log po spysheriffie... prosze sprawdzic

[luser17]

Oto moj log. Niestety z kompem cos nadal jest nietak.
Wyskakuje tez od czasu do czasu błąd z Winlogonem i nie moge zmienic strony startowej na stałe

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 23:27:44, on 2005-11-27
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
D:\dziadziaRe\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [PadTouch] "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [MailScanner] C:\Program Files\MKS\Bin\mks_mail.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Menu mks_vir.lnk = C:\Program Files\MKS\Bin\mks_menu.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html
O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\kldda.dll
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: MkSUpdateInt - MkS Sp. z o. o. - C:\Program Files\MKS\bin\MkSUpdateInt.exe
O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\MKS\Bin\mksmonsv.exe
O23 - Service: MkS_Scan - Unknown owner - C:\Program Files\MKS\Bin\mks_scan.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe



[Red]

wylacz przywracanie systemu ,wejdz w tryb awaryjny windowsa f8 i usuwasz:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

dodatkowo przelec system:
http://www.idg.pl/ftp/pc_3671/CWShredder%201.58.html
usun wszystko co znajdzie
dodatkowo prosze o log z :
http://www.atribune.org/downloads/l2mfix.exe
>> Sciagnij i uruchom (wypakuj)
>> Odpal go przez l2mfix.bat z jego folderu
>>Uruchom w nim opcje 1 - Run fix
>> Czekaj cierpliwie na zakonczenie
>>jesli "wywali" pulpit nie przejmuj sie

[luser17]

Kod: Zaznacz wszystko

L2MFIX find log 1.99
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Hints]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\IZIresizePX.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\policies]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\hr6805jue.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI)    ALLOW  Full access    ZARZ¤DZANIE NT\SYSTEM
(IO)    ALLOW  Full access    ZARZ¤DZANIE NT\SYSTEM
(ID-NI) ALLOW  Read           BUILTIN\Uľytkownicy
(ID-IO) ALLOW  Read           BUILTIN\Uľytkownicy
(ID-NI) ALLOW  Full access    BUILTIN\Administratorzy
(ID-IO) ALLOW  Full access    BUILTIN\Administratorzy
(ID-NI) ALLOW  Full access    ZARZ¤DZANIE NT\SYSTEM
(ID-IO) ALLOW  Full access    ZARZ¤DZANIE NT\SYSTEM
(ID-IO) ALLOW  Full access    TWŕRCA-WťA—CICIEL


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{DC299D7E-8B77-1C2C-0C3D-1BC607500917}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{F4742FFA-A231-49C1-8A90-71B634F0CF3F}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F4742FFA-A231-49C1-8A90-71B634F0CF3F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F4742FFA-A231-49C1-8A90-71B634F0CF3F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F4742FFA-A231-49C1-8A90-71B634F0CF3F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F4742FFA-A231-49C1-8A90-71B634F0CF3F}\InprocServer32]
@="C:\\WINDOWS\\system32\\IZIresizePX.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
   dcvoice.dll    Mon  2005-11-28   8:56:46   ..S.R        233 680   228,20 K
   isuv_32.dll    Sun  2005-11-27  23:36:48   ..S.R        236 559   231,01 K
   izires~1.dll   Mon  2005-11-28   8:45:58   ..S.R        233 680   228,20 K
   kt66l7~1.dll   Mon  2005-11-28   8:45:58   ..S.R        235 347   229,83 K

4 items found:  4 files (4 H/S), 0 directories.
   Total of file sizes:  939 266 bytes    917,25 K
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Wolumin w stacji C nie ma etykiety.
Numer seryjny woluminu: 0835-8D74

Katalog: C:\WINDOWS\System32

2005-11-28  08:56           233˙680 dcvoice.dll
2005-11-28  08:45           233˙680 IZIresizePX.dll
2005-11-28  08:45           235˙347 kt66l7js1.dll
2005-11-27  23:36           236˙559 isuv_32.dll
2005-08-25  17:21    <DIR>          dllcache
2003-12-15  10:31    <DIR>          Microsoft
               4 plik(˘w)         939˙266 bajt˘w
               2 katalog(˘w)  15˙528˙796˙160 bajt˘w wolnych

[/quote]

[Red]

prosze w notatniku wkleic:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Hints]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\policies]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{DC299D7E-8B77-1C2C-0C3D-1BC607500917}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{F4742FFA-A231-49C1-8A90-71B634F0CF3F}"=-

[HKEY_CLASSES_ROOT\CLSID\{F4742FFA-A231-49C1-8A90-71B634F0CF3F}]

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG

sciagasz:
http://www.bleepingcomputer.com/files/killbox.php


odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej scieżke:
odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej scieżki:
C:\WINDOWS\System32\dcvoice.dll
C:\WINDOWS\System32\IZIresizePX.dll
C:\WINDOWS\System32\kt66l7js1.dll
C:\WINDOWS\System32\isuv_32.dll
dopiero po ostatnim wklejeniu wciskasz x
następnie program będzie pytał o restart-potwierdzasz
dajesz log do kontrolnego sprawdzenia

nastepnie Reset do TRYBU AWARYJNEGO w Windows i uruchomienie pliku FIX.REG