Po kliknięciu wstecz wyskakuje błąd

**Posty:** 21 · przez **kadosh** 23 Sie 2008, 09:32

a mianowicie jast tak jak wchodze na dysk d nie systemowy i otwiemram jakis katalog ,potem gdy chce cofnac pojawia sie nformacja o Critikal sa dwa okienka tak i nie co bym wlaczyl kieruje mnie na jas strone i chce pobrac plik IE-AV.EXE co robie panowie Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:28:18, on 2008-08-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Kod: Zaznacz wszystko: Running processes: M:\WINDOWS\System32\smss.exe M:\WINDOWS\system32\winlogon.exe M:\WINDOWS\system32\services.exe M:\WINDOWS\system32\lsass.exe M:\WINDOWS\system32\svchost.exe M:\WINDOWS\System32\svchost.exe M:\Program Files\Lavasoft\Ad-Aware\aawservice.exe M:\WINDOWS\system32\spoolsv.exe M:\WINDOWS\Explorer.EXE M:\WINDOWS\RTHDCPL.EXE M:\WINDOWS\VistaDrive\VistaDrive.exe M:\Program Files\LClock\LClock.exe M:\Program Files\Unlocker\UnlockerAssistant.exe M:\Program Files\Java\jre1.6.0_04\bin\jusched.exe M:\WINDOWS\system32\oodtray.exe M:\WINDOWS\system32\RUNDLL32.EXE M:\WINDOWS\system32\ctfmon.exe M:\Program Files\Gadu-Gadu\gg.exe M:\PROGRA~1\MICROS~2\wcescomm.exe M:\Program Files\Corel\Graphics9\Register\Remind32.exe M:\PROGRA~1\MICROS~2\rapimgr.exe M:\install\Xfire\xfire.exe M:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe M:\WINDOWS\system32\svchost.exe M:\WINDOWS\System32\svchost.exe M:\WINDOWS\system32\nvsvc32.exe M:\WINDOWS\system32\oodag.exe M:\hobby\MoH airborn\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe M:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe M:\WINDOWS\Explorer.EXE M:\Program Files\Mozilla Firefox\firefox.exe M:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Ulubione O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - M:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - M:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: BHO.toolbar3 - {A4D16645-4149-41FB-B670-E06072E540C1} - M:\WINDOWS\system32\domie.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [VistaDrive] M:\WINDOWS\VistaDrive\VistaDrive.exe O4 - HKLM\..\Run: [LClock] M:\Program Files\LClock\LClock.exe O4 - HKLM\..\Run: [UnlockerAssistant] "M:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "M:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [OODefragTray] M:\WINDOWS\system32\oodtray.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE M:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE M:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Spik] M:\Program Files\Spik\Spik.exe -autostart O4 - HKCU\..\Run: [VisualTaskTips] M:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe O4 - HKCU\..\Run: [ctfmon.exe] M:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "M:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [H/PC Connection Agent] "M:\PROGRA~1\MICROS~2\wcescomm.exe" O4 - HKCU\..\Run: [SUPERAntiSpyware] M:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] M:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-20\..\Run: [VisualTaskTips] M:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [VisualTaskTips] M:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [VisualTaskTips] M:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O4 - Startup: Rejestrowanie produktów Corela.lnk = M:\Program Files\Corel\Graphics9\Register\Remind32.exe O4 - Startup: Xfire.lnk = M:\install\Xfire\xfire.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://M:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - M:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - M:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - M:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - M:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - M:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - M:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - M:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - M:\WINDOWS\Network Diagnostic\xpnetdiag.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E86900DA-0F96-4B3D-B41A-99A28F176A76}: NameServer = 10.51.61.1 O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - M:\Program Files\Spik\url_wpmsg.dll O20 - Winlogon Notify: !SASWinLogon - M:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - M:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - M:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - M:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - M:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - M:\WINDOWS\system32\oodag.exe O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - M:\hobby\MoH airborn\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe -- End of file - 6948 bytes

Dodano 23.08.2008 08:33:15:
dodam ze Combo fix nie moge uruchomic dalatego dalem loga z Hij

**Posty:** 99 · przez **alamakota** 23 Sie 2008, 10:13

Witaj,
musisz poprawić log(nie jest cały,brak nagłówka).

Do usunięcia:

O2 - BHO: BHO.toolbar3 - {A4D16645-4149-41FB-B670-E06072E540C1} - M:\WINDOWS\system32\domie.dll

**Posty:** 21 · przez **kadosh** 23 Sie 2008, 10:18

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:17:31, on 2008-08-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: M:\WINDOWS\System32\smss.exe M:\WINDOWS\system32\winlogon.exe M:\WINDOWS\system32\services.exe M:\WINDOWS\system32\lsass.exe M:\WINDOWS\system32\svchost.exe M:\WINDOWS\System32\svchost.exe M:\Program Files\Lavasoft\Ad-Aware\aawservice.exe M:\WINDOWS\system32\spoolsv.exe M:\WINDOWS\Explorer.EXE M:\WINDOWS\RTHDCPL.EXE M:\Program Files\LClock\LClock.exe M:\Program Files\Unlocker\UnlockerAssistant.exe M:\Program Files\Java\jre1.6.0_04\bin\jusched.exe M:\WINDOWS\system32\RUNDLL32.EXE M:\WINDOWS\system32\ctfmon.exe M:\Program Files\Gadu-Gadu\gg.exe M:\PROGRA~1\MICROS~2\wcescomm.exe M:\Program Files\Corel\Graphics9\Register\Remind32.exe M:\PROGRA~1\MICROS~2\rapimgr.exe M:\install\Xfire\xfire.exe M:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe M:\WINDOWS\system32\svchost.exe M:\WINDOWS\System32\svchost.exe M:\WINDOWS\system32\nvsvc32.exe M:\WINDOWS\system32\oodag.exe M:\hobby\MoH airborn\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe M:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe M:\Program Files\Mozilla Firefox\firefox.exe M:\Documents and Settings\JA\Pulpit\ada\SmitfraudFix\Policies.exe M:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Ulubione O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - M:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - M:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: BHO.toolbar3 - {A4D16645-4149-41FB-B670-E06072E540C1} - M:\WINDOWS\system32\domie.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [VistaDrive] M:\WINDOWS\VistaDrive\VistaDrive.exe O4 - HKLM\..\Run: [LClock] M:\Program Files\LClock\LClock.exe O4 - HKLM\..\Run: [UnlockerAssistant] "M:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "M:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [OODefragTray] M:\WINDOWS\system32\oodtray.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE M:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE M:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Spik] M:\Program Files\Spik\Spik.exe -autostart O4 - HKCU\..\Run: [VisualTaskTips] M:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe O4 - HKCU\..\Run: [ctfmon.exe] M:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "M:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [H/PC Connection Agent] "M:\PROGRA~1\MICROS~2\wcescomm.exe" O4 - HKCU\..\Run: [SUPERAntiSpyware] M:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] M:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-20\..\Run: [VisualTaskTips] M:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [VisualTaskTips] M:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [VisualTaskTips] M:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O4 - Startup: Rejestrowanie produktów Corela.lnk = M:\Program Files\Corel\Graphics9\Register\Remind32.exe O4 - Startup: Xfire.lnk = M:\install\Xfire\xfire.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://M:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - M:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - M:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - M:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - M:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - M:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - M:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - M:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - M:\WINDOWS\Network Diagnostic\xpnetdiag.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E86900DA-0F96-4B3D-B41A-99A28F176A76}: NameServer = 10.51.61.1 O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - M:\Program Files\Spik\url_wpmsg.dll O20 - Winlogon Notify: !SASWinLogon - M:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - M:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - M:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - M:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - M:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - M:\WINDOWS\system32\oodag.exe O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - M:\hobby\MoH airborn\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe -- End of file - 6919 bytes

Dodano 23.08.2008 09:23:47:
a jak to usunac ??? sorki ale jestem zielony

**Posty:** 99 · przez **alamakota** 23 Sie 2008, 10:27

Nie napisałam ,bo myślałam że wiesz jak.W hijacku usuń cały wpis,a póżniej sprawdz lokalizację tego dll i ręcznie pozbądz się go.
Pozdrawiam.

**Posty:** 684 · przez **djarta** 23 Sie 2008, 10:40

Jeśli nie działa ComboFix dajemy log z DSS!

====================
K.

**Posty:** 21 · przez **kadosh** 23 Sie 2008, 10:54

nie ma nigdzie DSS chce pobrac ale nie ma takiej strony ,zaden link nie dziala do DSS

**Posty:** 684 · przez **djarta** 23 Sie 2008, 11:00

Jaką masz wersję ComboFixa?Z lwem czy krzyżykiem?

====================
K.

**Posty:** 21 · przez **kadosh** 23 Sie 2008, 11:27

z lwem

**Posty:** 684 · przez **djarta** 23 Sie 2008, 11:29

Zmień wstecz datę o parę miesięcy, zapisz go pod nazwą Combo-Fix.exe, wyłącz wszystkie programy, i wtedy spróbuj :wink:

==========================
K.

**Posty:** 21 · przez **kadosh** 23 Sie 2008, 12:42

po usunieciu tego pliku co napisal-a alamakota problem zniknął ,
M:\WINDOWS\system32\domie.dll tylko tego nie moge usunac recznie

(

**Posty:** 18165 · przez **wojtas** 23 Sie 2008, 12:45

wklej log z hijacka z nagłówkiem.. juz ktoś Cie o to prosił..
sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

M:\WINDOWS\system32\domie.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

**Posty:** 21 · przez **kadosh** 23 Sie 2008, 13:21

zrobilem jak pisales tylko nadal nie moge sciagnac DSS nie ma strony

Dodano 23.08.2008 12:24:08:
ale mimo wszystko dziekuje za pomoc problem rozwiazany nic sie nie dzieje