Log - jakis syf mi wszedl

Klin · 29 Sierpień 2005 14:50

Witam ,

zasinatlowalem sobie dodatkowe ikonki do windy no i w pliku byl zawarty syf.

Widze ,ze jakies gowno mi siedzi w autostarcie ale nieda sie usunac …podaje loga :

Logfile of HijackThis v1.99.1

Scan saved at 16:52:03, on 29.08.2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe

C:\Programme\Gadu-Gadu\gg.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\kernel.exe

C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\sc_watch.exe

C:\Programme\NetMeter\NetMeter.exe

C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE

C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Dokumente und Einstellungen\Dawid\Desktop\Filmy\hijackthis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com/start.shtml

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adclick.hit.gemius.pl/hitredir/id=ncdL_PcBkE_Jxx_B0nbGkaei.szImsd1Eqmpw5.w40b..7/stparam=qjjspxpgaq/url=http://www.english.wskiz.edu/gg/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: IE5BarLauncherBHO Class - {1ADBCCE8-CF84-441E-9B38-AFC7A19C06A4} - C:\Programme\e-zshopper\BarLcher.dll

O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programme\NewDotNet\newdotnet6_38.dll

O3 - Toolbar: e-zshopper V1.20 - {3D782BB3-F2A5-11D3-BF4C-000000000000} - C:\Programme\e-zshopper\BarLcher.dll

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe

O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [AtiTrayTools] "C:\Programme\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe"

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programme\Gadu-Gadu\gg.exe" /tray

O9 - Extra button: eZshopper - {BFA03761-5565-41b3-93D9-82B354C0A8EC} - SHDOCVW.DLL (file missing)

O9 - Extra 'Tools' menuitem: e-zshopper - {BFA03761-5565-41b3-93D9-82B354C0A8EC} - SHDOCVW.DLL (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O17 - HKLM\System\CCS\Services\Tcpip\..\{19BEA577-2585-4200-8613-68B89ACBEBD6}: NameServer = 217.237.150.97 217.237.150.225

O17 - HKLM\System\CS1\Services\Tcpip\..\{19BEA577-2585-4200-8613-68B89ACBEBD6}: NameServer = 217.237.150.97 217.237.150.225

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

detektyw · 29 Sierpień 2005 14:56

Klin

Panel sterowania i odinstaluj C:\Programme\ NewDotNet \newdotnet6_38.dll

Wpisy 010 kasujesz za pomocą LSPFix

http://cexx.org/LSPFix.exe

El_Presidento · 29 Sierpień 2005 14:58

Napisz z jakiej strony je pobrales i co to byly za ikony. Aby nastepne osoby nie mialy juz tego problemu

Klin · 29 Sierpień 2005 15:17

http://forum.dobreprogramy.pl/viewtopic.php?t=40527

:evil: :evil: Ale mnie syfy denerwuja :?

Detektyw , jak mam to usunac tym programem ??

kuz5 · 29 Sierpień 2005 15:37

Odpal LSP-Fix i napisz jakie pliki znajdują sie w oknie Keep a my ci napiszemy jak i jaki plik usunąć.

Klin · 29 Sierpień 2005 17:27

Jest napisane :

mswsock.dll TCP/IP

winrnr.dll NTDS

rsvpsp.dll (protocol handler)

Tak jest tam napisane …

UPDATE:

ok wyczyscilem zobaczcie czy teraz czysto :

Logfile of HijackThis v1.99.1

Scan saved at 19:46:16, on 29.08.2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe

C:\Programme\Gadu-Gadu\gg.exe

C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\kernel.exe

C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\sc_watch.exe

C:\Programme\NetMeter\NetMeter.exe

C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE

C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE

C:\Dokumente und Einstellungen\Dawid\Desktop\Filmy\hijackthis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com/start.shtml

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adclick.hit.gemius.pl/hitredir/id=ncdL_PcBkE_Jxx_B0nbGkaei.szImsd1Eqmpw5.w40b..7/stparam=qjjspxpgaq/url=http://www.english.wskiz.edu/gg/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe

O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [AtiTrayTools] "C:\Programme\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe"

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programme\Gadu-Gadu\gg.exe" /tray

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{19BEA577-2585-4200-8613-68B89ACBEBD6}: NameServer = 217.237.150.97 217.237.150.225

O17 - HKLM\System\CS1\Services\Tcpip\..\{19BEA577-2585-4200-8613-68B89ACBEBD6}: NameServer = 217.237.150.97 217.237.150.225

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Gutek · 29 Sierpień 2005 19:41

Czysto