z win xp

**Posty:** 24 · przez **simon_centrum** 13 Lut 2006, 10:44

mam problem z win xp. przy starcie długo odpala sie strona zpraszamy, a potem wyskakuje komunikat- c/program files/common files/microsoft shared/web folders/ibm 00001.exe nie może odnależć pliku. proszę o pomoc :cry:

przez **Tom@szek** 13 Lut 2006, 10:45

Przeczytaj uważnie jak wklejać log i zamieść go w tym temacie
http://forum.programosy.pl/hijackthis-gtobsuga-i-umieszczanie-loga-vt9452.html

**Posty:** 3 · przez **KaiserX** 13 Lut 2006, 11:27

hmm moim zdaniem zrob system odnowa

jesli to spam to prosze usunac

Autor postu otrzymał pochwałę

**Posty:** 24 · przez **simon_centrum** 13 Lut 2006, 11:49

proszę o sprawLogfile of HijackThis v1.99.1
Scan saved at 09:42:38, on 2006-02-13
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
D:\Programy_1\Avast!\aswUpdSv.exe
D:\Programy_1\Avast!\ashServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\qttask.exe
D:\PROGRA~1\Avast!\ashDisp.exe
C:\WINDOWS\system32\svchost.exe
D:\Programy_1\Avast!\ashMaiSv.exe
D:\Programy_1\Avast!\ashWebSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Programy\WinRar 3.5\WinRAR.exe
C:\DOCUME~1\Simon\USTAWI~1\Temp\Rar$EX00.766\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\SpyBot\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [THGuard] "D:\Programy\Trojan Hunter\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\Avast!\ashDisp.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Programy\Office 2000\Office\OSA9.EXE
O8 - Extra context menu item: Pobierz używając Download &Express'a - D:\Programy\Download\Download Express\Add_Url.htm
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E509734B-0A60-42A4-9A2A-9703ED18B5A8}: NameServer = 195.114.161.55 195.114.181.130
O20 - Winlogon Notify: msctl32.dll - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Programy_1\Avast!\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Programy_1\Avast!\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Programy_1\Avast!\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Programy_1\Avast!\ashWebSv.exe" /service (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Programy\TuneUp 2006\WinStylerThemeSvc.exe

dzenie

przez **jeff** 13 Lut 2006, 11:56

Tom@szek podał Ci linka - zobacz jak sie obejmuje log - tagami , inaczej zsyp

**Posty:** 24 · przez **simon_centrum** 13 Lut 2006, 12:05

[code

]Logfile of HijackThis v1.99.1
Scan saved at 09:42:38, on 2006-02-13
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
D:\Programy_1\Avast!\aswUpdSv.exe
D:\Programy_1\Avast!\ashServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\qttask.exe
D:\PROGRA~1\Avast!\ashDisp.exe
C:\WINDOWS\system32\svchost.exe
D:\Programy_1\Avast!\ashMaiSv.exe
D:\Programy_1\Avast!\ashWebSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Programy\WinRar 3.5\WinRAR.exe
C:\DOCUME~1\Simon\USTAWI~1\Temp\Rar$EX00.766\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\SpyBot\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [THGuard] "D:\Programy\Trojan Hunter\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\Avast!\ashDisp.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Programy\Office 2000\Office\OSA9.EXE
O8 - Extra context menu item: Pobierz używając Download &Express'a - D:\Programy\Download\Download Express\Add_Url.htm
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E509734B-0A60-42A4-9A2A-9703ED18B5A8}: NameServer = 195.114.161.55 195.114.181.130
O20 - Winlogon Notify: msctl32.dll - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Programy_1\Avast!\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Programy_1\Avast!\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Programy_1\Avast!\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Programy_1\Avast!\ashWebSv.exe" /service (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Programy\TuneUp 2006\WinStylerThemeSvc.exe

przez **jeff** 13 Lut 2006, 12:09

wszystkie czynności wykonujesz w trybie awaryjnym z wyłączonym przywracaniem systemu

F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
O20 - Winlogon Notify: msctl32.dll - C:\WINDOWS\

najpierw kasujesz wpisy w Hijacku, potem ręcznie pogrubione pliki

**Posty:** 24 · przez **simon_centrum** 13 Lut 2006, 12:09

[quote]StartupList report, 2006-02-13, 09:54:42
StartupList version: 1.52.2
Started from : C:\DOCUME~1\Simon\USTAWI~1\Temp\Rar$EX00.656\HijackThis.EXE
Detected: Windows XP Dodatek SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
D:\Programy_1\Avast!\aswUpdSv.exe
D:\Programy_1\Avast!\ashServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\qttask.exe
D:\PROGRA~1\Avast!\ashDisp.exe
C:\WINDOWS\system32\svchost.exe
D:\Programy_1\Avast!\ashMaiSv.exe
D:\Programy_1\Avast!\ashWebSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\Simon\USTAWI~1\Temp\Rar$EX00.656\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Menu Start\Programy\Autostart]
Microsoft Office.lnk = D:\Programy\Office 2000\Office\OSA9.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ATIPTA = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
SoundMan = SOUNDMAN.EXE
NeroCheck = C:\WINDOWS\system32\NeroCheck.exe
QuickTime Task = "C:\WINDOWS\system32\qttask.exe" -atboottime
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
THGuard = "D:\Programy\Trojan Hunter\TrojanHunter 4.2\THGuard.exe"
Resume copy = copyfstq.exe /startup
avast! = D:\PROGRA~1\Avast!\ashDisp.exe

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - D:\Programy\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - D:\Programy\SpyBot\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}

--------------------------------------------------

Enumerating Task Scheduler jobs:

1-Click Maintenance.job
FRU Task #Hewlett-Packard#hp psc 1200 series#1136623564.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx
CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[MainControl Class]
CODEBASE = http://www.mks.com.pl/skaner/SkanerOnline.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll

--------------------------------------------------
End of report, 4 717 bytes
Report generated in 0,031 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

**Posty:** 24 · przez **simon_centrum** 13 Lut 2006, 12:10

możesz coś jaśniej jestem zielony :oops:

przez **jeff** 13 Lut 2006, 12:13

simon_centrum

nie wklejaj log ze startlisty tylko normalnie - do a system scan and save a logfile

pamietaj o tagach !!! Zrób co podałem wyzej

Wyłącz przywracanie systemu:

Mój komputer -> Właściwości-> Przywracanie systemu -> Wyłącz przywracanie systemu na wszystkich dyskach i zaptaszczasz wszystko

Reset budy - wchodzisz w tryb awaryjny

F8 przy startowaniu trzymasz i z menu wybierasz tryb awaryjny

odpalasz hijacka - robisz scan - zaznaczasz te wpisy co podałem - klikasz na FIX Checked a potem pogrubione pliki kasujesz recznie z dysku - po zabiegach nowy log

**Posty:** 24 · przez **simon_centrum** 13 Lut 2006, 12:36

po kłopocie!DZIĘki :banan:

z win xp

z win xp

Kto jest na forum