Problem ze strona startowa

IP: *.tvk.torun.pl / 217.173.176.* 31.10.04, 20:55
Witam serdecznie.
Zlapalem jakis badziew mimo, ze w tle chodza mi Sygate Personal Firewall i AVG
AntiVir z aktualnymi bazami. Mimo skanowania Ad-Aware 6 niestety ciagle mam
problem z wyskakujaca strona startowa w IE. Bloknalem IE na firewallu i
zainstalowalem Mozille, ale to tylko zwalczanie objawow. Bylbym wdzieczny,
gdyby ktos pomogl mi pozbyc sie tego syfu. Moj log z HijackThis:
Logfile of HijackThis v1.97.7
Scan saved at 20:52:34, on 2004-10-31
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP3 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
D:\Sygate\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
D:\AVG6\avgserv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
D:\AVG6\avgcc32.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\P2P Networking\P2P Networking.exe
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\Gadu-Gadu\gg.exe
D:\Mozilla\mozilla.exe
C:\Documents and Settings\wHiSpEr\Dane aplikacji\Microsoft\Internet
Explorer\Quick Launch\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://allways4u.com/index3.php?id=30758
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {B72F75B8-93F3-429D-B13E-660B206D897A} -
C:\WINNT\system32\peront.dll
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio -
{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [AVG_CC] D:\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
-atboottime
O4 - HKLM\..\Run: [SmcService] D:\Sygate\smc.exe -startgui
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\system32\P2P Networking\P2P
Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common
files\SearchUpgrader\SearchUpgrader.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control)
- http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) -
http://67.15.101.2/g_bin/eng/roulette_2_0_0_14.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) -
http://67.15.101.2/g_bin/eng/cards_2_0_0_47.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -
http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {4539348E-01D7-11D5-9A39-0080C8D85044} (GameDesire Slots 90th) -
http://67.15.101.2/g_bin/eng/slots90_2_0_0_19.cab
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) -
http://67.15.101.2/g_bin/eng/navy_2_0_0_14.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) -
http://67.15.101.3/g_bin/eng/poker_2_0_0_33.cab
O16 - DPF: {881290B9-F53C-4676-8DAF-3DBEFC297308} (GameDesire Makao) -
http://67.15.101.2/g_bin/eng/makao_2_0_0_14.cab
O16 - DPF: {9085316E-42BA-11D4-BAA3-0080C8D7ED4A} (GameDesire JungleHunter) -
http://67.15.101.2/g_bin/eng/hunter_2_0_0_15.cab
O16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) -
http://67.15.101.3/g_bin/eng/demon_2_0_0_18.cab
O16 - DPF: {A1FE3DEF-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Pirate)
- http://67.15.101.2/g_bin/eng/pirate_2_0_0_15.cab
O16 - DPF: {A6212120-01D4-11D5-9A39-0080C8D85044} (GameDesire Slots 70th) -
http://67.15.101.2/g_bin/eng/slots70_2_0_0_19.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire
Marbies&Diamonds) - http://67.15.101.3/g_bin/eng/marbles_2_0_0_19.cab
O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} (GameDesire Darts Games) -
http://67.15.101.2/g_bin/eng/darts_2_0_0_27.cab
O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) -
http://67.15.101.2/g_bin/eng/breakout_2_0_0_14.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DCB16E44-D6DB-473E-A251-F6FBB381C1C3} (GameDesire Chess) -
http://67.15.101.2/g_bin/eng/chess_2_0_0_14.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
http://skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {ECEAD8AE-01D6-11D5-9A39-0080C8D85044} (GameDesire Slots 80th) -
http://67.15.101.2/g_bin/eng/slots80_2_0_0_19.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) -
http://67.15.101.3/g_bin/eng/billard8_2_0_0_21.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) -
http://67.15.101.2/g_bin/eng/billard9_2_0_0_20.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) -
http://67.15.101.3/g_bin/pl/billardt_2_0_0_20.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
http://67.15.101.3/g_bin/eng/snooker_2_0_0_21.cab

Z gory dzieki za pomoc. Pozdrawiam.
wHiSpEr
    • netsec Re: Problem ze strona startowa 01.11.04, 11:56
      Wklej log z HiJack ale wykonany wersją 1.98.2:
      forum.gazeta.pl/forum/72,2.html?f=23618&w=16131117&wv.x=1&a=17082886
      • Gość: wHiSpEr Re: Problem ze strona startowa IP: *.tvk.torun.pl / 217.173.176.* 01.11.04, 22:44
        Prosze bardzo:

        Logfile of HijackThis v1.98.2
        Scan saved at 22:44:16, on 2004-11-01
        Platform: Windows 2000 SP3 (WinNT 5.00.2195)
        MSIE: Internet Explorer v5.00 SP3 (5.00.2920.0000)

        Running processes:
        C:\WINNT\System32\smss.exe
        C:\WINNT\system32\winlogon.exe
        C:\WINNT\system32\services.exe
        C:\WINNT\system32\lsass.exe
        D:\Sygate\smc.exe
        C:\WINNT\system32\svchost.exe
        C:\WINNT\system32\spoolsv.exe
        D:\AVG6\avgserv.exe
        C:\WINNT\System32\svchost.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
        C:\WINNT\System32\nvsvc32.exe
        C:\WINNT\system32\regsvc.exe
        C:\WINNT\system32\MSTask.exe
        C:\WINNT\system32\svchost.exe
        C:\WINNT\Explorer.EXE
        C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
        C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
        D:\AVG6\avgcc32.exe
        C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
        C:\Program Files\QuickTime\qttask.exe
        C:\WINNT\system32\P2P Networking\P2P Networking.exe
        C:\WINNT\System32\ctfmon.exe
        C:\Program Files\Tlen.pl\tlen.exe
        D:\Mozilla\mozilla.exe
        D:\HijackThis\HijackThis.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
        allways4u.com/index3.php?id=30758
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
        C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
        O2 - BHO: (no name) - {B72F75B8-93F3-429D-B13E-660B206D897A} -
        C:\WINNT\system32\peront.dll
        O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
        O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio -
        {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
        O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
        O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
        O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
        C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
        O4 - HKLM\..\Run: [AVG_CC] D:\AVG6\avgcc32.exe /startup
        O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
        Files\Java\j2re1.4.2_04\bin\jusched.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
        -atboottime
        O4 - HKLM\..\Run: [SmcService] D:\Sygate\smc.exe -startgui
        O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\system32\P2P Networking\P2P
        Networking.exe /AUTOSTART
        O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common
        files\SearchUpgrader\SearchUpgrader.exe
        O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
        O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
        Office\Office10\OSA.EXE
        O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
        res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
        C:\WINNT\System32\msjava.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console -
        {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
        O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) -
        67.15.101.2/g_bin/eng/roulette_2_0_0_14.cab
        O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) -
        67.15.101.2/g_bin/eng/cards_2_0_0_47.cab
        O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
        O16 - DPF: {4539348E-01D7-11D5-9A39-0080C8D85044} (GameDesire Slots 90th) -
        67.15.101.2/g_bin/eng/slots90_2_0_0_19.cab
        O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) -
        67.15.101.2/g_bin/eng/navy_2_0_0_14.cab
        O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) -
        67.15.101.3/g_bin/eng/poker_2_0_0_33.cab
        O16 - DPF: {881290B9-F53C-4676-8DAF-3DBEFC297308} (GameDesire Makao) -
        67.15.101.2/g_bin/eng/makao_2_0_0_14.cab
        O16 - DPF: {9085316E-42BA-11D4-BAA3-0080C8D7ED4A} (GameDesire JungleHunter) -
        67.15.101.2/g_bin/eng/hunter_2_0_0_15.cab
        O16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) -
        67.15.101.3/g_bin/eng/demon_2_0_0_18.cab
        O16 - DPF: {A1FE3DEF-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Pirate) -
        67.15.101.2/g_bin/eng/pirate_2_0_0_15.cab
        O16 - DPF: {A6212120-01D4-11D5-9A39-0080C8D85044} (GameDesire Slots 70th) -
        67.15.101.2/g_bin/eng/slots70_2_0_0_19.cab
        O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbies&Diamonds)
        - 67.15.101.3/g_bin/eng/marbles_2_0_0_19.cab
        O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} (GameDesire Darts Games) -
        67.15.101.2/g_bin/eng/darts_2_0_0_27.cab
        O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) -
        67.15.101.2/g_bin/eng/breakout_2_0_0_14.cab
        O16 - DPF: {DCB16E44-D6DB-473E-A251-F6FBB381C1C3} (GameDesire Chess) -
        67.15.101.2/g_bin/eng/chess_2_0_0_14.cab
        O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
        skaner.mks.com.pl/SkanerOnline.cab
        O16 - DPF: {ECEAD8AE-01D6-11D5-9A39-0080C8D85044} (GameDesire Slots 80th) -
        67.15.101.2/g_bin/eng/slots80_2_0_0_19.cab
        O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) -
        67.15.101.3/g_bin/eng/billard8_2_0_0_21.cab
        O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) -
        67.15.101.2/g_bin/eng/billard9_2_0_0_20.cab
        O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) -
        67.15.101.3/g_bin/pl/billardt_2_0_0_20.cab
        O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) -
        67.15.101.3/g_bin/eng/snooker_2_0_0_21.cab
        O18 - Filter: text/plain - {B72F75B8-93F3-429D-B13E-660B206D897A} -
        C:\WINNT\system32\peront.dll

        Pozdrawiam.
        • netsec Re: HiJack log - wHiSpEr 01.11.04, 22:59
          Zacznijmy od tego że Twój system nie jest w pełni zaktualizowany o
          krytyczne poprawki wpływające na jego bezpieczeństwo.

          Ściągnij nowy CWShredder 2.0
          cwshredder.net/bin/CWSInstall.exe
          Uruchom komputer w trybie awaryjnym.Tutaj masz opis jak to wykonać:
          support.microsoft.com/default.aspx?scid=kb;PL;202485
          Po uruchomieniu komputera w trybie awaryjnym, nie otwieraj Internet Explorera.

          Uruchom ponownie HiJackThis wykonaj SCAN i zaznacz(haczykiem) te pozycje:

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
          allways4u.com/index3.php?id=30758
          O2 - BHO: (no name) - {B72F75B8-93F3-429D-B13E-660B206D897A} -
          C:\WINNT\system32\peront.dll
          O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
          O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\system32\P2P Networking\P2P
          Networking.exe /AUTOSTART
          O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common
          files\SearchUpgrader\SearchUpgrader.exe
          O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
          O18 - Filter: text/plain - {B72F75B8-93F3-429D-B13E-660B206D897A} -
          C:\WINNT\system32\peront.dll

          Po zaznaczeniu wykonaj FIX CHECKED i potwierdź TAK/OK.

          W Panel Sterowania => Opcje Internetowe usuń
          Tymczasowe pliki Internetowe (Wszystkie) i Cooki.

          Odinstaluj w Panelu sterowania Dodaj/Usuń programy wszystkie
          programy, co do których nie masz pewności, że Ci są potrzebne.
          Odinstaluj koniecznie P2P Networking.

          Uruchom CWShredder i wykonaj Fix.

          Oczyść kosz.

          Uruchom komputer w normalnym trybie.

          Ściągnij i zainstaluj Ad-Aware SE Personal Edition v1.05
          Pobieranie najnowszej wersji:
          www.download.com/3000-2144-10045910.html
          Przeskanuj Ad-Aware cały system.W celu zapewnienia maksymalnej skuteczności
          programu,należy przed skanowaniem wykonać aktualizacje bazy wykrywania.
          W trakcie uruchamiania skanowania, należy w zakładce
          "Preparing System Scan" wybrać "Perform full system scan".
          Po zakończeniu skanowania przez Ad-aware pojawi się lista obiektów do
          usunięcia.

          Zakładam że firewall Sygate działa poprawnie.
          Zainstaluj Serwis Pack 4 dla Windows 2000: tinyurl.com/2yyfd + wszystkie
          krytyczne poprawki z htttp://www.windowsupdate.com
          • Gość: wHiSpEr Re: HiJack log - wHiSpEr IP: *.tvk.torun.pl / 217.173.176.* 02.11.04, 12:46
            > Uruchom komputer w trybie awaryjnym.Tutaj masz opis jak to wykonać:
            > support.microsoft.com/default.aspx?scid=kb;PL;202485
            :-D

            Poki co wyglada czysto. Nie wiem czemu, ale kiedys wylaczylem automatyczne
            aktualizacje. :/ Dzieki wielkie. No more IE. :D
            • netsec Re: HiJack log - wHiSpEr 02.11.04, 19:01
              > Dzieki wielkie. No more IE. :D

              Wyłacz kontrolki instalowanie active-X w Opcje Internetowe => Zabezpieczenia
              i będzie oki.
Pełna wersja