prosze o interpretacje loga,reklamy po spysheriffie

**Posty:** 10 · przez **destruktor** 14 Mar 2006, 22:14

:cry: Please Help,
Złapałam Spysheriffa,przeskanowałam go antiviren,spy boot an destroy,adaware'm z trybu awaryjnego,z hijacka pousuwałam niektore wpisy oznaczone na czerwono w analizie i dalej mecza mnie te reklamy,przy czym komp jest tak mułowaty,ze nie da sie praktycznie nic zrobic,gdzie to siedzi?
Prosze o pomoc,
Log z hijacka:
Logfile of HijackThis v1.99.1
Scan saved at 20:05:28, on 06-03-14
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\IDIOT\SYSTEM\KERNEL32.DLL
C:\IDIOT\SYSTEM\MSGSRV32.EXE
C:\IDIOT\SYSTEM\MPREXE.EXE
C:\IDIOT\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\AVKSERVICE.EXE
C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\AVKWCTL9.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\IDIOT\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\IDIOT\EXPLORER.EXE
C:\IDIOT\RUNDLL32.EXE
C:\IDIOT\TASKMON.EXE
C:\IDIOT\SYSTEM\SYSTRAY.EXE
C:\IDIOT\RUNDLL32.EXE
C:\IDIOT\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\AVKPOP.EXE
C:\IDIOT\SYSTEM\WMIEXE.EXE
C:\IDIOT\SYSTEM\DDHELP.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\IDIOT\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\IDIOT\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\IDIOT\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\IDIOT\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\IDIOT\SYSTEM\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [StillImageMonitor] C:\IDIOT\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [AVK Mail Checker] "C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\AVKPOP.EXE"
O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [AVKService] C:\PROGRA~1\ANTIVI~1\AVKSER~1.EXE
O4 - HKLM\..\RunServices: [AVKWCtl] C:\PROGRA~1\ANTIVI~1\AVKWCTL9.EXE
O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab

Czekam na jakiegos łaskawce,pozdrowka

przez **jeff** 14 Mar 2006, 22:17

poczytaj

http://forum.programosy.pl/hijackthis-gtobsuga-i-umieszczanie-loga-vt9452.html

i zobacz jak sie umieszcza log-a w tagach

**Posty:** 10 · przez **destruktor** 14 Mar 2006, 23:30

Sorki to mój pierwszy raz.
jakies cholerstwo pozostało mi po wirusie w formie napastujących okienek z reklamami,przeskanowalam go CWSredderem,Spyboot search and destroy,ad-awarem i ciagle to samo,jakies wskazowki?
Log

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:05:28, on 06-03-14 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\IDIOT\SYSTEM\KERNEL32.DLL C:\IDIOT\SYSTEM\MSGSRV32.EXE C:\IDIOT\SYSTEM\MPREXE.EXE C:\IDIOT\SYSTEM\MSTASK.EXE C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\AVKSERVICE.EXE C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\AVKWCTL9.EXE C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE C:\IDIOT\SYSTEM\mmtask.tsk C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE C:\IDIOT\EXPLORER.EXE C:\IDIOT\RUNDLL32.EXE C:\IDIOT\TASKMON.EXE C:\IDIOT\SYSTEM\SYSTRAY.EXE C:\IDIOT\RUNDLL32.EXE C:\IDIOT\SYSTEM\STIMON.EXE C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\AVKPOP.EXE C:\IDIOT\SYSTEM\WMIEXE.EXE C:\IDIOT\SYSTEM\DDHELP.EXE C:\HIJACKTHIS\HIJACKTHIS.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\IDIOT\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\IDIOT\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\IDIOT\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\IDIOT\SYSTEM\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\IDIOT\SYSTEM\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [StillImageMonitor] C:\IDIOT\SYSTEM\STIMON.EXE O4 - HKLM\..\Run: [AVK Mail Checker] "C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\AVKPOP.EXE" O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [AVKService] C:\PROGRA~1\ANTIVI~1\AVKSER~1.EXE O4 - HKLM\..\RunServices: [AVKWCtl] C:\PROGRA~1\ANTIVI~1\AVKWCTL9.EXE O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks" O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab

przez **jeff** 15 Mar 2006, 00:13

w logu nic nie widze

daj loga z Silent Runners

Ściągnij ten program na dysk i odpal

http://www.silentrunners.org/Silent%20Runners.zip

Pojawi się okienko i klikasz na "Nie ", dzięki czemu otrzymamy pełen log. Poczekaj chwile aż dostaniesz info że log już gotowy i wklej zawartość txt na forum

**Posty:** 10 · przez **destruktor** 15 Mar 2006, 00:23

Log z silent runners

[quote]"Silent Runners.vbs", revision 44, http://www.silentrunners.org/
Operating System: Windows 98
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ScanRegistry" = "C:\IDIOT\scanregw.exe /autorun" [MS]
"TaskMonitor" = "C:\IDIOT\taskmon.exe" [MS]
"SystemTray" = "SysTray.Exe" [MS]
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
"NvCplDaemon" = "RUNDLL32.EXE C:\IDIOT\SYSTEM\NvCpl.dll,NvStartup" [MS]
"NvMediaCenter" = "RUNDLL32.EXE C:\IDIOT\SYSTEM\NvMcTray.dll,NvTaskbarInit" [MS]
"StillImageMonitor" = "C:\IDIOT\SYSTEM\STIMON.EXE" [MS]
"AVK Mail Checker" = ""C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\AVKPOP.EXE"" ["G DATA Software AG"]
"NPROTECT" = "C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE" ["Symantec Corporation"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"SchedulingAgent" = "mstask.exe" [MS]
"AVKService" = "C:\PROGRA~1\ANTIVI~1\AVKSER~1.EXE" ["("]
"AVKWCtl" = "C:\PROGRA~1\ANTIVI~1\AVKWCTL9.EXE" [","]
"NPROTECT" = "C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE" ["Symantec Corporation"]
"SymTray - Norton SystemWorks" = "C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"" ["Symantec Corporation"]
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\IDIOT\SYSTEM\NVCPL.DLL" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\IDIOT\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\IDIOT\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\IDIOT\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{2E9D3540-211C-11d0-A5F2-00A0248C37BE}" = "Nero Shell Extension Property Sheet"
-> {HKLM...CLSID} = "Nero Shell Extension Property Sheet"
\InProcServer32\(Default) = "C:\Program Files\Ahead\nero\neroshx.dll" ["Ahead Software AG"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]
AVK9CM\(Default) = "{CAF4C320-32F5-11D3-A222-004095200FF2}"
-> {HKLM...CLSID} = "AVK9ContextMenue"
\InProcServer32\(Default) = "C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\SHELLEXT.DLL" ["4"]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]
AVK9CM\(Default) = "{CAF4C320-32F5-11D3-A222-004095200FF2}"
-> {HKLM...CLSID} = "AVK9ContextMenue"
\InProcServer32\(Default) = "C:\PROGRAM FILES\ANTIVIRENKIT PROFESSIONAL\SHELLEXT.DLL" ["4"]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "E:\tapety\chevrolet_corvette_convertible_2002_01_m.jpg"

Enabled Scheduled Tasks:
------------------------

"Rozpoczęcie aplikacji dostrajania" -> launches: "walign" [MS]
"Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe /CUSTOM /SCHEDULE" ["Symantec Corporation"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\IDIOT\SYSTEM\rnr20.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
C:\IDIOT\SYSTEM\mswsosp.dll [MS], 1
C:\IDIOT\SYSTEM\msafd.dll [MS], 2 - 4
C:\IDIOT\SYSTEM\rsvpsp.dll [MS], 5 - 6

Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
The Internet Explorer version cannot be found!

C:\IDIOT\INF\IERESET.INF (used to "Reset Web Settings")
The contents of IERESET.INF cannot be reliably checked!

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

Missing lines (compared with English-language version):
[Strings]: 2 lines

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 42 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 10 seconds.
---------- (total run time: 135 seconds)[/quote]

zaczynam sie poddawac

**Posty:** 8694 · przez **Red** 15 Mar 2006, 11:21

rosze sciagnac:

http://www.thatcomputerguy.us/downloads/findit9xme.zip

Rozpakuj >>> uruchom *Find.bat* >>> pokaż zawartość *output.txt*
na forum

**Posty:** 10 · przez **destruktor** 15 Mar 2006, 22:29

Bylabym wdzieczna za jakis pomysl,bo na formacie mi nie zalezy
[code]
Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System Directory -------

Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: 2337-1E0E
Katalog C:\IDIOT\SYSTEM

VSHELPER DLL 226 592 06.03.12 17:38 VSHELPER.DLL
MPWSOCK DLL 226 592 06.03.12 17:38 MPWSOCK.DLL
DIKAPI32 DLL 226 592 06.03.12 17:38 DIKAPI32.DLL
SDOOLSS DLL 226 592 06.03.12 17:38 SDOOLSS.DLL
VUAME DLL 226 592 06.03.12 17:38 VUAME.DLL
KSRNEL32 DLL 226 592 06.03.12 17:38 KSRNEL32.DLL
DKD9 DLL 226 592 06.03.12 17:38 dKd9.dll
AVCTRES DLL 226 592 06.03.12 17:38 avctres.dll
KCRNEL32 DLL 226 592 06.03.12 17:38 KCRNEL32.DLL
NURSPT DLL 226 592 06.03.12 17:38 nurspt.dll
{88F92~1 DAT 32 04.12.01 20:49 {88F920A1-43DA-11D9-8471-00E04C02004D}.dat
{4ACE3~1 DAT 32 04.12.01 20:48 {4ACE35E4-43DA-11D9-8471-00E04C02004D}.dat
12 plik(˘w) 2 265 984 bajt˘w
0 katalog(˘w) 6 200,06 MB wolnych

------- Hidden Files in System Directory -------

Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: 2337-1E0E
Katalog C:\IDIOT\SYSTEM

HPFHLPB0 GID 8 628 05.12.25 0:15 hpfhlpb0.GID
{88F92~1 DAT 32 04.12.01 20:49 {88F920A1-43DA-11D9-8471-00E04C02004D}.dat
{4ACE3~1 DAT 32 04.12.01 20:48 {4ACE35E4-43DA-11D9-8471-00E04C02004D}.dat
FOLDER HTT 13 264 04.10.29 23:26 folder.htt
DESKTOP INI 266 04.10.29 23:26 desktop.ini
5 plik(˘w) 22 222 bajt˘w
0 katalog(˘w) 6 200,05 MB wolnych

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{426C6343-A2D1-AD7A-AA58-EF9642D69276}"=""

------------------ Locate.com Results ------------------

C:\IDIOT\SYSTEM\
vshelper.dll Sun 2006-03-12 17:38:54 ..S.R 226 592 221,28 K
mpwsock.dll Sun 2006-03-12 17:38:54 ..S.R 226 592 221,28 K
dikapi32.dll Sun 2006-03-12 17:38:54 ..S.R 226 592 221,28 K
sdoolss.dll Sun 2006-03-12 17:38:54 ..S.R 226 592 221,28 K
vuame.dll Sun 2006-03-12 17:38:54 ..S.R 226 592 221,28 K
ksrnel32.dll Sun 2006-03-12 17:38:54 ..S.R 226 592 221,28 K
hpfhlpb0.gid Sun 2005-12-25 0:15:30 A..H. 8 628 8,43 K
dkd9.dll Sun 2006-03-12 17:38:54 ..S.R 226 592 221,28 K
avctres.dll Sun 2006-03-12 17:38:54 ..S.R 226 592 221,28 K
kcrnel32.dll Sun 2006-03-12 17:38:54 ..S.R 226 592 221,28 K
nurspt.dll Sun 2006-03-12 17:38:54 ..S.R 226 592 221,28 K

11 items found: 11 files, 0 directories.
Total of file sizes: 2 274 548 bytes 2,17 M

------------ Strings.exe Qoologic Results ------------

C:\IDIOT\SYSTEM.DAT: www.qoologic.com127.0.0.1
C:\IDIOT\hosts: 127.0.0.1 www.qoologic.com

-------------- Strings.exe Aspack Results -------------

----------------- HKLM Run Key ------------------

-------------- Strings.exe Umonitor Results -------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="C:\\IDIOT\\scanregw.exe /autorun"
"TaskMonitor"="C:\\IDIOT\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"NvCplDaemon"="RUNDLL32.EXE C:\\IDIOT\\SYSTEM\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\IDIOT\\SYSTEM\\NvMcTray.dll,NvTaskbarInit"
"StillImageMonitor"="C:\\IDIOT\\SYSTEM\\STIMON.EXE"
"AVK Mail Checker"="\"C:\\PROGRAM FILES\\ANTIVIRENKIT PROFESSIONAL\\AVKPOP.EXE\""
"NPROTECT"="C:\\Program Files\\Norton SystemWorks\\Norton Utilities\\NPROTECT.EXE"
"CookiePatrol"="C:\\PROGRA~1\\PESTPA~1\\CookiePatrol.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[/code]

z góry dzieki za pomoc

**Posty:** 8694 · przez **Red** 15 Mar 2006, 22:46

prosze otworzyc notatnik windowsa i wklej w nim to co ponizej:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{426C6343-A2D1-AD7A-AA58-EF9642D69276}"=-

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na Wszystkie pliki >>> Zapisz jako FIX.REG

nastepnie zastartuj komputer z dyskietki do >> DOS i wykonaj zestaw komend:

CD C:\WINDOWS\SYSTEM

ATTRIB -R -S -H DIKAPI32.DLL
ATTRIB -R -S -H SDOOLSS.DLL
ATTRIB -R -S -H VSHELPER.DLL
ATTRIB -R -S -H VUAME.DLL
ATTRIB -R -S -H KSRNEL32.DLL
ATTRIB -R -S -H dKd9.dll
ATTRIB -R -S -H avctres.dll
ATTRIB -R -S -H KCRNEL32.DLL
ATTRIB -R -S -H nurspt.dll

DEL DIKAPI32.DLL
DEL SDOOLSS.DLL
DEL VSHELPER.DLL
DEL VUAME.DLL
DEL KSRNEL32.DLL
DEL dKd9.dll
DEL avctres.dll
DEL KCRNEL32.DLL
DEL nurspt.dll

nastepnie uruchom wczesniej powstały plik fix w trybie awaryjnym klikajac na niego dwa razy

**Posty:** 10 · przez **destruktor** 16 Mar 2006, 22:52

No teraz to zasuwa,wielkie podziekowania za lekarstwo,co my bysmy zrobili bez was geniuszy.No to tego mam z głowy,czas sie wziac za drugiego,zupelny zbieg okolicznosci,moj brat sie tym zarazil tydzien wczesniej i jego tez musze uleczyc,tylko tu juz jest xp home.
Czy nie naduzylabym dobroci szanownego forum zamieszczajac jeszcze jednego loga z hijacka?tez pewnie nie poradze sobie,o ja glupia od urodzenia.
JESZCZE RAZ WIELKIE DZIEKI

**Posty:** 8694 · przez **Red** 17 Mar 2006, 11:15

Prosze o log xp home...

**Posty:** 10 · przez **destruktor** 17 Mar 2006, 16:04

w tym przypadku nie jestem pewna czy to pozostalosc po spysheriffie,wiem mniej wiecej co trzeba usunac z loga,ale w poprzednim przypadku nie dalo efektu i to chyba nie jest calkowite rozwiazanie problemu,dzieki za pomoc,sorki ze zawracam glowe
[quote]
Logfile of HijackThis v1.99.1
Scan saved at 13:17:34, on 2006-03-17
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVirenKit\AVKService.exe
C:\Program Files\AntiVirenKit\AVKWCtl.exe
C:\WINDOWS\System32\S3apphk.exe
C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE
C:\Program Files\Common Files\G DATA\AVKMail\AVKPOP.EXE
C:\Program Files\PowerDVD\PDVDServ.exe
C:\WINDOWS\SkFKTy1QQU4\command.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.onet.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKLM\..\Run: [AVK Mail Checker] "C:\Program Files\Common Files\G DATA\AVKMail\AVKPOP.EXE"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.onet.pl
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://promo.dollarrevenue.com/webmasterexe/drsmartload117a.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140901966718
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c46.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game08.zylom.com/activex/zylomgamesplayer.cab
O20 - Winlogon Notify: ShellScrap - C:\WINDOWS\system32\mvpml9711.dll
O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\AntiVirenKit\AVKService.exe
O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C:\Program Files\AntiVirenKit\AVKWCtl.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SkFKTy1QQU4\command.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE[/quote]

**Posty:** 8694 · przez **Red** 17 Mar 2006, 17:13

do xp

wylacz przywracanie systemu ,wejdz w tryb awaryjny windowsa f8 i usuwasz

C:\WINDOWS\SkFKTy1QQU4\command.exe
R3 - Default URLSearchHook is missing
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://promo.dollarrevenue.com/webmasterexe/drsmartload117a.exe
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c46.cab
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SkFKTy1QQU4\command.exe

to co pogrubilem usuwasz recznie z dysku ,wpisys zaznaczasz i naciskasz fix w hijacku

ddatkowo wykonaj:

Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop cmdService

sc delete cmdService

po usuwaniu dajesz log do kontroli

**Posty:** 10 · przez **destruktor** 19 Mar 2006, 16:32

Po wykonaniu instrukcji problem dalej istnieje,oto nowy log

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:28:25, on 2006-03-18 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\AntiVirenKit\AVKService.exe C:\Program Files\AntiVirenKit\AVKWCtl.exe C:\WINDOWS\System32\svchost.exe C:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.onet.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - Default URLSearchHook is missing O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O14 - IERESET.INF: START_PAGE_URL=http://www.onet.pl O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140901966718 O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game08.zylom.com/activex/zylomgamesplayer.cab O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\l2p2lc7o1f.dll O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\AntiVirenKit\AVKService.exe O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C:\Program Files\AntiVirenKit\AVKWCtl.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

przez **Tom@szek** 19 Mar 2006, 16:51

Usuwasz jeszcze to:

R3 - Default URLSearchHook is missing

Ściągnij ten program i daj log z poz 1>

http://www.atribune.org/downloads/l2mfix.exe

**Posty:** 10 · przez **destruktor** 24 Mar 2006, 18:17

Kolejny Log,prosze o analize

[code]
L2MFIX find log 032106
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OptimalLayout]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\g204lcdq1f0e.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{A045CB0D-5B74-9879-1904-DDB25F21C09C}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{E9C711CB-049A-46CB-A3E5-79243E0095BB}"=""
"{7FE5EBF0-81D9-4E69-82E7-8226E9574E33}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E9C711CB-049A-46CB-A3E5-79243E0095BB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E9C711CB-049A-46CB-A3E5-79243E0095BB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E9C711CB-049A-46CB-A3E5-79243E0095BB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E9C711CB-049A-46CB-A3E5-79243E0095BB}\InprocServer32]
@="C:\\WINDOWS\\system32\\WUV9VCM.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{7FE5EBF0-81D9-4E69-82E7-8226E9574E33}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7FE5EBF0-81D9-4E69-82E7-8226E9574E33}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7FE5EBF0-81D9-4E69-82E7-8226E9574E33}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7FE5EBF0-81D9-4E69-82E7-8226E9574E33}\InprocServer32]
@="C:\\WINDOWS\\system32\\DSTSQFX.DLL"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
wuv9vcm.dll Fri 2006-03-24 15:57:28 ..... 233 776 228,30 K
gp4sl3~1.dll Fri 2006-03-24 15:04:26 ..S.R 233 776 228,30 K
p2n8lc~1.dll Fri 2006-03-24 15:51:44 ..S.R 233 776 228,30 K
wnaspi32.dll Thu 2006-03-09 16:36:52 A.... 45 056 44,00 K
ff_vfw.dll Fri 2006-01-27 14:36:06 A.... 6 144 6,00 K
divx.dll Wed 2006-01-18 20:47:36 A.... 574 976 561,50 K
dpugui11.dll Fri 2006-01-06 17:35:00 A.... 593 920 580,00 K
dpl100.dll Mon 2005-12-26 22:35:12 A.... 86 016 84,00 K
dpu11.dll Fri 2006-01-06 17:34:58 A.... 294 912 288,00 K
dpus11.dll Fri 2006-01-06 17:34:58 A.... 339 968 332,00 K
dtu100.dll Fri 2006-01-06 17:35:00 A.... 200 704 196,00 K
libdivx.dll Fri 2006-01-06 17:17:36 A.... 1 044 480 1020,00 K
qt-dx331.dll Fri 2006-01-06 17:35:00 A.... 3 596 288 3,43 M
ssldivx.dll Fri 2006-01-06 17:17:36 A.... 200 704 196,00 K
xvidvfw.dll Fri 2005-12-30 20:18:26 A.... 180 224 176,00 K
xvidcore.dll Fri 2005-12-30 20:10:30 A.... 761 856 744,00 K
x264vfw.dll Fri 2006-02-17 20:22:22 A.... 457 234 446,52 K
l62s0g~1.dll Fri 2006-03-24 11:19:24 ..S.R 233 722 228,24 K
g204lc~1.dll Fri 2006-03-24 14:35:54 ..S.R 233 776 228,30 K

19 items found: 19 files (4 H/S), 0 directories.
Total of file sizes: 9 551 308 bytes 9,11 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Fri 2006-03-24 15:59:28 ..S.R 233 776 228,30 K

1 item found: 1 file (1 H/S), 0 directories.
Total of file sizes: 233 776 bytes 228,30 K
**********************************************************************************
Directory Listing of system files:
Wolumin w stacji C nie ma etykiety.
Numer seryjny woluminu: 4495-DA00

Katalog: C:\WINDOWS\System32

2006-03-24 15:59 233˙776 guard.tmp
2006-03-24 15:51 233˙776 p2n8lc5u1f.dll
2006-03-24 15:04 233˙776 gp4sl3h71.dll
2006-03-24 14:35 233˙776 g204lcdq1f0e.dll
2006-03-24 11:19 233˙722 l62s0gf7e62.dll
2004-06-11 16:25 <DIR> Microsoft
2002-09-02 17:49 <DIR> dllcache
5 plik(˘w) 1˙168˙826 bajt˘w
2 katalog(˘w) 9˙602˙629˙632 bajt˘w wolnych
[/code]

**Posty:** 8694 · przez **Red** 24 Mar 2006, 18:19

Sciagnij:
http://www.ewido.net/en/
przeskanuj kompa i daj mi wynik skanu na forum

**Posty:** 10 · przez **destruktor** 02 Kwi 2006, 16:10

[code]
____________
______________________________________
ewido security suite online scanner
http://www.ewido.net
__________________________________________________

Name: TrackingCookie.Adocean
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@my.adocean[1].txt
Risk: Medium

Name: TrackingCookie.Adocean
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@gde.adocean[2].txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@ad.yieldmanager[1].txt
Risk: Medium

Name: TrackingCookie.Clickbank
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@clickbank[1].txt
Risk: Medium

Name: TrackingCookie.Adocean
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@gde.adocean[3].txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@tradedoubler[1].txt
Risk: Medium

Name: TrackingCookie.Revenue
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@revenue[2].txt
Risk: Medium

Name: TrackingCookie.Adocean
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@ad.adocean[2].txt
Risk: Medium

Name: TrackingCookie.Fastclick
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@fastclick[2].txt
Risk: Medium

Name: TrackingCookie.Paypopup
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@paypopup[1].txt
Risk: Medium

Name: TrackingCookie.Fastclick
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@media.fastclick[1].txt
Risk: Medium

Name: TrackingCookie.Casalemedia
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@casalemedia[2].txt
Risk: Medium

Name: TrackingCookie.Valueclick
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@valueclick[2].txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@ad.yieldmanager[2].txt
Risk: Medium

Name: Adware.Look2Me
Path: [1532] C:\WINDOWS\system32\mkhtmler.dll
Risk: Medium

Name: Adware.Look2Me
Path: [1456] C:\WINDOWS\system32\guard.tmp
Risk: Medium

Name: Adware.Look2Me
Path: C:\WINDOWS\system32\mmobjs.dll
Risk: Medium

Name: Adware.Look2Me
Path: C:\WINDOWS\system32\guard.tmp
Risk: Medium

Name: Adware.Look2Me
Path: C:\WINDOWS\system32\irrol5931.dll
Risk: Medium

Name: Adware.Look2Me
Path: C:\WINDOWS\system32\h64mlgh1164.dll
Risk: Medium

Name: Adware.AdURL
Path: C:\WINDOWS\Temp\bw2.com
Risk: Medium

Name: Adware.AdURL
Path: C:\WINDOWS\icont.exe
Risk: Medium

Name: Adware.AdURL
Path: C:\Documents and Settings\TEMP.SKLEP\Ustawienia lokalne\Temporary Internet Files\Content.IE5\XDO6WOM2\AppWrap[1].exe
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: C:\Documents and Settings\TEMP.SKLEP\Cookies\jajo-pan@ad.yieldmanager[3].txt
Risk: Medium

[/code]
Prosze o analize,z gory dzieki

**Posty:** 8694 · przez **Red** 03 Kwi 2006, 14:02

Prosze o analize,z gory dzieki

zrobimy to jak dasz znak ze jestes .Przy usuwaniu tego vx2 musisz miec troszke czasu i trzeba to zrobic w jednej sesji ...zapewne pliki szpiega juz masz podmienione

**Posty:** 10 · przez **destruktor** 03 Kwi 2006, 18:07

Wiem,ze daje fraszke z tymi tygodniowymi przerwami,ale choroba mnie zmorzyla i nie mialam dostepu,sciagne go do siebie i dam znac kiedy bede mogla zasiasc przed nim calosesyjnie.Sorki za moja opieszchalosc,pozdrowka

prosze o interpretacje loga,reklamy po spysheriffie

Prosze o interpretacje loga,reklamy po spysheriffie

Wirus Spysheriff,pozostałości w formie reklam

Nic nie pomaga

Log z FindIt

Wielkie podziekowania za pomoc

Log z XP home

Niestety nie pomogło

Kolejny Log L2MFIX

Raport

Sorki

Kto jest na forum