wielka prośba o sprawdzenie loga ;]

**Posty:** 2323 · przez **Rufus** 27 Lut 2006, 22:44

Witam
Otóż dziś złapałem jakiegoś wira :cry:

po czy nastapiła seria przykrych zdarzeń między innymi: Wszystkie komunikatory nie chca dzialać przy każdym wyskakują błedy a przy avascie wystepuje błąd aktualizacji. Znikneło okno kont oraz szukajka nie działa poprawnie

Dysk przeskanowałem lecz nie wiele to dało :roll:

Prosze o pomoc

Kilka screenów :arrow:

Avast
Błąd przy gg
Błąd przy konnekcie
Błąd przy tlenie
Ustawienia kont
Szukajka

LOG: :arrow:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:23:06, on 2006-02-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\RECYCLER\services.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Kuba\Programy\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\wscntfy.exe D:\Kuba\Programy\Thomson\SpeedTouch USB\Dragdiag.exe D:\Kuba\Programy\cFos\cFosDNT.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\ctfmon.exe D:\Kuba\Programy\AutoConnect\AutoConnect.exe D:\Kuba\Programy\PeerGuardian2\pg2.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Kuba\Programy\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe D:\Kuba\Programy\Opera\Opera.exe C:\Documents and Settings\Kuba\Pulpit\Programy\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400134&utm_content=leftnav&utm_source=&utm_medium=&utm_campaign= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.accoona.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - <default> - (no file) F2 - REG:system.ini: UserInit=C:\WINDOWS\svchost32.exe,C:\WINDOWS\system32\userinit.exe,C:\RECYCLER\services.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Kuba\Programy\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\Kuba\Programy\FlashGet\jccatch.dll O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Kuba\Programy\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [cFosDNT] D:\Kuba\Programy\cFos\cFosDNT.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] D:\Kuba\Programy\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [PeerGuardian] D:\Kuba\Programy\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Kuba\Programy\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Konnekt] "D:\Kuba\Programy\Konnekt\konnekt.exe" /autostart O8 - Extra context menu item: Download All by FlashGet - D:\Kuba\Programy\FlashGet\jc_all.htm O8 - Extra context menu item: Download Using &BitSpirit - D:\Kuba\Programy\BitSpirit\bsurl.htm O8 - Extra context menu item: Download using FlashGet - D:\Kuba\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Kuba\Programy\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Kuba\Programy\FlashGet\flashget.exe O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll O15 - Trusted Zone: http://www.mks.com.pl O17 - HKLM\System\CCS\Services\Tcpip\..\{FA31F799-A5D3-4380-980A-A42BCA6F623D}: NameServer = 194.204.152.34 217.98.63.164 O20 - Winlogon Notify: directpt - C:\WINDOWS\SYSTEM32\directpt.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Kuba\Programy\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Dysk skanowałem avastem, spy emergency i ad-aware

Za wszelka pomac z góry dziękuje

**Posty:** 8694 · przez **Red** 27 Lut 2006, 23:03

usuwasz z wylaczonym przywracaniem systemu w xp i w trybie awaryjnym f8

C:\RECYCLER\services.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400134&utm_content=leftnav&utm_source=&utm_medium=&utm_campaign=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.accoona.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R3 - URLSearchHook: (no name) - <default> - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\svchost32.exe,C:\WINDOWS\system32\userinit.exe,C:\RECYCLER\services.exe
O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm
O20 - Winlogon Notify: directpt - C:\WINDOWS\SYSTEM32\directpt.dll

po usuwaniu dajesz log do kontroli

**Posty:** 1620 · przez **mafia435** 27 Lut 2006, 23:05

Tak to jest jak sie chodzi po stronkach z paniami hihihih nie no żartuje
Usuwasz

Kod: Zaznacz wszystko: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400134&utm_content=leftnav&utm_source=&utm_medium=&utm_campaign= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.accoona.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R3 - URLSearchHook: (no name) - <default> - (no file) F2 - REG:system.ini: UserInit=C:\WINDOWS\svchost32.exe,C:\WINDOWS\system32\userinit.exe,C:\RECYCLER\services.exe R3 - URLSearchHook: (no name) - - (no file) O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm O20 - Winlogon Notify: directpt - C:\WINDOWS\SYSTEM32\directpt.dll

Ręcznie z dysku:
C:\RECYCLER\services.exe
c:\secure32.html
file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm
C:\WINDOWS\SYSTEM32\directpt.dll

Wstawiasz log do kontroli.

Autor postu otrzymał pochwałę

**Posty:** 2323 · przez **Rufus** 28 Lut 2006, 00:16

mafia435 napisał(a):Tak to jest jak sie chodzi po stronkach z paniami

Ja na takie nie wchodze :oops:

LOG KONTROLNY :arrow:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:04:47, on 2006-02-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Kuba\Programy\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe D:\Kuba\Programy\Thomson\SpeedTouch USB\Dragdiag.exe D:\Kuba\Programy\cFos\cFosDNT.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\ctfmon.exe D:\Kuba\Programy\AutoConnect\AutoConnect.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Kuba\Programy\PeerGuardian2\pg2.exe D:\Kuba\Programy\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Documents and Settings\Kuba\Pulpit\Programy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Kuba\Programy\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\Kuba\Programy\FlashGet\jccatch.dll O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Kuba\Programy\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [cFosDNT] D:\Kuba\Programy\cFos\cFosDNT.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] D:\Kuba\Programy\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [PeerGuardian] D:\Kuba\Programy\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Kuba\Programy\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Konnekt] "D:\Kuba\Programy\Konnekt\konnekt.exe" /autostart O8 - Extra context menu item: Download All by FlashGet - D:\Kuba\Programy\FlashGet\jc_all.htm O8 - Extra context menu item: Download Using &BitSpirit - D:\Kuba\Programy\BitSpirit\bsurl.htm O8 - Extra context menu item: Download using FlashGet - D:\Kuba\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Kuba\Programy\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Kuba\Programy\FlashGet\flashget.exe O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll O15 - Trusted Zone: http://www.mks.com.pl O20 - Winlogon Notify: directpt - C:\WINDOWS\SYSTEM32\directpt.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Kuba\Programy\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Usunalem wszystko tak jak napisaliscie, ale nadal komunikatory nie dzialaja oraz szukajka jak i opcje kont no i oczywiscie avastowi bledy wyskakuja :cry:

**Posty:** 8694 · przez **Red** 28 Lut 2006, 00:39

prosze sciagnac:
http://www.ewido.net/en/download/
przeskanowac system i wklej to co znajdzie ewido ,nastepnie usun wszystko

sciagnij Registry Search Tool z tej stronki:
http://www.billsway.com/vbspage/

i daj mu na wyszukiwanie : directpt.dll wklej wynik na forum

**Posty:** 2323 · przez **Rufus** 28 Lut 2006, 01:16

Red napisał(a):przeskanowac system i wklej to co znajdzie ewido ,nastepnie usun wszystko

Zrobilem tak ;] :arrow:

Kod: Zaznacz wszystko: --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 23:24:27, 2006-02-27 + Report-Checksum: FA91582E + Scan result: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup HKU\S-1-5-21-527237240-1123561945-1177238915-1004\Software\Microsoft\Internet Explorer\URLSearchHooks\{944864A5-3916-46E2-96A9-A2E84F3F1208} -> Adware.Accoona : Cleaned with backup HKU\S-1-5-21-527237240-1123561945-1177238915-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{364B6276-C6C1-40B6-A6D7-6C48871FD707} -> Adware.Accoona : Cleaned with backup HKU\S-1-5-21-527237240-1123561945-1177238915-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6001CDF7-6F45-471B-A203-0225615E35A7} -> Adware.Generic : Cleaned with backup HKU\S-1-5-21-527237240-1123561945-1177238915-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{944864A5-3916-46E2-96A9-A2E84F3F1208} -> Adware.Accoona : Cleaned with backup HKU\S-1-5-21-527237240-1123561945-1177238915-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BE2ED590-CA49-46B5-8CCE-244FB2E0D1AA} -> Adware.WebDir : Cleaned with backup C:\Documents and Settings\Kuba\Cookies\kuba@ad.adocean[1].txt -> TrackingCookie.Adocean : Cleaned with backup C:\Documents and Settings\Kuba\Cookies\kuba@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Kuba\Cookies\kuba@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup :mozilla.28:C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\hi0rwohf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.29:C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\hi0rwohf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.10:C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\hi0rwohf.default\cookies.txt.bak -> TrackingCookie.Yadro : Cleaned with backup :mozilla.23:C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\hi0rwohf.default\cookies.txt.bak -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.24:C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\hi0rwohf.default\cookies.txt.bak -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Kuba\Moje dokumenty\WinAPI.exe -> Downloader.Harnig.bc : Cleaned with backup C:\Documents and Settings\Kuba\Moje dokumenty\WinDOS.exe -> Logger.KeyLogger.gp : Cleaned with backup C:\Documents and Settings\Kuba\Ustawienia lokalne\Temp\_ex4AF.tmp.exe -> Worm.Bagle.fc : Cleaned with backup C:\RECYCLER\services.exe -> Logger.KeyLogger.gp : Cleaned with backup C:\WINDOWS\country.exe -> Trojan.Dialer.my : Cleaned with backup D:\Instalki\UltraISO\UltraISO v7.65 Build 1225.rar/patch.exe -> Trojan.Agent.jh : Error during cleaning D:\Kuba\Programy\Tlen.pl\plugins\DozaKultury.tpl -> Adware.Doza : Cleaned with backup D:\Kuba\Programy\UltraISO\patch.exe -> Trojan.Agent.jh : Cleaned with backup D:\Różne\Dodatki\Cracki\Fifa Cracki.rar/Fifa Cracki\FIFA 2006 CRACK NOCD+SERIAL+KEYGEN.rar/FIFA 2006 CRACK NOCD+SERIAL+KEYGEN\La 1re astuce pour tricher avec eurobarre\Eurofake.exe -> Worm.Kelvir.bp : Cleaned with backup ::Report End

Red napisał(a):sciagnij Registry Search Tool z tej stronki:

Tu mi wyskakuje po uruchomieniu takie cos :arrow:

Kod: Zaznacz wszystko: http://img366.imageshack.us/img366/6919/skrypt7gq.jpg

**Posty:** 8694 · przez **Red** 28 Lut 2006, 11:04

prosze o log z :

http://www.sysinternals.com/Files/RootkitRevealer.zip

wylacz na czas skanowania zbedne programy i wklej na forum wynik

oraz log z:

otwierasz link>>> http://www.silentrunners.org/Silent%20Runners.vbs >>zapisujesz jako na pulpicie>>klikasz dwa razy >>masz wybor i wybierasz no>>i czekasz troszke az wygeneruje sie cały log do konca
wrzucasz na forum

**Posty:** 2323 · przez **Rufus** 28 Lut 2006, 17:03

Red napisał(a):http://www.sysinternals.com/Files/RootkitRevealer.zip

Prosze bardzo

Kod: Zaznacz wszystko: HKLM\SOFTWARE\Classes\Installer\Products\32418F9EE1126B64A90E8365B85CFCF6\ProductName 2006-02-23 15:47 26 bytes Data mismatch between Windows API and raw hive data. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}\DisplayName 2006-02-23 15:51 26 bytes Data mismatch between Windows API and raw hive data. HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg 2006-02-23 17:59 0 bytes Access is denied. HKLM\SYSTEM\ControlSet002\Services\sysbus32 2006-02-28 14:29 0 bytes Hidden from Windows API. HKLM\SYSTEM\ControlSet002\Services\Vax347s\Config\jdgg40 2006-02-28 14:28 0 bytes Hidden from Windows API. HKLM\SYSTEM\ControlSet003\Services\sysbus32 2006-02-28 14:29 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys 2006-02-22 21:50 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash-chat.pl 2006-02-08 19:59 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash-chat.pl\settings.sol 2006-02-08 19:59 83 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#heyah.pl 2006-02-01 16:38 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#heyah.pl\settings.sol 2006-02-01 16:38 78 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#hoomor.pl 2006-01-24 16:39 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#hoomor.pl\settings.sol 2006-01-24 16:39 79 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iprom.net 2006-02-04 17:36 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iprom.net\settings.sol 2006-02-04 17:36 79 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#miniclip.com 2006-02-17 14:07 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#miniclip.com\settings.sol 2006-02-17 14:07 82 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#mochibot.com 2006-02-21 22:06 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#mochibot.com\settings.sol 2006-02-21 22:06 82 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#multimedia.pl 2006-02-11 21:59 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#multimedia.pl\settings.sol 2006-02-11 21:59 83 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com 2006-01-26 11:33 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com\settings.sol 2006-01-26 11:33 86 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.fifastreet2.com 2006-02-09 18:13 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.fifastreet2.com\settings.sol 2006-02-09 18:13 89 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.heyah.pl 2006-02-01 16:38 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.heyah.pl\settings.sol 2006-02-01 16:38 82 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.mindistortion.net 2006-02-18 14:35 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.mindistortion.net\settings.sol 2006-02-18 14:35 91 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.myheritage.com 2006-02-15 22:01 0 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.myheritage.com\settings.sol 2006-02-15 22:01 88 bytes Hidden from Windows API. C:\Documents and Settings\Kuba\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 2006-02-22 21:50 589 bytes Hidden from Windows API. C:\Documents and Settings\LocalService\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys 2006-01-22 17:14 0 bytes Hidden from Windows API. C:\Documents and Settings\LocalService\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 2006-01-22 17:14 300 bytes Hidden from Windows API. C:\WINDOWS\system32\drivers\sysbus32.sys 2006-02-27 18:33 48.81 KB Hidden from Windows API.

Silentrunners nie dziala podobnie jak Registry Search Tool wyskakuje ten sam blad

Kod: Zaznacz wszystko: http://img96.imageshack.us/img96/5594/silentrunners3wt.jpg

**Posty:** 8694 · przez **Red** 28 Lut 2006, 17:27

mamy kwiatek:

C:\WINDOWS\system32\drivers\sysbus32.sys

start >uruchom> cmd

wstaw zestaw komend:

disable sysbus32
cd C:\WINDOWS\system32\drivers
del sysbus32.sys

sciagasz killbox :
http://www.bleepingcomputer.com/files/killbox.php

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę :
C:\WINDOWS\SYSTEM32\directpt.dll i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

Nastepnie sciagasz:
http://www.f-secure.com/exclude/blacklight/index.shtml
i przeskanuj kompa

po wszystkim dajesz do kontroli log z hijacka log z RootkitRevealer

**Posty:** 2323 · przez **Rufus** 28 Lut 2006, 19:20

Zrobilem tak jak mowisz tyle ze przy usuwaniu z killboxa wyskoczylo cos takiego a pc sie nie zresetowal :arrow:

Kod: Zaznacz wszystko: http://img159.imageshack.us/img159/1680/killbox2vx.jpg

Blacklight nic nie znalazl

Logi kontrolne :arrow:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 17:01:36, on 2006-02-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe D:\Kuba\Programy\ewido anti-malware\ewidoctrl.exe D:\Kuba\Programy\ewido anti-malware\ewidoguard.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Kuba\Programy\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Kuba\Programy\Thomson\SpeedTouch USB\Dragdiag.exe D:\Kuba\Programy\cFos\cFosDNT.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\ctfmon.exe D:\Kuba\Programy\AutoConnect\AutoConnect.exe D:\Kuba\Programy\PeerGuardian2\pg2.exe D:\Kuba\Programy\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe D:\Kuba\Programy\Konnekt\konnekt.exe D:\Kuba\Programy\Winamp\Winamp.exe D:\Kuba\Programy\Opera\Opera.exe C:\Documents and Settings\Kuba\Pulpit\Programy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Kuba\Programy\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\Kuba\Programy\FlashGet\jccatch.dll O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Kuba\Programy\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [cFosDNT] D:\Kuba\Programy\cFos\cFosDNT.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] D:\Kuba\Programy\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [PeerGuardian] D:\Kuba\Programy\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Kuba\Programy\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Konnekt] "D:\Kuba\Programy\Konnekt\konnekt.exe" /autostart O8 - Extra context menu item: Download All by FlashGet - D:\Kuba\Programy\FlashGet\jc_all.htm O8 - Extra context menu item: Download Using &BitSpirit - D:\Kuba\Programy\BitSpirit\bsurl.htm O8 - Extra context menu item: Download using FlashGet - D:\Kuba\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Kuba\Programy\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Kuba\Programy\FlashGet\flashget.exe O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll O15 - Trusted Zone: http://www.mks.com.pl O17 - HKLM\System\CCS\Services\Tcpip\..\{FA31F799-A5D3-4380-980A-A42BCA6F623D}: NameServer = 194.204.152.34 217.98.63.164 O20 - Winlogon Notify: directpt - directpt.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: ewido security suite control - ewido networks - D:\Kuba\Programy\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - D:\Kuba\Programy\ewido anti-malware\ewidoguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: JOPZRZ - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Kuba\USTAWI~1\Temp\JOPZRZ.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Kuba\Programy\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

RotkitRevealer

Kod: Zaznacz wszystko: HKLM\SOFTWARE\Classes\Installer\Products\32418F9EE1126B64A90E8365B85CFCF6\ProductName 2006-02-23 15:47 26 bytes Data mismatch between Windows API and raw hive data. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}\DisplayName 2006-02-23 15:51 26 bytes Data mismatch between Windows API and raw hive data. HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg 2006-02-23 17:59 0 bytes Access is denied. HKLM\SYSTEM\ControlSet002\Services\Vax347s\Config\jdgg40 2006-02-28 16:55 0 bytes Hidden from Windows API.

Dodam jeszcze ze komunikatory juz dzialaja normalnie tak samo avast juz nie "krzyczy" mi z bledem

Nie dzialaja jeszcze poprawnie konta i szukajaka ale to juz chyba nie dotyczy bezpieczenstwa

przez **Tom@szek** 28 Lut 2006, 23:35

Kod: Zaznacz wszystko: O20 - Winlogon Notify: directpt - directpt.dll (file missing)

Ściągasz http://www.cexx.org/LSPFix.exe

W programie zaznaczasz V i z lewego okna przenosisz plik directpt.dll na prawa strone -> finisch

Oczywiście w trybie awaryjnym.

Kod: Zaznacz wszystko: directpt.dll Added by the Troj/Haxdoor-AX rootkit Trojan.dded by the Troj/Haxdoor-AX rootkit Trojan.

[ Dodano: Dzisiaj o 22:03 ]
Upss - sorry
daj progsa z http://www.atribune.org/downloads/l2mfix.exe
uruchom z poz. 2
Później loga z hijackthis.

Autor postu otrzymał pochwałę

**Posty:** 2323 · przez **Rufus** 01 Mar 2006, 00:23

Kod: Zaznacz wszystko: L2mfix 010406 Creating Account. Polecenie zostao wykonane pomylnie. Adding Administrative privleges. Checking for L2MFix account(0=no 1=yes): 1 Granting SeDebugPrivilege to L2MFIX ... successful Checking for L2MFix account(0=no 1=yes): 0 Zipping up files for submission: zip warning: name not matched: dlls\*.* zip error: Nothing to do! (backup.zip) adding: backregs/notibac.reg (104 bytes security) (deflated 88%)

Log kontrolny

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:13:50, on 2006-02-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe D:\Kuba\Programy\ewido anti-malware\ewidoctrl.exe D:\Kuba\Programy\ewido anti-malware\ewidoguard.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Kuba\Programy\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Kuba\Programy\Thomson\SpeedTouch USB\Dragdiag.exe D:\Kuba\Programy\cFos\cFosDNT.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\ctfmon.exe D:\Kuba\Programy\AutoConnect\AutoConnect.exe D:\Kuba\Programy\PeerGuardian2\pg2.exe D:\Kuba\Programy\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe D:\Kuba\Programy\Konnekt\konnekt.exe D:\Kuba\Programy\Opera\Opera.exe C:\Documents and Settings\Kuba\Pulpit\Programy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Kuba\Programy\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\Kuba\Programy\FlashGet\jccatch.dll O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Kuba\Programy\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [cFosDNT] D:\Kuba\Programy\cFos\cFosDNT.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] D:\Kuba\Programy\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [PeerGuardian] D:\Kuba\Programy\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Kuba\Programy\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Konnekt] "D:\Kuba\Programy\Konnekt\konnekt.exe" /autostart O8 - Extra context menu item: Download All by FlashGet - D:\Kuba\Programy\FlashGet\jc_all.htm O8 - Extra context menu item: Download Using &BitSpirit - D:\Kuba\Programy\BitSpirit\bsurl.htm O8 - Extra context menu item: Download using FlashGet - D:\Kuba\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Kuba\Programy\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Kuba\Programy\FlashGet\flashget.exe O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll O15 - Trusted Zone: http://www.mks.com.pl O17 - HKLM\System\CCS\Services\Tcpip\..\{FA31F799-A5D3-4380-980A-A42BCA6F623D}: NameServer = 194.204.152.34 217.98.63.164 O20 - Winlogon Notify: directpt - directpt.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: ewido security suite control - ewido networks - D:\Kuba\Programy\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - D:\Kuba\Programy\ewido anti-malware\ewidoguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: JOPZRZ - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Kuba\USTAWI~1\Temp\JOPZRZ.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Kuba\Programy\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

przez **Tom@szek** 01 Mar 2006, 00:29

Tryb awaryjny - wyłącz przywracanie systemu - usuwasz

O20 - Winlogon Notify: directpt - directpt.dll (file missing)

O23 - Service: JOPZRZ - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Kuba\USTAWI~1\Temp\JOPZRZ.exe

Jesli coś pójdzie nie tak - poczekaj na Piotrka ( Red)

**Posty:** 8694 · przez **Red** 01 Mar 2006, 10:28

O20 - Winlogon Notify: directpt - directpt.dll (file missing)

to usuniesz hijackiem

dodatkowo wykonasz komendy:

Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop JOPZRZ

sc delete JOPZRZ

sciagniesz sobie :
http://www.atribune.org/ccount/click.php?id=1
kliknij dwa razy na ATF-Cleaner.exe,zaznacz Select All i nacisnij Empty Selected

Na koncu wyczyscisz całkowicie folder temp w ten sposob:
Start >>> Uruchom >>> cmd

Wpisz następujące komendy, każdą potwierdzając za pomocą ENTER:

RD /S /Q "C:\Documents and settings\Nazwa twojego konta\Ustawienia lokalne\Temp"
RD /S /Q "C:\Documents and settings\Nazwa twojego konta\Ustawienia lokalne\Temporary internet files"

I dajesz log do kontroli

**Posty:** 2323 · przez **Rufus** 01 Mar 2006, 13:07

Log

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 10:57:41, on 2006-03-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe D:\Kuba\Programy\ewido anti-malware\ewidoctrl.exe D:\Kuba\Programy\ewido anti-malware\ewidoguard.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Kuba\Programy\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Kuba\Programy\Thomson\SpeedTouch USB\Dragdiag.exe D:\Kuba\Programy\cFos\cFosDNT.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe D:\Kuba\Programy\AutoConnect\AutoConnect.exe D:\Kuba\Programy\PeerGuardian2\pg2.exe D:\Kuba\Programy\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe D:\Kuba\Programy\Opera\Opera.exe C:\Documents and Settings\Kuba\Pulpit\Programy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Kuba\Programy\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\Kuba\Programy\FlashGet\jccatch.dll O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Kuba\Programy\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [cFosDNT] D:\Kuba\Programy\cFos\cFosDNT.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] D:\Kuba\Programy\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [PeerGuardian] D:\Kuba\Programy\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Kuba\Programy\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O8 - Extra context menu item: Download All by FlashGet - D:\Kuba\Programy\FlashGet\jc_all.htm O8 - Extra context menu item: Download Using &BitSpirit - D:\Kuba\Programy\BitSpirit\bsurl.htm O8 - Extra context menu item: Download using FlashGet - D:\Kuba\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Kuba\Programy\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Kuba\Programy\FlashGet\flashget.exe O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll O15 - Trusted Zone: http://www.mks.com.pl O17 - HKLM\System\CCS\Services\Tcpip\..\{FA31F799-A5D3-4380-980A-A42BCA6F623D}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: ewido security suite control - ewido networks - D:\Kuba\Programy\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - D:\Kuba\Programy\ewido anti-malware\ewidoguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Kuba\Programy\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

**Posty:** 8694 · przez **Red** 01 Mar 2006, 13:13

Jest czysto.

Autor postu otrzymał pochwałę

**Posty:** 2323 · przez **Rufus** 01 Mar 2006, 13:17

Jest czysto.

Bo pomogliscie mi posprzatac

Wielkie dzieki za uratowanie mnie przed formatem :banan:

przez **Tom@szek** 01 Mar 2006, 23:16

Teraz czysto.

**Posty:** 8694 · przez **Red** 07 Mar 2006, 12:52

snorg a ty co...????Jesli masz problem to zakladasz swoj własny temat i opisujesz co sie dzieje,bo gołych logów tu sie nie sprawdza.

**Posty:** 20 · przez **snorg** 07 Mar 2006, 12:53

Red ----mam temat !!

wielka prośba o sprawdzenie loga ;]

Wielka prośba o sprawdzenie loga ;]

Kto jest na forum