dobreprogramy - forum

Kyniu6 · 26 Kwiecień 2005 19:42

Witam. Oto log kolegi.

Logfile of HijackThis v1.99.1 Scan saved at 21:33:19, on 05-04-26 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v5.00 (5.00.2614.3500) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\INTERNAT.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAM FILES\WINAMP\WINAMPA.EXE C:\NBQMBS.EXE C:\PROGRAM FILES\180SOLUTIONS\SAIS.EXE C:\WINDOWS\OHSF.EXE C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCK.EXE C:\WINDOWS\RUNDLL32.EXE C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCESS.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\RUNDLL32.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\PULPIT\HIJACKTHIS.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forum.dobreprogramy.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.eu.microsoft.com/poland/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\PROGRAM FILES\SIDEFIND\SFBHO.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM…\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM…\Run: [internat.exe] internat.exe O4 - HKLM…\Run: [systemTray] SysTray.Exe O4 - HKLM…\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM…\Run: [Zasobnik systemowy] SysTray.Exe O4 - HKLM…\Run: [Magic Install…] D:\SETUP.EXE O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [iST Service] \ISTsvc\istsvc.exe O4 - HKLM…\Run: [OeGxPxY8B] C:\NBQMBS.EXE O4 - HKLM…\Run: [Power Scan] C:\PROGRAM FILES\POWER SCAN\POWERSCAN.EXE O4 - HKLM…\Run: [ohsf] C:\WINDOWS\ohsf.exe O4 - HKLM…\Run: [Media Access] C:\PROGRAM FILES\MEDIA ACCESS\MediaAccK.exe O4 - HKLM…\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKCU…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU…\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU…\Run: [Gadu-Gadu] “C:\PROGRAM FILES\GADU-GADU\GG.EXE” /tray O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL O14 - IERESET.INF: SEARCH_PAGE_URL= O14 - IERESET.INF: START_PAGE_URL= O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4. … egular.cab O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Media … e-c123.cab O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-int … b?fgiocv=1 O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = http://www.aip.prv.pl O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 194.204.159.1,194.204.152.34 O18 - Filter: text/html - {F558FEE0-B68B-11D9-8DCD-00304F23D45E} - C:\WINDOWS\DANE APLIKACJI\MICROSOFT\INTERNET EXPLORER\V0.26.DAT

Z góry dzięki :lol:

pikasso · 26 Kwiecień 2005 19:47

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL

O14 - IERESET.INF: SEARCH_PAGE_URL=

O14 - IERESET.INF: START_PAGE_URL=

O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4. … egular.cab

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Media … e-c123.cab

O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-int … b?fgiocv=1

O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = http://www.aip.prv.pl

Gutek · 26 Kwiecień 2005 19:49

C:\NBQMBS.EXE C:\PROGRAM FILES\180SOLUTIONS\SAIS.EXE C:\WINDOWS\OHSF.EXE C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCK.EXE C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCESS.EXE C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\PROGRAM FILES\SIDEFIND\SFBHO.DLL O4 - HKLM…\Run: [iST Service] \ISTsvc\istsvc.exe O4 - HKLM…\Run: [OeGxPxY8B] C:\NBQMBS.EXE O4 - HKLM…\Run: [Power Scan] C:\PROGRAM FILES\POWER SCAN\POWERSCAN.EXE O4 - HKLM…\Run: [ohsf] C:\WINDOWS\ohsf.exe O4 - HKLM…\Run: [Media Access] C:\PROGRAM FILES\MEDIA ACCESS\MediaAccK.exe O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL O14 - IERESET.INF: SEARCH_PAGE_URL= O14 - IERESET.INF: START_PAGE_URL= O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Media … e-c123.cab O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-int … b?fgiocv=1

Zastartować do trybu awaryjnego bez internetu.
Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked.
Skasować z dysku pliki i foldery, które podkreśliłem na czerwono (odinstaluj w dodadj/usuń)
Dokończyć skanerami online - Scanery do wyboru
Pokazać nowy log

FxIstbar.exe. użyj

Kyniu6 · 26 Kwiecień 2005 20:21

Logfile of HijackThis v1.99.1 Scan saved at 22:19:03, on 05-04-26 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v5.00 (5.00.2614.3500) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\INTERNAT.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAM FILES\WINAMP\WINAMPA.EXE C:\PROGRAM FILES\GADU-GADU\GG.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\RUNDLL32.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\PULPIT\HIJACKTHIS.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.eu.microsoft.com/poland/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM…\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM…\Run: [internat.exe] internat.exe O4 - HKLM…\Run: [systemTray] SysTray.Exe O4 - HKLM…\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM…\Run: [Zasobnik systemowy] SysTray.Exe O4 - HKLM…\Run: [Magic Install…] D:\SETUP.EXE O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKCU…\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU…\Run: [Gadu-Gadu] “C:\PROGRAM FILES\GADU-GADU\GG.EXE” /tray O14 - IERESET.INF: SEARCH_PAGE_URL= O14 - IERESET.INF: START_PAGE_URL= O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4. … egular.cab O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = http://www.aip.prv.pl O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 194.204.159.1,194.204.152.34 O18 - Filter: text/html - {F558FEE0-B68B-11D9-8DCD-00304F23D45E} - C:\WINDOWS\DANE APLIKACJI\MICROSOFT\INTERNET EXPLORER\V0.26.DAT

Te wpisy ciągle wracają:

O14 - IERESET.INF: SEARCH_PAGE_URL=

O14 - IERESET.INF: START_PAGE_URL=

Tutaj log z tego programu FxIstbar:

Symantec Adware.Istbar Removal Tool 1.0.7 registry: HKEY_USERS.DEFAULT\Software\Avenue Media (key deleted) registry: HKEY_USERS.DEFAULT\Software\IST (key deleted) registry: HKEY_USERS.DEFAULT\Software\Policies\Avenue Media (key deleted) registry: HKEY_USERS.DEFAULT\Software\sais (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Avenue Media (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BrowserHelperObject.BAHelper (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BrowserHelperObject.BAHelper.1 (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{8CBA1B49-8144-4721-A7B1-64C578C9EED7} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{A3FDD654-A057-4971-9844-4ED8E67DBBB8} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface{339D8AFF-0B42-4260-AD82-78CE605A9543} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface{A36A5936-CFD9-4B41-86BD-319A1931887F} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SideFind.Finder (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SideFind.Finder.1 (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib{58634367-D62B-4C2C-86BE-5AAC45CDB671} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib{D0288A41-9855-4A9B-8316-BABE243648DA} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\ISTsvc (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions{10E42047-DEB9-4535-A118-B3F6EC39B807} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SideFind (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{A3FDD654-A057-4971-9844-4ED8E67DBBB8} (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISTsvc (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SideFind (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sais (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Avenue Media (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\SideFind (key deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\sais (key deleted) registry: HKEY_USERS.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping: {10E42047-DEB9-4535-A118-B3F6EC39B807} (value deleted) registry: HKEY_USERS.DEFAULT\Software\Microsoft\Internet Explorer\Main: BandRest (value deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main: BandRest (value deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run: IST Service (value deleted) registry: HKEY_LOCAL_MACHINE\SOFTWARE\PowerScan (key deleted) registry: HKEY_USERS.DEFAULT\SOFTWARE\PowerScan (key deleted) process: IEXPLORE.EXE (terminated) process: IEXPLORE.EXE (terminated) process: IEXPLORE.EXE (terminated) process: IEXPLORE.EXE (terminated) process: IEXPLORE.EXE (terminated) c:\WINDOWS\Temporary Internet Files\Content.IE5\GDIJKLMN\nem220[1].dll: (deleted) c:\WINDOWS\Temporary Internet Files\Content.IE5\GDIJKLMN\ncase_new[1].exe: (deleted) registry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run: ohsf (value deleted) c:\WINDOWS\ohsf.exe: (deleted) c:\Program Files\180Solutions\sais.exe: (deleted) C:\Program Files\180Solutions\FLEOK : (directory deleted) C:\Program Files\180Solutions : (directory deleted) registry: HKEY_USERS.DEFAULT\Software\Microsoft\Internet Explorer\Main: Start Page (value set to “about:blank”) Adware.Istbar has been successfully removed from your computer! Here is the report: The total number of the scanned files: 7170 The number of deleted files: 9 The number of directories deleted: 2 The number of threat processes terminated: 0 The number of other processes terminated: 5 The number of registry entries fixed: 33

Czy on sam usunął już świnstwa ??

Gutek · 26 Kwiecień 2005 20:28

LOG OK wszystko usunięte

Kyniu6 · 26 Kwiecień 2005 20:47

Dzięki wielkie Gutek2222

Gutek · 26 Kwiecień 2005 20:57

No jestem ślepy jeszcze wpis 018-ście

sorki i wszystko będzie OK