win32:trojan-gen.- potrzebny program do jego usuniecia

**Posty:** 77 · przez **WLOCHACZ** 19 Sty 2006, 11:25

Witam... potrzebowal bym jakiegos programu, moze sposobu zeby usunac tego trojana, wirusa, Win32:Trojan-gen... moj antivir sobie z nim nie radzi... przydala by sie jeszcze jakas dobra, wypropowana zapora ogniowa zeby uniknac takich problemow na przyszlosc... ale najbardziej zalezalo nby mi na programie ktory by mi takie problemy usowal... z gory dzieki za odpowiedz... Pozdro

**Posty:** 4043 · przez **prog** 19 Sty 2006, 11:30

wrzuc loga z hijackthis

http://forum.programosy.pl/hijackthis-gtobsuga-i-umieszczanie-loga-vt9452.html

pamietaj o TAGach

**Posty:** 77 · przez **WLOCHACZ** 19 Sty 2006, 12:41

Nie potrafie go w zaden sposub usunac...

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 10:33:58, on 2006-01-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ntlv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\taskbaricon.exe C:\WINDOWS\mssc32.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\eMule\emule.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Corel\Graphics9\Register\Remind32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Opera\Opera.exe C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\Rar$EX00.126\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Class - {2940FBDF-1F31-B348-ECE6-49CB795A24D6} - C:\WINDOWS\system32\addnc32.dll O2 - BHO: Class - {E1E8BF5D-DA2C-2AEB-9D92-079002785FD0} - C:\WINDOWS\system32\msyv.dll O2 - BHO: Class - {F53A477A-7B1C-2657-7904-F2611BC95C35} - C:\WINDOWS\apiye.dll O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\taskbaricon.exe O4 - HKLM\..\Run: [d3ez.exe] C:\WINDOWS\d3ez.exe O4 - HKLM\..\Run: [292.tmp] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\292.tmp.exe O4 - HKLM\..\Run: [293.tmp] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\293.tmp.exe O4 - HKLM\..\Run: [292.tmp.exe] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\292.tmp.exe O4 - HKLM\..\Run: [293.tmp.exe] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\293.tmp.exe O4 - HKLM\..\Run: [winaj.exe] C:\WINDOWS\winaj.exe O4 - HKLM\..\Run: [atlfy.exe] C:\WINDOWS\atlfy.exe O4 - HKLM\..\Run: [sdkli32.exe] C:\WINDOWS\system32\sdkli32.exe O4 - HKLM\..\Run: [mfcdf32.exe] C:\WINDOWS\mfcdf32.exe O4 - HKLM\..\Run: [d3ss.exe] C:\WINDOWS\d3ss.exe O4 - HKLM\..\Run: [msom32.exe] C:\WINDOWS\system32\msom32.exe O4 - HKLM\..\Run: [msvy.exe] C:\WINDOWS\system32\msvy.exe O4 - HKLM\..\Run: [ntya32.exe] C:\WINDOWS\system32\ntya32.exe O4 - HKLM\..\Run: [atlus32.exe] C:\WINDOWS\system32\atlus32.exe O4 - HKLM\..\Run: [apiyd.exe] C:\WINDOWS\apiyd.exe O4 - HKLM\..\Run: [mssc32.exe] C:\WINDOWS\mssc32.exe O4 - HKLM\..\Run: [appzf32.exe] C:\WINDOWS\appzf32.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [supervisor.exe] C:\WINDOWS\supervisor.exe O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - Startup: Rejestrowanie produktów Corela.lnk = C:\Program Files\Corel\Graphics9\Register\Remind32.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136872033154 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0_03) - O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) - O17 - HKLM\System\CCS\Services\Tcpip\..\{41901276-2F71-46C7-AA06-0938EA6D63E8}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: Workstation NetLogon Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\ntlv.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

**Posty:** 5151 · przez **JarekMk** 19 Sty 2006, 12:52

Ubijasz:

C:\WINDOWS\ntlv.exe
C:\WINDOWS\mssc32.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {2940FBDF-1F31-B348-ECE6-49CB795A24D6} - C:\WINDOWS\system32\addnc32.dll
O2 - BHO: Class - {E1E8BF5D-DA2C-2AEB-9D92-079002785FD0} - C:\WINDOWS\system32\msyv.dll
O2 - BHO: Class - {F53A477A-7B1C-2657-7904-F2611BC95C35} - C:\WINDOWS\apiye.dll
O4 - HKLM\..\Run: [d3ez.exe] C:\WINDOWS\d3ez.exe
O4 - HKLM\..\Run: [292.tmp] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\292.tmp.exe
O4 - HKLM\..\Run: [293.tmp] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\293.tmp.exe
O4 - HKLM\..\Run: [292.tmp.exe] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\292.tmp.exe
O4 - HKLM\..\Run: [293.tmp.exe] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\293.tmp.exe
O4 - HKLM\..\Run: [winaj.exe] C:\WINDOWS\winaj.exe
O4 - HKLM\..\Run: [atlfy.exe] C:\WINDOWS\atlfy.exe
O4 - HKLM\..\Run: [sdkli32.exe] C:\WINDOWS\system32\sdkli32.exe
O4 - HKLM\..\Run: [mfcdf32.exe] C:\WINDOWS\mfcdf32.exe
O4 - HKLM\..\Run: [d3ss.exe] C:\WINDOWS\d3ss.exe
O4 - HKLM\..\Run: [msom32.exe] C:\WINDOWS\system32\msom32.exe
O4 - HKLM\..\Run: [msvy.exe] C:\WINDOWS\system32\msvy.exe
O4 - HKLM\..\Run: [ntya32.exe] C:\WINDOWS\system32\ntya32.exe
O4 - HKLM\..\Run: [atlus32.exe] C:\WINDOWS\system32\atlus32.exe
O4 - HKLM\..\Run: [apiyd.exe] C:\WINDOWS\apiyd.exe
O4 - HKLM\..\Run: [mssc32.exe] C:\WINDOWS\mssc32.exe
O4 - HKLM\..\Run: [appzf32.exe] C:\WINDOWS\appzf32.exe
O4 - HKCU\..\Run: [supervisor.exe] C:\WINDOWS\supervisor.exe
O23 - Service: Workstation NetLogon Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\ntlv.exe

Wsio w trybie awaryjnym bez przywracania systemu. Najpierw kasujesz wpisy w programie a dopiero wytluszczone pliki recznie.

Teraz Start ---> Uruchom i wpisz %temp% kasujesz wszystko z tad.

przez **Tom@szek** 19 Sty 2006, 12:58

Przeczyść katalog:
C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\*.*

Start do trybu awaryjnego po wyłączeniu przywracania systemu.
Najpierw usuwasz wpisy podane w hijackthis, później pogrubione pliki ręcznie z dysku.

C:\WINDOWS\ntlv.exe

C:\WINDOWS\mssc32.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tiepq.dll/sp.html#17702%resultposition.net

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {2940FBDF-1F31-B348-ECE6-49CB795A24D6} - C:\WINDOWS\system32\addnc32.dll

O2 - BHO: Class - {E1E8BF5D-DA2C-2AEB-9D92-079002785FD0} - C:\WINDOWS\system32\msyv.dll

O2 - BHO: Class - {F53A477A-7B1C-2657-7904-F2611BC95C35} - C:\WINDOWS\apiye.dll

O4 - HKLM\..\Run: [d3ez.exe] C:\WINDOWS\d3ez.exe

O4 - HKLM\..\Run: [292.tmp]
C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\292.tmp.exe

O4 - HKLM\..\Run: [293.tmp] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\293.tmp.exe

O4 - HKLM\..\Run: [292.tmp.exe] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\292.tmp.exe

O4 - HKLM\..\Run: [293.tmp.exe] C:\DOCUME~1\STODOŁ~1\USTAWI~1\Temp\293.tmp.exe

O4 - HKLM\..\Run: [winaj.exe] C:\WINDOWS\winaj.exe
O4 - HKLM\..\Run: [atlfy.exe] C:\WINDOWS\atlfy.exe
O4 - HKLM\..\Run: [sdkli32.exe] C:\WINDOWS\system32\sdkli32.exe

O4 - HKLM\..\Run: [mfcdf32.exe] C:\WINDOWS\mfcdf32.exe

O4 - HKLM\..\Run: [d3ss.exe] C:\WINDOWS\d3ss.exe

O4 - HKLM\..\Run: [msom32.exe] C:\WINDOWS\system32\msom32.exe

O4 - HKLM\..\Run: [msvy.exe] C:\WINDOWS\system32\msvy.exe

O4 - HKLM\..\Run: [ntya32.exe]
C:\WINDOWS\system32\ntya32.exe

O4 - HKLM\..\Run: [atlus32.exe] C:\WINDOWS\system32\atlus32.exe

O4 - HKLM\..\Run: [apiyd.exe] C:\WINDOWS\apiyd.exe

O4 - HKLM\..\Run: [mssc32.exe] C:\WINDOWS\mssc32.exe

O4 - HKLM\..\Run: [appzf32.exe] C:\WINDOWS\appzf32.exe

O4 - HKCU\..\Run: [supervisor.exe] C:\WINDOWS\supervisor.exe

O23 - Service: Workstation NetLogon Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\ntlv.exe

**Posty:** 77 · przez **WLOCHACZ** 19 Sty 2006, 17:28

Dalej to samo przy wlanczaniu internet explorera antivir wykrywa dajej tego trojana... a takze od czasu do czasu pojawia mi sie w obszaze powiadomien czerwona tarcza przy ktorej pisze Your computer might be at risk i po kliknieciu na tarcze wlancza sie okno z odplatnymi Spyware...
to nie wplywa na prace komputera ale denerwuje mnie to da sie jakos tego wszystkiego pozbyc... zrobilem wedlug instrukcji i dalej to samo...

**Posty:** 8694 · przez **Red** 19 Sty 2006, 17:29

WLOCHACZ napisał(a):zrobilem wedlug instrukcji i dalej to samo...

wiec dajesz log do ponowniej kontroli...

**Posty:** 77 · przez **WLOCHACZ** 19 Sty 2006, 17:42

Logfile of HijackThis v1.99.1
Scan saved at 15:37:09, on 2006-01-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\neton32.exe
C:\WINDOWS\system32\apimd32.exe
C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\eMule\emule.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\STODOŁKOWIE\Moje dokumenty\stodolka@neostrada.pl\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\tajlb.dll/sp.html#37049%resultposition.net
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {F97F2532-4324-0DA9-21C3-64C1650A6515} - C:\WINDOWS\system32\atlps.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [apimd32.exe] C:\WINDOWS\system32\apimd32.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
O4 - HKLM\..\RunOnce: [neton32.exe] C:\WINDOWS\system32\neton32.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{41901276-2F71-46C7-AA06-0938EA6D63E8}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: Workstation NetLogon Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\ntlv.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

**Posty:** 8694 · przez **Red** 19 Sty 2006, 18:06

DALEJ SIEDZA SMIECI:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\tajlb.dll/sp.html#17702%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\tajlb.dll/sp.html#37049%resultposition.net
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {F97F2532-4324-0DA9-21C3-64C1650A6515} - C:\WINDOWS\system32\atlps.dll
O4 - HKLM\..\Run: [apimd32.exe] C:\WINDOWS\system32\apimd32.exe
O4 - HKLM\..\RunOnce: [neton32.exe] C:\WINDOWS\system32\neton32.exe
O23 - Service: Workstation NetLogon Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\ntlv.exe (file missing)

sposob usuwania:

wylacz przywracanie systemu ,wejdz w tryb awaryjny windowsa f8 i usuwasz

uzyj koniecznie tego programu
http://www.idg.pl/ftp/pc_3671/CWShredder%201.58.html

wpisy ktore wymienilem usuwasz hijackiem ,pogrubione recznie z dysku

i dajesz log kntrolnie

**Posty:** 77 · przez **WLOCHACZ** 19 Sty 2006, 19:24

Dzieki sliczne trojan znikl tarcza sie jak narazie nie pojawia... chyba zaczajilem o co chodzi z tymi wpisami...

[ Dodano: Dzisiaj o 18:26 ]
Log po mojich operacjach teraz chyba dobry co nie ?

[

Logfile of HijackThis v1.99.1
Scan saved at 17:23:03, on 2006-01-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\g\gg.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\STODOŁKOWIE\Moje dokumenty\stodolka@neostrada.pl\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\g\gg.exe" /tray
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{41901276-2F71-46C7-AA06-0938EA6D63E8}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: Workstation NetLogon Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\ntlv.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe]

**Posty:** 8694 · przez **Red** 19 Sty 2006, 19:42

bardzo dobrze

pozostaje jeszcze :

O23 - Service: Workstation NetLogon Service ( 11Fßä#·şÄÖ`I) - Unknown owner - C:\WINDOWS\ntlv.exe (file missing)

wejdz>>> Start > Uruchom >wpisz>> services.msc >>> zatrzymaj i wyłącz
ten proces>>> Workstation NetLogon Service(wlasciwosci>>tryb uruchamiania>>wylaczony)

Otwierasz HijackThis >>>open the Misc Tools >>> Delete NT Service >>> wklepujesz(kopiujesz)>11Fßä#·şÄÖ`I >>> zatwierdzasz. Potem ten wpis usuwasz hijackiem

I po sprawie

**Posty:** 77 · przez **WLOCHACZ** 19 Sty 2006, 20:33

dzieki sliczne... a moglbys mi napisac jakiej scian ogniowej najlepiej uzyc...tylko zeby byla darmowa... pozdro juz cie nie mecze

**Posty:** 8694 · przez **Red** 19 Sty 2006, 20:35

WLOCHACZ napisał(a):jakiej scian ogniowej najlepiej uzyc.

WLOCHACZ napisał(a):tylko zeby byla darmowa

kerio ..... i juz nie ciagniemy tego tematu co lepsze a co gorsze

win32:trojan-gen.- potrzebny program do jego usuniecia

Win32:Trojan-gen.- potrzebny program do jego usuniecia

Logo

Kto jest na forum