wstach1
13 Styczeń 2007 21:38
#1
Jestem zielony w tym temacie. Używam neostradę od roku i od świąt mam problemy z komputerem. Załapałem jakieś robactwo. Proszę doświadczonych forumowiczów o wyrozumiałośći pomoc w rozwiązaniu problemu. Naciskając Alt+Ctrl+Del nie mam nieaktywne pole menadżera zadań tak, więc nie wiem co powoduje zatykanie się systemu.
Logfile of HijackThis v1.99.1 Scan saved at 22:36:22, on 2007-01-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\CapTech\MegaTrack\Exe\MT_Manager.exe C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe C:\WINNT\system32\CCM\CcmExec.exe C:\WINNT\explorer.exe C:\Program Files\Winzip\WZQKPICK.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\stachwlo\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.tepenet/tp.pac R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe F3 - REG:win.ini: run=C:\WINNT\inet20000\services.exe O1 - Hosts: 212.160.172.46 vpn.telekomunikacja.pl O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file) O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file) O2 - BHO: (no name) - {11904ce8-632a-4856-a7cc-00b33fe71bd8} - (no file) O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file) O2 - BHO: (no name) - {15ACE85C-0BB1-42d1-9E32-07EB0506675A} - (no file) O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file) O2 - BHO: (no name) - {1b68470c-2def-493b-8a4a-8e2d81be4ea5} - (no file) O2 - BHO: (no name) - {1c4da27d-4d52-4465-a089-98e01bb725ca} - (no file) O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file) O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file) O2 - BHO: (no name) - {202a961f-23ae-42b1-9505-ffe3c818d717} - (no file) O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file) O2 - BHO: (no name) - {2e246fae-8420-11d9-870d-000c2917de7f} - (no file) O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file) O2 - BHO: (no name) - {479fd0cf-5be9-4c63-8cda-b6d371c67bd5} - (no file) O2 - BHO: (no name) - {5753791b-f607-48ca-814e-91c14d081f9e} - (no file) O2 - BHO: (no name) - {7070a8f9-08a4-ca47-0ab0-1eb9e4ee1f3b} - (no file) O2 - BHO: (no name) - {746455fe-d059-47e7-af0e-140e03f5a447} - (no file) O2 - BHO: (no name) - {7a7e6d97-b492-4884-9abb-c31281dcc4f2} - (no file) O2 - BHO: ASGP32.ASGP - {82B07A2B-F0AF-45FC-BE44-18D83B01EAD9} - C:\WINNT\system32\asgp32.dll O2 - BHO: (no name) - {860c2f6b-ca82-4282-9187-beccbb66f0af} - (no file) O2 - BHO: (no name) - {87185e78-a61b-4db3-965a-3235bbd7a622} - (no file) O2 - BHO: (no name) - {8dc8f96d-34f7-1501-a2a4-631341aa3ac1} - (no file) O2 - BHO: (no name) - {9c5875b8-93f3-429d-ff34-660b206d897a} - (no file) O2 - BHO: (no name) - {a2595f37-48d0-46a1-9b51-478591a97764} - (no file) O2 - BHO: (no name) - {a6f42cad-2559-48df-af30-89e480af5dfa} - (no file) O2 - BHO: (no name) - {b212d577-05b7-4963-911e-4a8588160dfa} - (no file) O2 - BHO: (no name) - {CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file) O2 - BHO: (no name) - {d1ac752e-883f-4ed8-8828-b618c3a72152} - (no file) O2 - BHO: (no name) - {e2b2b5a1-b48c-4886-a318-723916a01024} - (no file) O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file) O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file) O2 - BHO: (no name) - {e6d5237d-a6c7-4c83-a67f-f9f15586fa62} - (no file) O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file) O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file) O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file) O2 - BHO: (no name) - {fe2d25c1-c1db-4b5e-9390-af1cb5302f32} - (no file) O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file) O2 - BHO: (no name) - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} - (no file) O4 - HKLM…\Run: [bearShare] “C:\Program Files\BearShare\BearShare.exe” /pause O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKCU…\Run: [spyRemover TeaTimer] C:\Program Files\SpyRemover\TeaTimer.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: VPN Client.lnk = ? O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\Winzip\WZQKPICK.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = tp.gk.corp.tepenet O17 - HKLM\Software…\Telephony: DomainName = tp.gk.corp.tepenet O17 - HKLM\System\CCS\Services\Tcpip…{0B34F822-3773-49D0-A2B2-523C1DE2EBC3}: NameServer = 61.123.225.72 O17 - HKLM\System\CCS\Services\Tcpip…{C0FE68E0-1F87-4F21-AFE1-0A5501CF5DC8}: NameServer = 61.123.225.72 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = tp.gk.corp.tepenet O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.58 85.255.112.116 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.58 85.255.112.116 O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxdev.dll O21 - SSODL: CDRecorder026 - {A3BC5E20-0235-1ABF-9CE1-00AA00512026} - C:\WINNT\system32\hbihhz32.dll (file missing) O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: DeviceLock Service (DLService) - Telekomunikacja Polska - C:\WINNT\system32\DLService.exe O23 - Service: MT_Manager - Capella Technologies Inc. - C:\Program Files\CapTech\MegaTrack\Exe\MT_Manager.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - C:\Program Files\Spyware Doctor\sdhelp.exe (file missing)
adam9870
13 Styczeń 2007 21:49
#2
Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (wszystkie znaczki maja być na zielono, jeżeli któryś z nich będzie na żółto to go zostaw). Po użyciu narzędzia wymagany jest restart.
W trybie awaryjnym z wyłączonym przywracaniem systemu usuń:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb F2 - REG:system.ini: Shell=explorer.exe F3 - REG:win.ini: run=C:\WINNT\inet20000\services.exe O1 - Hosts: 212.160.172.46 vpn.telekomunikacja.pl O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file) O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file) O2 - BHO: (no name) - {11904ce8-632a-4856-a7cc-00b33fe71bd8} - (no file) O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file) O2 - BHO: (no name) - {15ACE85C-0BB1-42d1-9E32-07EB0506675A} - (no file) O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file) O2 - BHO: (no name) - {1b68470c-2def-493b-8a4a-8e2d81be4ea5} - (no file) O2 - BHO: (no name) - {1c4da27d-4d52-4465-a089-98e01bb725ca} - (no file) O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file) O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file) O2 - BHO: (no name) - {202a961f-23ae-42b1-9505-ffe3c818d717} - (no file) O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file) O2 - BHO: (no name) - {2e246fae-8420-11d9-870d-000c2917de7f} - (no file) O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file) O2 - BHO: (no name) - {479fd0cf-5be9-4c63-8cda-b6d371c67bd5} - (no file) O2 - BHO: (no name) - {5753791b-f607-48ca-814e-91c14d081f9e} - (no file) O2 - BHO: (no name) - {7070a8f9-08a4-ca47-0ab0-1eb9e4ee1f3b} - (no file) O2 - BHO: (no name) - {746455fe-d059-47e7-af0e-140e03f5a447} - (no file) O2 - BHO: (no name) - {7a7e6d97-b492-4884-9abb-c31281dcc4f2} - (no file) O2 - BHO: ASGP32.ASGP - {82B07A2B-F0AF-45FC-BE44-18D83B01EAD9} - C:\WINNT\system32\asgp32.dll O2 - BHO: (no name) - {860c2f6b-ca82-4282-9187-beccbb66f0af} - (no file) O2 - BHO: (no name) - {87185e78-a61b-4db3-965a-3235bbd7a622} - (no file) O2 - BHO: (no name) - {8dc8f96d-34f7-1501-a2a4-631341aa3ac1} - (no file) O2 - BHO: (no name) - {9c5875b8-93f3-429d-ff34-660b206d897a} - (no file) O2 - BHO: (no name) - {a2595f37-48d0-46a1-9b51-478591a97764} - (no file) O2 - BHO: (no name) - {a6f42cad-2559-48df-af30-89e480af5dfa} - (no file) O2 - BHO: (no name) - {b212d577-05b7-4963-911e-4a8588160dfa} - (no file) O2 - BHO: (no name) - {CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file) O2 - BHO: (no name) - {d1ac752e-883f-4ed8-8828-b618c3a72152} - (no file) O2 - BHO: (no name) - {e2b2b5a1-b48c-4886-a318-723916a01024} - (no file) O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file) O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file) O2 - BHO: (no name) - {e6d5237d-a6c7-4c83-a67f-f9f15586fa62} - (no file) O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file) O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file) O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file) O2 - BHO: (no name) - {fe2d25c1-c1db-4b5e-9390-af1cb5302f32} - (no file) O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file) O2 - BHO: (no name) - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} - (no file) O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.58 85.255.112.116 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.58 85.255.112.116 O21 - SSODL: CDRecorder026 - {A3BC5E20-0235-1ABF-9CE1-00AA00512026} - C:\WINNT\system32\hbihhz32.dll (file missing)
Pliki i foldery zaznaczone kasujesz ręcznie z dysku natomiast wpisy w HijackThis
Czy to Twoje DNS’y?
jeśli nie to także usuń.
Użyj narzędzia FixWareOut
Po wykonaniu pokaż nowy log z hjt, SilentRunners oraz zawartość pliku c:\fixwareout\raport.txt.
Gutek
13 Styczeń 2007 21:49
#3
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.tepenet/tp.pac F2 - REG:system.ini: Shell=explorer.exe F3 - REG:win.ini: run=C:\WINNT\inet20000\services.exe O1 - Hosts: 212.160.172.46 vpn.telekomunikacja.pl O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file) O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file) O2 - BHO: (no name) - {11904ce8-632a-4856-a7cc-00b33fe71bd8} - (no file) O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file) O2 - BHO: (no name) - {15ACE85C-0BB1-42d1-9E32-07EB0506675A} - (no file) O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file) O2 - BHO: (no name) - {1b68470c-2def-493b-8a4a-8e2d81be4ea5} - (no file) O2 - BHO: (no name) - {1c4da27d-4d52-4465-a089-98e01bb725ca} - (no file) O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file) O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file) O2 - BHO: (no name) - {202a961f-23ae-42b1-9505-ffe3c818d717} - (no file) O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file) O2 - BHO: (no name) - {2e246fae-8420-11d9-870d-000c2917de7f} - (no file) O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file) O2 - BHO: (no name) - {479fd0cf-5be9-4c63-8cda-b6d371c67bd5} - (no file) O2 - BHO: (no name) - {5753791b-f607-48ca-814e-91c14d081f9e} - (no file) O2 - BHO: (no name) - {7070a8f9-08a4-ca47-0ab0-1eb9e4ee1f3b} - (no file) O2 - BHO: (no name) - {746455fe-d059-47e7-af0e-140e03f5a447} - (no file) O2 - BHO: (no name) - {7a7e6d97-b492-4884-9abb-c31281dcc4f2} - (no file) O2 - BHO: ASGP32.ASGP - {82B07A2B-F0AF-45FC-BE44-18D83B01EAD9} - C:\WINNT\system32\asgp32.dll O2 - BHO: (no name) - {860c2f6b-ca82-4282-9187-beccbb66f0af} - (no file) O2 - BHO: (no name) - {87185e78-a61b-4db3-965a-3235bbd7a622} - (no file) O2 - BHO: (no name) - {8dc8f96d-34f7-1501-a2a4-631341aa3ac1} - (no file) O2 - BHO: (no name) - {9c5875b8-93f3-429d-ff34-660b206d897a} - (no file) O2 - BHO: (no name) - {a2595f37-48d0-46a1-9b51-478591a97764} - (no file) O2 - BHO: (no name) - {a6f42cad-2559-48df-af30-89e480af5dfa} - (no file) O2 - BHO: (no name) - {b212d577-05b7-4963-911e-4a8588160dfa} - (no file) O2 - BHO: (no name) - {CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file) O2 - BHO: (no name) - {d1ac752e-883f-4ed8-8828-b618c3a72152} - (no file) O2 - BHO: (no name) - {e2b2b5a1-b48c-4886-a318-723916a01024} - (no file) O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file) O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file) O2 - BHO: (no name) - {e6d5237d-a6c7-4c83-a67f-f9f15586fa62} - (no file) O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file) O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file) O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file) O2 - BHO: (no name) - {fe2d25c1-c1db-4b5e-9390-af1cb5302f32} - (no file) O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file) O2 - BHO: (no name) - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} - (no file) O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.58 85.255.112.116 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.58 85.255.112.116 O21 - SSODL: CDRecorder026 - {A3BC5E20-0235-1ABF-9CE1-00AA00512026} - C:\WINNT\system32\hbihhz32.dll (file missing)
Wyłączyć Przywracanie systemu w XP TU
Zastartować do trybu awaryjnego bez internetu(opis w linku wyżej).
Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked. Wpisy zostaną usunięte.
Skasować z dysku pliki i folder, które podkreśliłem na czerwono
Dokończyć skanerami online - Skanery do wyboru
Pokazać nowy logi z Silenta i HJT
Użyj FixWareOut - http://downloads.subratam.org/Fixwareout.exe
