Woooolny Net Po Reinstalacji Xp

[soSna]

Siemanko ... no wiec tak.

 

Zlorzylem kumplowi kompa. Zainstalowalem XP Pro i zamiast odrazu dac SP1 to podlaczylem neta : / ... chyba sie sciagnelo pare ad-awere/spy'ow/virow/trojanow. Po zrebootowaniu kompa odpalam neta i dziala on w miare swoich mozliwosci przez jakas minute, a potem prawie calkowicie siada ( nadal jest podlaczony, ale transfer pozostawia wieeeele do zyczenia - zazwyczaj stronki sie niewczytuja : > ).

 

Uzylem juz Ad-Awera i wywalilem pare gowien ale nadal nic ... antywirus wywalil tez pare plikow nalezacych chyba do KaZaA 3.

 

Zalaczam loga z HiJackThis - Mam nadzieje, ze dacie rade mi pomoc.

 

 

Logfile of HijackThis v1.99.1Scan saved at 21:04:58, on 2005-03-01Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Ahead\InCD\InCDsrv.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\System32\wdfmgr.exeC:\WINDOWS\System32\winpnp32.exeC:\WINDOWS\System32\crscs.exeC:\WINDOWS\System32\RunDll32.exeC:\WINDOWS\System32\spoolsvr.exeC:\Program Files\Java\jre1.5.0_01\bin\jusched.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Gadu-Gadu\gg.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\WINDOWS\System32\smsse.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Alwil Software\Avast4\setup\avast01.setupC:\Program Files\Alwil Software\Avast4\ashSimpl.exeC:\Documents and Settings\Admin\Pulpit\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = TPSA Śmierdzi kauem;FR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = ŁączaF2 - REG:system.ini: Shell=Explorer.exe smsse.exeO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dllO3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [PCprot] crscs.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [Vital Load Process] spoolsvr.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exeO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\RunServices: [PCprot] crscs.exeO4 - HKLM\..\RunServices: [Vital Load Process] spoolsvr.exeO4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /trayO4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htmO8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dllO9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exeO9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exeO16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://bezpieczenstwo.onet.pl/skaner/SkanerOnline.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{C7A8B512-EB63-409F-BA80-5621209DE4EC}: NameServer = 194.204.152.34 217.98.63.164O21 - SSODL: Web Event Logger - {79FEACFF-FFCE-815E-A900-316290B5B738} - C:\WINDOWS\System32\Obikocfl.dllO21 - SSODL: mtklefa - {58A8E7EA-8178-4B5F-DC9C-3D706C6A69C3} - C:\WINDOWS\System32\bhjrce32.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exeO23 - Service: Windows 32-bit PnP Driver (winpnp32) - Unknown owner - C:\WINDOWS\System32\winpnp32.exe

[N2O]

http://www.hijackthis.de/index.php

:)

[Kolobos]

Na poczatek menadzer zadan i zabij:

C:\WINDOWS\System32\winpnp32.exe

C:\WINDOWS\System32\crscs.exe

C:\WINDOWS\System32\spoolsvr.exe

C:\WINDOWS\System32\smsse.exe

 

W hijackthis usun:

 

F2 - REG:system.ini: Shell=Explorer.exe smsse.exe

O4 - HKLM\..\Run: [PCprot] crscs.exe

O4 - HKLM\..\Run: [Vital Load Process] spoolsvr.exe

O4 - HKLM\..\RunServices: [PCprot] crscs.exe

O4 - HKLM\..\RunServices: [Vital Load Process] spoolsvr.exe

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

O21 - SSODL: Web Event Logger - {79FEACFF-FFCE-815E-A900-316290B5B738} - C:\WINDOWS\System32\Obikocfl.dll

O21 - SSODL: mtklefa - {58A8E7EA-8178-4B5F-DC9C-3D706C6A69C3} - C:\WINDOWS\System32\bhjrce32.dll

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: Windows 32-bit PnP Driver (winpnp32) - Unknown owner - C:\WINDOWS\System32\winpnp32.exe

 

To chyba tyle :-)

Zainstaluj sobie SpyBot S&D i SpywareBlaster

[soSna]

sorry, ze tak tak dlugo nieodpowaidalem ale zachorowalem : /

 

chcialem Wam podziekowac za podjecie proby pomocy ale niestety niepodzialalo :P

 

zrobilem poprostu reinstala i zanim podalaczylem sie do neta zainstalowalem SP1 & 2 + avasta i wszystko juz gra : )

 

thnx anyway : )