Problem z plikiem ibm00003.exe

iwonaas · 14 Lipiec 2006 13:49

Mam problem z plikiem ibm00003.exe. Choć jest już usunięty, pojawia mi się komunikat, że nie można odnaleść tego pliku. Czy można z tym coś zrobić ?

Gutek · 14 Lipiec 2006 15:05

Daj log z Silenta i HJT - http://forum.dobreprogramy.pl/viewtopic.php?t=36654

iwonaas · 14 Lipiec 2006 15:18

Logfile of HijackThis v1.99.1 Scan saved at 17:20:17, on 06-07-14 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MSTASK.EXE C:\PROGRAM FILES\ESET\NOD32KRN.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\PROGRAM FILES\HP\HP SOFTWARE UPDATE\HPWUSCHD2.EXE C:\PROGRAM FILES\ESET\NOD32KUI.EXE C:\PROGRAM FILES\GADU-GADU\GG.EXE C:\PROGRAM FILES\SKYPE\PHONE\SKYPE.EXE C:\PROGRAM FILES\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\HP\DIGITAL IMAGING\BIN\HPQSTE08.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\PROGRAM FILES\OPERA\OPERA.EXE C:\WINDOWS\TEMP\RAR$EX00.300\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.biz/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nowfind.biz/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.biz/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.biz/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nowfind.biz/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.biz/clickpps.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p1 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.biz/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.biz/clickpps.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINDOWS\WEBDLG32.DLL (file missing) O1 - Hosts: 127.0.0.5 makethemcry.com O1 - Hosts: 127.0.0.5 loudcash.com O1 - Hosts: 127.0.0.5 iframestat.com O1 - Hosts: 127.0.0.5 toolbarpartner.com O1 - Hosts: 127.0.0.5 hqcash.com O1 - Hosts: 127.0.0.5 verybigcash.com O1 - Hosts: 127.0.0.5 makethemcry.com O1 - Hosts: 127.0.0.5 moviepartnership.com O1 - Hosts: 127.0.0.5 callmachine.com O1 - Hosts: 127.0.0.5 regcash.com O1 - Hosts: 127.0.0.5 toolbarpartner.com O1 - Hosts: 127.0.0.5 klikrevenue.com O1 - Hosts: 127.0.0.5 p2dll.com O1 - Hosts: 127.0.0.5 t73.com O1 - Hosts: 127.0.0.5 http://www.makethemcry.com O1 - Hosts: 127.0.0.5 http://www.loudcash.com O1 - Hosts: 127.0.0.5 http://www.iframestat.com O1 - Hosts: 127.0.0.5 http://www.toolbarpartner.com O1 - Hosts: 127.0.0.5 http://www.hqcash.com O1 - Hosts: 127.0.0.5 http://www.verybigcash.com O1 - Hosts: 127.0.0.5 http://www.makethemcry.com O1 - Hosts: 127.0.0.5 http://www.moviepartnership.com O1 - Hosts: 127.0.0.5 http://www.callmachine.com O1 - Hosts: 127.0.0.5 http://www.regcash.com O1 - Hosts: 127.0.0.5 http://www.toolbarpartner.com O1 - Hosts: 127.0.0.5 http://www.klikrevenue.com O1 - Hosts: 127.0.0.5 http://www.p2dll.com O1 - Hosts: 127.0.0.5 http://www.t73.com # O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-544243544243} - C:\WINDOWS\SYSTEM\TBC.DLL (file missing) O2 - BHO: CDownCom Class - {031B6D43-CBC4-46A5-8E46-CF8B407C1A33} - C:\WINDOWS\DOWNLO~1\IPREG32.DLL (file missing) O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINDOWS\WEBDLG32.DLL (file missing) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM220.DLL (file missing) O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\PROGRAM FILES\SIDEFIND\SFBHO.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-71766C641316} - C:\WINDOWS\SYSTEM\VLD1316.DLL (file missing) O3 - Toolbar: Search Toolbar - {9EAC0102-5E61-2312-BC2D-544243544243} - C:\WINDOWS\SYSTEM\TBC.DLL (file missing) O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\WEBDLG32.DLL (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM…\Run: [scanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM…\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM…\Run: [systemTray] SysTray.Exe O4 - HKLM…\Run: [QuickTime Task] “C:\WINDOWS\SYSTEM\QTTASK.EXE” -atboottime O4 - HKLM…\Run: [Zasobnik systemowy] SysTray.Exe O4 - HKLM…\Run: [stillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [KAV50Service] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kavmm.exe” -run bl -n Workstation -v 5.0.0.0 -ttsr 10000000 O4 - HKLM…\Run: [KAV50] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Workstation 5\kwsprod.exe” -run -n Workstation -v 5.0.0.0 -chkss O4 - HKLM…\RunServices: [schedulingAgent] mstask.exe O4 - HKLM…\RunServices: [NOD32kernel] “C:\Program Files\Eset\nod32krn.exe” O4 - HKCU…\Run: [Gadu-Gadu] “C:\PROGRAM FILES\GADU-GADU\GG.EXE” /tray O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O4 - HKCU…\Run: [skype] “C:\PROGRAM FILES\SKYPE\PHONE\SKYPE.EXE” /nosplash /minimized O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL (file missing) O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.qck.cc O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.thawte.com O15 - Trusted Zone: *.climaxbucks.com O15 - Trusted Zone: *.sidefind.com O15 - Trusted Zone: *.gateone.ath.cx O15 - Trusted Zone: *.zangocash.com O15 - Trusted Zone: *.loudcash.com O15 - Trusted Zone: http://ny.contentmatch.net (HKLM) O15 - Trusted Zone: *.gateone.ath.cx (HKLM) O15 - Trusted Zone: *.zangocash.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.loudcash.com (HKLM) O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares … egular.cab O21 - SSODL: DDE Module - {DABB03E9-AC0D-3740-E3E5-4B37C80837E5} - C:\WINDOWS\SYSTEM\mtwirl.dll (file missing)

Gutek · 14 Lipiec 2006 15:28

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.biz/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nowfind.biz/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.biz/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.biz/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nowfind.biz/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.biz/clickpps.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p1 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.biz/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.biz/clickpps.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINDOWS\WEBDLG32.DLL (file missing) O1 - Hosts: 127.0.0.5 makethemcry.com O1 - Hosts: 127.0.0.5 loudcash.com O1 - Hosts: 127.0.0.5 iframestat.com O1 - Hosts: 127.0.0.5 toolbarpartner.com O1 - Hosts: 127.0.0.5 hqcash.com O1 - Hosts: 127.0.0.5 verybigcash.com O1 - Hosts: 127.0.0.5 makethemcry.com O1 - Hosts: 127.0.0.5 moviepartnership.com O1 - Hosts: 127.0.0.5 callmachine.com O1 - Hosts: 127.0.0.5 regcash.com O1 - Hosts: 127.0.0.5 toolbarpartner.com O1 - Hosts: 127.0.0.5 klikrevenue.com O1 - Hosts: 127.0.0.5 p2dll.com O1 - Hosts: 127.0.0.5 t73.com O1 - Hosts: 127.0.0.5 http://www.makethemcry.com O1 - Hosts: 127.0.0.5 http://www.loudcash.com O1 - Hosts: 127.0.0.5 http://www.iframestat.com O1 - Hosts: 127.0.0.5 http://www.toolbarpartner.com O1 - Hosts: 127.0.0.5 http://www.hqcash.com O1 - Hosts: 127.0.0.5 http://www.verybigcash.com O1 - Hosts: 127.0.0.5 http://www.makethemcry.com O1 - Hosts: 127.0.0.5 http://www.moviepartnership.com O1 - Hosts: 127.0.0.5 http://www.callmachine.com O1 - Hosts: 127.0.0.5 http://www.regcash.com O1 - Hosts: 127.0.0.5 http://www.toolbarpartner.com O1 - Hosts: 127.0.0.5 http://www.klikrevenue.com O1 - Hosts: 127.0.0.5 http://www.p2dll.com O1 - Hosts: 127.0.0.5 http://www.t73.com # O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-544243544243} - C:\WINDOWS\SYSTEM\TBC.DLL (file missing) O2 - BHO: CDownCom Class - {031B6D43-CBC4-46A5-8E46-CF8B407C1A33} - C:\WINDOWS\DOWNLO~1\IPREG32.DLL (file missing) O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINDOWS\WEBDLG32.DLL (file missing) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM220.DLL (file missing) O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\PROGRAM FILES\SIDEFIND\SFBHO.DLL (file missing) O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-71766C641316} - C:\WINDOWS\SYSTEM\VLD1316.DLL (file missing) O3 - Toolbar: Search Toolbar - {9EAC0102-5E61-2312-BC2D-544243544243} - C:\WINDOWS\SYSTEM\TBC.DLL (file missing) O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\WEBDLG32.DLL (file missing) O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.qck.cc O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.thawte.com O15 - Trusted Zone: *.climaxbucks.com O15 - Trusted Zone: *.sidefind.com O15 - Trusted Zone: *.gateone.ath.cx O15 - Trusted Zone: *.zangocash.com O15 - Trusted Zone: *.loudcash.com O15 - Trusted Zone: http://ny.contentmatch.net (HKLM) O15 - Trusted Zone: *.gateone.ath.cx (HKLM) O15 - Trusted Zone: *.zangocash.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.loudcash.com (HKLM) O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares … egular.cab O21 - SSODL: DDE Module - {DABB03E9-AC0D-3740-E3E5-4B37C80837E5} - C:\WINDOWS\SYSTEM\mtwirl.dll (file missing)

w trybie awaryjnym usuń pliki i foldery, a wpisy HJT, użyj KillTrusted 0.7

Dokończyć skanerami online - Skanery do wyboru

Zób tak bo na pewno jest:

Zedytować musisz: Start >>> Uruchom >>> SYSTEM.INI i zedytuj ten wpis, jak się nie pokaże.

Mój komputer >>> Narzędzia >>> Opcje folderów >>> Widok

Zaznaczone Pokaż ukryte pliki i foldery + odznaczone Ukryj chronione pliki systemu operacyjnego…

Jak zedytować, w sekcji [boot] jest po shell = explorer.exe ibm00003.exe" [MS], usunąć stamtąd ibm00003.exe (ma zostać shell=explorer.exe)

iwonaas · 15 Lipiec 2006 08:38

Dziękuję bardzo. Nie pojawia mi się już komunikat, jest wszystko ok.

Gutek · 15 Lipiec 2006 08:43

Kontrolnie prosze o logi