ratunku ( log)

[wooycik]

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\javanet.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\wordpad.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\cosmo\cosmoWeatherStation.exe
C:\windows\system32\stonedrv.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\svchost32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\ROZRYWKA\Ustawienia lokalne\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CC1B4ECB-F813-F86D-9EDD-B6ED893E4757} - (no file)
R3 - URLSearchHook: (no name) - {CC1B4ECB-F813-F86D-9EDD-B6ED893E4757} - C:\WINDOWS\system32\resnwtmli.exe (file missing)
R3 - URLSearchHook: (no name) - {51FE8CD9-960A-3E15-32D3-30983E14039B} - C:\WINDOWS\system32\resnwtmli.exe (file missing)
R3 - URLSearchHook: (no name) - {874B87A7-BA3C-44DC-DDB5-B6351CAA2721} - C:\WINDOWS\system32\bootiltime.exe (file missing)
F2 - REG:system.ini: Shell=Explorer.exe javanet.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,javanet.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HostSrv] C:\WINDOWS\sachostx.exe
O4 - HKLM\..\Run: [Remote Procedure Call For Windows 32bit.] rpc.exe
O4 - HKLM\..\Run: [msconfig service] MSupdate32.exe
O4 - HKLM\..\Run: [Mcafee Antivirus Monitor] vstatm.exe
O4 - HKLM\..\Run: [cosmoWeatherStation] C:\WINDOWS\System32\cosmo/cosmoWeatherStation.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.5.3.0\WeatherOnTray.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msijavaup32.exe
O4 - HKCU\..\Run: [systemidle] stemIdle.exe
O4 - HKCU\..\Run: [Microsoft Windows Securety] wurguar.exe
O4 - HKCU\..\Run: [9E805BDB] C:\WINDOWS\system32\jlm3dv2.exe
O4 - HKCU\..\Run: [0D9363D6] C:\WINDOWS\system32\tppmandem.exe
O4 - HKCU\..\Run: [EDB8838B] C:\WINDOWS\system32\msickbo.exe
O4 - HKCU\..\Run: [B7E271FE] C:\WINDOWS\system32\comkbdin.exe
O4 - HKCU\..\Run: [993EDA53] C:\WINDOWS\system32\prver.exe
O4 - HKCU\..\Run: [EA20CC8E] C:\WINDOWS\system32\otviusteg.exe
O4 - HKCU\..\Run: [8B2A78F6] C:\WINDOWS\system32\hlptuti.exe
O4 - HKCU\..\Run: [EB8754C6] C:\WINDOWS\system32\z32disvc.exe
O4 - HKCU\..\Run: [A53EF3F3] C:\WINDOWS\system32\ions2.exe
O4 - HKCU\..\Run: [EC66EF03] C:\WINDOWS\system32\z32srock.exe
O4 - HKCU\..\Run: [BFE69E46] C:\WINDOWS\system32\mhsvrt.exe
O4 - HKCU\..\Run: [55390876] C:\WINDOWS\system32\dfrvipstu.exe
O4 - HKCU\..\Run: [A68D2E46] C:\WINDOWS\system32\kssvocs.exe
O4 - HKCU\..\Run: [Euv] C:\WINDOWS\System32\w?nlogon.exe
O4 - HKCU\..\Run: [Arod] "C:\WINDOWS\System32\SSTEM3~1\spoolsv.exe" -vt yazb
O4 - HKCU\..\Run: [50EE7B46] C:\WINDOWS\system32\rprotsd.exe
O4 - HKCU\..\Run: [svchost32] C:\WINDOWS\svchost32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Dino] c:\program files\ScreenMates\dinosm.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O15 - Trusted Zone: http://*.dialerdreams.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.gfoto.com/ImageUploader3.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com/software/4/1.9.21.21/tukati.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70B74E43-969F-45FA-BD49-54C3D95BA9E7}: NameServer = 213.241.79.37 195.114.181.130
O18 - Filter: text/html - (no CLSID) - (no file)
O18 - Filter: text/plain - (no CLSID) - (no file)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe (file missing)
O23 - Service: Microsoft Corporation (Windows Wordpad) - Unknown owner - C:\WINDOWS\wordpad.exe

[Red]

fajny ten log ,ale poczytaj w dziale jakie są zasady dotyczace umieszczania loga

[wooycik]

Oj, sorry zapomnialem napisać czemu go wstawiłem. No więc chodzi o to, że ogólnie co jakieś średnio 20 sekund komputer rozłącza się z internetem. Wyskakuje pełno dziwnych błędów które również uniemożliwiają prace np "Generic host process for win32". Kiedy przeskanowałem go avastem znalazł dużo trojanów ale nic z nimi nie mógł zrobić. Niewiem co mam zrobić. I prosze o pomoc i przepraszam za błąd.

[ Dodano: Dzisiaj o 15:47 ]
Oj, sorry zapomnialem napisać czemu go wstawiłem. No więc chodzi o to, że ogólnie co jakieś średnio 20 sekund komputer rozłącza się z internetem. Wyskakuje pełno dziwnych błędów które również uniemożliwiają prace np "Generic host process for win32". Kiedy przeskanowałem go avastem znalazł dużo trojanów ale nic z nimi nie mógł zrobić. Niewiem co mam zrobić. I prosze o pomoc i przepraszam za błąd.

[Red]

Popraw log w tagi.

[wooycik]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 15:47:46, on 25-08-2006
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\javanet.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wordpad.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\cosmo\cosmoWeatherStation.exe
C:\windows\system32\stonedrv.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\svchost32.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\ROZRYWKA\Ustawienia lokalne\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CC1B4ECB-F813-F86D-9EDD-B6ED893E4757} - (no file)
R3 - URLSearchHook: (no name) - {CC1B4ECB-F813-F86D-9EDD-B6ED893E4757} - C:\WINDOWS\system32\resnwtmli.exe (file missing)
R3 - URLSearchHook: (no name) - {51FE8CD9-960A-3E15-32D3-30983E14039B} - C:\WINDOWS\system32\resnwtmli.exe (file missing)
R3 - URLSearchHook: (no name) - {874B87A7-BA3C-44DC-DDB5-B6351CAA2721} - C:\WINDOWS\system32\bootiltime.exe (file missing)
F2 - REG:system.ini: Shell=Explorer.exe javanet.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,javanet.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HostSrv] C:\WINDOWS\sachostx.exe
O4 - HKLM\..\Run: [Remote Procedure Call For Windows 32bit.] rpc.exe
O4 - HKLM\..\Run: [msconfig service] MSupdate32.exe
O4 - HKLM\..\Run: [Mcafee Antivirus Monitor] vstatm.exe
O4 - HKLM\..\Run: [cosmoWeatherStation] C:\WINDOWS\System32\cosmo/cosmoWeatherStation.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.5.3.0\WeatherOnTray.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msijavaup32.exe
O4 - HKCU\..\Run: [systemidle] stemIdle.exe
O4 - HKCU\..\Run: [Microsoft Windows Securety] wurguar.exe
O4 - HKCU\..\Run: [9E805BDB] C:\WINDOWS\system32\jlm3dv2.exe
O4 - HKCU\..\Run: [0D9363D6] C:\WINDOWS\system32\tppmandem.exe
O4 - HKCU\..\Run: [EDB8838B] C:\WINDOWS\system32\msickbo.exe
O4 - HKCU\..\Run: [B7E271FE] C:\WINDOWS\system32\comkbdin.exe
O4 - HKCU\..\Run: [993EDA53] C:\WINDOWS\system32\prver.exe
O4 - HKCU\..\Run: [EA20CC8E] C:\WINDOWS\system32\otviusteg.exe
O4 - HKCU\..\Run: [8B2A78F6] C:\WINDOWS\system32\hlptuti.exe
O4 - HKCU\..\Run: [EB8754C6] C:\WINDOWS\system32\z32disvc.exe
O4 - HKCU\..\Run: [A53EF3F3] C:\WINDOWS\system32\ions2.exe
O4 - HKCU\..\Run: [EC66EF03] C:\WINDOWS\system32\z32srock.exe
O4 - HKCU\..\Run: [BFE69E46] C:\WINDOWS\system32\mhsvrt.exe
O4 - HKCU\..\Run: [55390876] C:\WINDOWS\system32\dfrvipstu.exe
O4 - HKCU\..\Run: [A68D2E46] C:\WINDOWS\system32\kssvocs.exe
O4 - HKCU\..\Run: [Euv] C:\WINDOWS\System32\w?nlogon.exe
O4 - HKCU\..\Run: [Arod] "C:\WINDOWS\System32\SSTEM3~1\spoolsv.exe" -vt yazb
O4 - HKCU\..\Run: [50EE7B46] C:\WINDOWS\system32\rprotsd.exe
O4 - HKCU\..\Run: [svchost32] C:\WINDOWS\svchost32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Dino] c:\program files\ScreenMates\dinosm.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O15 - Trusted Zone: http://*.dialerdreams.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.gfoto.com/ImageUploader3.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com/software/4/1.9.21.21/tukati.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70B74E43-969F-45FA-BD49-54C3D95BA9E7}: NameServer = 213.241.79.37 195.114.181.130
O18 - Filter: text/html - (no CLSID) - (no file)
O18 - Filter: text/plain - (no CLSID) - (no file)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe (file missing)
O23 - Service: Microsoft Corporation (Windows Wordpad) - Unknown owner - C:\WINDOWS\wordpad.exe



[ Dodano: Dzisiaj o 16:00 ]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 15:47:46, on 25-08-2006
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\javanet.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wordpad.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\cosmo\cosmoWeatherStation.exe
C:\windows\system32\stonedrv.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\svchost32.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\ROZRYWKA\Ustawienia lokalne\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CC1B4ECB-F813-F86D-9EDD-B6ED893E4757} - (no file)
R3 - URLSearchHook: (no name) - {CC1B4ECB-F813-F86D-9EDD-B6ED893E4757} - C:\WINDOWS\system32\resnwtmli.exe (file missing)
R3 - URLSearchHook: (no name) - {51FE8CD9-960A-3E15-32D3-30983E14039B} - C:\WINDOWS\system32\resnwtmli.exe (file missing)
R3 - URLSearchHook: (no name) - {874B87A7-BA3C-44DC-DDB5-B6351CAA2721} - C:\WINDOWS\system32\bootiltime.exe (file missing)
F2 - REG:system.ini: Shell=Explorer.exe javanet.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,javanet.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HostSrv] C:\WINDOWS\sachostx.exe
O4 - HKLM\..\Run: [Remote Procedure Call For Windows 32bit.] rpc.exe
O4 - HKLM\..\Run: [msconfig service] MSupdate32.exe
O4 - HKLM\..\Run: [Mcafee Antivirus Monitor] vstatm.exe
O4 - HKLM\..\Run: [cosmoWeatherStation] C:\WINDOWS\System32\cosmo/cosmoWeatherStation.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.5.3.0\WeatherOnTray.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msijavaup32.exe
O4 - HKCU\..\Run: [systemidle] stemIdle.exe
O4 - HKCU\..\Run: [Microsoft Windows Securety] wurguar.exe
O4 - HKCU\..\Run: [9E805BDB] C:\WINDOWS\system32\jlm3dv2.exe
O4 - HKCU\..\Run: [0D9363D6] C:\WINDOWS\system32\tppmandem.exe
O4 - HKCU\..\Run: [EDB8838B] C:\WINDOWS\system32\msickbo.exe
O4 - HKCU\..\Run: [B7E271FE] C:\WINDOWS\system32\comkbdin.exe
O4 - HKCU\..\Run: [993EDA53] C:\WINDOWS\system32\prver.exe
O4 - HKCU\..\Run: [EA20CC8E] C:\WINDOWS\system32\otviusteg.exe
O4 - HKCU\..\Run: [8B2A78F6] C:\WINDOWS\system32\hlptuti.exe
O4 - HKCU\..\Run: [EB8754C6] C:\WINDOWS\system32\z32disvc.exe
O4 - HKCU\..\Run: [A53EF3F3] C:\WINDOWS\system32\ions2.exe
O4 - HKCU\..\Run: [EC66EF03] C:\WINDOWS\system32\z32srock.exe
O4 - HKCU\..\Run: [BFE69E46] C:\WINDOWS\system32\mhsvrt.exe
O4 - HKCU\..\Run: [55390876] C:\WINDOWS\system32\dfrvipstu.exe
O4 - HKCU\..\Run: [A68D2E46] C:\WINDOWS\system32\kssvocs.exe
O4 - HKCU\..\Run: [Euv] C:\WINDOWS\System32\w?nlogon.exe
O4 - HKCU\..\Run: [Arod] "C:\WINDOWS\System32\SSTEM3~1\spoolsv.exe" -vt yazb
O4 - HKCU\..\Run: [50EE7B46] C:\WINDOWS\system32\rprotsd.exe
O4 - HKCU\..\Run: [svchost32] C:\WINDOWS\svchost32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Dino] c:\program files\ScreenMates\dinosm.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O15 - Trusted Zone: http://*.dialerdreams.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.gfoto.com/ImageUploader3.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com/software/4/1.9.21.21/tukati.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70B74E43-969F-45FA-BD49-54C3D95BA9E7}: NameServer = 213.241.79.37 195.114.181.130
O18 - Filter: text/html - (no CLSID) - (no file)
O18 - Filter: text/plain - (no CLSID) - (no file)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe (file missing)
O23 - Service: Microsoft Corporation (Windows Wordpad) - Unknown owner - C:\WINDOWS\wordpad.exe



[Red]

usuwasz z wylaczonym przywracaniem systemu w xp i w trybie awaryjnym f8

C:\WINDOWS\System32\javanet.exe
C:\WINDOWS\System32\cosmo\cosmoWeatherStation.exe
C:\windows\system32\stonedrv.exe
C:\WINDOWS\svchost32.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CC1B4ECB-F813-F86D-9EDD-B6ED893E4757} - (no file)
R3 - URLSearchHook: (no name) - {CC1B4ECB-F813-F86D-9EDD-B6ED893E4757} - C:\WINDOWS\system32\resnwtmli.exe (file missing)
R3 - URLSearchHook: (no name) - {51FE8CD9-960A-3E15-32D3-30983E14039B} - C:\WINDOWS\system32\resnwtmli.exe (file missing)
R3 - URLSearchHook: (no name) - {874B87A7-BA3C-44DC-DDB5-B6351CAA2721} - C:\WINDOWS\system32\bootiltime.exe (file missing)
F2 - REG:system.ini: Shell=Explorer.exe javanet.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,javanet.exe
O4 - HKLM\..\Run: [HostSrv] C:\WINDOWS\sachostx.exe
O4 - HKLM\..\Run: [Remote Procedure Call For Windows 32bit.] rpc.exe
O4 - HKLM\..\Run: [msconfig service] MSupdate32.exe
O4 - HKLM\..\Run: [Mcafee Antivirus Monitor] vstatm.exe
O4 - HKLM\..\Run: [cosmoWeatherStation] C:\WINDOWS\System32\cosmo/cosmoWeatherStation.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msijavaup32.exe
O4 - HKCU\..\Run: [systemidle] stemIdle.exe
O4 - HKCU\..\Run: [Microsoft Windows Securety] wurguar.exe
O4 - HKCU\..\Run: [9E805BDB] C:\WINDOWS\system32\jlm3dv2.exe
O4 - HKCU\..\Run: [0D9363D6] C:\WINDOWS\system32\tppmandem.exe
O4 - HKCU\..\Run: [EDB8838B] C:\WINDOWS\system32\msickbo.exe
O4 - HKCU\..\Run: [B7E271FE] C:\WINDOWS\system32\comkbdin.exe
O4 - HKCU\..\Run: [993EDA53] C:\WINDOWS\system32\prver.exe
O4 - HKCU\..\Run: [EA20CC8E] C:\WINDOWS\system32\otviusteg.exe
O4 - HKCU\..\Run: [8B2A78F6] C:\WINDOWS\system32\hlptuti.exe
i reszte tez ,tylko ze juz nie pogrubiałem uffff
O4 - HKCU\..\Run: [EB8754C6] C:\WINDOWS\system32\z32disvc.exe
O4 - HKCU\..\Run: [A53EF3F3] C:\WINDOWS\system32\ions2.exe
O4 - HKCU\..\Run: [EC66EF03] C:\WINDOWS\system32\z32srock.exe
O4 - HKCU\..\Run: [BFE69E46] C:\WINDOWS\system32\mhsvrt.exe
O4 - HKCU\..\Run: [55390876] C:\WINDOWS\system32\dfrvipstu.exe
O4 - HKCU\..\Run: [A68D2E46] C:\WINDOWS\system32\kssvocs.exe
O4 - HKCU\..\Run: [Euv] C:\WINDOWS\System32\w?nlogon.exe
O4 - HKCU\..\Run: [Arod] "C:\WINDOWS\System32\SSTEM3~1\spoolsv.exe" -vt yazb
O4 - HKCU\..\Run: [50EE7B46] C:\WINDOWS\system32\rprotsd.exe
O4 - HKCU\..\Run: [svchost32] C:\WINDOWS\svchost32.exe
O4 - HKCU\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O15 - Trusted Zone: http://*.dialerdreams.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O18 - Filter: text/html - (no CLSID) - (no file)
O18 - Filter: text/plain - (no CLSID) - (no file)

zaznaczasz wpisy w hijacku i naciskasz fix ,a to co pogrubiłem (nie dałem rady do konca,wyzej widzisz) usuwasz recznie z dysku i po restarcie dajesz log do kontroli raz jeszcxze.


ps
wojtas przeciez on opisał problem

[wooycik]

Jak próbuje wejść w folder "System32" to mi sie automatycznie komputer restartuje. Usunąłem procesy w hijacku ale ręcznie nie da rady.

[Red]

Przeskanuj kompa >>>
http://www.ewido.net/en/download/
usun wszystko co znajdzie i wtedy moze dasz rade wejść.

[wooycik]

próbowalem przeskanowac ale znowu sie resetowal a teraz nie moge nawet włączyc ani przeinstalowac tego programu. Udało mi sie wejsc w system32 ale tam nie ma prawie zadnego z plików które mam usunąć.

[jeff]

wooycik

daj nowy log

[wooycik]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 14:05:14, on 26-08-2006
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\jconsole.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\system32\cscript.exe
C:\Documents and Settings\ROZRYWKA\Pulpit\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe jconsole.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,jconsole.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

[jeff]

log urwany

[wooycik]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 14:10:59, on 26-08-2006
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\jconsole.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\System32\msijavaup32.exe
C:\Documents and Settings\ROZRYWKA\Pulpit\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe msijavaup32.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,msijavaup32.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.5.3.0\WeatherOnTray.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKLM\..\RunServices: [Windows Kernel System Service] wkssvr.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msijavaup32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Dino] c:\program files\ScreenMates\dinosm.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O15 - Trusted IP range: 213.159.117.202
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.gfoto.com/ImageUploader3.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com/software/4/1.9.21.21/tukati.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70B74E43-969F-45FA-BD49-54C3D95BA9E7}: NameServer = 213.241.79.37 195.114.181.130
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe (file missing)

[jeff]

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,msijavaup32.exe
O4 - HKLM\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKLM\..\RunServices: [Windows Kernel System Service] wkssvr.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msijavaup32.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.5.3.0\WeatherOnTray.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O15 - Trusted IP range: 213.159.117.202

pogrubione pliki/ foldery wywalasz recznie

[wooycik]

Niewiem jak usunąć te pliki ręcznie a "O15 - Trusted IP range: 213.159.117.202" za każdym razem powraca do loga

[jeff]

Niewiem jak usunąć te pliki ręcznie

skasujesz wpisy w Hijacku to bez robienia reseta kompa dajesz prawym myszy na plik/folder i usuń

a "O15 - Trusted IP range: 213.159.117.202" za każdym razem powraca do loga

użyj kill trusted

http://www.searchengines.pl/phpbb203/index.php?showtopic=26221&st=0&p=121907?entry121907

[wooycik]

wiem jak sie usuwa pliki tylko że ich nigdzie niema, nawet jak wyszukuje niczego nie znajduje.

[jeff]

nawet jak wyszukuje niczego nie znajduje.

a masz zaznaczoną opcję pokazywania ukrytych plików/folderów ?

[wooycik]

a gdzie to sie włącza??

[jeff]

Mój komputer >> narzędzia>>opcje folderow>>widok>>pokaz ukryte pliki i foldery