CxtPls.EXE

Witam

W moim menedzerze zadan windows znajduje sie cala masa niepokojacych mnie, uruchomionych aplikacji miedzy innymi plik CxtPls.EXE ktory wielokrotnie usuwalem jednak caly czas sie odradza, dodam ze ten walsnie plik zuzywa spora czesc procesora i zaczyna dzialac w momencie otwarcia IE. Czy ktos ma jakis pomysl jak roprawic sie z tym badziewiem?

Moim drugim problemem jest spora ilosc popupow odpalajacych sie nawet kiedy zadne okno IE nie jest otwarte, chcialem naswietlic bardziej sprawe poprzez pokazanie loga z "Hijack this" , jednak kiedy robie save i otwiera sie notepad nic w nim nie ma, co rowniez zaliczam do problemow z jakimi sie borykam. Jakies pomysly??

Z gory wielkie dzieki za pomoc

Nie no nie poleglem bo wszystko dziala tez nie lubie takich koncow ale nic sie juz poradzic nie dalo, zupelnie mi windowsy zwariowaly, klikalem w IE ikone, pojawia sie klepsydra i po chwili znika. Klikam w moj komputer pojawia sie klepsydra i znika a potem znika wszystko na pulpicie i znow sie pojawia :/ Troche ciezko to wytlumaczyc bo nie operuje na poziomie "freestyle" jezykiem komputerowym ;). W kazydm razie jestem juz po reinstalce i wszystko dziala jak trza ;). Sorry za zamieszanie Bobi.

2steppa

Dodano: 12.11.2004 14:38:08

2steppa:
Przepraszam ze nie piosałem wcześniej ale postanowilismy z kolega przeinstalowac system i "zaczac od poczatku".DZIEKUJE jeszcze raz za pomoc!

Chlopie polegles
Jak ja nie lubie takich koncow tematu :?

Bobi

Dodano: 11.11.2004 23:54:18

Przepraszam ze nie piosałem wcześniej ale postanowilismy z kolega przeinstalowac system i "zaczac od poczatku".DZIEKUJE jeszcze raz za pomoc!

2steppa

Dodano: 11.11.2004 21:25:45

2steppa:
Witam Panowie. Pisze w imieniu 2steppa, udostępnił mi swój login. Ma on powaźny problem. Nie działa IE, więc nie moźe tu pisać. Jest ogólny "FREEZE" . Nie da się wejść w źaden folder, dosłownie nic, ani z poziomu pulpitu, ani z poziomu menu start, nie da się wejść w panel sterowania, dosłownie nic. Proszę o jakąś radę. W imieniu 2steppa dziękuję.

Napisz cos wiecej bo ze nie da sie wejsc to zbyt ogolne stwierdzenie
Jakis komunikat, blad ??
Co co chodzi??

Bobi

Dodano: 11.11.2004 16:03:42

Witam Panowie. Pisze w imieniu 2steppa, udostępnił mi swój login. Ma on powaźny problem. Nie działa IE, więc nie moźe tu pisać. Jest ogólny "FREEZE" . Nie da się wejść w źaden folder, dosłownie nic, ani z poziomu pulpitu, ani z poziomu menu start, nie da się wejść w panel sterowania, dosłownie nic. Proszę o jakąś radę. W imieniu 2steppa dziękuję.

2steppa

Dodano: 11.11.2004 15:52:37

Wylacz przywracanie
Usun pliki z dysku:
advstr10.exe
ahuocmgr.exe
C:WINDOWS sdb >> cały katalog
Helper100.dll
ntrnl.dll
poszukaj >> rdgPL10.exe

Fix

R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *hot–searches.com*;*lender–search.com*
R3 – Default URLSearchHook is missing
O1 – Hosts file is located at: C:WINDOWS sdbhosts
O1 – Hosts: 81.211.105.69 lender–search.com
O1 – Hosts: 81.211.105.68 hot–searches.com
O2 – BHO: (no name) – {017C20C1–F86F–11D8–9B25–000ACD002AE3} – C:WINDOWSHelper100.dll
O2 – BHO: (no name) – {474E62C7–3D2C–42C7–BAD8–B1107C6A7D25} – C:WINDOWSSystem32 trnl.dll
O4 – HKLM..Run: [MSConfig] C:WINDOWSPCHealthHelpCtrBinariesMSConfig.exe /auto
O4 – HKLM..Run: [v77S38R] advstr10.exe
O4 – HKCU..Run: [ewo2RUd5T] ahuocmgr.exe
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
016 – DPF: {00302A9F–D06F–4D1A–A4C8–44E835163330} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {03796105–A76F–7B07–27A6–444F164CAB58} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {16A0F0BB–D3B5–7F68–E043–1CF8682A422C} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {18F9323B–33DB–2280–A0D8–636E592A5DC4} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {2E0DF572–85A4–4023–C302–33E93C5BE405} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {3594008F–E457–1B0F–787E–674433C75DB9} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {40BDD771–ACA3–4664–29FB–384F08274306} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {492CCB1D–1FB2–2FFD–6310–21962538B59A} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {4F122C1D–EB7C–41ED–F154–49FD1567E1CF} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {4F5E4276–C120–11D6–A1FD–00508B9D48EA} (dldisplay Class) – http://www.gamehouse.com/ghdlctl.cab
O16 – DPF: {6770709C–4B9F–182E–9757–524600DEB51B} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {68271488–3B48–4543–A045–1A0234DD746E} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {696C94DA–78E0–32E0–55CD–14D230C9BD66} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {71208C39–D62C–4E79–8CA5–210D19631E1D} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {72600AAC–A13A–3E43–5363–2CEB4CCD03B1} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {7FC6E71F–0227–7651–C1CB–675C27F52478} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {91433D86–9F27–402C–B5E3–DEBDD122C339} – http://www.netvenda.com/sites/games–intl/pl/games4.cab
O16 – DPF: {DDFFA75A–E81D–4454–89FC–B9FD0631E726} – http://www.bundleware.com/activeX/BM2/BM2.dll

Co to za plik i od czego, ktory masz na pulpicie >> attachment.exe

Bobi

Dodano: 11.11.2004 15:02:48

Sorry ze znowu mieszam ale udalo mi sie wreszcie zrobic tego loga z HJT oto on :

Logfile of HijackThis v1.97.7
Scan saved at 12:39:58, on 2004–11–11
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesAlienGUIsewbload.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesNorton SystemWorksNorton AntiVirus avapsvc.exe
C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
C:WINDOWSExplorer.EXE
C:WINDOWSSystem32 vsvc32.exe
C:PROGRA~1NORTON~1SPEEDD~1 opdb.exe
C:Program FilesWinampwinampa.exe
C:Program FilesCommon FilesRealUpdate_OB ealsched.exe
C:Program FilesQuickTimeqttask.exe
C:WINDOWSiexplore.exe
C:Program FilesGIANT Company SoftwareGIANT AntiSpywaregcasServ.exe
C:Program FilesGadu–Gadugg.exe
C:Program FilesGIANT Company SoftwareGIANT AntiSpywaregcasDtServ.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSExplorer.EXE
C:Program FilesWinRARWinRAR.exe
C:Documents and SettingsAndrzejPulpitattachment.exe

R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = 192.168.0.1:8080
R1 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *hot–searches.com*;*lender–search.com*
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – Default URLSearchHook is missing
O1 – Hosts file is located at: C:WINDOWS sdbhosts
O1 – Hosts: 81.211.105.69 lender–search.com
O1 – Hosts: 81.211.105.68 hot–searches.com
O2 – BHO: (no name) – {017C20C1–F86F–11D8–9B25–000ACD002AE3} – C:WINDOWSHelper100.dll
O2 – BHO: (no name) – {474E62C7–3D2C–42C7–BAD8–B1107C6A7D25} – C:WINDOWSSystem32 trnl.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" –osboot
O4 – HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" –atboottime
O4 – HKLM..Run: [Explorer] C:WINDOWSiexplore.exe
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [MSConfig] C:WINDOWSPCHealthHelpCtrBinariesMSConfig.exe /auto
O4 – HKLM..Run: [v77S38R] advstr10.exe
O4 – HKLM..Run: [gcasServ] "C:Program FilesGIANT Company SoftwareGIANT AntiSpywaregcasServ.exe"
O4 – HKCU..Run: [ewo2RUd5T] ahuocmgr.exe
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O4 – HKLM..RunOnce: [GIANTAntiSpywareCleaner] C:Program FilesGIANT Company SoftwareGIANT AntiSpywaregcASCleaner.exe
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 – Extra button: Badanie (HKLM)
O9 – Extra button: Related (HKLM)
O9 – Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 – DPF: {00302A9F–D06F–4D1A–A4C8–44E835163330} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {02BF25D5–8C17–4B23–BC80–D3488ABDDC6B} (QuickTime Object) – http://www.apple.com/qtactivex/qtplugin.cab
O16 – DPF: {03796105–A76F–7B07–27A6–444F164CAB58} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {166B1BCA–3F9C–11CF–8075–444553540000} (Shockwave ActiveX Control) – http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 – DPF: {16A0F0BB–D3B5–7F68–E043–1CF8682A422C} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {17492023–C23A–453E–A040–C7C580BBF700} (Windows Genuine Advantage Validation Tool) – http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 – DPF: {18F9323B–33DB–2280–A0D8–636E592A5DC4} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {288C5F13–7E52–4ADA–A32E–F5BF9D125F98} (CR64Loader Object) – http://www.miniclip.com/platypus/miniclipGameLoader.dll
O16 – DPF: {2E0DF572–85A4–4023–C302–33E93C5BE405} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {33564D57–0000–0010–8000–00AA00389B71} – http://download.microsoft.com/download/F/6/E/F6E491A6–77E1–4E20–9F5F–94901338C922/wmv9VCM.CAB
O16 – DPF: {3594008F–E457–1B0F–787E–674433C75DB9} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {40BDD771–ACA3–4664–29FB–384F08274306} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {492CCB1D–1FB2–2FFD–6310–21962538B59A} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {4F122C1D–EB7C–41ED–F154–49FD1567E1CF} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {4F5E4276–C120–11D6–A1FD–00508B9D48EA} (dldisplay Class) – http://www.gamehouse.com/ghdlctl.cab
O16 – DPF: {56336BCB–3D8A–11D6–A00B–0050DA18DE71} (RdxIE Class) – http://software–dl.real.com/08326394118f186d0520/netzip/RdxIE601.cab
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097252674030
O16 – DPF: {6770709C–4B9F–182E–9757–524600DEB51B} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {68271488–3B48–4543–A045–1A0234DD746E} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {696C94DA–78E0–32E0–55CD–14D230C9BD66} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {71208C39–D62C–4E79–8CA5–210D19631E1D} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {72600AAC–A13A–3E43–5363–2CEB4CCD03B1} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {7FC6E71F–0227–7651–C1CB–675C27F52478} – http://213.159.117.150/1/rdgPL10.exe
O16 – DPF: {91433D86–9F27–402C–B5E3–DEBDD122C339} – http://www.netvenda.com/sites/games–intl/pl/games4.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {DDFFA75A–E81D–4454–89FC–B9FD0631E726} – http://www.bundleware.com/activeX/BM2/BM2.dll

Z wiekszoscia problemow juz sie chyba uporalem dzieki programowi "Giant AntiSpyware", ale bardzo bym prosil o rzucenie okiem jeszcze na tego loga HJT, co ewentualnie usunac. Pozdro

2steppa

Dodano: 11.11.2004 13:45:57

Wiec po kolei
Wylacz przywracanie systemu
Wylacz w tasku procesy wymienione w Run Keys
Pozbadz sie w rejestrze kluczy oraz plikow nizej wymienionych

**** Run Keys ****
RUN: [ntrnlc] C:WINDOWSSystem32 trnlc.exe
RUN: [MSConfig] C:WINDOWSPCHealthHelpCtrBinariesMSConfig.exe /auto >> to odpowiedzialne za uruchamianie msconfig przy starcie, jesli chcesz mozesz zostawic

RUN: [TV Media] C:Program FilesTV MediaTvm.exe
RUN: [AutoUpdater] "C:Program FilesAutoUpdateAutoUpdate.exe"
RUN: [v77S38R] advstr10.exe
RUN: [ewo2RUd5T] ahuocmgr.exe
RUN: [TV Media] C:Program FilesTV MediaTvm.exe

**** Browser Helper Objects ****

BHO: [] C:Program FilesCxtPlsCxtPls.dll
BHO: [SDWin32 Class] C:WINDOWSSystem32 trnl.dll
BHO: [LinkTracker Class] C:WINDOWSSystem32lmf32.dll

**** IE Extensions ****

IEExt: [SideFind]

**** Hosts File Entries ****

HOSTS: 127.0.0.3 n–glx.s–redirect.com
HOSTS: 127.0.0.3 x.full–tgp.net
HOSTS: 127.0.0.3 counter.sexmaniack.com
HOSTS: 127.0.0.3 autoescrowpay.com
HOSTS: 127.0.0.3 www.autoescrowpay.com
HOSTS: 127.0.0.3 www.awmdabest.com
HOSTS: 127.0.0.3 www.sexfiles.nu
HOSTS: 127.0.0.3 awmdabest.com
HOSTS: 127.0.0.3 sexfiles.nu
HOSTS: 127.0.0.3 allforadult.com
HOSTS: 127.0.0.3 www.allforadult.com
HOSTS: 127.0.0.3 www.iframe.biz
HOSTS: 127.0.0.3 iframe.biz
HOSTS: 127.0.0.3 www.newiframe.biz
HOSTS: 127.0.0.3 newiframe.biz
HOSTS: 127.0.0.3 www.vesbiz.biz
HOSTS: 127.0.0.3 vesbiz.biz
HOSTS: 127.0.0.3 www.Pamela.biz
HOSTS: 127.0.0.3 Pamela.biz
HOSTS: 127.0.0.1 www.igetnet.com
HOSTS: 127.0.0.1 code.ignphrases.com
HOSTS: 127.0.0.1 clear–search.com
HOSTS: 127.0.0.1 r1.clrsch.com
HOSTS: 127.0.0.1 sds.clrsch.com
HOSTS: 127.0.0.1 status.clrsch.com
HOSTS: 127.0.0.1 www.clrsch.com
HOSTS: 127.0.0.1 clr–sch.com
HOSTS: 127.0.0.1 sds–qckads.com
HOSTS: 127.0.0.1 status.qckads.com

**** IE Settings ****

IEBypass: *hot–searches.com*;*lender–search.com*

Local Page: http://213.159.117.134/index.php
Search Bar: http://hot–searches.com/search.php?v=6&aff=6381289

**** IE Context Menu (Right click) ****

IEContext: [Web Rebates] file://C:Program FilesWeb_RebatesSy1150Tp1150scri1150a.htm

**** Downloaded Program Files ****

{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]

**** Custom IE Search Items ****

SEARCH: [SearchAssistant] about:blank
SEARCH: [Data]
SEARCH: [SearchAssistant] about:blank
SEARCH: [CustomizeSearch]
SEARCH: [Search Assistant] http://www.seekseek.com/quicksearch.asp?keyphrase=

Wlacz przywracanie

Bobi

Dodano: 11.11.2004 11:29:30

O to chodzilo?

**** Run Keys ****

RUN: [WinampAgent] C:Program FilesWinampwinampa.exe
RUN: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
RUN: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" –osboot
RUN: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" –atboottime
RUN: [Explorer] C:WINDOWSiexplore.exe
RUN: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
RUN: [ntrnlc] C:WINDOWSSystem32 trnlc.exe
RUN: [MSConfig] C:WINDOWSPCHealthHelpCtrBinariesMSConfig.exe /auto
RUN: [TV Media] C:Program FilesTV MediaTvm.exe
RUN: [AutoUpdater] "C:Program FilesAutoUpdateAutoUpdate.exe"
RUN: [v77S38R] advstr10.exe
RUN: [ewo2RUd5T] ahuocmgr.exe
RUN: [TV Media] C:Program FilesTV MediaTvm.exe
RUN: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray

**** Browser Helper Objects ****

BHO: [] C:Program FilesCxtPlsCxtPls.dll
BHO: [] C:WINDOWSHelper100.dll
BHO: [SDWin32 Class] C:WINDOWSSystem32 trnl.dll
BHO: [LinkTracker Class] C:WINDOWSSystem32lmf32.dll
BHO: [IeCatch2 Class] C:PROGRA~1FlashGetjccatch.dll

**** IE Toolbars ****

TOOLBAR: [Norton AntiVirus] C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
TOOLBAR: [FlashGet Bar] C:PROGRA~1FlashGetfgiebar.dll
TOOLBAR: [&Radio] C:WINDOWSSystem32msdxm.ocx

**** IE Extensions ****

IEExt: []
IEExt: [SideFind]
IEExt: [Badanie]
IEExt: [@shdoclc.dll,–866]
IEExt: [FlashGet] C:PROGRA~1FlashGetflashget.exe

**** Hosts File Entries ****

HOSTS: 127.0.0.3 n–glx.s–redirect.com
HOSTS: 127.0.0.3 x.full–tgp.net
HOSTS: 127.0.0.3 counter.sexmaniack.com
HOSTS: 127.0.0.3 autoescrowpay.com
HOSTS: 127.0.0.3 www.autoescrowpay.com
HOSTS: 127.0.0.3 www.awmdabest.com
HOSTS: 127.0.0.3 www.sexfiles.nu
HOSTS: 127.0.0.3 awmdabest.com
HOSTS: 127.0.0.3 sexfiles.nu
HOSTS: 127.0.0.3 allforadult.com
HOSTS: 127.0.0.3 www.allforadult.com
HOSTS: 127.0.0.3 www.iframe.biz
HOSTS: 127.0.0.3 iframe.biz
HOSTS: 127.0.0.3 www.newiframe.biz
HOSTS: 127.0.0.3 newiframe.biz
HOSTS: 127.0.0.3 www.vesbiz.biz
HOSTS: 127.0.0.3 vesbiz.biz
HOSTS: 127.0.0.3 www.pizdato.biz
HOSTS: 127.0.0.3 pizdato.biz
HOSTS: 127.0.0.1 www.igetnet.com
HOSTS: 127.0.0.1 code.ignphrases.com
HOSTS: 127.0.0.1 clear–search.com
HOSTS: 127.0.0.1 r1.clrsch.com
HOSTS: 127.0.0.1 sds.clrsch.com
HOSTS: 127.0.0.1 status.clrsch.com
HOSTS: 127.0.0.1 www.clrsch.com
HOSTS: 127.0.0.1 clr–sch.com
HOSTS: 127.0.0.1 sds–qckads.com
HOSTS: 127.0.0.1 status.qckads.com

**** IE Settings ****

IEProxy: 192.168.0.1:8080
IEBypass: *hot–searches.com*;*lender–search.com*
Default Page: http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default Search: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Local Page: http://213.159.117.134/index.php
Search Bar: http://hot–searches.com/search.php?v=6&aff=6381289
Search Page: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

**** IE Context Menu (Right click) ****

IEContext: [Download All by FlashGet] C:Program FilesFlashGetjc_all.htm
IEContext: [Download using FlashGet] C:Program FilesFlashGetjc_link.htm
IEContext: [E&ksport do programu Microsoft Excel] res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
IEContext: [Web Rebates] file://C:Program FilesWeb_RebatesSy1150Tp1150scri1150a.htm

**** Layered Service Providers ****

LSP: lspak.dll over [MSAFD Tcpip [TCP/IP]]
LSP: lspak.dll over [MSAFD Tcpip [UDP/IP]]
LSP: MSAFD Tcpip [TCP/IP]
LSP: MSAFD Tcpip [UDP/IP]
LSP: RSVP UDP Service Provider
LSP: RSVP TCP Service Provider
LSP: MSAFD NetBIOS [DeviceNetBT_Tcpip_{BBBD906E–2A47–494A–9015–AF47FF411853}] SEQPACKET 0
LSP: MSAFD NetBIOS [DeviceNetBT_Tcpip_{BBBD906E–2A47–494A–9015–AF47FF411853}] DATAGRAM 0
LSP: MSAFD NetBIOS [DeviceNetBT_Tcpip_{91731410–B171–4B01–80C9–7D5183343F3C}] SEQPACKET 1
LSP: MSAFD NetBIOS [DeviceNetBT_Tcpip_{91731410–B171–4B01–80C9–7D5183343F3C}] DATAGRAM 1
LSP: MSAFD NetBIOS [DeviceNetBT_Tcpip_{EA6DDDD5–0A07–4C67–932F–B007AEF936FA}] SEQPACKET 2
LSP: MSAFD NetBIOS [DeviceNetBT_Tcpip_{EA6DDDD5–0A07–4C67–932F–B007AEF936FA}] DATAGRAM 2

**** Blocked Control Panel Items ****

BLOCKED: [ncpa.cpl] No
BLOCKED: [odbccp32.cpl] No

**** Downloaded Program Files ****

{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]
{00302A9F–D06F–4D1A–A4C8–44E835163330} [http://213.159.117.150/1/rdgPL10.exe]

**** Custom IE Search Items ****

SEARCH: [SearchAssistant] about:blank
SEARCH: [Data]
SEARCH: [SearchAssistant] about:blank
SEARCH: [CustomizeSearch]
SEARCH: [Search Assistant] http://www.seekseek.com/quicksearch.asp?keyphrase=

Jak takiego syfu nalapales nie wiem, wiem za to ze gdybym chcial cos takiego u siebie zrobic musilbym sie niezle natrudzic

fajnie... :( tez nie wiem jak to sie stalo, ciekawostka dropsa jest to ze robilem reinstalke i format jakies 3 tygodnie temu.

HOSTS: 127.0.0.3 www.sexfiles.nu
HOSTS: 127.0.0.3 awmdabest.com
HOSTS: 127.0.0.3 sexfiles.nu
HOSTS: 127.0.0.3 allforadult.com
HOSTS: 127.0.0.3 www.allforadult.com

haha no ladnie :) dzieki za pomoc jeszcze raz

2steppa

Dodano: 11.11.2004 02:20:17

Trochę smiecia jest z tego co zobaczyłem.
Będzie sypać Bloodhound.Exploit.6 podczas sprawdzania w edycji text.

Uźyj bajeru z załącznika, wytnij to co się pokaźe i zapodaj w formacie Code.

McScr@by

Dodano: 10.11.2004 23:04:45

2steppa:
ale zobaczyles te screeny? postaram sie jakos zrobic tego loga inaczej.

Tak widzialem
Z procesow to zamknij te ktore napisalem wyzej a z loga nie przesadzajac to polowa odleci

Update: Kombinuj z logiem :wink:

Wylacz Przywracanie
Na screenach masz pozycje ktore nalezy usunac (FIX) z loga oraz odszukac na dysku wszystki pliki wymienione (pokaz systemowi zeby szukal w ukrytych) i wywalic

Jak takiego syfu nalapales nie wiem, wiem za to ze gdybym chcial cos takiego u siebie zrobic musilbym sie niezle natrudzic

Jak juz wykombinujesz z HJT wklej na forum loga ale juz nie screena

Bobi

Dodano: 10.11.2004 21:04:48

ale zobaczyles te screeny? postaram sie jakos zrobic tego loga inaczej.

2steppa

Dodano: 10.11.2004 20:35:04

Wiec do zabicia i usniecia sa procesy:
advstr10.exe
ahuocmgr.exe

Postaraj sie zrobic to co polecilem z HJT bo uwierz mi ze przepisywanie tego z screena to głupia robota
a smiecia w cholere niestety

Bobi

Dodano: 10.11.2004 19:32:44

i jescze screeny z HJT

2steppa

Dodano: 10.11.2004 17:01:17

Zrobilem skan Norton Anti_vir, spy–ware usuwam na bierzaco spybot–em.
Tak jak mowiles usunalem CxtPls.EXE, zobaczymy na ile ta metoda bedzie skuteczna poniewaz wczoraj robilem dokladnie to samo a dzis odrodzilo sie na nowo, puki co ,dziala. Wylaczylem przywracanie systemu. Niestety nie udalo mi sie dojsc do tego jak zrobic save tego loga z HJT dlatego pod spodem umieszczam kolejno screeny z menedzera i HJT.

Jako bonus jeszcze jedna sprawa, mianowicie mam w Program Files folder o nazwie "TV Media" nie mam pojecia skad sie wzial, a co gorsze nie da sie go skasowac bo pisze ze cos go uzywa, w menedzerze takiej aplikacji nie ma, jedynie po wlaczeniu msconfig widac zaznaczone "TVM" jednak po odznaczeniu i restarcie zaznacze sie na nowo. Mam nadzieje ze nie zawracam glowy zbytnio. Dzieki za porady.

2steppa

Dodano: 10.11.2004 16:52:50

CxtPls.EXE

Odpowiedzi: 15