Gość: lilka IP: *.icpnet.pl / 62.21.96.* 30.03.05, 20:32 Trojan.StartPage co ja mam z tym zrobic? Prosze o pomoc Pozdroffki dla wszystkich Odpowiedz Link Zgłoś Obserwuj wątek Podgląd Opublikuj
Gość: Kolobos Re: Trojan.StartPage IP: *.warszawa.sdi.tpnet.pl 30.03.05, 20:37 Chyba najlepiej bedzie go usunac ;-) Najpierw sciagnij i uruchom (przy wylaczonej przegladarce) cwshredder.net/bin/CWShredder.exe Nastepnie wklej log z hijackthis -> www.spychecker.com/program/hijackthis.html (Do a system scan and save a logfile) Odpowiedz Link Zgłoś
Gość: lilka Re: Trojan.StartPage IP: *.icpnet.pl / 62.21.96.* 30.03.05, 20:43 eee jak wyłaczyc przegladarke? Odpowiedz Link Zgłoś
Gość: Kolobos Re: Trojan.StartPage IP: *.warszawa.sdi.tpnet.pl 30.03.05, 20:45 Wystarczy zamknac wszystkie okna i tyle. Ale mozesz to pomina i wklej log z hijackthis o ktorym juz pisalem. Odpowiedz Link Zgłoś
Gość: lila Re: Trojan.StartPage IP: *.icpnet.pl / 62.21.96.* 30.03.05, 20:52 gdzie ten log wkleic ;)? Odpowiedz Link Zgłoś
Gość: lilka Re: Trojan.StartPage IP: *.icpnet.pl / 62.21.96.* 30.03.05, 20:56 Logfile of HijackThis v1.99.1 Scan saved at 20:50:55, on 2005-03-30 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\temp\salm.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Media Pass\MediaPass.exe C:\WINDOWS\System32\ilmojjzvhnfvcthd.exe C:\Program Files\Media Pass\MediaPassK.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\agnieszka\Pulpit\CWShredder.exe C:\Documents and Settings\agnieszka\Ustawienia lokalne\Temp\Katalog tymczasowy 1 dla hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = letgohome.com/sp.htm?id=34508 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 213.159.117.134/index.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = letgohome.com/sp.htm?id=34508 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = letgohome.com/hp.htm?id=34508 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 213.159.117.134/index.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 213.159.117.134/index.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = letgohome.com/sp.htm?id=34508 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 213.159.117.134/index.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 213.159.117.134/index.php R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [salm] c:\temp\salm.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe O4 - HKLM\..\Run: [Control handler] C:\WINDOWS\System32\ilmojjzvhnfvcthd.exe O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - HKLM\..\Run: [czen] C:\WINDOWS\czen.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.iframedollars.biz O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.iframedollars.biz (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted IP range: 213.159.117.202 O15 - Trusted IP range: 213.159.117.202 (HKLM) O16 - DPF: RaptisoftGameLoader - www.miniclip.com/hamsterball/raptisoftgameloader.cab O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms- its:mhtml:file://c:\nosuxxx.mht!http://www.kazaalite.pl/stats/xaw.chm::/bridge- c18.cab O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - toolbar.google.com/data/pl/big/1.1.62-big/GoogleNav.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - skaner.mks.com.pl/SkanerOnline.cab O20 - AppInit_DLLs: p7vg5o8pddx2hdll.dll.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Usługa Auto Protect programu Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corpo Odpowiedz Link Zgłoś
Gość: Kolobos Re: Trojan.StartPage IP: *.warszawa.sdi.tpnet.pl 30.03.05, 21:28 Doklej koniec log'a bo sie nie zmiescil caly. A z tego co jest to zaznacz te wpisy w hijackthis: R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = letgohome.com/sp.htm?id=34508 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 213.159.117.134/index.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = letgohome.com/sp.htm?id=34508 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = letgohome.com/hp.htm?id=34508 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 213.159.117.134/index.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 213.159.117.134/index.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = letgohome.com/sp.htm?id=34508 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 213.159.117.134/index.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 213.159.117.134/index.php R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - (no file) O4 - HKLM\..\Run: [salm] c:\temp\salm.exe Ten program odinstaluj najpierw w dodaj-usun programy: O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe O4 - HKLM\..\Run: [Control handler] C:\WINDOWS\System32\ilmojjzvhnfvcthd.exe O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - HKLM\..\Run: [czen] C:\WINDOWS\czen.exe O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.iframedollars.biz O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.iframedollars.biz (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted IP range: 213.159.117.202 O15 - Trusted IP range: 213.159.117.202 (HKLM) O16 - DPF: RaptisoftGameLoader - www.miniclip.com/hamsterball/raptisoftgameloader.cab O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms- its:mhtml:file://c:\nosuxxx.mht!http://www.kazaalite.pl/stats/xaw.chm::/bridge- c18.cab O20 - AppInit_DLLs: p7vg5o8pddx2hdll.dll.dll I nacisnij Fix Checked, nastepnie uruchom ponownie komputer i wklej nowy log. Odpowiedz Link Zgłoś
Gość: lilka Re: Trojan.StartPage IP: *.icpnet.pl / 62.21.96.* 30.03.05, 22:19 eee tego fragmentu: O4 - HKLM\..\Run: [czen] C:\WINDOWS\czen.exe juz nie ma... mozliwe ze to sie zmieniło na O4 - HKLM\..\Run: [kpuj] C:\WINDOWS\kpuj.exe ? Odpowiedz Link Zgłoś
Gość: lilka Re: Trojan.StartPage IP: *.icpnet.pl / 62.21.96.* 30.03.05, 21:39 O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe Odpowiedz Link Zgłoś
Gość: Kolobos Re: Trojan.StartPage IP: *.warszawa.sdi.tpnet.pl 30.03.05, 21:43 Tak jak myslalem w koncowce nic zlego juz nie bylo, a wiec zrob tak jak napisalem wczesniej. Odpowiedz Link Zgłoś
Gość: lilka Re: Trojan.StartPage IP: *.icpnet.pl / 62.21.96.* 30.03.05, 22:41 Logfile of HijackThis v1.99.1 Scan saved at 22:40:19, on 2005-03-30 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\ilmojjzvhnfvcthd.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Documents and Settings\agnieszka\Ustawienia lokalne\Temp\Katalog tymczasowy 7 dla hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = letgohome.com/hp.htm?id=34508 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\FMETNY~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [Control handler] C:\WINDOWS\System32\ilmojjzvhnfvcthd.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - toolbar.google.com/data/pl/big/1.1.62-big/GoogleNav.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - skaner.mks.com.pl/SkanerOnline.cab O20 - AppInit_DLLs: f8z48owbbr4c.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Usługa Auto Protect programu Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe Odpowiedz Link Zgłoś
Gość: lilka Re: Trojan.StartPage IP: *.icpnet.pl / 62.21.96.* 30.03.05, 22:41 Albo cos zle zrobiłam albo to nie pomaga :((((( Odpowiedz Link Zgłoś
Gość: Kolobos Re: Trojan.StartPage IP: *.warszawa.sdi.tpnet.pl 30.03.05, 23:06 Log wyglada juz lepiej, ale dalej zostalo pare rzeczy. Na poczatek sciagnij to: www.derbilk.de/SpSeHjfix110.zip rozpakuj, uruchom -> Start Disinfect (zamknij wczesniej wszystkie okienka przegladarki) Nastepnie sciagnij to: www.downloads.subratam.org/KillBox.zip rozpakuj, uruchom, zaznacz delete on reboot i wklej do tego programu sciezke do tego pliku: C:\WINDOWS\System32\FMETNY~1.DLL i nacisnij czerwony przycisk z X, to samo zrob z: C:\WINDOWS\System32\ilmojjzvhnfvcthd.exe Nastepnie uruchom hijackthis i zaznacz te wpisy: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = letgohome.com/hp.htm?id=34508 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\FMETNY~1.DLL O4 - HKLM\..\Run: [Control handler] C:\WINDOWS\System32\ilmojjzvhnfvcthd.exe O20 - AppInit_DLLs: f8z48owbbr4c.dll I Fix Checked, reset i wklej nowy log :-) Odpowiedz Link Zgłoś
Gość: lilka Re: Trojan.StartPage IP: *.icpnet.pl / 62.21.96.* 30.03.05, 23:54 Logfile of HijackThis v1.99.1 Scan saved at 23:53:24, on 2005-03-30 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Documents and Settings\agnieszka\Ustawienia lokalne\Temp\Katalog tymczasowy 12 dla hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = letgohome.com/hp.htm?id=34508 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\W8C6S4~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - toolbar.google.com/data/pl/big/1.1.62-big/GoogleNav.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - skaner.mks.com.pl/SkanerOnline.cab O20 - AppInit_DLLs: m5yr142bri5l.dll.dll.dll.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Usługa Auto Protect programu Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe Odpowiedz Link Zgłoś
Gość: Kolobos Re: Trojan.StartPage IP: *.warszawa.sdi.tpnet.pl 31.03.05, 00:10 Zostal juz tylko ten letgohome, opis jego usuniecia jest tutaj: www.searchengines.pl/phpbb203/index.php?showtopic=14185&st=50&#entry114898 Wszystko jest opisane bardzo dokladnie i prosto wiec napewno sobie poradzisz z usunieciem :-) Odpowiedz Link Zgłoś
Gość: lilka Re: Trojan.StartPage IP: *.icpnet.pl / 62.21.96.* 31.03.05, 00:28 Utwórz plik usuwający?? A jak? :( Wiem ze jestem załamujaca.. Odpowiedz Link Zgłoś
Gość: Kolobos Re: Trojan.StartPage IP: *.warszawa.sdi.tpnet.pl 31.03.05, 00:39 Wlacz sobie notatnik i wklej do niego to: REGEDIT4 [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{467FAEB2-5F5B-4c81-BAE0- 2A4752CA7F4E}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D721150-AEF3-457B-B03A- 5097B623CE45}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{444A5674-FF85-45D4-9AE2- 4199D8D70C85}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Plugin6.DNSErrObj] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Plugin6.DNSErrObj.1] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\redalert.here] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\redalert.here.1] [-HKEY_LOCAL_MACHINE\SOFTWARE\Melcosoft] [- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Cassandra] Wybierz z menu plik->zapisz jako wymierz nazwe fix.reg i zapisz go na pulpicie. Nastepnie uruchom windows w trybie awaryjnym (nacisnij F8 podczas startu system) Uruchom hijackthis i usun te wpisy: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = letgohome.com/hp.htm?id=34508 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\W8C6S4~1.DLL O20 - AppInit_DLLs: m5yr142bri5l.dll.dll.dll.dll Fix Checked, nastepnie uruchom wczesniej przygotowany Fix.reg Nastepnie uzyj killbox'a tak jak jest napisane w opisie: "Na początek wyczyścić tempy opcją: Tools >>> Delete Temp folders. Potem zaznaczyć kolejną opcję Delete file on reboot i w polu Full Path of File to Delete wkleić po kolei wszystkie ścieżki do plików zdeklarowanych na kasację. Po każdym wklejeniu program będzie pytał o reset co potwierdzasz dopiero po wklejeniu ostatniej ze ścieżek gdyż pliki muszą zostać skasowane za jednym zamachem. Reset komputerka - oczywiście znów do trybu awaryjnego." Czyli te dwa: m5yr142bri5l.dll.dll.dll.dll W8C6S4~1.DLL Jak nie bedziesz mogla znalezc tego pierwszego to poszukaj go przez Szukaj plikow i folderow Oczywiscie to co napisalem to marny opis w porownaniu z tym z: www.searchengines.pl/phpbb203/index.php?showtopic=14185&st=50&#entry114898 Gdzie jest opisane wszystko dokladniej i naprawde latwiej juz sie nie da :( Odpowiedz Link Zgłoś
Gość: Gość Re: Trojan.StartPage IP: *.tpnet.pl / *.tpnet.pl 04.04.05, 08:00 wirusy.antivirenkit.pl/wirus/wirus.php?lang=pl&id=Trojan.Win32.StartPage.uz Odpowiedz Link Zgłoś
Gość: lilka Re: Trojan.StartPage IP: *.icpnet.pl 31.03.05, 19:28 ehh robiłam tak uz 5 razy i nic:( to tam ciagle siedzi Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\Winamp\Winamp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\agnieszka\Ustawienia lokalne\Temp\Katalog tymczasowy 30 dla hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = letgohome.com/hp.htm?id=34508 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = letgohome.com/hp.htm?id=34508 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\W8C6S4~1.DLL O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - toolbar.google.com/data/pl/big/1.1.62-big/GoogleNav.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - skaner.mks.com.pl/SkanerOnline.cab O20 - AppInit_DLLs: fb8lsvf4r4l14jll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Usługa Auto Protect programu Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\P Odpowiedz Link Zgłoś
Gość: Kolobos Re: Trojan.StartPage IP: *.warszawa.sdi.tpnet.pl 31.03.05, 23:08 Ten opis na stronie jest bardzo dobrze napisany, a skoro dalej Ci nie wychodzi usuniecie tego to moze popros kogos kto sie zna i niech Ci to usunie :( Ja Ci tylko moge napisac ze masz usunac te pliki za jednym razem: fb8lsvf4r4l14jll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll oraz: C:\WINDOWS\System32\W8C6S4~1.DLL Ten pierwszy wyszukaj przez Szukaj plikow w windowsie i wklej sciezke do killboxa, eh zreszta juz to pisalem.Wiec chyba nie jestem Ci w stanie pomoc :( Odpowiedz Link Zgłoś
Gość: lilka Re: Trojan.StartPage IP: *.icpnet.pl 04.04.05, 20:06 dzieki slicznie za wsparcie. wprawdzie strona startowa nadal ta sama (wredne badziewie)ale juz mnie antuwirus nie straszy ze mam kompa zainfekowanego:) chociaz nie wiem czy sie powinnam tym pocieszac:D Buzka Odpowiedz Link Zgłoś
