czy log jest poprawny?

**Posty:** 8694 · przez **Red** 28 Mar 2006, 14:28

Zrob fix i daj logi

**Posty:** 24 · przez **vixen85m** 28 Mar 2006, 14:34

Prosze

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:16:38, on 06-03-28 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:/WINDOWS/SYSTEM/KERNEL32.DLL C:/WINDOWS/SYSTEM/MSGSRV32.EXE C:/WINDOWS/SYSTEM/MPREXE.EXE C:/WINDOWS/SYSTEM/MSTASK.EXE C:/WINDOWS/SYSTEM/mmtask.tsk C:/WINDOWS/SYSTEM/ATI2EVXX.EXE C:/WINDOWS/EXPLORER.EXE E:/PROGRAM FILES/WINAMP/WINAMPA.EXE C:/PROGRAM FILES/ATI TECHNOLOGIES/ATI CONTROL PANEL/ATIPTAXX.EXE C:/WINDOWS/SYSTEM/DDHELP.EXE C:/WINDOWS/SYSTEM/WBEM/WINMGMT.EXE D:/PROGRAM FILES/OPERA/OPERA.EXE C:/WINDOWS/SYSTEM/SPOOL32.EXE C:/PROGRAM FILES/GADU-GADU/GG.EXE E:/HIJACKTHIS/HIJACKTHIS.EXE O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:/PROGRAM FILES/ADOBE/ACROBAT 5.0/READER/ACTIVEX/ACROIEHELPER.OCX O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:/Program Files/Java/jre1.5.0_06/bin/ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/SYSTEM/MSDXM.OCX O4 - HKLM/../Run: [WinampAgent] E:/Program Files/Winamp/winampa.exe O4 - HKLM/../Run: [key2] C:/WINDOWS/SYSTEM/winlog.exe O4 - HKLM/../Run: [AVKWCtl] C:/PROGRA~1/ANTIVI~1/AVKWCTL9.EXE O4 - HKLM/../Run: [ATIPTA] C:/Program Files/ATI Technologies/ATI Control Panel/atiptaxx.exe O4 - HKLM/../RunServices: [SchedulingAgent] mstask.exe O4 - HKLM/../RunServices: [ATIPOLL] ati2evxx.exe O4 - HKLM/../RunServices: [ATISmart] C:/WINDOWS/SYSTEM/ati2s9ag.exe O4 - HKCU/../Run: [Komunikator] D:/PROGRAM FILES/TLEN.PL/TLEN.EXE O8 - Extra context menu item: Download using FlashGet - C:/PROGRAM FILES/FLASHGET/jc_link.htm O8 - Extra context menu item: Download All by FlashGet - C:/PROGRAM FILES/FLASHGET/jc_all.htm O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:/PROGRAM FILES/FLASHGET/FLASHGET.EXE (file missing) O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:/PROGRAM FILES/FLASHGET/FLASHGET.EXE (file missing) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/PROGRAM FILES/JAVA/JRE1.5.0_06/BIN/SSV.DLL O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/PROGRAM FILES/JAVA/JRE1.5.0_06/BIN/SSV.DLL O12 - Plugin for .spop: C:/PROGRA~1/INTERN~1/Plugins/NPDocBox.dll O15 - Trusted Zone: *.gateone.ath.cx O15 - Trusted Zone: *.gateone.ath.cx (HKLM) O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://download.ewido.net/ewidoOnlineScan.cab O17 - HKLM/System/CCS/Services/VxD/MSTCP: NameServer = 194.204.159.1,194.204.152.34

"Silent Runners.vbs", revision 44, http://www.silentrunners.org/
Operating System: Windows 98
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Komunikator" = "D:\PROGRAM FILES\TLEN.PL\TLEN.EXE" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"WinampAgent" = "E:\Program Files\Winamp\winampa.exe" [null data]
"key2" = "C:\WINDOWS\SYSTEM\winlog.exe" [file not found]
"AVKWCtl" = "C:\PROGRA~1\ANTIVI~1\AVKWCTL9.EXE" [file not found]
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"SchedulingAgent" = "mstask.exe" [MS]
"ATIPOLL" = "ati2evxx.exe" ["ATI Technologies Inc."]
"ATISmart" = "C:\WINDOWS\SYSTEM\ati2s9ag.exe" [" "]

HKLM\Software\Microsoft\Active Setup\Installed Components\
{44BBA840-CC51-11CF-AAFA-00AA00B6015C}.Restore\(Default) = "Microsoft Outlook Express 6"
\StubPath = "rundll32.exe advpack.dll,UserUnInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "D:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX" ["("]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\Dane aplikacji\Microsoft\Internet Explorer\Tapeta programu Internet Explorer.bmp"

WIN.INI & SYSTEM.INI launch points:
-----------------------------------

SYSTEM.INI
[boot]
"SCRNSAVE.EXE=D:\SCREEN~1\SKYROC~1\SKYROC~1.SCR" (Skyrocket.scr) [null data]

Enabled Scheduled Tasks:
------------------------

"Rozpoczęcie aplikacji dostrajania" -> launches: "walign" [MS]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\WINDOWS\SYSTEM\rnr20.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
C:\WINDOWS\SYSTEM\mswsosp.dll [MS], 1
C:\WINDOWS\SYSTEM\msafd.dll [MS], 2 - 4
C:\WINDOWS\SYSTEM\rsvpsp.dll [MS], 5 - 6

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{5AA06644-BC46-4220-A460-47A6EB47C96D}"
-> {HKLM...CLSID} = "NavExcel Toolbar"
\InProcServer32\(Default) = "C:\PROGRAM FILES\NAVEXCEL SEARCH TOOLBAR\NAVEXCELBAR.DLL" [file not found]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE" [file not found]

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL" ["Sun Microsystems, Inc."]

Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
The Internet Explorer version cannot be found!

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
The contents of IERESET.INF cannot be reliably checked!

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

Missing lines (compared with English-language version):
[Strings]: 2 lines

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 12 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 12 seconds.
---------- (total run time: 47 seconds)

**Posty:** 8694 · przez **Red** 28 Mar 2006, 14:49

Nie dodałes fixa o ktorym pisałem powyzej:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"key2"=-

**Posty:** 24 · przez **vixen85m** 28 Mar 2006, 15:02

"Silent Runners.vbs", revision 44, http://www.silentrunners.org/
Operating System: Windows 98
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Komunikator" = "D:\PROGRAM FILES\TLEN.PL\TLEN.EXE" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"WinampAgent" = "E:\Program Files\Winamp\winampa.exe" [null data]
"key2" = "C:\WINDOWS\SYSTEM\winlog.exe" [file not found]
"AVKWCtl" = "C:\PROGRA~1\ANTIVI~1\AVKWCTL9.EXE" [file not found]
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"SchedulingAgent" = "mstask.exe" [MS]
"ATIPOLL" = "ati2evxx.exe" ["ATI Technologies Inc."]
"ATISmart" = "C:\WINDOWS\SYSTEM\ati2s9ag.exe" [" "]

HKLM\Software\Microsoft\Active Setup\Installed Components\
{44BBA840-CC51-11CF-AAFA-00AA00B6015C}.Restore\(Default) = "Microsoft Outlook Express 6"
\StubPath = "rundll32.exe advpack.dll,UserUnInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "D:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX" ["("]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\Dane aplikacji\Microsoft\Internet Explorer\Tapeta programu Internet Explorer.bmp"

WIN.INI & SYSTEM.INI launch points:
-----------------------------------

SYSTEM.INI
[boot]
"SCRNSAVE.EXE=D:\SCREEN~1\SKYROC~1\SKYROC~1.SCR" (Skyrocket.scr) [null data]

Enabled Scheduled Tasks:
------------------------

"Rozpoczęcie aplikacji dostrajania" -> launches: "walign" [MS]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\WINDOWS\SYSTEM\rnr20.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
C:\WINDOWS\SYSTEM\mswsosp.dll [MS], 1
C:\WINDOWS\SYSTEM\msafd.dll [MS], 2 - 4
C:\WINDOWS\SYSTEM\rsvpsp.dll [MS], 5 - 6

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{5AA06644-BC46-4220-A460-47A6EB47C96D}"
-> {HKLM...CLSID} = "NavExcel Toolbar"
\InProcServer32\(Default) = "C:\PROGRAM FILES\NAVEXCEL SEARCH TOOLBAR\NAVEXCELBAR.DLL" [file not found]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE" [file not found]

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL" ["Sun Microsystems, Inc."]

Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
The Internet Explorer version cannot be found!

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
The contents of IERESET.INF cannot be reliably checked!

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

Missing lines (compared with English-language version):
[Strings]: 2 lines

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 3 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 13 seconds.
---------- (total run time: 35 seconds)

**Posty:** 4043 · przez **prog** 28 Mar 2006, 15:09

Dalej nie ma fixa

vixen85m napisał(a):"key2" = "C:\WINDOWS\SYSTEM\winlog.exe" [file not found]

**Posty:** 24 · przez **vixen85m** 28 Mar 2006, 15:14

Coś źle robie? Jak utworzyć fixa?

**Posty:** 8694 · przez **Red** 28 Mar 2006, 15:16

do notatnika windowsa wklej:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"key2"=-

w notatniku>>Plik >> Zapisz jako, zapisz jako typ: wszystkie pliki, nazwa pliku: Fix.reg
Klikasz dwa razy na powstały plik i potwierdzasz.

**Posty:** 24 · przez **vixen85m** 28 Mar 2006, 15:22

To właśnie tak robie, ale nic się poźniej nie dzieje. Pisze, że informacja została poprawnie wprowadzona do rejestru.

**Posty:** 8694 · przez **Red** 28 Mar 2006, 15:25

A restartujesz kompa??

**Posty:** 24 · przez **vixen85m** 28 Mar 2006, 15:28

Nie, a trzeba?

**Posty:** 8694 · przez **Red** 28 Mar 2006, 15:31

Zrestartuj kompa i daj raz jeszcze logi....tylko pamietaj o dodaniu fixa dokladnie tak jak napisałem

**Posty:** 24 · przez **vixen85m** 28 Mar 2006, 15:51

A teraz dobrze?

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:26:11, on 06-03-28 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:/WINDOWS/SYSTEM/KERNEL32.DLL C:/WINDOWS/SYSTEM/MSGSRV32.EXE C:/WINDOWS/SYSTEM/MPREXE.EXE C:/WINDOWS/SYSTEM/MSTASK.EXE C:/WINDOWS/SYSTEM/mmtask.tsk C:/WINDOWS/SYSTEM/ATI2EVXX.EXE C:/WINDOWS/EXPLORER.EXE E:/PROGRAM FILES/WINAMP/WINAMPA.EXE C:/PROGRAM FILES/ATI TECHNOLOGIES/ATI CONTROL PANEL/ATIPTAXX.EXE C:/WINDOWS/SYSTEM/DDHELP.EXE D:/PROGRAM FILES/OPERA/OPERA.EXE C:/WINDOWS/SYSTEM/WBEM/WINMGMT.EXE E:/HIJACKTHIS/HIJACKTHIS.EXE O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:/PROGRAM FILES/ADOBE/ACROBAT 5.0/READER/ACTIVEX/ACROIEHELPER.OCX O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:/Program Files/Java/jre1.5.0_06/bin/ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/SYSTEM/MSDXM.OCX O4 - HKLM/../Run: [WinampAgent] E:/Program Files/Winamp/winampa.exe O4 - HKLM/../Run: [key2] C:/WINDOWS/SYSTEM/winlog.exe O4 - HKLM/../Run: [AVKWCtl] C:/PROGRA~1/ANTIVI~1/AVKWCTL9.EXE O4 - HKLM/../Run: [ATIPTA] C:/Program Files/ATI Technologies/ATI Control Panel/atiptaxx.exe O4 - HKLM/../RunServices: [SchedulingAgent] mstask.exe O4 - HKLM/../RunServices: [ATIPOLL] ati2evxx.exe O4 - HKLM/../RunServices: [ATISmart] C:/WINDOWS/SYSTEM/ati2s9ag.exe O4 - HKCU/../Run: [Komunikator] D:/PROGRAM FILES/TLEN.PL/TLEN.EXE O8 - Extra context menu item: Download using FlashGet - C:/PROGRAM FILES/FLASHGET/jc_link.htm O8 - Extra context menu item: Download All by FlashGet - C:/PROGRAM FILES/FLASHGET/jc_all.htm O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:/PROGRAM FILES/FLASHGET/FLASHGET.EXE (file missing) O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:/PROGRAM FILES/FLASHGET/FLASHGET.EXE (file missing) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/PROGRAM FILES/JAVA/JRE1.5.0_06/BIN/SSV.DLL O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/PROGRAM FILES/JAVA/JRE1.5.0_06/BIN/SSV.DLL O12 - Plugin for .spop: C:/PROGRA~1/INTERN~1/Plugins/NPDocBox.dll O15 - Trusted Zone: *.gateone.ath.cx O15 - Trusted Zone: *.gateone.ath.cx (HKLM) O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://download.ewido.net/ewidoOnlineScan.cab O17 - HKLM/System/CCS/Services/VxD/MSTCP: NameServer = 194.204.159.1,194.204.152.34

"Silent Runners.vbs", revision 44, http://www.silentrunners.org/
Operating System: Windows 98
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Komunikator" = "D:\PROGRAM FILES\TLEN.PL\TLEN.EXE" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"WinampAgent" = "E:\Program Files\Winamp\winampa.exe" [null data]
"key2" = "C:\WINDOWS\SYSTEM\winlog.exe" [file not found]
"AVKWCtl" = "C:\PROGRA~1\ANTIVI~1\AVKWCTL9.EXE" [file not found]
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"SchedulingAgent" = "mstask.exe" [MS]
"ATIPOLL" = "ati2evxx.exe" ["ATI Technologies Inc."]
"ATISmart" = "C:\WINDOWS\SYSTEM\ati2s9ag.exe" [" "]

HKLM\Software\Microsoft\Active Setup\Installed Components\
{44BBA840-CC51-11CF-AAFA-00AA00B6015C}.Restore\(Default) = "Microsoft Outlook Express 6"
\StubPath = "rundll32.exe advpack.dll,UserUnInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "D:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX" ["("]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\Dane aplikacji\Microsoft\Internet Explorer\Tapeta programu Internet Explorer.bmp"

WIN.INI & SYSTEM.INI launch points:
-----------------------------------

SYSTEM.INI
[boot]
"SCRNSAVE.EXE=D:\SCREEN~1\SKYROC~1\SKYROC~1.SCR" (Skyrocket.scr) [null data]

Enabled Scheduled Tasks:
------------------------

"Rozpoczęcie aplikacji dostrajania" -> launches: "walign" [MS]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\WINDOWS\SYSTEM\rnr20.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
C:\WINDOWS\SYSTEM\mswsosp.dll [MS], 1
C:\WINDOWS\SYSTEM\msafd.dll [MS], 2 - 4
C:\WINDOWS\SYSTEM\rsvpsp.dll [MS], 5 - 6

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{5AA06644-BC46-4220-A460-47A6EB47C96D}"
-> {HKLM...CLSID} = "NavExcel Toolbar"
\InProcServer32\(Default) = "C:\PROGRAM FILES\NAVEXCEL SEARCH TOOLBAR\NAVEXCELBAR.DLL" [file not found]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE" [file not found]

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL" ["Sun Microsystems, Inc."]

Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
The Internet Explorer version cannot be found!

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
The contents of IERESET.INF cannot be reliably checked!

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

Missing lines (compared with English-language version):
[Strings]: 2 lines

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 26 seconds, including 10 seconds for message boxes)

**Posty:** 8694 · przez **Red** 28 Mar 2006, 16:05

sciagnij:

http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip

i daj mu na wyszukanie >>>winlog.exe

**Posty:** 24 · przez **vixen85m** 28 Mar 2006, 16:09

Wyskoczyło coś takiego:

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "winlog.exe" 06-03-28 14:52:39

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"key2"="C:\\WINDOWS\\SYSTEM\\winlog.exe"

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU]
"i"="winlog.exe"

**Posty:** 8694 · przez **Red** 28 Mar 2006, 16:27

otworz notatnik i wklej w nim to co ponizej:

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"key2"=-

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU]
"i"=""

w notatniku>>Plik >> Zapisz jako, zapisz jako typ: wszystkie pliki, nazwa pliku: Fix.reg
Klikasz dwa razy na powstały plik i potwierdzasz.

**Posty:** 24 · przez **vixen85m** 28 Mar 2006, 16:37

Zrobione, teraz uruchomic hijacka?

**Posty:** 8694 · przez **Red** 28 Mar 2006, 16:38

restart kompa i raz jeszcze log do kontroli

**Posty:** 24 · przez **vixen85m** 28 Mar 2006, 16:44

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:27:00, on 06-03-28 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:/WINDOWS/SYSTEM/KERNEL32.DLL C:/WINDOWS/SYSTEM/MSGSRV32.EXE C:/WINDOWS/SYSTEM/MPREXE.EXE C:/WINDOWS/SYSTEM/MSTASK.EXE C:/WINDOWS/SYSTEM/mmtask.tsk C:/WINDOWS/SYSTEM/ATI2EVXX.EXE C:/WINDOWS/EXPLORER.EXE E:/PROGRAM FILES/WINAMP/WINAMPA.EXE C:/PROGRAM FILES/ATI TECHNOLOGIES/ATI CONTROL PANEL/ATIPTAXX.EXE C:/WINDOWS/SYSTEM/DDHELP.EXE D:/PROGRAM FILES/OPERA/OPERA.EXE E:/HIJACKTHIS/HIJACKTHIS.EXE O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:/PROGRAM FILES/ADOBE/ACROBAT 5.0/READER/ACTIVEX/ACROIEHELPER.OCX O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:/Program Files/Java/jre1.5.0_06/bin/ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/SYSTEM/MSDXM.OCX O4 - HKLM/../Run: [WinampAgent] E:/Program Files/Winamp/winampa.exe O4 - HKLM/../Run: [AVKWCtl] C:/PROGRA~1/ANTIVI~1/AVKWCTL9.EXE O4 - HKLM/../Run: [ATIPTA] C:/Program Files/ATI Technologies/ATI Control Panel/atiptaxx.exe O4 - HKLM/../RunServices: [SchedulingAgent] mstask.exe O4 - HKLM/../RunServices: [ATIPOLL] ati2evxx.exe O4 - HKLM/../RunServices: [ATISmart] C:/WINDOWS/SYSTEM/ati2s9ag.exe O4 - HKCU/../Run: [Komunikator] D:/PROGRAM FILES/TLEN.PL/TLEN.EXE O8 - Extra context menu item: Download using FlashGet - C:/PROGRAM FILES/FLASHGET/jc_link.htm O8 - Extra context menu item: Download All by FlashGet - C:/PROGRAM FILES/FLASHGET/jc_all.htm O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:/PROGRAM FILES/FLASHGET/FLASHGET.EXE (file missing) O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:/PROGRAM FILES/FLASHGET/FLASHGET.EXE (file missing) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/PROGRAM FILES/JAVA/JRE1.5.0_06/BIN/SSV.DLL O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/PROGRAM FILES/JAVA/JRE1.5.0_06/BIN/SSV.DLL O12 - Plugin for .spop: C:/PROGRA~1/INTERN~1/Plugins/NPDocBox.dll O15 - Trusted Zone: *.gateone.ath.cx O15 - Trusted Zone: *.gateone.ath.cx (HKLM) O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://download.ewido.net/ewidoOnlineScan.cab O17 - HKLM/System/CCS/Services/VxD/MSTCP: NameServer = 194.204.159.1,194.204.152.34

**Posty:** 8694 · przez **Red** 28 Mar 2006, 17:12

zostały ci tylko dwa wpisy do usuniecia,ten duzy syf juz poleciał

O15 - Trusted Zone: *.gateone.ath.cx
O15 - Trusted Zone: *.gateone.ath.cx (HKLM)

Czy ewido sobie z tym nie radzi???Sprobuj raz jeszcze je usunac w trybie awaryjnym ...

**Posty:** 24 · przez **vixen85m** 28 Mar 2006, 17:34

Cały czas te dwa pliki są, nie moge ich usunąć

Jesli chodzi o ewido to w IE nie moge go uruchomić, po akceptacji mam tylko białe okno, nic się nie dzieje. Był tu problem z javą kiedyś i może dlatego? A w operze, gdy chce uruchomić program dostaje komunikat: "Sorry, your browser does not support ActiveX or it is not enabled."
Skoro jednak mówisz, że najwiekszy syf został usunięty to może nic już nie będę robić?

czy log jest poprawny?

Kto jest na forum