prosze o sprawdzenie loga

**Posty:** 3874 · przez **Wojtasgls** 18 Kwi 2006, 13:01

Witajcie prosze o sprawdzenie loga wrocilem ze swiat kompa zostawilem kolega i to co zastalem po wlaczeniu: tapeta zmieniona na jakas z ostrzezeniem o spamie i n ie da sie jej usunac, co chwila wyskakuje komunikat yoyrs computer is dangers i rozne strony z pornografia a i nie dda sie wlaczyc menedzera zadan heh pomocy:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 10:43:18, on 2006-04-18 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\atievxx.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\MMTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\System32\kernels8.exe C:\WINDOWS\System32\netfilt4.exe C:\WINDOWS\inet20001\winlogon.exe C:\Windows\xpupdate.exe C:\WINDOWS\System32\dlh9jkdq2.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\inet20001\socks.exe C:\WINDOWS\System32\dllcache\IExplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\ja\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F3 - REG:win.ini: run=C:\WINDOWS\inet20001\winlogon.exe O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inet20001\3.03.00.dll O2 - BHO: IExplorerHelper Class - {E89097ED-3400-411D-9647-D368C3311C98} - C:\WINDOWS\System32\IeHelperExVSSS.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [MMTray] MMTray.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels8.exe O4 - HKLM\..\Run: [netfilt4] C:\WINDOWS\System32\netfilt4.exe O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20001\winlogon.exe O4 - HKLM\..\Run: [Microsoft standard protector] C:\WINDOWS\inet20001\socks.exe O4 - HKLM\..\Run: [windows] c:\temp\svchost.exe O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels8.exe O4 - HKLM\..\RunServices: [netfilt4] C:\WINDOWS\System32\netfilt4.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe O4 - HKCU\..\Run: [netfilt4] C:\WINDOWS\System32\netfilt4.exe O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20001\winlogon.exe O4 - HKCU\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s O4 - HKCU\..\Run: [Key] C:\DOCUME~1\ja\USTAWI~1\Temp\7.tmp O4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\System32\vxgame6.exe3584.exe O4 - HKCU\..\Run: [BraveSentry] C:\Program Files\BraveSentry\BraveSentry.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O20 - Winlogon Notify: 2006reg - C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll O20 - Winlogon Notify: 3246762198745124975reg - C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll O20 - Winlogon Notify: SensSrv - C:\WINDOWS\SYSTEM32\senssrv.dll O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: Performance True Type Font (PerfFont) - Unknown owner - C:\WINDOWS\System32\perfont.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

**Posty:** 8694 · przez **Red** 18 Kwi 2006, 13:02

daj jeszcze jeden log:

otwierasz link>>> http://www.silentrunners.org/Silent%20Runners.vbs >>zapisujesz jako na pulpicie>>klikasz dwa razy >>masz wybor i wybierasz no>>i czekasz troszke az wygeneruje sie cały log do konca
wrzucasz na forum

**Posty:** 3874 · przez **Wojtasgls** 18 Kwi 2006, 13:25

oto to ten log z wielkim problemem go tu wklejam juz komp strasznie chodzi na rogramosy ledwo co weszlem:(

Kod: Zaznacz wszystko: Silent Runners.vbs", revision 43, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"] "Windows update loader" = "C:\Windows\xpupdate.exe" [null data] "netfilt4" = "C:\WINDOWS\System32\netfilt4.exe" [null data] "xp_system" = "C:\WINDOWS\inet20001\winlogon.exe" [null data] "WindowsUpdate" = "C:\WINDOWS\System\svchost.exe /s" [null data] "Key" = "C:\DOCUME~1\ja\USTAWI~1\Temp\7.tmp" [null data] "WinMedia" = "C:\WINDOWS\System32\vxgame6.exe3584.exe" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "MMTray" = "MMTray.exe" ["Morgan Multimedia"] "DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "System" = "C:\WINDOWS\System32\kernels8.exe" [null data] "netfilt4" = "C:\WINDOWS\System32\netfilt4.exe" [null data] "xp_system" = "C:\WINDOWS\inet20001\winlogon.exe" [null data] "WindowsUpdate" = (empty string) "Microsoft standard protector" = "C:\WINDOWS\inet20001\socks.exe " [null data] "windows" = "c:\temp\svchost.exe" [null data] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided) \StubPath = ""C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {5321E378-FFAD-4999-8C62-03CA8155F0B3}\(Default) = "HBO Class" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\inet20001\3.03.00.dll" [empty string] {E89097ED-3400-411D-9647-D368C3311C98}\(Default) = "IExplorerHelper Class" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\IeHelperExVSSS.dll" [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"] HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ INFECTION WARNING! "run" = "C:\WINDOWS\inet20001\winlogon.exe" [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! 2006reg\DLLName = "C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll" [null data] INFECTION WARNING! 3246762198745124975reg\DLLName = "C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll" [null data] INFECTION WARNING! SensSrv\DLLName = "senssrv.dll" ["Microsoft Windows Publisher"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] Group Policies [Description] {enabled Group Policy setting}: ------------------------------------------------------------ HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ HIJACK WARNING! "ForceActiveDesktopOn"=dword:00000001 [enables Active Desktop and prevents disabling it] {User Configuration|Administrative Templates|Desktop|Active Desktop| Enable Active Desktop} HIJACK WARNING! "Wallpaper" = "C:\WINDOWS\desktop.html" [disables the Display Properties|Desktop (tab) (except the "Customize Desktop..." button); selects wallpaper if Active Desktop is enabled] {User Configuration|Administrative Templates|Desktop|Active Desktop| Active Desktop Wallpaper|Wallpaper Name:} Active Desktop and Wallpaper: ----------------------------- Active Desktop enabled via Group Policy. Wallpaper selected via Group Policy. Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\ssmyst.scr" [MS] Startup items in "ja" & "All Users" startup folders: ---------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 16 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\atievxx.exe" [MS] Belkin Wireless USB Network Adapter, Belkin Wireless USB Network Adapter Service, "C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe" [null data] ewido security suite control, ewido security suite control, "C:\Program Files\ewido anti-malware\ewidoctrl.exe" ["ewido networks"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 12 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 35 seconds. ---------- (total run time: 103 seconds)

**Posty:** 8694 · przez **Red** 18 Kwi 2006, 13:37

wylacz przywracanie systemu ,wejdz w tryb awaryjny windowsa f8 i usuwasz

prosze otworzyc notatnik windowsa i wklej w nim to co ponizej:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows update loader"=-
"netfilt4"=-
"xp_system"=-
"WindowsUpdate"=-
"Key"=-
"WinMedia"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"System"=-
"netfilt4"=-
"xp_system"=-
"WindowsUpdate"=-
"Microsoft standard protector"=-
"windows"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
"{5321E378-FFAD-4999-8C62-03CA8155F0B3}"=-
"{E89097ED-3400-411D-9647-D368C3311C98}"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"run"=-

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\2006reg]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\3246762198745124975reg]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensSrv]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"ForceActiveDesktopOn"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"Wallpaper"=-

nastepnie w notatniku>>Plik >> Zapisz jako, zapisz jako typ: wszystkie pliki, nazwa pliku: Fix.reg
przechodzi do trybu waryjnego iKlikasz dwa razy na powstały plik i potwierdzasz.

po zastosowaniu fixa dajesz raz jeszcze dwa logi do kontroli

Autor postu otrzymał pochwałę

**Posty:** 3874 · przez **Wojtasgls** 18 Kwi 2006, 13:58

Wyglada na to ze wszystko juz ok ale na wszelki wypadek:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:36:46, on 2006-04-18 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\MMTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\atievxx.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\ja\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inet20001\3.03.00.dll O2 - BHO: IExplorerHelper Class - {E89097ED-3400-411D-9647-D368C3311C98} - C:\WINDOWS\System32\IeHelperExVSSS.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [MMTray] MMTray.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels8.exe O4 - HKLM\..\RunServices: [netfilt4] C:\WINDOWS\System32\netfilt4.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O20 - Winlogon Notify: 2006reg - C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll O20 - Winlogon Notify: 3246762198745124975reg - C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: Performance True Type Font (PerfFont) - Unknown owner - C:\WINDOWS\System32\perfont.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 43, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "MMTray" = "MMTray.exe" ["Morgan Multimedia"] "DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided) \StubPath = ""C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {5321E378-FFAD-4999-8C62-03CA8155F0B3}\(Default) = "HBO Class" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\inet20001\3.03.00.dll" [empty string] {E89097ED-3400-411D-9647-D368C3311C98}\(Default) = "IExplorerHelper Class" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\IeHelperExVSSS.dll" [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! 2006reg\DLLName = "C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll" [null data] INFECTION WARNING! 3246762198745124975reg\DLLName = "C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll" [null data] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\ssmyst.scr" [MS] Startup items in "ja" & "All Users" startup folders: ---------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 16 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\atievxx.exe" [MS] Belkin Wireless USB Network Adapter, Belkin Wireless USB Network Adapter Service, "C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe" [null data] ewido security suite control, ewido security suite control, "C:\Program Files\ewido anti-malware\ewidoctrl.exe" ["ewido networks"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 22 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 30 seconds. ---------- (total run time: 127 seconds)

**Posty:** 1665 · przez **SER** 18 Kwi 2006, 14:04

O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inet20001\3.03.00.dll
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels8.exe
O4 - HKLM\..\RunServices: [netfilt4] C:\WINDOWS\System32\netfilt4.exe
O20 - Winlogon Notify: 2006reg - C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll
O20 - Winlogon Notify: 3246762198745124975reg - C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll

Usuwasz wpisy w trybie awaryjnym z wyłączonym Przywracaniem Systemu, a pogrubione pliki ręcznie

**Posty:** 8694 · przez **Red** 18 Kwi 2006, 14:07

jeszcze nie koniec
wykonaj:

Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop PerfFont

sc delete PerfFont

w hijacku zaznacz i usun:

O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inet20001\3.03.00.dll
O2 - BHO: IExplorerHelper Class - {E89097ED-3400-411D-9647-D368C3311C98} - C:\WINDOWS\System32\IeHelperExVSSS.dll
O23 - Service: Performance True Type Font (PerfFont) - Unknown owner - C:\WINDOWS\System32\perfont.exe (file missing)

recznie usun:

C:\WINDOWS\inet20001

sciagnij killboxa:
http://www.bleepingcomputer.com/files/killbox.php

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę :
C:\WINDOWS\System32\IeHelperExVSSS.dll i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

tak samo usuniesz sciezki:
C:\WINDOWS\System32\kernels8.exe
C:\WINDOWS\System32\netfilt4.exe

po usuwaniu sciagniesz:
http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip

i dasz mu wyszukanie dwoch sciezek:
2006.dll
oraz
3246762198745124975.dll

i wklej te dwa wyniki na forum

**Posty:** 3874 · przez **Wojtasgls** 18 Kwi 2006, 16:07

wszystko pokolei wykonywalem do momentu wklejenie nie umiem :oops:

ale prz 2006.dll jest napisane: Search completed in 37 seconds. No instatances of "2006.dll" found. a przy 3246762198745124975.dll to samo. na wszelki wypadek daje logi bo dalej nie moge wejsc w menedzer zadan:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:46:08, on 2006-04-18 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\MMTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\atievxx.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\ja\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [MMTray] MMTray.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels8.exe O4 - HKLM\..\RunServices: [netfilt4] C:\WINDOWS\System32\netfilt4.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O20 - Winlogon Notify: 2006reg - C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll O20 - Winlogon Notify: 3246762198745124975reg - C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 43, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "MMTray" = "MMTray.exe" ["Morgan Multimedia"] "DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided) \StubPath = ""C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! 2006reg\DLLName = "C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll" [null data] INFECTION WARNING! 3246762198745124975reg\DLLName = "C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll" [null data] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\ssmyst.scr" [MS] Startup items in "ja" & "All Users" startup folders: ---------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 16 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\atievxx.exe" [MS] Belkin Wireless USB Network Adapter, Belkin Wireless USB Network Adapter Service, "C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe" [null data] ewido security suite control, ewido security suite control, "C:\Program Files\ewido anti-malware\ewidoctrl.exe" ["ewido networks"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 15 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 32 seconds. ---------- (total run time: 109 seconds)

**Posty:** 8694 · przez **Red** 18 Kwi 2006, 16:15

C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll
C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll

czy nie mozesz tego usunac recznie w trybie awaryjnym (masz podane sciezki)??

zastosuj jeszcze jeden fix w notatniku:

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"SystemTools"=-
"netfilt4"=-

dodaj fix do rejestru.....

**Posty:** 3874 · przez **Wojtasgls** 18 Kwi 2006, 16:31

nie moge niestety dodac bo wyskakuje ze pliki sa uzywane ani recznie nie moge ani przez killboxa. fixa do rejestru dodalem

**Posty:** 8694 · przez **Red** 18 Kwi 2006, 16:39

Wojtasgls napisał(a):fixa do rejestru dodalem

ok,jesli sie dodal to dobrze,pozniej sprawdzimy

zastosuj:

http://securityresponse.symantec.com/avcenter/FixVundo.exe
oraz to:

http://www.atribune.org/ccount/click.php?id=4

i sprobuj raz jeszcze wyszukac te dll tak jak cie prosilem ,za pomocą:
http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip
wklej najpierw jedna w puste pole,szukaj a nastepnie drugą:

2006.dll

3246762198745124975.dll

zastosuj rowniez skanowanie ewido:
http://www.ewido.net/en/
i wklej to co znalazl rowniez na forum ....

**Posty:** 3874 · przez **Wojtasgls** 18 Kwi 2006, 16:56

wszystkie dzialania do ewido bez efektow nic nie znalazly. Ewido uzywam na codzien ale teraz tez przepuscilem i zaraz wkleje wyniki bo cos juz znalazl

[ Dodano: Dzisiaj o 15:09 ]
oto winik z ewido troche tego jest:(

Kod: Zaznacz wszystko: ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 14:51:30, 2006-04-18 + Report-Checksum: 15E8E593 + Scan result: HKU\S-1-5-21-1606980848-1383384898-1343024091-1003\Software\Microsoft\Internet Explorer\Keywords -> Adware.CoolWebSearch : Cleaned with backup [688] C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll -> Trojan.Agent.oh : Error during cleaning [1012] C:\WINDOWS\System32\wbem\wmiprvi.dll -> Trojan.Mutech.b : Cleaned with backup C:\WINDOWS\SYSTEM\svchost.exe -> Backdoor.Agent.xb : Cleaned with backup C:\WINDOWS\SYSTEM32\wbem\wmiprvi.dll -> Trojan.Mutech.b : Cleaned with backup C:\WINDOWS\SYSTEM32\vxgamet1.exe -> Downloader.Agent.hy : Cleaned with backup C:\WINDOWS\SYSTEM32\vxgamet2.exe -> Downloader.Small.atl : Cleaned with backup C:\WINDOWS\SYSTEM32\maxd64.exe -> Trojan.Dialer.ay : Cleaned with backup C:\WINDOWS\SYSTEM32\vxgamet3.exe -> Proxy.Small.bo : Cleaned with backup C:\WINDOWS\SYSTEM32\vxgame2.exe -> Trojan.Small : Cleaned with backup C:\WINDOWS\SYSTEM32\vxgame3.exe -> Downloader.CWS.s : Cleaned with backup C:\WINDOWS\SYSTEM32\vxgame4.exe -> Trojan.Small : Cleaned with backup C:\WINDOWS\SYSTEM32\senssrv.dll -> Downloader.Agent.afl : Cleaned with backup C:\WINDOWS\SYSTEM32\dlh9jkdq2.exe -> Not-A-Virus.Hoax.Win32.Renos.ch : Cleaned with backup C:\WINDOWS\SYSTEM32\dlh9jkdq5.exe -> Downloader.Small.crm : Cleaned with backup C:\WINDOWS\SYSTEM32\dlh9jkdq6.exe -> Downloader.Tibs.dr : Cleaned with backup C:\WINDOWS\SYSTEM32\dlh9jkdq7.exe -> Downloader.Tibs.dr : Cleaned with backup C:\WINDOWS\SYSTEM32\qvxgamet2.exe -> Downloader.Small.cqe : Cleaned with backup C:\WINDOWS\SYSTEM32\qvxgamet3.exe -> Trojan.Small : Cleaned with backup C:\WINDOWS\SYSTEM32\qvxgamet4.exe -> Trojan.Small : Cleaned with backup C:\WINDOWS\xpupdate.exe -> Not-A-Virus.Hoax.Win32.Renos.ch : Cleaned with backup C:\WINDOWS\TEMP\8F03.tmp -> Not-A-Virus.SpamTool.Win32.Agent.e : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\2.dlb -> Not-A-Virus.Hoax.Win32.Renos.ch : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\5.dlb -> Downloader.Small.crm : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\6.dlb -> Downloader.Tibs.dr : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\7.dlb -> Downloader.Tibs.dr : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\vx2.game -> Trojan.Small : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\vx3.game -> Downloader.CWS.s : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\maxdd.game -> Trojan.Dialer.ay : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\vx4.game -> Trojan.Small : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\vxt3.game -> Proxy.Small.bo : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\vxt4.game -> Hijacker.BHO.d : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\vxt2.game -> Downloader.Small.atl : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\2.tmp -> Downloader.Agent.afl : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\3.tmp -> Trojan.Small : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\4.tmp -> Logger.Small.ak : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\qvxt2.game -> Downloader.Small.cqe : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\qvxt3.game -> Trojan.Small : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\5.tmp -> Downloader.Agent.afl : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\6.tmp -> Trojan.Small : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\7.tmp -> Logger.Small.ak : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\qvxt4.game -> Trojan.Small : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temp\vxt1.game -> Downloader.Agent.hy : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temporary Internet Files\Content.IE5\9OGNPT4D\ym11_[1].exe -> Not-A-Virus.SpamTool.Win32.Agent.e : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temporary Internet Files\Content.IE5\9OGNPT4D\new[1].htm -> Not-A-Virus.Constructor.Perl.Msdds.b : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temporary Internet Files\Content.IE5\9OGNPT4D\xpl[1].wmf -> Exploit.MS05-053-WMF : Cleaned with backup C:\Documents and Settings\ja\Ustawienia lokalne\Temporary Internet Files\Content.IE5\SZV7Q851\xpl[1].wmf -> Exploit.MS05-053-WMF : Cleaned with backup C:\Documents and Settings\ja\Pulpit\backups\backup-20060418-133323-680.dll -> Adware.Ihbo : Cleaned with backup C:\Documents and Settings\ja\Pulpit\backups\backup-20060418-133323-139.dll -> Trojan.Small : Cleaned with backup C:\Documents and Settings\ja\Cookies\ja@gde.adocean[2].txt -> TrackingCookie.Adocean : Cleaned with backup C:\Recycled\Dc8\ACM.dll -> Adware.SaveNow : Cleaned with backup C:\temp\svchost.exe -> Downloader.Small.cqe : Cleaned with backup C:\!KillBox\IeHelperExVSSS.dll -> Trojan.Small : Cleaned with backup C:\!KillBox\netfilt4.exe -> Proxy.Small.bo : Cleaned with backup C:\!KillBox\IeHelperExVSSS.dll ( 1) -> Trojan.Small : Cleaned with backup ::Report End

**Posty:** 8694 · przez **Red** 18 Kwi 2006, 17:27

ewido dal sobie rade ,ale zostawil :

C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll

nie moze sobie z tym poradzic hm.....

zastosuj jeszcze jeden fix:

REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\Notify\3246762198745124975]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\2006]

w notatniku>>Plik >> Zapisz jako, zapisz jako typ: wszystkie pliki, nazwa pliku: Fix.reg
W trybie awaryjnym Klikasz dwa razy na powstały plik i potwierdzasz.

po tym dajesz log z hijack this do kontroli

**Posty:** 3874 · przez **Wojtasgls** 18 Kwi 2006, 17:39

dobra zrobione ale menedzer dalej nie dziala:((((

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:21:50, on 2006-04-18 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\MMTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\atievxx.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\ja\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [MMTray] MMTray.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels8.exe O4 - HKLM\..\RunServices: [netfilt4] C:\WINDOWS\System32\netfilt4.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O20 - Winlogon Notify: 2006reg - C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll O20 - Winlogon Notify: 3246762198745124975reg - C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

**Posty:** 8694 · przez **Red** 18 Kwi 2006, 17:42

czy ty masz wylaczone przywracanie systemu ?????Bo robisz cos zle ,niby fixy sie dodają i musza zadzialac ,a u ciebie wpisy powracają na nowo

albo dajesz mi zle zlogi ,zrobione w zlym momencie

uruchom fixy w trybie normalnym .....

**Posty:** 3874 · przez **Wojtasgls** 18 Kwi 2006, 17:52

przywracanie systemu wylaczone na 100% w zlym momencie niewiem co to znaczy robie na koniec logi. ok dodalem w normalnym trybie teraz i robie resa

**Posty:** 8694 · przez **Red** 18 Kwi 2006, 17:53

i wklej log ponownie ...po dodaniu fixów

**Posty:** 3874 · przez **Wojtasgls** 18 Kwi 2006, 17:56

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:39:07, on 2006-04-18 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\MMTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\atievxx.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\ja\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [MMTray] MMTray.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels8.exe O4 - HKLM\..\RunServices: [netfilt4] C:\WINDOWS\System32\netfilt4.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O20 - Winlogon Notify: 2006reg - C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll O20 - Winlogon Notify: 3246762198745124975reg - C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

**Posty:** 8694 · przez **Red** 18 Kwi 2006, 17:58

siedzi jak siedziało:

O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels8.exe
O4 - HKLM\..\RunServices: [netfilt4] C:\WINDOWS\System32\netfilt4.exe
O20 - Winlogon Notify: 2006reg - C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll
O20 - Winlogon Notify: 3246762198745124975reg - C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll

**Posty:** 3874 · przez **Wojtasgls** 18 Kwi 2006, 18:17

qrr... hmm.. wzielem teraz poscilem w awaryjnym hj. i zfixowalem wchodze w normal i dalej siedzi chodz na 100%%% jestem pewny ze przywracanie wylaczon. Niewiem o co chodzi co radzisz???

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:00:10, on 2006-04-18 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\MMTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\atievxx.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe C:\Documents and Settings\ja\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [MMTray] MMTray.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O20 - Winlogon Notify: 2006reg - C:\Documents and Settings\All Users\Dokumenty\Settings\2006.dll O20 - Winlogon Notify: 3246762198745124975reg - C:\Documents and Settings\All Users\Dokumenty\Settings\3246762198745124975.dll O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

prosze o sprawdzenie loga

prosze o sprawdzenie loga

Kto jest na forum