Fatalnie dzialajacy internet

siwy89 · 8 Styczeń 2007 14:30

mam problem chyba zlapalem jakis syf. Log z hijack thisa, jak bedzie potrzebny to wrzuce tez z silent runners

Logfile of HijackThis v1.99.1 Scan saved at 15:32:28, on 2007-01-08 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Progrmay\avast\aswUpdSv.exe D:\Progrmay\NetLimiter\NetLimiter.exe D:\Progrmay\avast\ashDisp.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\IEXPLORE.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Progrmay\avast\ashServ.exe C:\WINDOWS\system\dllhost.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\System32\irdvxc.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4gui.exe D:\Progrmay\avast\ashWebSv.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4gui.exe D:\Progrmay\avast\ashMaiSv.exe D:\Progrmay\Mozilla Firefox\firefox.exe D:\Szkoła\Siwy\HijackThis.com.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Progrmay\adobe reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Progrmay\Java\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NetLimiter] D:\Progrmay\NetLimiter\NetLimiter.exe /s O4 - HKLM…\Run: [avast!] D:\Progrmay\avast\ashDisp.exe O4 - HKLM…\Run: [sunJavaUpdateSched] D:\Progrmay\Java\bin\jusched.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [internet Explorer] C:\WINDOWS\System32\IEXPLORE.exe O4 - HKLM…\Run: [meshal] C:\WINDOWS\System32\almutairi.exe O4 - HKLM…\RunServices: [internet Explorer] C:\WINDOWS\System32\IEXPLORE.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [Windows LoL Layer] iwffvol.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = D:\Progrmay\msOffice\Office\OSA9.EXE O10 - Broken Internet access because of LSP provider ‘c:\windows\system32\rsvpsp.dll’ missing O17 - HKLM\System\CCS\Services\Tcpip…{D06AF5DA-D6B5-4C32-87FB-920DF315D6A2}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Progrmay\avast\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Progrmay\avast\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Progrmay\avast\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Progrmay\avast\ashWebSv.exe" /service (file missing) O23 - Service: Windows Host Services (DLLHOST32) - Unknown owner - C:\WINDOWS\system\dllhost.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe" /service (file missing) O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\System32\rsvp.exe (file missing)

Gutek · 8 Styczeń 2007 14:38

Start >>> Uruchom >>> services.msc >>> zatrzymaj i wyłącz Network helper Service , a wpisy usuń HT

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\System32\almutairi.exe

C:\WINDOWS\System32\irdvxc.exe

C:\WINDOWS\System32\IEXPLORE.exe

C:\WINDOWS\System32\iwffvol.exe

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

Po wszytskim nowe logi z Silenta i HJT

siwy89 · 8 Styczeń 2007 16:22

Po zabiegach wrzucam log hijack this. silent runners cos bardzo wolno generuje ten log a za bardzo nie mam czasu.

Logfile of HijackThis v1.99.1 Scan saved at 17:23:03, on 2007-01-08 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Progrmay\avast\aswUpdSv.exe D:\Progrmay\NetLimiter\NetLimiter.exe D:\Progrmay\avast\ashDisp.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\IEXPLORE.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Progrmay\avast\ashServ.exe C:\WINDOWS\system\dllhost.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4gui.exe D:\Progrmay\avast\ashWebSv.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4gui.exe D:\Progrmay\avast\ashMaiSv.exe D:\Progrmay\Mozilla Firefox\firefox.exe D:\Szkoła\Siwy\HijackThis.com.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Progrmay\adobe reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Progrmay\Java\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NetLimiter] D:\Progrmay\NetLimiter\NetLimiter.exe /s O4 - HKLM…\Run: [avast!] D:\Progrmay\avast\ashDisp.exe O4 - HKLM…\Run: [sunJavaUpdateSched] D:\Progrmay\Java\bin\jusched.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [internet Explorer] C:\WINDOWS\System32\IEXPLORE.exe O4 - HKLM…\RunServices: [internet Explorer] C:\WINDOWS\System32\IEXPLORE.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = D:\Progrmay\msOffice\Office\OSA9.EXE O10 - Broken Internet access because of LSP provider ‘c:\windows\system32\rsvpsp.dll’ missing O17 - HKLM\System\CCS\Services\Tcpip…{D06AF5DA-D6B5-4C32-87FB-920DF315D6A2}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Progrmay\avast\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Progrmay\avast\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Progrmay\avast\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Progrmay\avast\ashWebSv.exe" /service (file missing) O23 - Service: Windows Host Services (DLLHOST32) - Unknown owner - C:\WINDOWS\system\dllhost.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe" /service (file missing) O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\System32\rsvp.exe (file missing)

Mam pytanie co do tych 04 IEXPLORE, czy to na pewno nie jest jakis robal??

adam9870 · 8 Styczeń 2007 16:39

Start => uruchom => cmd => wpisz:

sc stop MSDisk

sc delete MSDisk

Pliki usuń ręcznie w trybie awaryjnym jeśli będą, a wpisy w hjt.

Po wykonaniu proszę pokazać nowy log z HijackThis plus z SilentRunners.

siwy89 · 8 Styczeń 2007 20:05

Po zabiegach

Logfile of HijackThis v1.99.1 Scan saved at 21:08:20, on 2007-01-08 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Progrmay\avast\aswUpdSv.exe D:\Progrmay\NetLimiter\NetLimiter.exe D:\Progrmay\avast\ashDisp.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Progrmay\avast\ashServ.exe C:\WINDOWS\system\dllhost.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4gui.exe D:\Progrmay\avast\ashWebSv.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4gui.exe D:\Progrmay\avast\ashMaiSv.exe D:\Progrmay\Mozilla Firefox\firefox.exe D:\Szkoła\Siwy\HijackThis.com.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Progrmay\adobe reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Progrmay\Java\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NetLimiter] D:\Progrmay\NetLimiter\NetLimiter.exe /s O4 - HKLM…\Run: [avast!] D:\Progrmay\avast\ashDisp.exe O4 - HKLM…\Run: [sunJavaUpdateSched] D:\Progrmay\Java\bin\jusched.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\GetFlash.exe -p O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = D:\Progrmay\msOffice\Office\OSA9.EXE O10 - Broken Internet access because of LSP provider ‘c:\windows\system32\rsvpsp.dll’ missing O17 - HKLM\System\CCS\Services\Tcpip…{D06AF5DA-D6B5-4C32-87FB-920DF315D6A2}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Progrmay\avast\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Progrmay\avast\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Progrmay\avast\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Progrmay\avast\ashWebSv.exe" /service (file missing) O23 - Service: Windows Host Services (DLLHOST32) - Unknown owner - C:\WINDOWS\system\dllhost.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\System32\rsvp.exe (file missing)

adam9870 · 8 Styczeń 2007 20:24

Jest ok.

Dlaczego nie wkleiłeś loga z Silenta?

Proponuję zainstalować dodatek Service Pack 2. Poprawia on bezpieczeństwo w systemie etc.

http://xp.net.pl/art/xpsp2.html

http://xp.net.pl/art/windowsxp_sp2.html