z pko inteligo

[Dhogar]

Nie moge sie zalogwoac w serwisie PKO Inteligo. Gdy probuje to zorbic zamaist strony wyswietla mi sie komunikat NIE UDALO SIE NAWIAZAC POLACZENIA Firefox nie może nawiązać połączenia z serwerem www.pkointeligo.pl. Wsyzstkie inne strony choda bezblednie, uzywalem innych pzregladarek niestety nic to nie dalo. Wylaczylem firewalla, usunelem service packa. Wczoraj pzreinstalowalem windowsa na pcozatklu bylo dobzre, ale jak wylaczylem komputer to znowu nie moglem otwozryc strony. Prosze pomozcie.

[High Voltage]

wywal ciasteczka i spróbuj ponownie
ja teraz sprawdziłem i zalogowało mi sie bez problemu.

[MISTEJK]

może syfik się przypodział...

Wklej logi z Hijackthis + Silent Runners

[Dhogar]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 12:26:50, on 2006-12-31
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Norton Personal Firewall\NISUM.EXE
E:\WINDOWS\Vista32.exe
E:\Program Files\Norton Personal Firewall\NISSERV.EXE
E:\Program Files\Norton Personal Firewall\SymProxySvc.exe
E:\WINDOWS\System32\ctfmon.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\foobar2000\foobar2000.exe
E:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
E:\Program Files\Norton AntiVirus\navapsvc.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\Program Files\Norton AntiVirus\cfgwiz.exe
E:\Program Files\Norton AntiVirus\NAVW32.EXE
E:\Program Files\Common Files\Symantec Shared\NMain.exe
E:\Program Files\WinRAR\WinRAR.exe
E:\Documents and Settings\Administrator\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NAV CfgWiz] E:\PROGRA~1\NORTON~2\Cfgwiz.exe /R
O4 - HKLM\..\Run: [ccApp] E:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] E:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Advanced Tools Check] E:\PROGRA~1\NORTON~2\AdvTools\ADVCHK.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: The Matrix_ Path of Neo Registration.lnk = E:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\{4559B18F-5961-4699-8F22-724FD9DEB0C2}\{E571E8B1-9771-465D-9DE0-3BA2D1BDAE99}\ATR1.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{E9FBD0FE-1E46-4AD3-8160-5CA4483D3BCC}: NameServer = 194.204.159.1 194.204.152.34
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Personal Firewall Service (NISSERV) - Symantec Corporation - E:\Program Files\Norton Personal Firewall\NISSERV.EXE
O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - E:\Program Files\Norton Personal Firewall\NISUM.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Personal Firewall Proxy Service (SymProxySvc) - Symantec Corporation - E:\Program Files\Norton Personal Firewall\SymProxySvc.exe
O23 - Service: Vista32 - Unknown owner - E:\WINDOWS\Vista32.exe



[MISTEJK]

Pobierz i uruchom narzędzie : The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

E:\WINDOWS\Vista32.exe
E:\WINDOWS\web\related.htm

Folders to delete:

E:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\{4559B18F-5961-4699-8F22-724FD9DEB0C2}

Drivers to unload:

MSDisk

Vista32

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK. Po restarcie w hijacku usuwasz te wpisy:

E:\WINDOWS\Vista32.exe
O4 - Startup: The Matrix_ Path of Neo Registration.lnk = E:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\{4559B18F-5961-4699-8F22-724FD9DEB0C2}\{E571E8B1-9771-465D-9DE0-3BA 2D1BDAE99}\ATR1.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O23 - Service: Vista32 - Unknown owner - E:\WINDOWS\Vista32.exe

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + hijackthis + silent runners

[Dhogar]

Kod: Zaznacz wszystko

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\hlbplsym

*******************

Script file located at: \??\E:\ryyuskaf.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at E:\Avenger

*******************

Beginning to process script file:

File E:\WINDOWS\Vista32.exe deleted successfully.


Folder E:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\{4559B18F-5961-4699-8F22-724FD9DEB0C2} not found!
Deletion of folder E:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\{4559B18F-5961-4699-8F22-724FD9DEB0C2} failed!

Could not process line:
E:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\{4559B18F-5961-4699-8F22-724FD9DEB0C2}
Status: 0xc0000034



Registry key \Registry\Machine\System\CurrentControlSet\Services\MSDisk not found!
Unload of driver MSDisk failed!

Could not process line:
MSDisk
Status: 0xc0000034

Driver Vista32 unloaded successfully.

Completed script processing.

*******************

Finished!  Terminate.