alka44 08.12.04, 12:32 I jednak zostają. Te same, które wczesniej próbowałam usunąć w trybie awaryjnym i nic nie dało. Chyba tylko format został? Odpowiedz Link Zgłoś Obserwuj wątek Podgląd Opublikuj
Gość: piecyk gazowy Re: Spybot nie radzi sobie IP: *.tpnet.pl / *.tpnet.pl 08.12.04, 12:57 forum.gazeta.pl/forum/72,2.html?f=430&w=14530041&a=14530514 Odpowiedz Link Zgłoś
alka44 Re: Spybot nie radzi sobie 08.12.04, 13:06 ogfile of HijackThis v1.98.2 Scan saved at 13:06:10, on 04-12-08 Platform: Windows 98 Gold (Win9x 4.10.1998) MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\RUNDLL32.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\ATICWD32.EXE C:\SBPCI\CTMIX32.EXE C:\WINDOWS\SYSTEM\INTERNAT.EXE C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE C:\WINDOWS\TEMP\RAR$EX00.943\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchalot.com/search.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchalot.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchalot.com/search.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/MStartEnter/Portal/portal.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.searchalot.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = www.onet.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O3 - Toolbar: @msdxmLC.dll,-1@1045,&Radio - {8E718888-423F-11D2-876E- 00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe O4 - HKLM\..\Run: [NOD32POP3] "C:\Program Files\Eset\pop3scan.exe" /uninstall O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe" O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe O4 - HKLM\..\Run: [CreativeMixer] C:\SBPCI\ctmix32.exe /T O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla! \Stopzilla.exe" /autorun O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Classes] C:\WINDOWS\SYSTEM\MSTAR2.EXE O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\SYSTEM\twink64.exe internat.dll,LoadKeyboardProfile O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe O4 - HKCU\..\Run: [Komunikator] C:\PROGRAM FILES\TLEN.PL\TLEN.EXE O4 - HKCU\..\Run: [Spyware Begone] C:\FREESCAN\FREESCAN.EXE -FastScan O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Startup: Uruchamianie pakietu Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html O9 - Extra button: (no name) - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - (no file) O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b- 00aa003c157a} - (no file) O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing) O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99- 19841353B4F0} - http://www.searchalot.com (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5- 00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.topconverting.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.slotchbar.com O16 - DPF: {70AA7362-0A16-11D4-877B-008048C4AC6F} (MainControl Class) - http://download.mks.com.pl/files/webscan/WebScan.cab O16 - DPF: {37A49D66-2735-4BB9-8503-82BA5E2333D0} (MailCfg Control) - https://poczta.wp.pl/autoryzacja/mailcfg.ocx O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} - http://merchant.eops.de/dialersoftware/cax.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab O16 - DPF: BSK Online - https://ssl.bsk.com.pl/component/BSKOnl.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://host.cycore.net/plugins/windows/ie/Cult3D_IE_5.3.0.228.cab O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - Odpowiedz Link Zgłoś
Gość: piecyk gazowy Re: Spybot nie radzi sobie IP: *.tpnet.pl / *.tpnet.pl 08.12.04, 16:52 alka44 napisała: No... zobaczymy... Ściągnij, zainstaluj i przy wyłączonym Internet Explorerze uruchom CWShreddera: cwshredder.net/bin/CWSInstall.exe Do wyrzucenia (zaznacz poniższe pozycje i wciśnij Fix Checked; po czyszczeniu CSWShredderem niektórych pozycji u Ciebie już może nie być): > R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = > www.searchalot.com/search.htm > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = > about:blank > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = > about:blank > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = > file://C:\WINDOWS\TEMP\sp.html > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = > file://C:\WINDOWS\TEMP\sp.html > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = > www.searchalot.com > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = > www.searchalot.com/search.htm > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = > file://C:\WINDOWS\TEMP\sp.html > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = > file://C:\WINDOWS\TEMP\sp.html > R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = > file://C:\WINDOWS\TEMP\sp.html > R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = > about:blank > R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = > file://C:\WINDOWS\TEMP\sp.html > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = > file:///C:/Program%20Files/MStartEnter/Portal/portal.html > R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank > R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = > www.searchalot.com > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = www.onet.pl > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 ieautosearch > O1 - Hosts: 69.20.16.183 auto.search.msn.com > O1 - Hosts: 69.20.16.183 search.netscape.com > O4 - HKLM\..\Run: [NOD32POP3] "C:\Program Files\Eset\pop3scan.exe" /uninstall > O4 - HKLM\..\Run: [Classes] C:\WINDOWS\SYSTEM\MSTAR2.EXE > O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\SYSTEM\twink64.exe > internat.dll,LoadKeyboardProfile > O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye > Network\bin\bargains.exe > O9 - Extra button: (no name) - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - (no > file) > O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b- > 00aa003c157a} - (no file) > O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - > www.searchalot.com (file missing) > O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99- > 19841353B4F0} - www.searchalot.com (file missing) > O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - > C:\WINDOWS\SYSTEM\Shdocvw.dll > O15 - Trusted Zone: *.searchmiracle.com > O15 - Trusted Zone: *.mt-download.com > O15 - Trusted Zone: *.skoobidoo.com > O15 - Trusted Zone: *.searchbarcash.com > O15 - Trusted Zone: *.windupdates.com > O15 - Trusted Zone: *.my-internet.info > O15 - Trusted Zone: *.flingstone.com > O15 - Trusted Zone: *.clickspring.net > O15 - Trusted Zone: *.topconverting.com > O15 - Trusted Zone: *.crazywinnings.com > O15 - Trusted Zone: *.ysbweb.com > O15 - Trusted Zone: *.slotchbar.com > O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} - > merchant.eops.de/dialersoftware/cax.cab > host.cycore.net/plugins/windows/ie/Cult3D_IE_5.3.0.228.cab > O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - Na koniec wygeneruj jeszcze raz loga i wklej. Odpowiedz Link Zgłoś
Gość: piecyk gazowy Poprawka! IP: *.tpnet.pl / *.tpnet.pl 08.12.04, 16:54 Ta pozycja jest poprawna: > O4 - HKLM\..\Run: [NOD32POP3] "C:\Program Files\Eset\pop3scan.exe" /uninstall Nie usuwaj. Odpowiedz Link Zgłoś
alka44 Re: Spybot nie radzi sobie 08.12.04, 16:03 no i co o tym myślicie madrzy ludzie? Chyba tylko format. Odpowiedz Link Zgłoś
Gość: piecyk gazowy Re: Spybot nie radzi sobie IP: *.tpnet.pl / *.tpnet.pl 08.12.04, 23:30 Wszystko czyli co? Jaki efekt? Może wklej loga jeszcze raz? Odpowiedz Link Zgłoś
netsec Re: Spybot nie radzi sobie 09.12.04, 08:47 Proponuje te narzędzie usuwające sp.htm: 80.53.91.142/netsec/tools/sphjfix.exe Uruchom startdisinfection przy zamkniętych innych programach Odpowiedz Link Zgłoś
alka44 Re: Spybot nie radzi sobie 09.12.04, 22:24 co to znaczy?? jak to zrobiłeś?? A chasło to z loga?? Odpowiedz Link Zgłoś
