problem z programem (chyba virus)

**Posty:** 94 · przez **wojtek24** 03 Lip 2007, 20:50

dalem loga do sprawdzenia i nic nie wykrylo usunelem wirusa z komputera i wszystkie spyw ale mam problem caly czas pokazuje mi sie w prawym dolnym rogu niebieska ikonka ze znakiem zapytania i co chwila zmienia sie na czerwona z krzyzykiem,nie moge jej usunac w zaden sposob a gry klikne na niego dowolnym przyciskiem myszy wlacza mi sie strona z jakims niby antyspy protector do sciagniecia i co jakis czas wyskakuje z tego okienka "system alert" ze niby wykryl jakies spyware prosze o pomoc ps.jaki jest najlepszy do usuwania spyware

**Posty:** 1850 · przez **Tomaszu** 03 Lip 2007, 20:59

wojtek24 napisał(a):dalem loga do sprawdzenia

Daj go jeszcze raz. Ostatnio nie napisałeś czemu wklejasz loga.
Teraz przyczynę znamy. Daj loga. Tylko nie ten sam, którego podawałeś ostatnio. Możliwe ze masz dużo syfu...

**Posty:** 94 · przez **wojtek24** 03 Lip 2007, 23:54

log ponizej

**Posty:** 18165 · przez **wojtas** 04 Lip 2007, 00:03

log musy byc w tagach

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

Autor postu otrzymał pochwałę

**Posty:** 94 · przez **wojtek24** 04 Lip 2007, 00:06

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 23:29:07, on 2007-07-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergencySrv.exe C:\WINDOWS\system32\usrbridg.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergency.exe C:\Program Files\Opera\Opera.exe C:\Program Files\totalcmd\TOTALCMD.EXE D:\Programy\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yoby.net/sb/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [SpyEmergency] "C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergency.exe" O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.0_03\bin\npjpi140_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.0_03\bin\npjpi140_03.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {7AA32FC7-133B-4AE7-998E-CED0D9829B12} (luna Class) - http://axcab.wrs.mcboo.com/website.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{503622AC-AF51-4B73-A157-D71ABE407652}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{9F67C703-E697-473C-9FCA-1A9CD2E70270}: NameServer = 85.255.116.107 85.255.112.83 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Spy Emergency Shield Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergencySrv.exe O23 - Service: IrBridge User-Level Interface (USRBRIDG) - Extended Systems, Inc. - C:\WINDOWS\system32\usrbridg.exe

**Posty:** 18165 · przez **wojtas** 04 Lip 2007, 00:08

Ściągnij program http://downloads.subratam.org/Fixwareout.exe i zastosuj go

oraz daj loga z combofixa

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

ora hijacka

**Posty:** 94 · przez **wojtek24** 04 Lip 2007, 00:10

do usuniecia spy uzywalem programow spy emergency 2007 i spybot serch & destroy, skasowal kilka spy ale problem opisany powyzej nadal istnieje skanowalem tez avastem i mks online

**Posty:** 18165 · przez **wojtas** 04 Lip 2007, 00:12

zorb co kazalem i wruc z logami

**Posty:** 94 · przez **wojtek24** 04 Lip 2007, 00:25

dzieki po uzyciu tego combo fix problem znikl

jakby co dam jeszcze loga z combo fix i hj ps. co mam zrobic z plikami ktore utworzyly sie na c: w folderze qoobox tam sa jakies pliki objete kwarantana mozna je wyrzucic?

Kod: Zaznacz wszystko: "WWW" - 2007-07-03 23:52:21 - ComboFix 07-07-03.9 - Dodatek Service Pack 2 [color=red][b]FAT32 [/b][/color] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1.\TEMP C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1.\TEMP\0F8F5844.TMP C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1.\TEMP\CAAA7DD7.TMP C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1.\TEMP\DFC5A2B2.TMP C:\DOCUME~1\WWW\DANEAP~1.\macromedia\Flash Player\#SharedObjects\MDPY2UV3\iforex.com C:\DOCUME~1\WWW\DANEAP~1.\macromedia\Flash Player\#SharedObjects\MDPY2UV3\iforex.com\Emerp\Events\flash_object.swf\user_data.sol C:\DOCUME~1\WWW\DANEAP~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com C:\DOCUME~1\WWW\DANEAP~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol C:\DOCUME~1\WWW\Pulpit.\internet explorer.lnk C:\Program Files\Common Files\{19141~1 C:\Program Files\Common Files\{39141~1 C:\Program Files\ipwindows C:\Program Files\ipwindows\pop2DB.tmp C:\Program Files\ipwindows\popD06.tmp C:\Program Files\ipwindows\set1.tmp C:\Program Files\ipwindows\set2.tmp C:\Program Files\ipwindows\set3.tmp C:\Program Files\ipwindows\set4.tmp C:\Program Files\ipwindows\set5.tmp C:\Program Files\ipwindows\set6.tmp C:\Program Files\ipwindows\set9.tmp C:\WINDOWS\retadpu41.exe C:\WINDOWS\system32\nuqjici.dll ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_COM+_MESSAGES ((((((((((((((((((((((((( Files Created from 2007-06-03 to 2007-07-03 ))))))))))))))))))))))))))))))) 2007-07-03 23:52 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-03 23:47 6,902 --a------ C:\dnsbak.reg 2007-07-03 21:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1\Spybot - Search & Destroy 2007-07-03 16:11 94,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-03 16:11 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-07-03 16:11 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-03 16:11 689,280 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-03 16:11 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-03 16:11 31,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-03 16:11 23,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-03 15:47 14,528 --a------ C:\WINDOWS\system32\drivers\spyemrg_guard.sys 2007-07-03 15:47 14,016 --a------ C:\WINDOWS\system32\drivers\spyemrg.sys 2007-07-03 15:47 129,856 --a------ C:\WINDOWS\system32\SpyEmergencyCnt.dll 2007-07-03 15:47 <DIR> d-------- C:\Program Files\NETGATE 2007-07-03 15:47 <DIR> d-------- C:\DOCUME~1\WWW\DANEAP~1\Spy Emergency 2007-07-03 15:47 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1\NETGATE 2007-06-27 23:32 16,896 --a------ C:\WINDOWS\system32\DECRYPT.DLL 2007-06-26 09:42 <DIR> d-------- C:\Program Files\HT Networks 2007-06-18 19:17 <DIR> d-------- C:\Program Files\mget 2007-06-13 21:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1\Ubisoft 2007-06-11 12:04 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-06-11 12:03 51,232 --a------ C:\wwdc.exe 2007-06-11 12:02 2,085,616 --a------ C:\WindowsXP-KB894391-x86-PLK.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-03 21:53:02 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-03 21:53:02 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-05-14 20:20:34 -------- d-----w C:\Program Files\Sierra On-Line 2007-05-13 11:48:34 -------- d-----w C:\DOCUME~1\WWW\DANEAP~1\Lost Marble 2007-05-13 11:06:36 -------- d-----w C:\DOCUME~1\WWW\DANEAP~1\Sports Interactive 2007-04-20 00:14:48 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2003-05-15 00:47 50376 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{31FF080D-12A3-439A-A2EF-4BA95A3148E8}] 2007-01-04 22:57 247112 --a------ C:\Program Files\GetRight\xx2gr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}] 2006-10-31 07:55 1803720 --a------ C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ C:\PROGRA~1\SPYBOT~1\SDHelper.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40] "nwiz"="nwiz.exe" [2004-07-15 11:42 C:\WINDOWS\system32\nwiz.exe] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-21 11:20] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-01-15 18:28] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpyEmergency"="C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergency.exe" [2007-06-18 17:30] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins] C:\Program Files\Ipwindows\ipwins.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mp3 option atom kind] C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\camp setup mp3 option\Multi support.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartSync - ScheduleSync] C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ThisPlus] C:\DOCUME~1\WWW\DANEAP~1\MULTIO~1\LOVEPROXYPOKE.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusProtectPro 3.3] "C:\Program Files\VirusProtectPro 3.3\VirusProtectPro 3.3.exe" /h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wuauserv"=2 (0x2) "wscsvc"=2 (0x2) "srservice"=2 (0x2) "SharedAccess"=2 (0x2) "Schedule"=2 (0x2) "ALG"=3 (0x3) "avast! Web Scanner"=3 (0x3) "avast! Mail Scanner"=3 (0x3) "avast! Antivirus"=2 (0x2) "aswUpdSv"=2 (0x2) Contents of the 'Scheduled Tasks' folder 2006-12-06 22:03:10 C:\WINDOWS\tasks\Symantec NetDetect.job 2007-02-26 01:53:28 C:\WINDOWS\tasks\ADC4693A92FC1C56.job ************************************************************************** catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-03 23:55:28 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-03 23:56:18 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-03 23:56 --- E O F ---

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 00:00:52, on 2007-07-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergencySrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\usrbridg.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergency.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Opera\Opera.exe C:\Program Files\totalcmd\TOTALCMD.EXE C:\WINDOWS\system32\NOTEPAD.EXE D:\Programy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [SpyEmergency] "C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergency.exe" O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.0_03\bin\npjpi140_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.0_03\bin\npjpi140_03.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {7AA32FC7-133B-4AE7-998E-CED0D9829B12} (luna Class) - http://axcab.wrs.mcboo.com/website.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{503622AC-AF51-4B73-A157-D71ABE407652}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{9F67C703-E697-473C-9FCA-1A9CD2E70270}: NameServer = 85.255.116.107 85.255.112.83 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Spy Emergency Shield Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergencySrv.exe O23 - Service: IrBridge User-Level Interface (USRBRIDG) - Extended Systems, Inc. - C:\WINDOWS\system32\usrbridg.exe

[ Dodano: Dzisiaj o 0:48 ]
mam inny problem teraz za kazdym razem spybot s & d wykrywa mi Zlob.DNSChanger za kazdym razem usuwam i znowu jest jak sie go pozbyc i co on powoduje

**Posty:** 18165 · przez **wojtas** 04 Lip 2007, 09:35

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\dnsbak.reg
C:\WINDOWS\tasks\ADC4693A92FC1C56.job

Registry keys to delete:

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ThisPlus

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mp3 option atom kind

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusProtectPro 3.3

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O17 - HKLM\System\CCS\Services\Tcpip\..\{9F67C703-E697-473C-9FCA-1A9CD2E70270}: NameServer = 85.255.116.107 85.255.112.83

wojtek24 napisał(a):spybot s & d wykrywa mi Zlob.DNSChanger

pokaz screena

wojtek24 napisał(a):mozna je wyrzucic?

mozesz

**Posty:** 94 · przez **wojtek24** 04 Lip 2007, 15:36

po zrobieniu tego co kazales w avenger i hij problem z zlobem zniknal spybot nie nie pokazuje juz nic inne antyviry i antyspaje tez problemow narazie nie widze, chyba narazie jestem czysty wiec bardzo serdzecznie dziekuje za pomoc (pochwala juz poleciala

**Posty:** 4 · przez **sedes** 05 Lip 2007, 16:57

Mam ten sam problem co moj przedmowca ale pomimo prob jakie opisywaliscie powyzej tej "herb" niebiesko czerowny nie chce zniknac

to moj log :

Logfile of HijackThis v1.99.1
Scan saved at 16:25:48, on 2007-07-05
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\DOCUME~1\Familia\USTAWI~1\Temp\Rar$EX00.734\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Dzieńdobry!] C:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {81E688E8-36A4-4FEF-B70B-8B0A1C5C1308} (WebLauncherX Control) - http://www.abra-meble.pl/cadprojekt/launcher.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

**Posty:** 18165 · przez **wojtas** 05 Lip 2007, 17:30

sedes zaloz swoj topic i tam wszystko opisz

**Posty:** 5 · przez **wimcyk** 10 Lip 2007, 23:43

Ok thnx

problem z programem (chyba virus)

problem z programem (chyba virus)

nowy log

Kto jest na forum