Oto log z hijack:
- Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1
Scan saved at 14:51:28, on 2006-03-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\Program Files\Microsoft SQL Server\MSSQL$INSERTGT\Binn\sqlservr.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\RunDll32.exe
E:\WINDOWS\System32\keyhook.exe
E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Messenger\msmsgs.exe
C:\winstall.exe
E:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
E:\Program Files\OpenOffice.org1.1.0\program\soffice.exe
E:\Documents and Settings\MAD-POL\Moje dokumenty\KillBox\KillBox.exe
E:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SpySheriff\SpySheriff.exe
E:\Documents and Settings\MAD-POL\Moje dokumenty\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [SiSUSBRG] E:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SiS Windows KeyHook] E:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [auto__hloader__key] E:\WINDOWS\system32\hloader_exe.exe
O4 - HKLM\..\Run: [auto__antiav__key] E:\WINDOWS\system32\antiav_exe.exe
O4 - HKLM\..\Run: [MKS_MENU] E:\Program Files\MKS\Bin\mks_menu.exe
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [auto__hloader__key] E:\WINDOWS\system32\hloader_exe.exe
O4 - HKCU\..\Run: [auto__antiav__key] E:\WINDOWS\system32\antiav_exe.exe
O4 - HKCU\..\Run: [updateMgr] E:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - Startup: OpenOffice.org 1.1.0.lnk = E:\Program Files\OpenOffice.org1.1.0\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Service Manager.lnk = E:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Pobierz używając Download &Express'a - E:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://skaner.mks.com.pl
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098893931114
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_37.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - E:\Program Files\Wirtualna Polska\wpkontakt\url_wpmsg.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Prosiłbym o pomoc bo jak tata się dowie to mnie za jaj.. nie wazne za co powiesi.
PS. Mam również pewien problem. Gdy chce uruchomić Panel Sterowania komputer totalnie się zawiesza i jest kapliczka, w żaden sposób nie moge uruchomić tego panelu! Nie wiem co jest powodem myślę że to chyba źle przeprowadzona aktualizacja systemu ale to tylko domysły. Może będziecie coś na ten temat wiedzieć i pomożecie. Tak jak już mówiłem l2mfix nie działa nie wiedzieć czemu.
Oto report.txt z l2mfix który wyskakuje po jakiejś sekundzie a w oknie cmd pokazuje się że "nie można odnaleźć pliku" , czyli działa ale nie tak jak powinien.
- Kod: Zaznacz wszystko
L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
**********************************************************************************
useragent:
**********************************************************************************
Shell Extension key:
**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:
E:\WINDOWS\SYSTEM32\
gdi32.dll Thu 2005-12-29 3:56:06 A.... 280 064 273,50 K
webclnt.dll Wed 2006-01-04 4:36:30 A.... 68 096 66,50 K
2 items found: 2 files, 0 directories.
Total of file sizes: 348 160 bytes 340,00 K
Locate .tmp files:
No matches found.
**********************************************************************************
Directory Listing of system files:
Wolumin w stacji E to System
Numer seryjny woluminu: 2C65-9C87
Katalog: E:\WINDOWS\System32
2006-02-27 17:15 <DIR> dllcache
2004-10-27 17:15 <DIR> Microsoft
0 plik(˘w) 0 bajt˘w
2 katalog(˘w) 9˙939˙570˙688 bajt˘w wolnych
.