system
12 Grudzień 2005 19:23
#1
Witam mam identyczny problem a nie chce zaśmiecac forum kolejnym tym samym tematem ,wiec piszę tutaj…sytuacja jak u kolegów wcześniej, nie znam sie sam na tym wszystkim i podaje logi z hiJacka,byłbym bardzo wdzieczny za rozwiązanie mojego problemu,dzieki z góry!!
Logfile of HijackThis v1.99.1 Scan saved at 20:23:21, on 2005-12-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\System32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Common Files\Symantec Shared\ccProxy.exe D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\Program Files\Winamp\winampa.exe D:\WINDOWS\SOUNDMAN.EXE D:\WINDOWS\System32\nvraidservice.exe D:\Program Files\Common Files\Symantec Shared\ccApp.exe D:\WINDOWS\System32\wbem\unsecapp.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Gadu-Gadu\gg.exe C:\winstall.exe D:\Program Files\Common Files\VCClient\VCClient.exe D:\Program Files\Common Files\VCClient\VCMain.exe D:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\Messenger\msmsgs.exe D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE D:\Documents and Settings\Michał\Pulpit\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=D:\WINDOWS\System32\Userinit.exe O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\WINDOWS\Downloaded Program Files\googlenav.dll O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM…\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [NVRaidService] D:\WINDOWS\System32\nvraidservice.exe O4 - HKLM…\Run: [ccApp] “D:\Program Files\Common Files\Symantec Shared\ccApp.exe” O4 - HKLM…\Run: [urlLSTCK.exe] D:\Program Files\Norton Internet Security\UrlLstCk.exe O4 - HKLM…\Run: [symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM…\Run: [winsync] D:\WINDOWS\system32\wyqwwi.exe reg_run O4 - HKCU…\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O4 - HKCU…\Run: [CU1] D:\Program Files\Common Files\VCClient\VCClient.exe O4 - HKCU…\Run: [CU2] D:\Program Files\Common Files\VCClient\VCMain.exe O4 - HKCU…\Run: [MSMSGS] “D:\Program Files\Messenger\msmsgs.exe” /background O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = D:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O8 - Extra context menu item: &Google Search - res://D:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://D:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://D:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://D:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/pl/big/1 … gleNav.cab O20 - Winlogon Notify: RunOnceEx - D:\WINDOWS\system32\m4460ehseh460.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: SAVScan - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Zaznaczam ze system mam na dysku D
lazikar
12 Grudzień 2005 21:05
#2
Wydzielono z innego tematu.
Gutek
12 Grudzień 2005 21:44
#3
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html O4 - HKLM…\Run: [winsync] D:\WINDOWS\system32\wyqwwi.exe reg_run O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O4 - HKCU…\Run: [CU1] D:\Program Files\Common Files\VCClient\VCClient.exe O4 - HKCU…\Run: [CU2] D:\Program Files\Common Files\VCClient\VCMain.exe
Wyłączyć Przywracanie systemu w XP TU
Zastartować do trybu awaryjnego bez internetu(opis w linku wyżej).
Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked. Wpisy zostaną usunięte.
Skasować z dysku pliki i folder, które podkreśliłem na czerwono
Dokończyć skanerami online - Scanery do wyboru
Pokazać nowy log
zastosuj Usuwanie tapety SpySheriff
Usuwanie VX2.BetterInternet L2Mfix
system
13 Grudzień 2005 19:40
#4
Logfile of HijackThis v1.99.1 Scan saved at 20:28:32, on 2005-12-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\System32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\Program Files\Winamp\winampa.exe D:\WINDOWS\SOUNDMAN.EXE D:\WINDOWS\System32\nvraidservice.exe D:\Program Files\Common Files\Symantec Shared\ccApp.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Gadu-Gadu\gg.exe D:\Program Files\Messenger\msmsgs.exe D:\Program Files\Common Files\Symantec Shared\ccProxy.exe D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe D:\WINDOWS\System32\wbem\unsecapp.exe D:\Program Files\Internet Explorer\iexplore.exe D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE D:\Documents and Settings\Michał\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=D:\WINDOWS\System32\Userinit.exe O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\WINDOWS\Downloaded Program Files\googlenav.dll O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM…\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [NVRaidService] D:\WINDOWS\System32\nvraidservice.exe O4 - HKLM…\Run: [ccApp] “D:\Program Files\Common Files\Symantec Shared\ccApp.exe” O4 - HKLM…\Run: [urlLSTCK.exe] D:\Program Files\Norton Internet Security\UrlLstCk.exe O4 - HKLM…\Run: [symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM…\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKCU…\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [MSMSGS] “D:\Program Files\Messenger\msmsgs.exe” /background O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = D:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O8 - Extra context menu item: &Google Search - res://D:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://D:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://D:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://D:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/pl/big/1 … gleNav.cab O20 - Winlogon Notify: Reliability - D:\WINDOWS\system32\kt40l7hm1.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: SAVScan - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
WIEC TAK…:
wpis
nie chciał sie bardzo długo usunąć ale w koncu chyba dało rade(za kazdym razem widniał w HiJacku)
znikneła mi juz ikonka"your computer is infected" ale ciągle pojawiają sie kupy pop upów
L2Mfix nawet nie zaczął szperać w komputerze bo od razu windows zgłosił błąd w ramce edytora rejestru: “nie mozna skopiowac shell.reg,bład podczas kopiowania pliku;moze być to bład dysku lub systemu”
Dalej jestem załamany bo wszystko robiłem zgodnie z instrukcjami…
system
14 Grudzień 2005 15:37
#6
oto log z Silent Runners :
“Silent Runners.vbs”, revision 41, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “D:\WINDOWS\system32\ctfmon.exe” [MS] “Gadu-Gadu” = ““D:\Program Files\Gadu-Gadu\gg.exe” /tray” [“sms-express.com ”] “MSMSGS” = ““D:\Program Files\Messenger\msmsgs.exe” /background” [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “NeroFilterCheck” = “D:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “WinampAgent” = “D:\Program Files\Winamp\winampa.exe” [null data] “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “NVRaidService” = “D:\WINDOWS\System32\nvraidservice.exe” [“NVIDIA Corporation”] “ccApp” = ““D:\Program Files\Common Files\Symantec Shared\ccApp.exe”” [“Symantec Corporation”] “URLLSTCK.exe” = “D:\Program Files\Norton Internet Security\UrlLstCk.exe” [“Symantec Corporation”] “Symantec NetDriver Monitor” = “D:\PROGRA~1\SYMNET~1\SNDMon.exe” [“Symantec Corporation”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++} “cleanup” = (empty string) HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {CLSID}\InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {CLSID}\InProcServer32(Default) = “D:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” -> {CLSID}\InProcServer32(Default) = “D:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll” [empty string] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {CLSID}\InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] “{0521C5B6-6972-432B-9735-C454D2E6E64C}” = (no title provided) -> {CLSID}\InProcServer32(Default) = “D:\WINDOWS\system32\mktrig.dll” [file not found] “{A7839463-F25F-47B7-BDD2-EDD8AED3A791}” = (no title provided) -> {CLSID}\InProcServer32(Default) = “D:\WINDOWS\system32\dbdskres.dll” [null data] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ “AppInit_DLLs” = (value not set) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] INFECTION WARNING! CSCSettings\DLLName = “D:\WINDOWS\system32\p0n80a5ued.dll” [null data] INFECTION WARNING! wzcnotif\DLLName = “wzcdlg.dll” [MS] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ fgsffngx(Default) = “{186054df-4371-46ed-be28-df3bdfbabd36}” -> {CLSID}\InProcServer32(Default) = “D:\WINDOWS\System32\fgqff.dll” [null data] Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}” -> {CLSID}\InProcServer32(Default) = “D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}” -> {CLSID}\InProcServer32(Default) = “D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] Group Policies [Description] {enabled Group Policy setting}: ------------------------------------------------------------ HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ HIJACK WARNING! “ForceActiveDesktopOn”=dword:00000001 [enables Active Desktop and prevents disabling it] {User Configuration|Administrative Templates|Desktop|Active Desktop| Enable Active Desktop} Active Desktop and Wallpaper: ----------------------------- Active Desktop enabled via Group Policy. HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “D:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0\ “SCRNSAVE.EXE” = “D:\WINDOWS\System32\logon.scr” [MS] Startup items in “Michał” & “All Users” startup folders: -------------------------------------------------------- D:\Documents and Settings\All Users\Menu Start\Programy\Autostart “ATI CATALYST – pasek zadań” -> shortcut to: “D:\Program Files\ATI Technologies\ATI.ACE\CLI.exe SystemTray” [null data] Enabled Scheduled Tasks: ------------------------ “Norton AntiVirus - Scan my computer” -> launches: “D:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe /task:“D:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca”” [“Symantec Corporation”] “Symantec NetDetect” -> launches: “D:\Program Files\Symantec\LiveUpdate\NDETECT.EXE” [“Symantec Corporation”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = “&Google” [from CLSID] -> {CLSID}\InProcServer32(Default) = “D:\WINDOWS\Downloaded Program Files\googlenav.dll” [“Google Inc.”] “{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}” = “Web assistant” [from CLSID] -> {CLSID}\InProcServer32(Default) = “D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = “&Google” [from CLSID] -> {CLSID}\InProcServer32(Default) = “D:\WINDOWS\Downloaded Program Files\googlenav.dll” [“Google Inc.”] “{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}” = “Web assistant” -> {CLSID}\InProcServer32(Default) = “D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”] “{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}” = “Norton AntiVirus” -> {CLSID}\InProcServer32(Default) = “D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “D:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “D:\WINDOWS\System32\Ati2evxx.exe” [“ATI Technologies Inc.”] Norton AntiVirus Auto Protect Service, navapsvc, ““D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe”” [“Symantec Corporation”] SAVScan, SAVScan, “D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe” [“Symantec Corporation”] Symantec Event Manager, ccEvtMgr, ““D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe”” [“Symantec Corporation”] Symantec Network Drivers Service, SNDSrvc, ““D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe”” [“Symantec Corporation”] Symantec Network Proxy, ccProxy, ““D:\Program Files\Common Files\Symantec Shared\ccProxy.exe”” [“Symantec Corporation”] Symantec Settings Manager, ccSetMgr, ““D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe”” [“Symantec Corporation”] Windows User Mode Driver Framework, UMWdf, “D:\WINDOWS\System32\wdfmgr.exe” [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 45 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 11 seconds. ---------- (total run time: 83 seconds)
I czy jest inna mozliwość(rećznie jak w win98/me albo innym programem tego VX2??Bo L2Mfix wykrywa błąd rejestru(pisałem wyzej w ost. poscie) i nie chce kontynuować…
Gutek
14 Grudzień 2005 16:15
#7
Otwórz Notatnik i wklej w nim to:
Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG
Start do z Konsoli Odzyskiwania
CD C:\WINDOWS\system32
ATTRIB -R-S-H fgqff.dll
ATTRIB -R-S-H p0n80a5ued.dll
ATTRIB -R-S-H dbdskres.dll
ATTRIB -R-S-H mktrig.dll
ATTRIB -R-S-H guard.tmp
DEL fgqff.dll
DEL p0n80a5ued.dll
DEL dbdskres.dll
DEL mktrig.dll
DEL guard.tmp
EXIT
Przejście do trybu awaryjnego Windows i uruchomienie pliku FIX.REG . Dajesz mi nowego loga z Silenta.
system
14 Grudzień 2005 16:45
#8
moze wyjde na głupka ale co znaczy “CD XP” , za pomocą cd instalacyjnego?
Gutek
14 Grudzień 2005 16:53
#9
