Prosze sprawdzcie logi

siwy89 · 7 Październik 2006 19:34

Chyba cos nie tak jest z systemem

Sprawdzcie logi

Hijackthis

Logfile of HijackThis v1.99.1

Scan saved at 21:32:25, on 2006-10-07

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

D:\Progrmay\avast\aswUpdSv.exe

D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe

D:\Progrmay\kerio\Personal Firewall 4\kpf4gui.exe

C:\WINDOWS\System32\svchost32.exe

D:\Progrmay\kerio\Personal Firewall 4\kpf4gui.exe

D:\Progrmay\Winamp\winampa.exe

D:\Progrmay\NetLimiter\NetLimiter.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\System32\svcchost.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

D:\Progrmay\Corel\Register\Remind32.exe

D:\Progrmay\firefox\firefox.exe

D:\Szkoła\Siwy\HijackThis.com.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Progrmay\adobe reader\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Progrmay\Java\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM…\Run: [WinampAgent] D:\Progrmay\Winamp\winampa.exe

O4 - HKLM…\Run: [NetLimiter] D:\Progrmay\NetLimiter\NetLimiter.exe /s

O4 - HKLM…\Run: [avast!] D:\Progrmay\avast\ashDisp.exe

O4 - HKLM…\Run: [sunJavaUpdateSched] D:\Progrmay\Java\bin\jusched.exe

O4 - HKLM…\Run: [semanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe

O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM…\Run: [Microsoft Windows Update 32] svchost32.exe

O4 - HKLM…\Run: [msvcc25] svcchost.exe

O4 - HKLM…\RunServices: [Microsoft Windows Update 32] svchost32.exe

O4 - HKLM…\RunServices: [msvcc25] svcchost.exe

O4 - HKLM…\RunOnce: [Microsoft Windows Update 32] svchost32.exe

O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background

O4 - HKCU…\Run: [Gadu-Gadu] “D:\Progrmay\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [Microsoft Windows Update 32] svchost32.exe

O4 - HKCU…\RunOnce: [Microsoft Windows Update 32] svchost32.exe

O4 - Startup: Rejestrowanie produktów Corela.lnk = D:\Progrmay\Corel\Register\Remind32.exe

O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

O4 - Global Startup: Microsoft Office.lnk = D:\Progrmay\msOffice\Office\OSA9.EXE

O10 - Broken Internet access because of LSP provider ‘c:\windows\system32\rsvpsp.dll’ missing

O17 - HKLM\System\CCS\Services\Tcpip…{D06AF5DA-D6B5-4C32-87FB-920DF315D6A2}: NameServer = 194.204.152.34 217.98.63.164

O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Progrmay\avast\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - D:\Progrmay\avast\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - D:\Progrmay\avast\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - D:\Progrmay\avast\ashWebSv.exe" /service (file missing)

O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe

O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\System32\rsvp.exe (file missing)

jesli bedzie potrzeba wrzuce silent runners

Bieniol · 7 Październik 2006 19:39

Użyj narzędzia --> WinsockFix

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (jeżeli jakieś znaczki są żółte, to niech takie zostaną). Po użyciu tego narzędzia wymagany jest reset sysa.

W trybie awaryjnym z wyłączonym przywracaniem systemu usuwasz (wpisy Hijackiem, pliki/foldery na czerwono ręcznie z dysku):

Po zabiegach nowy log z Hijacka + log z Silent Runners

Gutek · 7 Październik 2006 19:40

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Uwaga: Jak wklejasz loga to obejmuj go znacznikiem (tagiem) CODE lub QUOTE - POPRAW

Pozdrawiam Gutek2222

siwy89 · 7 Październik 2006 19:54

ten program, ktory poleciles mi sciagnac tzn. winodws worm door cleaner w ogole sie nie otwiera

Bieniol · 7 Październik 2006 20:04

Usuń w takim razie najpier to co wskazałem, a na koniec sprobuj odpalić WWDC

Jeżeli się nie uda, to i tak wklej logi o które prosiłem

siwy89 · 7 Październik 2006 20:19

Logfile of HijackThis v1.99.1 Scan saved at 22:20:18, on 2006-10-07 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Progrmay\avast\aswUpdSv.exe D:\Progrmay\Winamp\winampa.exe D:\Progrmay\NetLimiter\NetLimiter.exe D:\Progrmay\avast\ashServ.exe D:\Progrmay\avast\ashDisp.exe D:\Progrmay\Java\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Progrmay\Corel\Register\Remind32.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4gui.exe D:\Progrmay\avast\ashMaiSv.exe D:\Progrmay\kerio\Personal Firewall 4\kpf4gui.exe D:\Progrmay\avast\ashWebSv.exe D:\Progrmay\firefox\firefox.exe D:\Szkoła\Siwy\HijackThis.com.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Progrmay\adobe reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Progrmay\Java\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [WinampAgent] D:\Progrmay\Winamp\winampa.exe O4 - HKLM…\Run: [NetLimiter] D:\Progrmay\NetLimiter\NetLimiter.exe /s O4 - HKLM…\Run: [avast!] D:\Progrmay\avast\ashDisp.exe O4 - HKLM…\Run: [sunJavaUpdateSched] D:\Progrmay\Java\bin\jusched.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [Gadu-Gadu] “D:\Progrmay\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [Microsoft Windows Update 32] svchost32.exe O4 - Startup: Rejestrowanie produktów Corela.lnk = D:\Progrmay\Corel\Register\Remind32.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = D:\Progrmay\msOffice\Office\OSA9.EXE O10 - Broken Internet access because of LSP provider ‘c:\windows\system32\rsvpsp.dll’ missing O17 - HKLM\System\CCS\Services\Tcpip…{D06AF5DA-D6B5-4C32-87FB-920DF315D6A2}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Progrmay\avast\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Progrmay\avast\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Progrmay\avast\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Progrmay\avast\ashWebSv.exe" /service (file missing) O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\System32\rsvp.exe (file missing)

“Silent Runners.vbs”, revision 46, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\System32\CTFMON.EXE” [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “WinampAgent” = “D:\Progrmay\Winamp\winampa.exe” [null data] “NetLimiter” = “D:\Progrmay\NetLimiter\NetLimiter.exe /s” [“LockTime”] “avast!” = “D:\Progrmay\avast\ashDisp.exe” [null data] “SunJavaUpdateSched” = “D:\Progrmay\Java\bin\jusched.exe” [“Sun Microsystems, Inc.”] “TkBellExe” = ““C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot” [“RealNetworks, Inc.”] “KernelFaultCheck” = “C:\WINDOWS\system32\dumprep 0 -k” [MS] HKLM\Software\Microsoft\Active Setup\Installed Components\ >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS(Default) = “Dostosowywanie przeglądarki” \StubPath = “RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP” [MS] {2C7339CF-2B09-4501-B3F3-F3508C9228ED}(Default) = “Themes Setup” \StubPath = “C:\WINDOWS\system32\regsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32\themeui.dll” [MS] {44BBA840-CC51-11CF-AAFA-00AA00B6015C}(Default) = “Microsoft Outlook Express 6” \StubPath = ““C:\Program Files\Outlook Express\setup50.exe” /APP:OE /CALLER:WINNT /user /install” [MS] {5945c046-1e7d-11d1-bc44-00c04fd912be}(Default) = “Windows Messenger 4.0” \StubPath = “rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser” [MS] {7790769C-0471-11d2-AF11-00C04FA35D02}(Default) = “Książka adresowa 6” \StubPath = ““C:\Program Files\Outlook Express\setup50.exe” /APP:WAB /CALLER:WINNT /user /install” [MS] {89820200-ECBD-11cf-8B85-00AA005B4340}(Default) = “Aktualizacja pulpitu Windows” \StubPath = “regsvr32.exe /s /n /i:U shell32.dll” [MS] {89820200-ECBD-11cf-8B85-00AA005B4383}(Default) = “Internet Explorer 6” \StubPath = “C:\WINDOWS\system32\ie4uinit.exe” [MS] {ACC563BC-4266-43f0-B6ED-9D38C4202C7E}(Default) = “Dostęp do programu Internet Explorer” \StubPath = “rundll32 iesetup.dll,IEAccessUserInst” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “D:\Progrmay\adobe reader\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “D:\Progrmay\Java\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar2.dll” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “D:\Progrmay\avast\ashShell.dll” [“ALWIL Software”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Progrmay\winrar\rarext.dll” [null data] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “D:\Progrmay\msOffice\Office\OLKFSTUB.DLL” [MS] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “D:\Progrmay\realplayer\rpshell.dll” [“RealNetworks, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “D:\Progrmay\avast\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Progrmay\winrar\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Progrmay\winrar\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “D:\Progrmay\avast\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Progrmay\winrar\rarext.dll” [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “(Brak)” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “%SystemRoot%\System32\logon.scr” [MS] Startup items in “Administrator” & “All Users” startup folders: --------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “DSLMON” -> shortcut to: “C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe” [empty string] “Microsoft Office” -> shortcut to: “D:\Progrmay\msOffice\Office\OSA9.EXE -b -l” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\System32\nwprovau.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18 %SystemRoot%\system32\rsvpsp.dll [file not found], 04 - 05 All Non-Disabled Services (Display Name, Service Name, Path {Service DLL}): --------------------------------------------------------------------------- avast! Antivirus, avast! Antivirus, ““D:\Progrmay\avast\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““D:\Progrmay\avast\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““D:\Progrmay\avast\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““D:\Progrmay\avast\ashWebSv.exe” /service” [“ALWIL Software”] Karta wydajności WMI, WmiApSrv, “C:\WINDOWS\System32\wbem\wmiapsrv.exe” [MS] QoS RSVP, RSVP, “C:\WINDOWS\System32\rsvp.exe” [file not found] Sunbelt Kerio Personal Firewall 4, KPF4, “D:\Progrmay\kerio\Personal Firewall 4\kpf4ss.exe” [“Sunbelt Software”] Usługa administracyjna Menedżera dysków logicznych, dmadmin, “C:\WINDOWS\System32\dmadmin.exe /com” [“Microsoft Corp., Veritas Software”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 79 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 25 seconds. ---------- (total run time: 193 seconds)

Bieniol · 7 Październik 2006 20:46

Do usunięcia jeszcze ten wpis:

Użyj narzędzia --> WinsockFix

Gutek · 8 Październik 2006 23:38

Prosiłem o coś KOSZ