proszę o pomoc i spradzenie loga

**Posty:** 44 · przez **Gural** 27 Lut 2006, 18:36

proszę o pomoc zostalem zarazony spy sheriffem oto log z hi jacka:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:26:29, on 2006-02-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Razer\Copperhead\razerhid.exe C:\Program Files\Razer\Copperhead\razertra.exe C:\Program Files\Razer\Copperhead\razerofa.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Konnekt\konnekt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\tool2.exe C:\WINDOWS\system32\paytime.exe c:\drsmartload1.exe C:\WINDOWS\system32\svchost.exe C:\DOCUME~1\KIEŁCZ~1\USTAWI~1\Temp\B.tmp C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\WScript.exe C:\WINDOWS\System32\WScript.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Kiełczewski\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [Copperhead] C:\Program Files\Razer\Copperhead\razerhid.exe O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O20 - Winlogon Notify: directpt - C:\WINDOWS\SYSTEM32\directpt.dll O20 - Winlogon Notify: wancp - C:\WINDOWS\SYSTEM32\wancp.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe

[/code]

**Posty:** 8694 · przez **Red** 27 Lut 2006, 18:40

wylacz przywracanie systemu ,wejdz w tryb awaryjny windowsa f8 i usuwasz

C:\WINDOWS\tool2.exe
C:\WINDOWS\system32\paytime.exe
c:\drsmartload1.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O20 - Winlogon Notify: directpt - C:\WINDOWS\SYSTEM32\directpt.dll
O20 - Winlogon Notify: wancp - C:\WINDOWS\SYSTEM32\wancp.dll

wymienione wpisy zaznacz w hijacku i nacisnij fix ,a to co pogrubiłem wyszukaj w systemie i usun recznie

po wszystkim dajesz log do kontroli

**Posty:** 44 · przez **Gural** 27 Lut 2006, 18:55

zrobilem to lecz pliki :
O20 - Winlogon Notify: directpt - C:\WINDOWS\SYSTEM32\directpt.dll
O20 - Winlogon Notify: wancp - C:\WINDOWS\SYSTEM32\wancp.dll
niechca sie usunac recznie.

Mam jeszcze jeden problem mam wyndows xp sp2 i niechce mi sie wlaczyc zapora.

Log z hi jacka :

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:44:10, on 2006-02-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Razer\Copperhead\razerhid.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Razer\Copperhead\razertra.exe C:\Program Files\Razer\Copperhead\razerofa.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Documents and Settings\Kiełczewski\Pulpit\HijackThis.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [Copperhead] C:\Program Files\Razer\Copperhead\razerhid.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O20 - Winlogon Notify: directpt - C:\WINDOWS\SYSTEM32\directpt.dll O20 - Winlogon Notify: wancp - C:\WINDOWS\SYSTEM32\wancp.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe

**Posty:** 8694 · przez **Red** 27 Lut 2006, 18:57

prosze sciagnac :
http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip

i daj na wyszukanie:
directpt.dll

oraz

wancp.dll wklej wyniki na forum

**Posty:** 44 · przez **Gural** 27 Lut 2006, 19:09

mam jeszcze jeden problem moj antywirus skanuje caly czas poczte chociaz niemam zalozonego konta w serwisie, z ktorego robione jest saknowanie oto screen

pliku directpt.dll ten program niemoze znalesc

plik wancp.dll:

Kod: Zaznacz wszystko: REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "wancp.dll" 2006-02-27 16:51:32 ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wancp] "DLLName"="wancp.dll"

**Posty:** 8694 · przez **Red** 27 Lut 2006, 20:24

prosze otworzyc notatnik windowsa i wklej w nim to co ponizej:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wancp]

nastepnie w notatniku>>Plik >> Zapisz jako, zapisz jako typ: wszystkie pliki, nazwa pliku: Fix.reg
Klikasz dwa razy na powstały plik i potwierdzasz

Sciagasz killbox stad:
http://www.bleepingcomputer.com/files/killbox.php

odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej scieżki:
C:\WINDOWS\SYSTEM32\directpt.dll
C:\WINDOWS\SYSTEM32\wancp.dll wciskasz x
następnie program będzie pytał o restart-potwierdzasz

Sciagasz i instalujesz:
http://www.ewido.net/en/download/

przeskanuj system i wrzuc na forum wynik skanowania oraz log z hijacka

**Posty:** 44 · przez **Gural** 27 Lut 2006, 22:32

Skan z ewido :

Kod: Zaznacz wszystko: --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 20:22:04, 2006-02-27 + Report-Checksum: C0EF18D9 + Scan result: HKU\S-1-5-21-602162358-842925246-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6001CDF7-6F45-471B-A203-0225615E35A7} -> Adware.Generic : Cleaned with backup C:\System Volume Information\_restore{23622804-A97B-4494-824E-0A2D5183B8CE}\RP44\A0017984.dll -> Proxy.Agent.hs : Cleaned with backup C:\System Volume Information\_restore{23622804-A97B-4494-824E-0A2D5183B8CE}\RP44\A0017991.dll -> Proxy.Agent.hs : Cleaned with backup C:\System Volume Information\_restore{23622804-A97B-4494-824E-0A2D5183B8CE}\RP44\A0018002.dll -> Proxy.Agent.hs : Cleaned with backup C:\System Volume Information\_restore{23622804-A97B-4494-824E-0A2D5183B8CE}\RP44\A0018013.dll -> Proxy.Agent.hs : Cleaned with backup C:\System Volume Information\_restore{23622804-A97B-4494-824E-0A2D5183B8CE}\RP44\A0018023.DLL -> Proxy.Agent.hs : Cleaned with backup C:\System Volume Information\_restore{23622804-A97B-4494-824E-0A2D5183B8CE}\RP44\A0018034.DLL -> Proxy.Agent.hs : Cleaned with backup C:\WINDOWS\system32\paytime.exe -> Hijacker.StartPage.adi : Cleaned with backup C:\WINDOWS\system32\ssldr32.dll -> Proxy.Agent.hs : Cleaned with backup C:\WINDOWS\system32\win_o3.dll -> Downloader.Agent.aef : Cleaned with backup C:\WINDOWS\country.exe -> Trojan.Dialer.my : Cleaned with backup C:\WINDOWS\toolbar.exe -> Downloader.Adload.q : Cleaned with backup C:\WINDOWS\ms1.exe -> Downloader.Agent.aea : Cleaned with backup C:\Documents and Settings\Kiełczewski\Ustawienia lokalne\Temp\9.tmp -> Proxy.Agent.hs : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@spylog[2].txt -> TrackingCookie.Spylog : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@hotlog[1].txt -> TrackingCookie.Hotlog : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@ehg-hotgroup.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@www.etracker[2].txt -> TrackingCookie.Etracker : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@sonycorporate.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@sonymediasoftware.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@adviva[2].txt -> TrackingCookie.Adviva : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@ehg-bestbuy.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@e-2dj6wjmyumd5kcq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@e-2dj6wjliohczohp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@e-2dj6wfkoupdpklp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@ilead.itrack[2].txt -> TrackingCookie.Itrack : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@gde.adocean[2].txt -> TrackingCookie.Adocean : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@e-2dj6wgkykgdzskq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@e-2dj6wfmiwgdjcdp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@e-2dj6wflysgcjslp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@ads.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@idg.adocean[1].txt -> TrackingCookie.Adocean : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@my.adocean[2].txt -> TrackingCookie.Adocean : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@ad.adocean[1].txt -> TrackingCookie.Adocean : Cleaned with backup C:\Documents and Settings\Kiełczewski\Cookies\kiełczewski@cz4.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup C:\Program Files\SpySheriff -> Adware.SpySheriff : Cleaned with backup C:\Program Files\SpySheriff\Uninstall.exe -> Adware.SpySheriff : Cleaned with backup C:\!KillBox\wancp.dll -> Proxy.Agent.hs : Cleaned with backup ::Report End

skan z hi jacka:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:23:20, on 2006-02-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Razer\Copperhead\razerhid.exe C:\Program Files\Razer\Copperhead\razertra.exe C:\Program Files\Razer\Copperhead\razerofa.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Konnekt\konnekt.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Kiełczewski\Pulpit\Nowy folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [Copperhead] C:\Program Files\Razer\Copperhead\razerhid.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O20 - Winlogon Notify: directpt - directpt.dll (file missing) O20 - Winlogon Notify: wancp - wancp.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe

**Posty:** 8694 · przez **Red** 27 Lut 2006, 22:52

usun w hijacku dwa wpisy 020 ,zaznacz i fix

Bedzie juz czysto

Autor postu otrzymał pochwałę

**Posty:** 44 · przez **Gural** 27 Lut 2006, 23:01

nadal niemoge właczyć zapory ssystemu windows xp sp2 z powodu nieokreslonego problemu. problem nastapil wraz z pojawieniem sie spy sheriffa co mam zrobic aby z powrotem moc wlaczyc zapore?

**Posty:** 8694 · przez **Red** 28 Lut 2006, 01:03

prosze jeszcze uzyc:

http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

oraz przeskanuj system kasperskim :
http://www.kaspersky.pl/virusscanner.html

wklej wynik kasowania

**Posty:** 1 · przez **gottguinn** 28 Lut 2006, 23:41

a mi wyskakuje taki błąd

Autor postu otrzymał pochwałę

przez **jeff** 28 Lut 2006, 23:43

gottguinn

spadaj frajerze na drzewo :evil:

proszę o pomoc i spradzenie loga

Proszę o pomoc i spradzenie loga

Kto jest na forum