Jak tam mój log :D

incognito997 · 25 Kwiecień 2005 16:12

Logfile of HijackThis v1.99.1

Scan saved at 18:09:46, on 2005-04-25

Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe

C:\PROGRA~1\NEOSTR~1\CnxMon.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe

C:\Program Files\CiDial\CiDial.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AvTask.exe

C:\Documents and Settings\1\Pulpit\hijackthis\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =  

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

R3 - Default URLSearchHook is missing

F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {EB78D545-7084-1460-B78B-C15169BF794D} - (no file)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe

O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKCU\..\Run: [HDDHealth] C:\Program Files\HDD Health\hddhealth.exe -wl

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O8 - Extra context menu item: Pobierz przez Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html

O8 - Extra context menu item: Pobierz wszystko przez Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O15 - Trusted Zone: *.awmdabest.com (HKLM)

O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)

O15 - Trusted IP range: 206.161.125.149

O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone

O17 - HKLM\System\CCS\Services\Tcpip\..\{78444802-384D-460F-9EE6-2156A533A556}: NameServer = 194.204.152.34 217.98.63.164

O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe

O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe

O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe

O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe

O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe

Czy coś jest nie tak ??

boczi · 25 Kwiecień 2005 16:25

Kasacja w Hijacku z wył. przywracaniem systemu w atrybie awaryjnym [F8].

R3 - Default URLSearchHook is missing

   	O2 - BHO: (no name) - {EB78D545-7084-1460-B78B-C15169BF794D} - (no file)

 	O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)

Wpisy:

O15 - Trusted Zone: *.awmdabest.com (HKLM)

O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)

O15 - Trusted IP range: 206.161.125.149

O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone

usuwasz programem KillTrusted

Odinstaluj soft Neo i skonfiguruj połączenie ręcznie.

http://www.neostrada.info

http://www.turbokrecik.info

http://www.autoconnect.prv.pl

Po czynnościach na nowo log

musg · 25 Kwiecień 2005 16:30

kosmetycznie ciachnij:

wylacz przywracanie systemu i usun:

sciagnij program :

http://www.searchengines.pl/phpbb203/in … ost&id=459

i wywal

natomiast ten wpis:

usuwasz tak:

http://forum.mks.com.pl/forum/viewthread.php?tid=11654

za pomoca tego programu:

http://www.bleepingcomputer.com/files/killbox.php

na koniec wywal:

O2 - BHO: (no name) - {EB78D545-7084-1460-B78B-C15169BF794D} - (no file)

daj raz jeszcze log

incognito997 · 25 Kwiecień 2005 16:56

Teraz log wygląda tak :lol:

Logfile of HijackThis v1.99.1

Scan saved at 18:56:23, on 2005-04-25

Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe

C:\PROGRA~1\NEOSTR~1\CnxMon.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe

C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\CiDial\CiDial.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Winamp\winamp.exe

C:\Documents and Settings\1\Pulpit\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP

F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM…\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe

O4 - HKLM…\Run: [CloneCDTray] “C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe” /s

O4 - HKLM…\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe

O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon

O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe

O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe

O4 - HKLM…\Run: [APVXDWIN] “C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE” /s

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [nwiz] nwiz.exe /install

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [HDDHealth] C:\Program Files\HDD Health\hddhealth.exe -wl

O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized

O8 - Extra context menu item: Pobierz przez Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html

O8 - Extra context menu item: Pobierz wszystko przez Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O17 - HKLM\System\CCS\Services\Tcpip…{78444802-384D-460F-9EE6-2156A533A556}: NameServer = 194.204.152.34 217.98.63.164

O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe

O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe

O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe

O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe

O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe

musg · 25 Kwiecień 2005 17:15

sciagnij:

http://www.bleepingcomputer.com/files/killbox.php

wklej w okienku:

C:\WINDOWS\System32\hwclock.exe

cytat:

W okienku wpisujemy ścieżkę dostępu albo klikamy Brosfe for file i sami wskazujemy plik.Następnie wybieramy metodę usuwania: Standard File kiil , Delate on Reboot albo Replece on

reszta jest ok

pamietaj o sp2

incognito997 · 25 Kwiecień 2005 17:17

Ej słuchaj … wtedy pisze ze ten plik nieistnieje a napewno robie dobrze wszystko :-o więc niewiem …

musg · 25 Kwiecień 2005 17:24

slucham

zrob tak-wywa go za pomoca hijacka:

Odpalasz— HijackThis Misc Tools>>> Delete NT service >>> wpisz hwclock >>> Ok i restart kompa

incognito997 · 25 Kwiecień 2005 17:25

OK teraz jest dobrze :lol: dziekS

musg · 25 Kwiecień 2005 17:29

to dobrze pamietaj jeszcze o sp2

http://www.microsoft.com/poland/windows … fault.mspx

incognito997 · 25 Kwiecień 2005 17:40

Ej nie , jednak niejest dobrze ten wpis dalej jest a jak chce skasować tak jak mi napisałeś wyżej to pisze takie coś :

The service ‘hwclock’ is enabled and/or running. Disable it first , using HijackThis itself ( from the scan results) or the services.msc window.

Gutek · 25 Kwiecień 2005 17:45

OK zobacz TUTAJ i bedzie z głowy

incognito997 · 25 Kwiecień 2005 17:46

w TUTAJ nie ma nic chyba coś się nieudało

musg · 25 Kwiecień 2005 17:48

mialo byc w tutaj

http://www.searchengines.pl/phpbb203/in … etlastpost

Gutek · 25 Kwiecień 2005 17:48

Już jest edytowałem mały błąd na szybkiego nie dziw się