137 wirusów i brak plików po ich usunięciu

**Posty:** 31 · przez **Slawekbe5** 18 Sie 2008, 09:24

Po przeskanowaniu systemu Avirą wyskoczyło 137 wirusów, które usunąłem. Po tym podczas uruchamiania systemu brakuje 3 plików. Poniżej logi:

Kod: Zaznacz wszystko: ComboFix 08-08-15.04 - Sławek 2008-08-18 9:13:23.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.608 [GMT 2:00] Running from: C:\Różne programy\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\WINDOWS\autorun.inf C:\WINDOWS\system\oeminfo.ini . ((((((((((((((((((((((((( Files Created from 2008-07-18 to 2008-08-18 ))))))))))))))))))))))))))))))) . 2008-08-18 09:07 . 2006-03-02 14:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll 2008-08-18 09:06 . 2008-08-18 09:06 <DIR> d-------- C:\WINDOWS\LastGood.Tmp 2008-08-18 09:05 . 2008-08-18 09:05 749 -rah----- C:\WINDOWS\WindowsShell.Manifest 2008-08-18 09:05 . 2008-08-18 09:05 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest 2008-08-18 09:05 . 2008-08-18 09:05 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest 2008-08-18 09:05 . 2008-08-18 09:05 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest 2008-08-18 09:05 . 2008-08-18 09:05 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest 2008-08-18 09:05 . 2008-08-18 09:05 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest 2008-08-18 08:27 . 2008-08-18 08:27 2,620 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-18 08:19 . 2008-08-18 08:19 <DIR> d-------- C:\VundoFix Backups 2008-08-18 08:17 . 2008-08-18 08:26 <DIR> d-------- C:\Różne programy 2008-08-18 07:55 . 2008-08-18 07:55 <DIR> d-------- C:\Program Files\Avira 2008-08-18 07:55 . 2008-08-18 07:55 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avira 2008-08-08 13:05 . 2008-08-08 13:05 <DIR> d-------- C:\Program Files\MarBit 2008-08-08 13:05 . 2008-08-08 13:05 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-08-08 13:05 . 2007-09-04 18:56 164,352 --a------ C:\WINDOWS\system32\unrar.dll 2008-08-08 13:01 . 2008-08-08 13:01 0 --a------ C:\WINDOWS\nsreg.dat 2008-08-08 12:46 . 2008-08-08 12:46 <DIR> d-------- C:\Program Files\Java 2008-08-08 12:46 . 2008-08-08 12:46 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-08 12:46 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-08 11:26 . 2008-08-08 11:26 <DIR> d-------- C:\WINDOWS\system32\URTTemp 2008-08-08 11:24 . 2008-08-08 11:24 <DIR> d-------- C:\Program Files\CCleaner 2008-08-08 11:21 . 2008-08-08 11:21 <DIR> d-------- C:\Program Files\IrfanView 2008-08-08 11:21 . 2008-08-08 11:21 <DIR> d-------- C:\Program Files\7-Zip 2008-08-08 11:07 . 2008-08-08 12:53 <DIR> d-------- C:\Tapety z gier 2008-08-08 10:50 . 2008-08-08 10:50 <DIR> d-------- C:\Program Files\Emapa 2008-07-30 08:11 . 2008-07-30 08:11 1 --a------ C:\atlas.prn . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-09 14:18 --------- d-----w C:\Documents and Settings\Sławek\Dane aplikacji\Nokia Multimedia Player . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360] "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-05-15 17:12 484904] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 10:21 153136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 07:26 7700480] "Samsung Common SM"="C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" [2005-07-03 09:20 372736] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 12:36 229376] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 13:06 40048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 07:26 86016] "nwiz"="nwiz.exe" [2007-04-19 07:26 1626112 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26e9fff1-05fc-11dd-9ca4-001d7d9695fd}] \Shell\AutoRun\command - F:\ \Shell\open\Command - rundll32.exe .\desktop.dll,InstallM [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{80e77514-5fa7-11dd-9d08-001d7d9695fd}] \Shell\AutoRun\command - F:\ \Shell\open\Command - rundll32.exe .\desktop.dll,InstallM *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Sławek\Dane aplikacji\Mozilla\Firefox\Profiles\iqk28z0f.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-18 09:14:29 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-18 9:14:52 ComboFix-quarantined-files.txt 2008-08-18 07:14:49 Pre-Run: 153,127,358,464 bajtów wolnych Post-Run: 153,119,858,688 bajtów wolnych 102 --- E O F --- 2008-04-25 12:43:16

i drugi

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:15:53, on 2008-08-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe \?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe -- End of file - 5745 bytes

Proszę o pomoc.

**Posty:** 18165 · przez **wojtas** 18 Sie 2008, 11:42

jakich plików ?

Otworz notatnik i wklej w nim to:

Folder::
C:\VundoFix Backups

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26e9fff1-05fc-11dd-9ca4-001d7d9695fd}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{80e77514-5fa7-11dd-9d08-001d7d9695fd}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 31 · przez **Slawekbe5** 18 Sie 2008, 17:43

Po użyciu Combofixa jż przy odpalaniu nie ma komunikatu o braku plików. Z tego co pamiętam to jeden nazywał się copy.exe.

wojtas napisał(a):Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

Przez przypadek usunąłem go więc nie mogę wrzucić. Przeskanowałem wszystko jeszcze raz Avira i innymi programami z tego forum i wszystko działa dobrze. Jak będę miał jutro dostęp do komputera to odpale Combofix i umieszczę logi na forum. Dzięki za pomoc.