proszę o sprawdzenie loga. plizzz. pilne :(

**Posty:** 2 · przez **shrekus22** 02 Sty 2006, 21:28

Witam mam problem. Wyrzuca mi error 384 (spysheriff) pilne

Prosze o pomoc. To moj log. Z gory Dzieki.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:11:50, on 2006-01-02 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe F:\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\paytime.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe C:\WINDOWS\System32\paytime.exe C:\WINDOWS\System32\sywsvcs.exe F:\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\Microsoft Office\Office\FINDFAST.EXE f:\Alwil Software\Avast4\aswUpdSv.exe f:\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe C:\WINDOWS\System32\svchost.exe f:\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Madzia\Ustawienia lokalne\Temp\Katalog tymczasowy 1 dla hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [avast!] f:\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [odk_mon] F:\Moje\Tomek\Odkurzacz 9 Pro\odk_mon.exe O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - HKLM\..\Run: [NI.UWFX5_0001_N57M2112] "C:\DOCUME~1\Madzia\USTAWI~1\Temp\6.tmp" -nag O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sywsvcs.exe O4 - Global Startup: NkbMonitor.exe.lnk = F:\Nikon\PictureProject\NkbMonitor.exe O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6B920C5A-4130-4DDF-886D-8769A832B3E3}: NameServer = 195.136.250.200,195.136.250.201 O17 - HKLM\System\CS1\Services\Tcpip\..\{6B920C5A-4130-4DDF-886D-8769A832B3E3}: NameServer = 195.136.250.200,195.136.250.201 O17 - HKLM\System\CS2\Services\Tcpip\..\{6B920C5A-4130-4DDF-886D-8769A832B3E3}: NameServer = 195.136.250.200,195.136.250.201 O20 - Winlogon Notify: avpe32 - C:\WINDOWS\SYSTEM32\avpe32.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - f:\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - f:\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - f:\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - f:\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

Pozdro Tom

**Posty:** 8694 · przez **Red** 02 Sty 2006, 23:55

usuwasz z wylaczonym przywracaniem systemu w xp i w trybie awaryjnym f8

C:\WINDOWS\System32\paytime.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
C:\WINDOWS\System32\sywsvcs.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe
O4 - HKLM\..\Run: [NI.UWFX5_0001_N57M2112] "C:\DOCUME~1\Madzia\USTAWI~1\Temp\6.tmp" -nag
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sywsvcs.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

to co jest pogrubione usuwasz recznie z dysku ,reszte zaznaczasz w hijacku i fix

nastepnie sciagasz:
http://www.bleepingcomputer.com/files/killbox.php

odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej scieżke:
C:\WINDOWS\SYSTEM32\avpe32.dll wciskasz x
następnie program będzie pytał o restart-potwierdzasz

dajesz log kontrolnie do sprawdzenia

**Posty:** 2 · przez **shrekus22** 03 Sty 2006, 00:20

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:18:39, on 2006-01-02 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe f:\Alwil Software\Avast4\aswUpdSv.exe f:\Alwil Software\Avast4\ashServ.exe f:\Alwil Software\Avast4\ashWebSv.exe F:\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe F:\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\Microsoft Office\Office\FINDFAST.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Madzia\Ustawienia lokalne\Temp\Katalog tymczasowy 3 dla hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [avast!] f:\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [odk_mon] F:\Moje\Tomek\Odkurzacz 9 Pro\odk_mon.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: NkbMonitor.exe.lnk = F:\Nikon\PictureProject\NkbMonitor.exe O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6B920C5A-4130-4DDF-886D-8769A832B3E3}: NameServer = 195.136.250.200,195.136.250.201 O17 - HKLM\System\CS1\Services\Tcpip\..\{6B920C5A-4130-4DDF-886D-8769A832B3E3}: NameServer = 195.136.250.200,195.136.250.201 O17 - HKLM\System\CS2\Services\Tcpip\..\{6B920C5A-4130-4DDF-886D-8769A832B3E3}: NameServer = 195.136.250.200,195.136.250.201 O20 - Winlogon Notify: avpe32 - avpe32.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - f:\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - f:\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - f:\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - f:\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

ale mam jeszcze taki problem ze nie mam tapety tylko info "spyware infection"

Pozdro
Tom

**Posty:** 8694 · przez **Red** 03 Sty 2006, 00:37

jeszcze masz do usuniecia:

F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O20 - Winlogon Notify: avpe32 - avpe32.dll (file missing)

pogrubione recznie z dysku ,reszta hijackiem i dajesz log kontrolnie

proszę o sprawdzenie loga. plizzz. pilne :(

proszę o sprawdzenie loga. plizzz. pilne :(

:(

Kto jest na forum