Proszę o sprawdzenie loga

schodek · 18 Październik 2005 16:35

No więc ostatnio coraj to gorzej się dzieje z moim systemem, wszystko szaleje, zawiesza się, uruchamia się masa różnych nie znanych mi aplikacji, znika momentami pulpit itd

Logfile of HijackThis v1.99.1 Scan saved at 18:34:36, on 2005-10-18 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\csrss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\System32\mdms.exe F:\Program Files\Internet Explorer\IEXPLORE.EXE I:\Dzony-Loker\mirc.exe F:\WINDOWS\explorer.exe F:\Program Files\Azureus\Azureus.exe F:\Program Files\Java\jre1.5.0\bin\javaw.exe I:\Spybot - Search & Destroy\SpybotSD.exe F:\Documents and Settings\Schodek\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = F:\WINDOWS\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = F:\WINDOWS\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = F:\WINDOWS\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = F:\WINDOWS\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = F:\WINDOWS\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - Default URLSearchHook is missing F2 - REG:system.ini: UserInit=F:\WINDOWS\System32\userinit.exe,userinit.exe O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: - {1E6CE4CD-161B-4847-B8BF-E2EF72299D69} - F:\WINDOWS\System32\ib1.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - I:\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: F:\WINDOWS\adsldpbc.dll - {6C793BD2-2B0C-4B9D-9DE4-77306EC0C063} - F:\WINDOWS\adsldpbc.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - F:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - G:\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar.dll (file missing) O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\pl-pl\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar.dll (file missing) O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\pl-pl\msntb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [Generic Host Process for Win32 Services] F:\WINDOWS\System32\Drivers\svchost.exe O4 - HKLM…\Run: [avast!] G:\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [msoft-updater23] slssystem.exe O4 - HKLM…\Run: [ms_anti_spywarebxp] F:\WINDOWS\mwfirebpx.exe O4 - HKLM…\Run: [MSConfig] F:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM…\Run: [sysMemory manager] f:\windows\system32\mdms.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\RunServices: [dx32serv] dx32cxlp.exe O4 - HKLM…\RunServices: [msoft-updater23] slssystem.exe O4 - HKLM…\RunOnce: [ms_anti_spywarebxp] F:\WINDOWS\mwfirebpx.exe O4 - HKCU…\Run: [CTFMON.EXE] drwatson32.exe -run F:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [ms_anti_spywarebxp] F:\WINDOWS\mwfirebpx.exe O4 - HKCU…\RunOnce: [ms_anti_spywarebxp] F:\WINDOWS\mwfirebpx.exe O4 - Global Startup: Microsoft Office.lnk = G:\Office\Office10\OSA.EXE O8 - Extra context menu item: &Add animation to IncrediMail Style Box - G:\INCRED~1\bin\resources\WebMenuImg.htm O8 - Extra context menu item: &Google Search - res://F:\Program Files\Google\googletoolbar.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://F:\Program Files\Google\googletoolbar.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://F:\Program Files\Google\googletoolbar.dll/cmcache.html O8 - Extra context menu item: Download with GetRight - F:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://G:\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - F:\Program Files\GetRight\GRbrowse.htm O8 - Extra context menu item: Si&milar Pages - res://F:\Program Files\Google\googletoolbar.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://F:\Program Files\Google\googletoolbar.dll/cmtrans.html O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - G:\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - G:\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - G:\FlashGet\flashget.exe O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - G:\FlashGet\flashget.exe O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Media … ge-c11.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/S … anager.ocx O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe … loader.cab O20 - Winlogon Notify: tcpG4T - tcpG4T.dll (file missing) O21 - SSODL: DEFCEDHG - {68FA4AFB-17E6-544B-01DE-2C5341177D57} - F:\WINDOWS\System32\Opccjcpp.dll (file missing) O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - G:\Antyvirusek\AVGUARD.EXE O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - G:\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - G:\Alwil Software\Avast4\ashServ.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - G:\Antyvirusek\AVWUPSRV.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\System32\nvsvc32.exe

schodek · 18 Październik 2005 16:50

Właśnie przed momentem sobie o tym przypomniałem, teraz powinno byc dobrze

Gutek · 18 Październik 2005 17:47

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = F:\WINDOWS\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = F:\WINDOWS\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = F:\WINDOWS\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = F:\WINDOWS\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = F:\WINDOWS\secure32.html R3 - Default URLSearchHook is missing F2 - REG:system.ini: UserInit=F:\WINDOWS\System32\userinit.exe, userinit.exe O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - (no file) O2 - BHO: - {1E6CE4CD-161B-4847-B8BF-E2EF72299D69} - F:\WINDOWS\System32\ib1.dll O2 - BHO: F:\WINDOWS\adsldpbc.dll - {6C793BD2-2B0C-4B9D-9DE4-77306EC0C063} - F:\WINDOWS\adsldpbc.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - F:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O4 - HKLM…\Run: [Generic Host Process for Win32 Services] F:\WINDOWS\System32\Drivers\svchost.exe O4 - HKLM…\Run: [msoft-updater23] slssystem.exe O4 - HKLM…\Run: [ms_anti_spywarebxp] F:\WINDOWS\mwfirebpx.exe O4 - HKLM…\Run: [sysMemory manager] f:\windows\system32\mdms.exe O4 - HKLM…\RunServices: [dx32serv] dx32cxlp.exe O4 - HKLM…\RunServices: [msoft-updater23] slssystem.exe O4 - HKLM…\RunOnce: [ms_anti_spywarebxp] F:\WINDOWS\mwfirebpx.exe O4 - HKCU…\Run: [ms_anti_spywarebxp] F:\WINDOWS\mwfirebpx.exe O4 - HKCU…\RunOnce: [ms_anti_spywarebxp] F:\WINDOWS\mwfirebpx.exe O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Media … ge-c11.cab O20 - Winlogon Notify: tcpG4T - tcpG4T.dll (file missing) O21 - SSODL: DEFCEDHG - {68FA4AFB-17E6-544B-01DE-2C5341177D57} - F:\WINDOWS\System32\ Opccjcpp.dll(file missing)

Użyj Windows Worms Doors Cleanerazmień znaczki z disable na enable. Po użyciu tego narzędzia wymagany jest reset sysa.

Wyłączyć Przywracanie systemu w XP TU
Zastartować do trybu awaryjnego bez internetu(opis w linku wyżej).
Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked. Wpisy zostaną usunięte.
Skasować z dysku pliki i foldery, które podkreśliłem na czerwono
Dokończyć skanerami online - Scanery do wyboru
Pokazać nowy log

Poczytaj Usuwanie Trojan.Repsamo oraz Wersje Backdoor.Haxdoor - AG:

Brak SP2 - nie może być Antyvirusek i Avast4 razem