Bardzo prosze o sprawdzenie loga

11.10.05, 19:08
Logfile of HijackThis v1.99.1
Scan saved at 18:05:42, on 11/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\System32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\WINDOWS\System32\CTHELPER.EXE
E:\Program Files\D-Tools\daemon.exe
E:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
E:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
E:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
E:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
E:\WINDOWS\System32\wuauclt.exe
E:\Program Files\Alwil Software\Avast4\ashSimpl.exe
E:\Program Files\Gadu-Gadu\gg.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Documents and Settings\Artur i Justyna\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
www.google.pl/
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - (no file)
O2 - BHO: E:\WINDOWS\adsldpbc.dll - {F462AEEF-160B-4657-9B86-821BB6210DA4} -
E:\WINDOWS\adsldpbc.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program
files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control
Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\D-Tools\daemon.exe" -
lang 1033
O4 - HKLM\..\Run: [Google Desktop Search] "E:\Program Files\Google\Google
Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [MicrosoftAntiSpywareCleaner] E:\Program
Files\Microsoft AntiSpyware\gcASCleaner.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\Program Files\Microsoft
ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Shell] "E:\Program Files\Common Files\Microsoft Shared\Web
Folders\ibm00001.exe"
O4 - HKCU\..\Run: [SNInstall] E:\WINDOWS\tool2.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Program Files\Gadu-Gadu\gg.exe" /tray
O8 - Extra context menu item: &Google Search - res://E:\Program
Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://E:\Program
Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://E:\Program
Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://E:\Program
Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://E:\Program
Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://E:\Program
Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-
00C04FAE2D4F} - E:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -
E:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-
9307-00C04FAE2D4F} - E:\Program Files\Microsoft ActiveSync\inetrepl.dll
O15 - Trusted Zone: *.coolwebsearch.com
O15 - Trusted Zone: *.searchmeup.com
O20 - Winlogon Notify: style32 - E:\WINDOWS\q3239640.dll (file missing)
O20 - Winlogon Notify: tcpG4T - tcpG4T.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - E:\WINDOWS\System32
\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil
Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil
Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil
Software\Avast4\ashWebSv.exe" /service (file missing)

    • Gość: Kolobos Re: Bardzo prosze o sprawdzenie loga IP: *.warszawa.sdi.tpnet.pl 11.10.05, 19:14
      Usun w hijackthis:

      O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - (no file)
      O2 - BHO: E:\WINDOWS\adsldpbc.dll - {F462AEEF-160B-4657-9B86-821BB6210DA4} -
      E:\WINDOWS\adsldpbc.dll <- usun plik
      O4 - HKCU\..\Run: [Shell] "E:\Program Files\Common Files\Microsoft Shared\Web
      Folders\ibm00001.exe" <- usun plik, a nastepnie sciagnij i uruchom:
      www.kellys-korner-xp.com/regs_edits/exefix.reg
      O4 - HKCU\..\Run: [SNInstall] E:\WINDOWS\tool2.exe <- usun plik
      O15 - Trusted Zone: *.coolwebsearch.com
      O15 - Trusted Zone: *.searchmeup.com
      O20 - Winlogon Notify: style32 - E:\WINDOWS\q3239640.dll (file missing)
      O20 - Winlogon Notify: tcpG4T - tcpG4T.dll (file missing) <- usun z rejestru
      ten klucz:
      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tcpG4T
      oraz ta usluge:
      HKLM\SYSTEM\CurrentControlSet\Services\msudp4\ i plik msudp4.sys




      • still_thinking Czy juz jest ok? 11.10.05, 19:29
        Nadal tapeta na pulpicie nie chce mi sie zmienic tylko pisze SPYWARE INFECTION



        Logfile of HijackThis v1.99.1
        Scan saved at 18:28:32, on 11/10/2005
        Platform: Windows XP SP1 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

        Running processes:
        E:\WINDOWS\System32\smss.exe
        E:\WINDOWS\system32\winlogon.exe
        E:\WINDOWS\system32\services.exe
        E:\WINDOWS\system32\lsass.exe
        E:\WINDOWS\System32\Ati2evxx.exe
        E:\WINDOWS\system32\svchost.exe
        E:\WINDOWS\System32\svchost.exe
        E:\WINDOWS\system32\Ati2evxx.exe
        E:\WINDOWS\Explorer.EXE
        E:\WINDOWS\system32\spoolsv.exe
        E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        E:\WINDOWS\System32\CTHELPER.EXE
        E:\Program Files\D-Tools\daemon.exe
        E:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        E:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
        E:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
        E:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
        E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        E:\Program Files\Alwil Software\Avast4\ashServ.exe
        E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        E:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
        E:\WINDOWS\System32\wuauclt.exe
        E:\Program Files\Alwil Software\Avast4\ashSimpl.exe
        E:\Program Files\Gadu-Gadu\gg.exe
        E:\Program Files\Internet Explorer\IEXPLORE.EXE
        E:\WINDOWS\system32\NOTEPAD.EXE
        E:\WINDOWS\System32\svchost.exe
        E:\Documents and Settings\Artur i Justyna\Desktop\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.google.pl/
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.google.pl/
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
        E:\WINDOWS\System32\msdxm.ocx
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program
        files\google\googletoolbar1.dll
        O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control
        Panel\atiptaxx.exe
        O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
        O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\D-Tools\daemon.exe" -
        lang 1033
        O4 - HKLM\..\Run: [Google Desktop Search] "E:\Program Files\Google\Google
        Desktop Search\GoogleDesktop.exe" /startup
        O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\RunOnce: [MicrosoftAntiSpywareCleaner] E:\Program Files\Microsoft
        AntiSpyware\gcASCleaner.exe
        O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\Program Files\Microsoft
        ActiveSync\WCESCOMM.EXE"
        O4 - HKCU\..\Run: [Shell] "E:\Program Files\Common Files\Microsoft Shared\Web
        Folders\ibm00001.exe"
        O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Program Files\Gadu-Gadu\gg.exe" /tray
        O8 - Extra context menu item: &Google Search - res://E:\Program
        Files\Google\GoogleToolbar1.dll/cmsearch.html
        O8 - Extra context menu item: &Translate English Word - res://E:\Program
        Files\Google\GoogleToolbar1.dll/cmwordtrans.html
        O8 - Extra context menu item: Backward Links - res://E:\Program
        Files\Google\GoogleToolbar1.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://E:\Program
        Files\Google\GoogleToolbar1.dll/cmcache.html
        O8 - Extra context menu item: Similar Pages - res://E:\Program
        Files\Google\GoogleToolbar1.dll/cmsimilar.html
        O8 - Extra context menu item: Translate Page into English - res://E:\Program
        Files\Google\GoogleToolbar1.dll/cmtrans.html
        O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-
        00C04FAE2D4F} - E:\Program Files\Microsoft ActiveSync\inetrepl.dll
        O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -
        E:\Program Files\Microsoft ActiveSync\inetrepl.dll
        O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-
        9307-00C04FAE2D4F} - E:\Program Files\Microsoft ActiveSync\inetrepl.dll
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
        E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: Ati HotKey Poller - Unknown owner - E:\WINDOWS\System32
        \Ati2evxx.exe
        O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
        O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil
        Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil
        Software\Avast4\ashMaiSv.exe" /service (file missing)
        O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil
        Software\Avast4\ashWebSv.exe" /service (file missing)

        • Gość: Kolobos Re: Czy juz jest ok? IP: *.warszawa.sdi.tpnet.pl 11.10.05, 19:39
          Jeszcze to zostalo:
          O4 - HKCU\..\Run: [Shell] "E:\Program Files\Common Files\Microsoft Shared\Web
          Folders\ibm00001.exe" <- mialas usunac plik oraz wpis i uruchomic exefix.reg do
          ktorego link podalem.

          Tapte naprawiasz tak jak to jest opisane tutaj:
          www.searchengines.pl/phpbb203/index.php?showtopic=31936
          odszukaj swoja i zrob to co masz napisane.

    • still_thinking Re: Bardzo prosze o sprawdzenie loga 11.10.05, 19:37
      Wiem,ze jestes bardzo busy ,ale sprawdz mi prosze jeszcze raz.Aha nie wiem jak
      sie usuwa z rejestru ,nie wiem nawet gdzie to jest :(((

      Bede bardzo wdzieczna za pomoc

      Justyna
Pełna wersja