FAQ | Points | Add... | Recent posts | Search | Register | Log in


Strona startowa i sprawdzenie loga
Search:  
Post new topic  This topic is locked      Main Page -> Forum Index -> Computer Service -> Computer Software -> Strona startowa i sprawdzenie loga
Author
Message
WłodekS
Poziom 2
Poziom 2


Joined: 04 Oct 2005
Posts: 3
Location: Przysucha
Post#1 Post from the author of the topic 04 Oct 2005 21:45   

Strona startowa i sprawdzenie loga
Mam problem ze strona startową. Próbowałem Ad-aware, SpayBot, CWShredder i nadal sie ładuje. Pojawiaja się ciągle wpisy w rejestrze z przekierowanie na strone http://195.95.218.172/index.php.
Oto mój log. Może ktoś mi pomoże?. Włodek


hijackthis.txt
 Description:
 n/a

Download
 Filename:  hijackthis.txt
 Contents:  
 Filesize:  10.27 KB
 Punkty:  0.00
Back to top
   
Google

Google Adsense
Post# Post from the author of the topic 04 Oct 2005 21:45   



Back to top
   
Kolobos
Poziom 26
Poziom 26


Joined: 13 Jun 2003
Posts: 26223
Location: Warszawa
Post#2 04 Oct 2005 22:01helpful post - solution   

Strona startowa i sprawdzenie loga
Nie mogles normalnie wkleic log'a? Po co ten zalacznik?

Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000) <- co to ma byc? zarty sobie robisz? http://www.windowupdate.com i sciagnij najnowsza wersje IE!

Zakoncz procesy w menadzerze zadan:

C:\Program Files\Media Gateway\MediaGateway.exe
C:\WINNT\system32\paytime.exe
C:\WINNT\tool2.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
C:\winstall.exe
C:\WINNT\system32\paytime.exe
C:\WINNT\tool2.exe

W hijackthis usun:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe "C:\WINNT\system32\divxenc.exe"
O1 - Hosts: 127.0.0.4 n-glx.s-redirect.com
O1 - Hosts: 127.0.0.4 x.full-tgp.net
O1 - Hosts: 127.0.0.4 counter.sexmaniack.com
O1 - Hosts: 127.0.0.4 autoescrowpay.com
O1 - Hosts: 127.0.0.4 www.autoescrowpay.com
O1 - Hosts: 127.0.0.4 www.awmdabest.com
O1 - Hosts: 127.0.0.4 www.sexfiles.nu
O1 - Hosts: 127.0.0.4 awmdabest.com
O1 - Hosts: 127.0.0.4 sexfiles.nu
O1 - Hosts: 127.0.0.4 allforadult.com
O1 - Hosts: 127.0.0.4 www.allforadult.com
O1 - Hosts: 127.0.0.4 www.iframe.biz
O1 - Hosts: 127.0.0.4 iframe.biz
O1 - Hosts: 127.0.0.4 www.newiframe.biz
O1 - Hosts: 127.0.0.4 newiframe.biz
O1 - Hosts: 127.0.0.4 www.vesbiz.biz
O1 - Hosts: 127.0.0.4 vesbiz.biz
O1 - Hosts: 127.0.0.4 www.pizdato.biz
O1 - Hosts: 127.0.0.4 pizdato.biz
O1 - Hosts: 127.0.0.4 www.aaasexypics.com
O1 - Hosts: 127.0.0.4 aaasexypics.com
O1 - Hosts: 127.0.0.4 www.virgin-tgp.net
O1 - Hosts: 127.0.0.4 virgin-tgp.net
O1 - Hosts: 127.0.0.4 www.awmcash.biz
O1 - Hosts: 127.0.0.4 awmcash.biz
O1 - Hosts: 127.0.0.4 buldog-stats.com
O1 - Hosts: 127.0.0.4 www.buldog-stats.com
O1 - Hosts: 127.0.0.4 fregat.drocherway.com
O1 - Hosts: 127.0.0.4 slutmania.biz
O1 - Hosts: 127.0.0.4 www.slutmania.biz
O1 - Hosts: 127.0.0.4 toolbarpartner.com
O1 - Hosts: 127.0.0.4 www.toolbarpartner.com
O1 - Hosts: 127.0.0.4 www.megapornix.com
O1 - Hosts: 127.0.0.4 megapornix.com
O1 - Hosts: 127.0.0.4 www.sp2fucked.biz
O1 - Hosts: 127.0.0.4 sp2fucked.biz
O1 - Hosts: 127.0.0.4 greg-tut.com
O1 - Hosts: 127.0.0.4 www.greg-tut.com
O1 - Hosts: 127.0.0.4 nylonsexy.com
O1 - Hosts: 127.0.0.4 www.nylonsexy.com
O1 - Hosts: 127.0.0.4 vparivalka.com
O1 - Hosts: 127.0.0.4 www.vparivalka.com
O1 - Hosts: 127.0.0.4 iframeprofit.com
O1 - Hosts: 127.0.0.4 www.iframeprofit.com
O1 - Hosts: 127.0.0.4 topsearch10.com
O1 - Hosts: 127.0.0.4 www.topsearch10.com
O1 - Hosts: 127.0.0.4 statscash.biz
O1 - Hosts: 127.0.0.4 www.statscash.biz
O1 - Hosts: 127.0.0.4 vxiframe.biz
O1 - Hosts: 127.0.0.4 www.vxiframe.biz
O1 - Hosts: 127.0.0.4 crazy-toolbar.com
O1 - Hosts: 127.0.0.4 www.crazy-toolbar.com
O1 - Hosts: 127.0.0.4 topcash.biz
O1 - Hosts: 127.0.0.4 www.topcash.biz
O1 - Hosts: 127.0.0.4 loadcash.biz
O1 - Hosts: 127.0.0.4 www.loadcash.biz
O1 - Hosts: 127.0.0.4 txiframe.biz
O1 - Hosts: 127.0.0.4 www.txiframe.biz
O1 - Hosts: 127.0.0.4 procounter.biz
O1 - Hosts: 127.0.0.4 www.procounter.biz
O1 - Hosts: 127.0.0.4 advadmin.biz
O1 - Hosts: 127.0.0.4 www.advadmin.biz
O1 - Hosts: 127.0.0.4 trafficbest.net
O1 - Hosts: 127.0.0.4 www.trafficbest.net
O1 - Hosts: 127.0.0.4 besthvac.com
O1 - Hosts: 127.0.0.4 www.besthvac.com
O1 - Hosts: 127.0.0.4 traff4.com
O1 - Hosts: 127.0.0.4 www.traff4.com
O1 - Hosts: 127.0.0.4 ambush-script.com
O1 - Hosts: 127.0.0.4 www.ambush-script.com
O1 - Hosts: 127.0.0.4 beehappyy.biz
O1 - Hosts: 127.0.0.4 www.beehappyy.biz
O1 - Hosts: 127.0.0.4 tracktraff.cc
O1 - Hosts: 127.0.0.4 www.tracktraff.cc
O1 - Hosts: 127.0.0.4 allcount.net
O1 - Hosts: 127.0.0.4 www.allcount.net
O1 - Hosts: 127.0.0.4 onedayoffer.biz
O1 - Hosts: 127.0.0.4 www.onedayoffer.biz127.0.0.1 downloads1.kaspersky-labs.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll <- odinstaluj
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe <- odinstaluj i usun katalog Media Gateway
O4 - HKLM\..\Run: [SysMemory manager] c:\winnt\system32\mdms.exe <- usun plik + reszta do usuniecia podana tutaj:
http://securityresponse.symantec.com/avcenter/venc/data/trojan.repsamo.html
O4 - HKLM\..\Run: [PayTime] C:\WINNT\system32\paytime.exe <- usun plik
O4 - HKLM\..\Run: [CPU Watcher] rundll32.exe C:\WINNT\cpu.dll,load <- usun plik cpu.dll
O4 - HKLM\..\Run: [divx] "C:\WINNT\system32\divxenc.exe" <- usun plik
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" <- usun plik
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe <- usun plik
O4 - HKCU\..\Run: [PayTime] C:\WINNT\system32\paytime.exe <- usun plik
O4 - HKCU\..\Run: [divx] "C:\WINNT\system32\divxenc.exe" <- usun plik
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1045\OLFSNT40.EXE <- usun z autostartu jak nie uzywasz.
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O13 - Gopher Prefix:
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/180solutions/ie/Bridge-c139.cab
O21 - SSODL: SysTray.Excn - {1722ECFF-4356-4f5b-B534-E67294FE75E9} - C:\WINNT\system32\gqhphiqi.dll <- usun plik
O21 - SSODL: SysTray.Exsh - {1768ECFC-4F5C-4f5b-B134-D67294FC78E9} - C:\WINNT\system32\ianbjfoq.dll <- usun plik
O21 - SSODL: SysTray.Exsn - {2368D1FC-2F5C-4f1b-B124-E67214FC78E2} - C:\WINNT\system32\kagngchc.dll <- usun plik
O23 - Service: Microsoft H.323 Gatekeeper (GKSVC) - Unknown owner - svchost.exe (file missing) <- uruchom services.msc i wylacz ta usluge, nastepnie usun w hijackthis -> delete nt service i wpisz tam GKSVC

Przeskanuj tez tym:
http://download.microsoft.com/download/8/1/5/815d2d60-49b5-44dc-ae35-fca2f2c6f0cc/MicrosoftAntiSpywareInstall.exe
http://download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po przeskanowaniu odinstaluj.
Zamknij porty tym:
www.firewallleaktester.com/tools/wwdc.exe
Back to top
   
Google

Google Adsense
Post# 04 Oct 2005 22:01helpful post - solution   



Back to top
   
WłodekS
Poziom 2
Poziom 2


Joined: 04 Oct 2005
Posts: 3
Location: Przysucha
Post#3 Post from the author of the topic 06 Oct 2005 20:00   

Re: Strona startowa i sprawdzenie loga
Dzięki wielkie!!! Chyba już wszystko wykurzone bo chodzi poprawnie. Nie mogę tylko odinstalować MicrosoftAntySyware. Muszę spróbować w trybie awaryjnym. Po tych wszystkich czynnościach mam taki log.
Jeszcze raz dzięki Kolobos. :D
Wlodek

Logfile of HijackThis v1.99.1
Scan saved at 14:31:54, on 2005-10-06
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\Program Files\OLAP Services\Bin\msmdsrv.exe
C:\WINNT\system32\ntfrs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wins.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\dns.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\ismserv.exe
C:\WINNT\System32\modemshr.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\Exchsrvr\bin\mad.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\Program Files\Microsoft Shared Fax\Bin\FXSSVC.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Microsoft ISA Server\mspadmin.exe
C:\Program Files\Exchsrvr\bin\store.exe
C:\Program Files\Exchsrvr\bin\emsmta.exe
C:\Program Files\Microsoft ISA Server\w3proxy.exe
C:\Program Files\Microsoft ISA Server\W3Prefch.exe
C:\Program Files\Microsoft ISA Server\wspsrv.exe
C:\Program Files\Alwil Software\Avast4\aswWebSv.exe
C:\Program Files\Alwil Software\Avast4\aswMaiSv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\ALWILS~1\Avast4\aswDisp.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\DC++\DCPlusPlus.exe
E:\Bezpieczeństwo\Strona startowa\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = SBS2K:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\aswDisp.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O13 - Gopher Prefix:
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1128534326156
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = men2k.edu.pl
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF11CE82-6E56-474A-BE6C-0D10052D1D91}: Domain = men2k.edu.pl
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF11CE82-6E56-474A-BE6C-0D10052D1D91}: NameServer = 192.168.16.2
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = men2k.edu.pl
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = men2k.edu.pl
O21 - SSODL: Internet Explorer - {F28A40D7-AD0E-034A-C651-5F0ED76232E6} - C:\WINNT\system32\Fdgijg32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswWebSv.exe" /service (file missing)
O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Microsoft Connector for POP3 Mailboxes (MSPOP3Connector) - Unknown owner - C:\Program Files\Microsoft BackOffice\Connectivity\POP3 Connector\vmimb.exe" /SERVICE (file missing)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe (file missing)
Back to top
   
Google

Google Adsense
Post# Post from the author of the topic 06 Oct 2005 20:00   



Back to top
   
Kolobos
Poziom 26
Poziom 26


Joined: 13 Jun 2003
Posts: 26223
Location: Warszawa
Post#4 06 Oct 2005 20:19helpful post - solution   

Strona startowa i sprawdzenie loga
Antispyware zostaw, tylko ewido miales usunac.

Jeszcze to do wywalenia:
O21 - SSODL: Internet Explorer - {F28A40D7-AD0E-034A-C651-5F0ED76232E6} - C:\WINNT\system32\Fdgijg32.dll (file missing)
Back to top
   
WłodekS
Poziom 2
Poziom 2


Joined: 04 Oct 2005
Posts: 3
Location: Przysucha
Post#5 Post from the author of the topic 10 Oct 2005 10:44   

Re: Strona startowa i sprawdzenie loga
Dzięki
Pozdrawiam
Włodek

Moderated by jankolo:
Temat zamykam

Back to top
   
Post new topic  This topic is locked      Main Page -> Forum Index -> Computer Service -> Computer Software -> Strona startowa i sprawdzenie loga
Page 1 of 1
Similar topics
zablokowana strona startowa w IE (4)
Pomocy-Strona startowa (11)
problem ze strona startowa (11)
Strona Startowa IE (3)
strona startowa (11)
strona startowa (12)
strona startowa w ie 6 (15)
Strona Startowa (3)
Strona startowa w IE i rejestr (4)
IE6 strona startowa (10)

Page generation time: 1.089 seconds


FAQ || Administrator || Moderators || Widgets and banners || Contact
elektroda.pl topic RSS feed