsartm_new.dll
O20 - AppInit_DLLs: CLKERN.DLL
O20 - Winlogon Notify: winuai32 - D:WINDOWSSYSTEM32winuai32.dll
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:Program FilesAVPersonalAVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:Program FilesAVPersonalAVWUPSRV.EXE
O23 - Service: Network Security Service (NSS) - Unknown - C:WINDOWSieye.exe
O23 - Service: ZESOFT - Unknown - D:WINDOWSzeta.exe (file missing)
O23 - Service: Power Manager - Unknown - D:WINDOWSsvchost.exe (file missing)
, WareOut, SpyAxe, rootkit, Apyware Quake i syfu co nie miara lecimy
