Prosze o sprawdzenie loga

richarddwinter · 17 Luty 2006 21:16

Logfile of HijackThis v1.99.1 Scan saved at 22:16:06, on 2006-02-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\explorer.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\mpcsvc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\V\NqY2lr\command.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\Network Monitor\netmon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\RICHAR~1\USTAWI~1\Temp\Rar$EX04.797\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\system32\sxlntr.exe F3 - REG:win.ini: load=C:\WINDOWS\system32\sxlntr.exe F3 - REG:win.ini: run=C:\WINDOWS\system32\sxlntr.exe O1 - Hosts: 85.249.23.233 socks.tempservice.org127.0.0.1 http://www.trendmicro.com O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [Repair Service Manager] C:\WINDOWS\system32\mpcsvc.exe O4 - HKLM…\Run: [gimmygames] C:\gimmygames9.exe O4 - HKLM…\Run: [gimmygames] C:\gimmygames9.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [NBJ] “C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” O4 - HKCU…\Run: [AtiTrayTools] “C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe” O4 - HKCU…\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU…\Run: [Repair Service Manager] C:\WINDOWS\system32\mpcsvc.exe O4 - HKCU…\Run: [Repair Service Manager] C:\WINDOWS\system32\mpcsvc.exe O4 - HKCU…\Run: [shell] “C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00007.exe” O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{0DBFC789-3F44-4FCA-B07E-962CE915BC0C}: NameServer = 192.168.0.1,194.204.159.1 O17 - HKLM\System\CS1\Services\Tcpip…{0DBFC789-3F44-4FCA-B07E-962CE915BC0C}: NameServer = 192.168.0.1,194.204.159.1 O17 - HKLM\System\CS2\Services\Tcpip…{0DBFC789-3F44-4FCA-B07E-962CE915BC0C}: NameServer = 192.168.0.1,194.204.159.1 O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\enp2l17o1.dll O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - C:\WINDOWS\system32\blagpcep.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\V\NqY2lr\command.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

rudik77 · 17 Luty 2006 23:14

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\system32\sxlntr.exe F3 - REG:win.ini: load=C:\WINDOWS\system32\sxlntr.exe F3 - REG:win.ini: run=C:\WINDOWS\system32\sxlntr.exe O1 - Hosts: 85.249.23.233 socks.tempservice.org127.0.0.1 http://www.trendmicro.com O4 - HKLM…\Run: [gimmygames] C:\gimmygames9.exe O4 - HKLM…\Run: [gimmygames] C:\gimmygames9.exe O4 - HKCU…\Run: [shell] “C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00007.exe” O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\V\NqY2lr\command.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

od czego to sa wpisy.?

pliki i foldery zaznaczone na czerwono usuwasz w trybie awaryjnym recznie.!

Po zakonczeniu pokazac nowego loga.

kuz5 · 19 Luty 2006 20:47

Są to DNS-y richarddwinter , usunięcie tych wpisów moze spowodować utratę neta

rudik77 omijasz syf [-X

Następne takie posty bedą kasowane

Usuń: (wszystko oczywiście robisz w trybie awaryjnym z wyłączonym przywracaniem systemu)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\system32\sxlntr.exe F3 - REG:win.ini: load=C:\WINDOWS\system32\sxlntr.exe F3 - REG:win.ini: run=C:\WINDOWS\system32\sxlntr.exe O1 - Hosts: 85.249.23.233 socks.tempservice.org127.0.0.1 http://www.trendmicro.com O4 - HKLM…\Run: [Repair Service Manager] C:\WINDOWS\system32\mpcsvc.exe O4 - HKLM…\Run: [gimmygames] C:\gimmygames9.exe O4 - HKLM…\Run: [gimmygames] C:\gimmygames9.exe O4 - HKCU…\Run: [Repair Service Manager] C:\WINDOWS\system32\mpcsvc.exe O4 - HKCU…\Run: [Repair Service Manager] C:\WINDOWS\system32\mpcsvc.exe O4 - HKCU…\Run: [shell] “C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00007.exe” O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - C:\WINDOWS\system32\blagpcep.dll

Start => Uruchom => wpisz services.msc => zatrzymaj i wyłącz procesy Command Service oraz Network Monitor następnie odpalasz HijackThis Misc Tools => Delete NT service => wpisz cmdService => Ok i zresetuj komputer.

Pliki na czerwono usun ręcznie z dysku

Daj log nr 1 z narzędzia L2Mfix