Prosze o sprawdzenie loga


(Feniq) #1

mam problem weszlem na stronke i cos mi nieposzlo i teraz mi pokazuje blad ibm00001 i wira chyba mam

Mam prosbe o sprawdzenie loga

Logfile of HijackThis v1.99.1

Scan saved at 22:22:30, on 05-10-05

Platform: Windows 98 SE (Win9x 4.10.2222A)

MSIE: Internet Explorer v5.00 (5.00.2614.3500)


Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\WINDOWS\SYSTEM\HPOOPM07.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE

C:\WINDOWS\SYSTEM\SPOOL32.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPODEV07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\FRU\REMIND32.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOEVM07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOSTS07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOFXM07.EXE

C:\PROGRAM FILES\WAPSTER\AQQ\AQQ.EXE

C:\WINDOWS\SYSTEM\MDMS.EXE

C:\WINDOWS\TOOL2.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\WINDOWS\SYSTEM\PAYTIME.EXE

C:\WINDOWS\SYSTEM\SENDER.EXE

C:\WINDOWS\PULPIT\STRAWA\śCIąGANIE\HIJACKTHIS\HIJACKTHIS.EXE


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.eu.microsoft.com/poland/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O1 - Hosts: 127.0.0.4 n-glx.s-redirect.com

O1 - Hosts: 127.0.0.4 x.full-tgp.net

O1 - Hosts: 127.0.0.4 counter.sexmaniack.com

O1 - Hosts: 127.0.0.4 autoescrowpay.com

O1 - Hosts: 127.0.0.4 www.autoescrowpay.com

O1 - Hosts: 127.0.0.4 www.awmdabest.com

O1 - Hosts: 127.0.0.4 www.sexfiles.nu

O1 - Hosts: 127.0.0.4 awmdabest.com

O1 - Hosts: 127.0.0.4 sexfiles.nu

O1 - Hosts: 127.0.0.4 allforadult.com

O1 - Hosts: 127.0.0.4 www.allforadult.com

O1 - Hosts: 127.0.0.4 www.iframe.biz

O1 - Hosts: 127.0.0.4 iframe.biz

O1 - Hosts: 127.0.0.4 www.newiframe.biz

O1 - Hosts: 127.0.0.4 newiframe.biz

O1 - Hosts: 127.0.0.4 www.vesbiz.biz

O1 - Hosts: 127.0.0.4 vesbiz.biz

O1 - Hosts: 127.0.0.4 www.pizdato.biz

O1 - Hosts: 127.0.0.4 pizdato.biz

O1 - Hosts: 127.0.0.4 www.aaasexypics.com

O1 - Hosts: 127.0.0.4 aaasexypics.com

O1 - Hosts: 127.0.0.4 www.virgin-tgp.net

O1 - Hosts: 127.0.0.4 virgin-tgp.net

O1 - Hosts: 127.0.0.4 www.awmcash.biz

O1 - Hosts: 127.0.0.4 awmcash.biz

O1 - Hosts: 127.0.0.4 buldog-stats.com

O1 - Hosts: 127.0.0.4 www.buldog-stats.com

O1 - Hosts: 127.0.0.4 fregat.drocherway.com

O1 - Hosts: 127.0.0.4 slutmania.biz

O1 - Hosts: 127.0.0.4 www.slutmania.biz

O1 - Hosts: 127.0.0.4 toolbarpartner.com

O1 - Hosts: 127.0.0.4 www.toolbarpartner.com

O1 - Hosts: 127.0.0.4 www.megapornix.com

O1 - Hosts: 127.0.0.4 megapornix.com

O1 - Hosts: 127.0.0.4 www.sp2fucked.biz

O1 - Hosts: 127.0.0.4 sp2fucked.biz

O1 - Hosts: 127.0.0.4 greg-tut.com

O1 - Hosts: 127.0.0.4 www.greg-tut.com

O1 - Hosts: 127.0.0.4 nylonsexy.com

O1 - Hosts: 127.0.0.4 www.nylonsexy.com

O1 - Hosts: 127.0.0.4 vparivalka.com

O1 - Hosts: 127.0.0.4 www.vparivalka.com

O1 - Hosts: 127.0.0.4 iframeprofit.com

O1 - Hosts: 127.0.0.4 www.iframeprofit.com

O1 - Hosts: 127.0.0.4 topsearch10.com

O1 - Hosts: 127.0.0.4 www.topsearch10.com

O1 - Hosts: 127.0.0.4 statscash.biz

O1 - Hosts: 127.0.0.4 www.statscash.biz

O1 - Hosts: 127.0.0.4 vxiframe.biz

O1 - Hosts: 127.0.0.4 www.vxiframe.biz

O1 - Hosts: 127.0.0.4 crazy-toolbar.com

O1 - Hosts: 127.0.0.4 www.crazy-toolbar.com

O1 - Hosts: 127.0.0.4 topcash.biz

O1 - Hosts: 127.0.0.4 www.topcash.biz

O1 - Hosts: 127.0.0.4 loadcash.biz

O1 - Hosts: 127.0.0.4 www.loadcash.biz

O1 - Hosts: 127.0.0.4 txiframe.biz

O1 - Hosts: 127.0.0.4 www.txiframe.biz

O1 - Hosts: 127.0.0.4 procounter.biz

O1 - Hosts: 127.0.0.4 www.procounter.biz

O1 - Hosts: 127.0.0.4 advadmin.biz

O1 - Hosts: 127.0.0.4 www.advadmin.biz

O1 - Hosts: 127.0.0.4 trafficbest.net

O1 - Hosts: 127.0.0.4 www.trafficbest.net

O1 - Hosts: 127.0.0.4 besthvac.com

O1 - Hosts: 127.0.0.4 www.besthvac.com

O1 - Hosts: 127.0.0.4 traff4.com

O1 - Hosts: 127.0.0.4 www.traff4.com

O1 - Hosts: 127.0.0.4 ambush-script.com

O1 - Hosts: 127.0.0.4 www.ambush-script.com

O1 - Hosts: 127.0.0.4 beehappyy.biz

O1 - Hosts: 127.0.0.4 www.beehappyy.biz

O1 - Hosts: 127.0.0.4 tracktraff.cc

O1 - Hosts: 127.0.0.4 www.tracktraff.cc

O1 - Hosts: 127.0.0.4 allcount.net

O1 - Hosts: 127.0.0.4 www.allcount.net

O1 - Hosts: 127.0.0.4 onedayoffer.biz

O1 - Hosts: 127.0.0.4 www.onedayoffer.biz

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRAM FILES\FLASHGET\JCCATCH.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FGIEBAR.DLL

O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [SystemTray] SysTray.Exe

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe

O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\stimon.exe

O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\SYSTEM\hpoopm07.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP

O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE

O4 - HKLM\..\Run: [SysMemory manager] c:\windows\system\mdms.exe

O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\SYSTEM\paytime.exe

O4 - HKLM\..\Run: [combo.exe] combo.exe

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe

O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WAPSTER\AQQ\AQQ.EXE

O4 - HKCU\..\Run: [Shell] "C:\WINDOWS\SYSTEM\ibm00001.exe"

O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe

O4 - HKCU\..\Run: [SNInstall] C:\WINDOWS\TOOL2.EXE

O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\SYSTEM\paytime.exe

O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

O4 - Startup: Uruchamianie pakietu Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

O4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe

O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\FRU\Remind32.exe

O8 - Extra context menu item: Download using FlashGet - C:\PROGRAM FILES\FLASHGET\jc_link.htm

O8 - Extra context menu item: Download All by FlashGet - C:\PROGRAM FILES\FLASHGET\jc_all.htm

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE

O14 - IERESET.INF: SEARCH_PAGE_URL=

O14 - IERESET.INF: START_PAGE_URL=

O20 - Winlogon Notify: style2 - C:\WINDOWS\Q735628.DLL

z góry dziekuje


(Gutek) #2

  1. Zastartować do trybu awaryjnego bez internetu.

  2. Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked. Wpisy zostaną usunięte.

  3. Skasować z dysku pliki i foldery, które podkreśliłem na czerwono

  4. Dokończyć skanerami online - Scanery do wyboru

  5. Pokazać nowy log :stuck_out_tongue:

Zobacz Usuwanie Trojan.Repsamo

CWS.Systime Removal 3.5 też użyj oraz poczytaj jak usunąc tapetę SpySheriff


(Feniq) #3

to moj nowy log mam nadzieje ze wszystko dobrze zrobilem choc troszke wolno mi komp jeszcze chodzi

Logfile of HijackThis v1.99.1

Scan saved at 23:28:56, on 05-10-05

Platform: Windows 98 SE (Win9x 4.10.2222A)

MSIE: Internet Explorer v5.00 (5.00.2614.3500)


Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\IBM00001.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\WINDOWS\SYSTEM\HPOOPM07.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE

C:\PROGRAM FILES\WAPSTER\AQQ\AQQ.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPODEV07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\FRU\REMIND32.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\WINDOWS\SYSTEM\SPOOL32.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOEVM07.EXE

C:\WINDOWS\SYSTEM\HPOIPM07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOSTS07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOFXM07.EXE

C:\WINDOWS\PULPIT\STRAWA\śCIąGANIE\HIJACKTHIS\HIJACKTHIS.EXE


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O1 - Hosts: 127.0.0.4 n-glx.s-redirect.com

O1 - Hosts: 127.0.0.4 x.full-tgp.net

O1 - Hosts: 127.0.0.4 counter.sexmaniack.com

O1 - Hosts: 127.0.0.4 autoescrowpay.com

O1 - Hosts: 127.0.0.4 www.autoescrowpay.com

O1 - Hosts: 127.0.0.4 www.awmdabest.com

O1 - Hosts: 127.0.0.4 www.sexfiles.nu

O1 - Hosts: 127.0.0.4 awmdabest.com

O1 - Hosts: 127.0.0.4 sexfiles.nu

O1 - Hosts: 127.0.0.4 allforadult.com

O1 - Hosts: 127.0.0.4 www.allforadult.com

O1 - Hosts: 127.0.0.4 www.iframe.biz

O1 - Hosts: 127.0.0.4 iframe.biz

O1 - Hosts: 127.0.0.4 www.newiframe.biz

O1 - Hosts: 127.0.0.4 newiframe.biz

O1 - Hosts: 127.0.0.4 www.vesbiz.biz

O1 - Hosts: 127.0.0.4 vesbiz.biz

O1 - Hosts: 127.0.0.4 www.pizdato.biz

O1 - Hosts: 127.0.0.4 pizdato.biz

O1 - Hosts: 127.0.0.4 www.aaasexypics.com

O1 - Hosts: 127.0.0.4 aaasexypics.com

O1 - Hosts: 127.0.0.4 www.virgin-tgp.net

O1 - Hosts: 127.0.0.4 virgin-tgp.net

O1 - Hosts: 127.0.0.4 www.awmcash.biz

O1 - Hosts: 127.0.0.4 awmcash.biz

O1 - Hosts: 127.0.0.4 buldog-stats.com

O1 - Hosts: 127.0.0.4 www.buldog-stats.com

O1 - Hosts: 127.0.0.4 fregat.drocherway.com

O1 - Hosts: 127.0.0.4 slutmania.biz

O1 - Hosts: 127.0.0.4 www.slutmania.biz

O1 - Hosts: 127.0.0.4 toolbarpartner.com

O1 - Hosts: 127.0.0.4 www.toolbarpartner.com

O1 - Hosts: 127.0.0.4 www.megapornix.com

O1 - Hosts: 127.0.0.4 megapornix.com

O1 - Hosts: 127.0.0.4 www.sp2fucked.biz

O1 - Hosts: 127.0.0.4 sp2fucked.biz

O1 - Hosts: 127.0.0.4 greg-tut.com

O1 - Hosts: 127.0.0.4 www.greg-tut.com

O1 - Hosts: 127.0.0.4 nylonsexy.com

O1 - Hosts: 127.0.0.4 www.nylonsexy.com

O1 - Hosts: 127.0.0.4 vparivalka.com

O1 - Hosts: 127.0.0.4 www.vparivalka.com

O1 - Hosts: 127.0.0.4 iframeprofit.com

O1 - Hosts: 127.0.0.4 www.iframeprofit.com

O1 - Hosts: 127.0.0.4 topsearch10.com

O1 - Hosts: 127.0.0.4 www.topsearch10.com

O1 - Hosts: 127.0.0.4 statscash.biz

O1 - Hosts: 127.0.0.4 www.statscash.biz

O1 - Hosts: 127.0.0.4 vxiframe.biz

O1 - Hosts: 127.0.0.4 www.vxiframe.biz

O1 - Hosts: 127.0.0.4 crazy-toolbar.com

O1 - Hosts: 127.0.0.4 www.crazy-toolbar.com

O1 - Hosts: 127.0.0.4 topcash.biz

O1 - Hosts: 127.0.0.4 www.topcash.biz

O1 - Hosts: 127.0.0.4 loadcash.biz

O1 - Hosts: 127.0.0.4 www.loadcash.biz

O1 - Hosts: 127.0.0.4 txiframe.biz

O1 - Hosts: 127.0.0.4 www.txiframe.biz

O1 - Hosts: 127.0.0.4 procounter.biz

O1 - Hosts: 127.0.0.4 www.procounter.biz

O1 - Hosts: 127.0.0.4 advadmin.biz

O1 - Hosts: 127.0.0.4 www.advadmin.biz

O1 - Hosts: 127.0.0.4 trafficbest.net

O1 - Hosts: 127.0.0.4 www.trafficbest.net

O1 - Hosts: 127.0.0.4 besthvac.com

O1 - Hosts: 127.0.0.4 www.besthvac.com

O1 - Hosts: 127.0.0.4 traff4.com

O1 - Hosts: 127.0.0.4 www.traff4.com

O1 - Hosts: 127.0.0.4 ambush-script.com

O1 - Hosts: 127.0.0.4 www.ambush-script.com

O1 - Hosts: 127.0.0.4 beehappyy.biz

O1 - Hosts: 127.0.0.4 www.beehappyy.biz

O1 - Hosts: 127.0.0.4 tracktraff.cc

O1 - Hosts: 127.0.0.4 www.tracktraff.cc

O1 - Hosts: 127.0.0.4 allcount.net

O1 - Hosts: 127.0.0.4 www.allcount.net

O1 - Hosts: 127.0.0.4 onedayoffer.biz

O1 - Hosts: 127.0.0.4 www.onedayoffer.biz

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRAM FILES\FLASHGET\JCCATCH.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FGIEBAR.DLL

O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [SystemTray] SysTray.Exe

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe

O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\stimon.exe

O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\SYSTEM\hpoopm07.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP

O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE

O4 - HKLM\..\Run: [SysMemory manager] c:\windows\system\mdms.exe

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe

O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WAPSTER\AQQ\AQQ.EXE

O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

O4 - Startup: Uruchamianie pakietu Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

O4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe

O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\FRU\Remind32.exe

O8 - Extra context menu item: Download using FlashGet - C:\PROGRAM FILES\FLASHGET\jc_link.htm

O8 - Extra context menu item: Download All by FlashGet - C:\PROGRAM FILES\FLASHGET\jc_all.htm

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE

O14 - IERESET.INF: SEARCH_PAGE_URL=

O14 - IERESET.INF: START_PAGE_URL=

O20 - Winlogon Notify: style2 - C:\WINDOWS\Q1334051.DLL

(Gutek) #4

zostało, użyj jeszcze CWShredder + VX2Look - Armageddon i dla 98\Me - musisz zamienić LodDel.exe na DelLater.exe dostępne na diamondcs.

  • Content Menu > Try to kill reg keys - zastąpione przez deletion panel

  • "Zacinanie". Jest to efekt specjalny, żeby ktoś niecierpliwy nie wyłączył VX2Look przed końcem skanowania. To nie jest prawdziwy HANG !


(Kuz5) #5

Usuń jeszcze to:

Gutek2222 podał ci link jak usunąc Trojan.Repsamo

Pliki mdms.exe , Q1334051.DLL oraz IBM00001.EXE usuń programem Pocket Killbox czyli odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżke:

C:\WINDOWS\SYSTEM**** IBM00001.EXE

następnie program będzie pytał o restart (oczywiście zgadzasz sie)

I to samo robisz ze ścieżkami:

c:\windows\system**** mdms.exe

C:\WINDOWS**** Q1334051.DLL


(Feniq) #6

hmm nieczaje mozesz mi to jakos bardzoej rozpisac ?:smiley:


(Gutek) #7

Pobierz Pocket Killbox i zaznaczasz opcję Delete on Reboot i w polu Full Path of File to Delete wklejasz ścieżkę C:\WINDOWS\System32\mdms.exe itd. te co są zaznaczone an czerwono. Program poprosi o reset kompa ... czyli resetujesz.


(Feniq) #8

ok zrobilem jak mowiliscie tylko teraz mi wyskakuje ze niemoze znalesc sciezki do ibm00001 ale jednak widac ze komp szybciej chodzi a oto jeszcze moj log

Logfile of HijackThis v1.99.1

Scan saved at 00:14:09, on 05-10-06

Platform: Windows 98 SE (Win9x 4.10.2222A)

MSIE: Internet Explorer v5.00 (5.00.2614.3500)


Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\WINDOWS\SYSTEM\HPOOPM07.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE

C:\PROGRAM FILES\WAPSTER\AQQ\AQQ.EXE

C:\WINDOWS\SYSTEM\SPOOL32.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPODEV07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\FRU\REMIND32.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOEVM07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOSTS07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOFXM07.EXE

C:\WINDOWS\PULPIT\STRAWA\śCIąGANIE\HIJACKTHIS\HIJACKTHIS.EXE


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O1 - Hosts: 127.0.0.4 n-glx.s-redirect.com

O1 - Hosts: 127.0.0.4 x.full-tgp.net

O1 - Hosts: 127.0.0.4 counter.sexmaniack.com

O1 - Hosts: 127.0.0.4 autoescrowpay.com

O1 - Hosts: 127.0.0.4 www.autoescrowpay.com

O1 - Hosts: 127.0.0.4 www.awmdabest.com

O1 - Hosts: 127.0.0.4 www.sexfiles.nu

O1 - Hosts: 127.0.0.4 awmdabest.com

O1 - Hosts: 127.0.0.4 sexfiles.nu

O1 - Hosts: 127.0.0.4 allforadult.com

O1 - Hosts: 127.0.0.4 www.allforadult.com

O1 - Hosts: 127.0.0.4 www.iframe.biz

O1 - Hosts: 127.0.0.4 iframe.biz

O1 - Hosts: 127.0.0.4 www.newiframe.biz

O1 - Hosts: 127.0.0.4 newiframe.biz

O1 - Hosts: 127.0.0.4 www.vesbiz.biz

O1 - Hosts: 127.0.0.4 vesbiz.biz

O1 - Hosts: 127.0.0.4 www.pizdato.biz

O1 - Hosts: 127.0.0.4 pizdato.biz

O1 - Hosts: 127.0.0.4 www.aaasexypics.com

O1 - Hosts: 127.0.0.4 aaasexypics.com

O1 - Hosts: 127.0.0.4 www.virgin-tgp.net

O1 - Hosts: 127.0.0.4 virgin-tgp.net

O1 - Hosts: 127.0.0.4 www.awmcash.biz

O1 - Hosts: 127.0.0.4 awmcash.biz

O1 - Hosts: 127.0.0.4 buldog-stats.com

O1 - Hosts: 127.0.0.4 www.buldog-stats.com

O1 - Hosts: 127.0.0.4 fregat.drocherway.com

O1 - Hosts: 127.0.0.4 slutmania.biz

O1 - Hosts: 127.0.0.4 www.slutmania.biz

O1 - Hosts: 127.0.0.4 toolbarpartner.com

O1 - Hosts: 127.0.0.4 www.toolbarpartner.com

O1 - Hosts: 127.0.0.4 www.megapornix.com

O1 - Hosts: 127.0.0.4 megapornix.com

O1 - Hosts: 127.0.0.4 www.sp2fucked.biz

O1 - Hosts: 127.0.0.4 sp2fucked.biz

O1 - Hosts: 127.0.0.4 greg-tut.com

O1 - Hosts: 127.0.0.4 www.greg-tut.com

O1 - Hosts: 127.0.0.4 nylonsexy.com

O1 - Hosts: 127.0.0.4 www.nylonsexy.com

O1 - Hosts: 127.0.0.4 vparivalka.com

O1 - Hosts: 127.0.0.4 www.vparivalka.com

O1 - Hosts: 127.0.0.4 iframeprofit.com

O1 - Hosts: 127.0.0.4 www.iframeprofit.com

O1 - Hosts: 127.0.0.4 topsearch10.com

O1 - Hosts: 127.0.0.4 www.topsearch10.com

O1 - Hosts: 127.0.0.4 statscash.biz

O1 - Hosts: 127.0.0.4 www.statscash.biz

O1 - Hosts: 127.0.0.4 vxiframe.biz

O1 - Hosts: 127.0.0.4 www.vxiframe.biz

O1 - Hosts: 127.0.0.4 crazy-toolbar.com

O1 - Hosts: 127.0.0.4 www.crazy-toolbar.com

O1 - Hosts: 127.0.0.4 topcash.biz

O1 - Hosts: 127.0.0.4 www.topcash.biz

O1 - Hosts: 127.0.0.4 loadcash.biz

O1 - Hosts: 127.0.0.4 www.loadcash.biz

O1 - Hosts: 127.0.0.4 txiframe.biz

O1 - Hosts: 127.0.0.4 www.txiframe.biz

O1 - Hosts: 127.0.0.4 procounter.biz

O1 - Hosts: 127.0.0.4 www.procounter.biz

O1 - Hosts: 127.0.0.4 advadmin.biz

O1 - Hosts: 127.0.0.4 www.advadmin.biz

O1 - Hosts: 127.0.0.4 trafficbest.net

O1 - Hosts: 127.0.0.4 www.trafficbest.net

O1 - Hosts: 127.0.0.4 besthvac.com

O1 - Hosts: 127.0.0.4 www.besthvac.com

O1 - Hosts: 127.0.0.4 traff4.com

O1 - Hosts: 127.0.0.4 www.traff4.com

O1 - Hosts: 127.0.0.4 ambush-script.com

O1 - Hosts: 127.0.0.4 www.ambush-script.com

O1 - Hosts: 127.0.0.4 beehappyy.biz

O1 - Hosts: 127.0.0.4 www.beehappyy.biz

O1 - Hosts: 127.0.0.4 tracktraff.cc

O1 - Hosts: 127.0.0.4 www.tracktraff.cc

O1 - Hosts: 127.0.0.4 allcount.net

O1 - Hosts: 127.0.0.4 www.allcount.net

O1 - Hosts: 127.0.0.4 onedayoffer.biz

O1 - Hosts: 127.0.0.4 www.onedayoffer.biz

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRAM FILES\FLASHGET\JCCATCH.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FGIEBAR.DLL

O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [SystemTray] SysTray.Exe

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe

O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\stimon.exe

O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\SYSTEM\hpoopm07.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP

O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE

O4 - HKLM\..\Run: [SysMemory manager] c:\windows\system\mdms.exe

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe

O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WAPSTER\AQQ\AQQ.EXE

O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

O4 - Startup: Uruchamianie pakietu Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

O4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe

O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\FRU\Remind32.exe

O8 - Extra context menu item: Download using FlashGet - C:\PROGRAM FILES\FLASHGET\jc_link.htm

O8 - Extra context menu item: Download All by FlashGet - C:\PROGRAM FILES\FLASHGET\jc_all.htm

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE

O14 - IERESET.INF: SEARCH_PAGE_URL=

O14 - IERESET.INF: START_PAGE_URL=

O20 - Winlogon Notify: style2 - C:\WINDOWS\Q1334051.DLL (file missing)

i jeszcze jedno pytanie:

niewiecie jak moge zabezpieczyc kompa przed powtorka takiego czegos ze mi sie nawgrywa tych smieci?


(Gutek) #9

Poczytaj uważnie co napisałem Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked a te pliki: Q1334051.DLL i mdms.exe tym programem co mówiliśmy wyżej z kuz5


(Feniq) #10

moze teraz dobrze...

Logfile of HijackThis v1.99.1

Scan saved at 00:31:14, on 05-10-06

Platform: Windows 98 SE (Win9x 4.10.2222A)

MSIE: Internet Explorer v5.00 (5.00.2614.3500)


Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\WINDOWS\SYSTEM\HPOOPM07.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE

C:\PROGRAM FILES\WAPSTER\AQQ\AQQ.EXE

C:\WINDOWS\SYSTEM\SPOOL32.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPODEV07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\FRU\REMIND32.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOEVM07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOSTS07.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOFXM07.EXE

C:\WINDOWS\PULPIT\PROGRAMY\HIJACKTHIS\HIJACKTHIS.EXE


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRAM FILES\FLASHGET\JCCATCH.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FGIEBAR.DLL

O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [SystemTray] SysTray.Exe

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe

O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\stimon.exe

O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\SYSTEM\hpoopm07.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP

O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe

O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WAPSTER\AQQ\AQQ.EXE

O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

O4 - Startup: Uruchamianie pakietu Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

O4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe

O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\FRU\Remind32.exe

O8 - Extra context menu item: Download using FlashGet - C:\PROGRAM FILES\FLASHGET\jc_link.htm

O8 - Extra context menu item: Download All by FlashGet - C:\PROGRAM FILES\FLASHGET\jc_all.htm

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE

O14 - IERESET.INF: SEARCH_PAGE_URL=

O14 - IERESET.INF: START_PAGE_URL=

(Gutek) #11

Już czysto :stuck_out_tongue:

Wpisami 014 nie przejmuj się, możesz jeszcze(powinieneś):

Start >>> Programy >>> Autostart >>> kasacja z prawokliku tych wpisów.