Czym Usunac Wyskakujące Okienka?

[Gość wodnikpl]

Witam,

 

problem jest nastepujacy. Co jakis czas sam mi sie wlacza firefox nawet wtedy gdy go nie uzywam i otwiera mi jakes reklamy :mur: Reinstalnalem i dalej to samo. W IE problem nie znika. Czym da sie usunac te spamowanie albo jak to wylaczyc ?? Jestem swiezo po formacie.

[ULLISSES]

Czy to jest na pewno okno Firefoxa? 99% spamu używa polecenia:

IEXPLORE.EXE %, co w moim przypadku jest dla nich zgubne - nie mam takiego pliku w systemie :]

Głupie reklamy w IE odpala od czasu do czasu FlashGet bodajże oraz niektóre inne "darmowe" programy.

Wklej log z HiJack.

[Kolobos]

Uzyj:

http://www.simplytech.it/L2MRemover/index_e.htm

http://www.softpedia.com/get/Internet/Popu...rs/Killme.shtml

 

Jak juz usuniesz look2me to wklej na forum log z hijackthis.

[Gość wodnikpl]

Czy to jest na pewno okno Firefoxa? 99% spamu używa polecenia:

IEXPLORE.EXE %, co w moim przypadku jest dla nich zgubne - nie mam takiego pliku w systemie :]

Głupie reklamy w IE odpala od czasu do czasu FlashGet bodajże oraz niektóre inne "darmowe" programy.

Wklej log z HiJack.

Napewno okno z Firefoxa. Normalnie robie cos na pc a za chwile sie wlacza ff z jakas reklama o darmowych wygaszaczach albo jakies konkursy ;/

 

A to moj log:

 

Logfile of HijackThis v1.99.1

Scan saved at 10:03:44, on 2006-07-20

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\V29kbmlr\command.exe

D:\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

D:\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

D:\BTC\KMaestro.exe

D:\AutoConnect\AutoConnect.exe

D:\ObjectDock\ObjectDock.exe

D:\przydatne\wazne\dtb\dtb.exe

D:\Xfire\xfire.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Adam\Pulpit\hijackthis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FlashGet\fgiebar.dll

O4 - HKLM\..\Run: [Zone Labs Client] d:\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [DiskeeperSystray] "D:\Diskeeper Corporation\Diskeeper\DkIcon.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [btcMaestro] d:\BTC\KMaestro.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKCU\..\Run: [oiuq] C:\PROGRA~1\COMMON~1\oiuq\oiuqm.exe

O4 - HKCU\..\Run: [AutoConnect] D:\AutoConnect\AutoConnect.exe

O4 - Startup: Skrót do autostart.lnk = C:\Documents and Settings\Adam\Moje dokumenty\autostart.vbs

O4 - Startup: Stardock ObjectDock.lnk = D:\ObjectDock\ObjectDock.exe

O8 - Extra context menu item: Download All by FlashGet - D:\FlashGet\jc_all.htm

O8 - Extra context menu item: Download using FlashGet - D:\FlashGet\jc_link.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{FF6E7921-368B-4E6B-A10B-BC85F2640477}: NameServer = 194.204.152.34 217.98.63.164

O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\lvj0091me.dll

O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\ddutil.dll (file missing)

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\V29kbmlr\command.exe

O23 - Service: Diskeeper - Diskeeper Corporation - D:\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Edytowane 20 Lipca 2006 przez wodnikpl

[Kolobos]

Dlaczego nie uzyles programow, ktore Ci podalem?

 

W hjt usun:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL

O4 - HKCU\..\Run: [oiuq] C:\PROGRA~1\COMMON~1\oiuq\oiuqm.exe <- katalog oiuq usun z dysku.

O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\lvj0091me.dll

O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\ddutil.dll (file missing)

 

Usluga do kasacji:

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\V29kbmlr\command.exe

Usuwasz tak:

Start->Uruchom->cmd i tam:

sc stop cmdService

sc delete cmdService

 

Katalog V29kbmlr usun z dysku, do tego przeskanuj system przy pomocy ewido.

[ULLISSES]

Kolobos: Byłeś szybszy. ;)

 

wodnikpl: Rzuć okiem tutaj, jeśli jeszcze nie czytałeś: http://forum.purepc.pl/index.php?showtopic=151728

[Gość wodnikpl]

Narazie wszystko jest OK.

 

Moj log wyglada nastepujaco:

 

Logfile of HijackThis v1.99.1

Scan saved at 17:47:03, on 2006-07-20

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

D:\Zone Labs\ZoneAlarm\zlclient.exe

D:\BTC\KMaestro.exe

D:\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

D:\AutoConnect\AutoConnect.exe

C:\WINDOWS\system32\wuauclt.exe

D:\ObjectDock\ObjectDock.exe

D:\Xfire\Xfire.exe

D:\przydatne\wazne\DTB\DTB.exe

D:\Tlen.pl\tlen.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Adam\Pulpit\hijackthis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FlashGet\fgiebar.dll

O4 - HKLM\..\Run: [Zone Labs Client] d:\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [btcMaestro] d:\BTC\KMaestro.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O8 - Extra context menu item: Download All by FlashGet - D:\FlashGet\jc_all.htm

O8 - Extra context menu item: Download using FlashGet - D:\FlashGet\jc_link.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{FF6E7921-368B-4E6B-A10B-BC85F2640477}: NameServer = 194.204.152.34 217.98.63.164

O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll

O20 - Winlogon Notify: Uninstall - C:\WINDOWS\

O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - D:\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)

O23 - Service: Diskeeper - Diskeeper Corporation - D:\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

czy jescze cos nalezy wywalic ??

[Kolobos]

Jeszcze to:

O20 - Winlogon Notify: Uninstall - C:\WINDOWS\

 

Log jest juz ok.

[Gość wodnikpl]

Dobra usunałem juz to. Dzieki za pomoc