problem ze spy albo virusem (virus pro)

**Posty:** 4 · przez **sedes** 05 Lip 2007, 17:40

Mam problem z tym virusem czy co to jest. Chodzi mi o ten "herb" z "X" na czerwonym tle lub "?" na niebieskim. Nie mam pojecia jak sie tego pozybyc PLZ help moj log

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:25:48, on 2007-07-05 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\System32\CTsvcCDA.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\DOCUME~1\Familia\USTAWI~1\Temp\Rar$EX00.734\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Dzieńdobry!] C:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O16 - DPF: {81E688E8-36A4-4FEF-B70B-8B0A1C5C1308} (WebLauncherX Control) - [url=http://www.abra-meble.pl/cadprojekt/launcher.cab]http://www.abra-meble.pl/cadprojekt/launcher.cab[/url] O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

**Posty:** 18165 · przez **wojtas** 05 Lip 2007, 17:43

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

skasuj wpis:

O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)

oraz daj loga z:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 4 · przez **sedes** 05 Lip 2007, 17:55

Kod: Zaznacz wszystko: "Familia" - 2007-07-05 17:21:58 - ComboFix 07-07-04.4 - Dodatek Service Pack. 1 ((((((((((((((((((((((((( Files Created from 2007-06-05 to 2007-07-05 ))))))))))))))))))))))))))))))) 2007-07-05 16:04 4,934 --a------ C:\dnsbak.reg 2007-07-05 15:38 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-03 22:29 <DIR> d-------- C:\Program Files\Real Alternative 2007-07-03 22:29 <DIR> d-------- C:\Program Files\Media Player Classic 2007-07-03 22:29 <DIR> d-------- C:\DOCUME~1\Familia\DANEAP~1\Real 2007-07-03 22:29 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-07-01 20:37 <DIR> d-------- C:\Program Files\Common Files\DirectX 2007-07-01 20:26 <DIR> d-------- C:\DOCUME~1\Familia\DANEAP~1\InstallShield 2007-07-01 03:14 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-07-01 03:14 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-07-01 03:14 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-07-01 03:14 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-07-01 03:14 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-07-01 03:14 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-07-01 03:14 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-07-01 03:14 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-07-01 03:14 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-07-01 03:14 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-07-01 03:14 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-07-01 03:14 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-07-01 03:14 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-07-01 03:14 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-07-01 03:14 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-07-01 03:14 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-07-01 03:14 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2007-07-01 03:14 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-07-01 03:13 <DIR> d-------- C:\Program Files\direx 2007-07-01 02:27 740,442 --a------ C:\WINDOWS\system32\divx.dll 2007-07-01 02:27 630,784 --a------ C:\WINDOWS\system32\vp7vfw.dll 2007-07-01 02:27 593,920 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-07-01 02:27 564,224 --a------ C:\WINDOWS\system32\x264vfw.dll 2007-07-01 02:27 438,272 --a------ C:\WINDOWS\system32\vp6vfw.dll 2007-07-01 02:27 39,936 --a------ C:\WINDOWS\system32\huffyuv.dll 2007-07-01 02:27 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2007-07-01 02:27 217,088 --a------ C:\WINDOWS\system32\i420vfw.dll 2007-07-01 02:27 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-07-01 02:27 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-07-01 01:39 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2007-07-01 01:39 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-07-01 01:39 <DIR> d-------- C:\Program Files\AGEIA Technologies 2007-07-01 01:35 2,414,360 --a------ C:\WINDOWS\d3dx9_31.dll 2007-07-01 01:34 68,888 --a------ C:\WINDOWS\xinput1_3.dll 2007-07-01 01:33 24,344 --a------ C:\WINDOWS\X3DAudio1_1.dll 2007-07-01 01:09 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-07-01 00:55 <DIR> d-------- C:\Program Files\7-Zip 2007-06-30 15:34 <DIR> d-------- C:\Program Files\Nsasoft 2007-06-29 14:32 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-06-29 14:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Adobe Systems 2007-06-28 15:13 <DIR> d-------- C:\DOCUME~1\Familia\PressService 2007-06-24 22:39 <DIR> d-------- C:\Program Files\LM Studio 2007-06-24 22:17 <DIR> d-------- C:\WINDOWS\system32\URTTEMP 2007-06-24 18:10 <DIR> d-------- C:\Program Files\Skype 2007-06-24 18:10 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-06-24 18:10 <DIR> d-------- C:\DOCUME~1\Familia\DANEAP~1\Skype 2007-06-24 18:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype 2007-06-22 22:10 <DIR> d-------- C:\Program Files\Teamspeak2_RC2 2007-06-22 22:10 <DIR> d-------- C:\DOCUME~1\Familia\DANEAP~1\teamspeak2 2007-06-19 20:22 <DIR> d--h----- C:\WINDOWS\PIF 2007-06-08 20:12 <DIR> d-------- C:\Program Files\INTERIAPL 2007-06-08 20:12 <DIR> d-------- C:\DOCUME~1\Familia\DANEAP~1\INTERIAPL 2007-06-08 17:33 20,096 --a------ C:\WINDOWS\system32\drivers\MSIRCOMM.sys 2007-06-08 17:13 99,840 --a------ C:\WINDOWS\system32\irftp.exe 2007-06-08 17:13 78,848 --a------ C:\WINDOWS\system32\irmon.dll 2007-06-08 17:13 7,680 --a------ C:\WINDOWS\system32\wshirda.dll 2007-06-08 17:13 55,296 --a------ C:\WINDOWS\system32\drivers\irda.sys 2007-06-08 17:13 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys 2007-06-08 17:13 19,561 -ra------ C:\WINDOWS\system32\drivers\ma-660.sys 2007-06-08 16:53 <DIR> d-------- C:\Program Files\Mobile Action 2007-06-08 16:33 225,280 --a------ C:\WINDOWS\X70phmgunin.exe 2007-06-08 16:30 225,280 -ra------ C:\WINDOWS\Z600phmgunin.exe 2007-06-08 16:29 <DIR> d-------- C:\DOCUME~1\Familia\DANEAP~1\MobileAction 2007-06-08 10:02 <DIR> d-------- C:\Program Files\Cartall 2007-06-08 10:02 <DIR> d-------- C:\Program Files\Borland 2007-06-08 10:01 299,520 --a------ C:\WINDOWS\uninst.exe 2007-06-07 16:24 <DIR> d-------- C:\Program Files\3wPlayer 2007-06-06 14:30 <DIR> d-------- C:\Program Files\123 Video Converter 2007-06-06 14:02 <DIR> d-------- C:\DOCUME~1\Familia\DANEAP~1\Ulead Systems 2007-06-06 14:01 1,645,320 --------- C:\WINDOWS\system32\gdiplus.dll 2007-06-06 13:58 <DIR> d-------- C:\Program Files\SmartSound Software 2007-06-06 13:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\SmartSound Software Inc 2007-06-06 13:55 <DIR> d-------- C:\WINDOWS\system32\windows media 2007-06-06 13:54 <DIR> d--h----- C:\WINDOWS\msdownld.tmp 2007-06-06 13:52 86,016 --a------ C:\WINDOWS\unvise32qt.exe 2007-06-06 13:52 <DIR> d-------- C:\WINDOWS\system32\QuickTime 2007-06-06 13:52 <DIR> d-------- C:\Program Files\QuickTime 2007-06-06 13:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\QuickTime 2007-06-06 13:51 <DIR> d-------- C:\Program Files\Windows Media Components 2007-06-06 13:50 <DIR> d-------- C:\Program Files\Ulead Systems 2007-06-06 13:50 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2007-06-06 13:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Ulead Systems (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-05 13:45:43 79,386 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-05 13:45:43 457,230 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-04 18:52:49 8,704 --s-a-w C:\WINDOWS\system32\xnvaogd.dll 2007-07-04 15:24:36 -------- d-----w C:\DOCUME~1\Familia\DANEAP~1\uTorrent 2007-07-01 18:27:24 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-01 00:27:57 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-07-01 00:23:44 -------- d-----w C:\Program Files\DivX 2007-06-20 10:53:33 -------- d-s---w C:\Program Files\Xfire 2007-06-19 22:04:41 -------- d-----w C:\DOCUME~1\Familia\DANEAP~1\Xfire 2007-06-08 13:03:14 -------- d--h--w C:\Program Files\WindowsUpdate 2007-06-06 11:56:26 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-27 12:27:25 -------- d-----w C:\Program Files\Easy GIF Animator 2007-05-16 18:44:05 -------- d-----w C:\Program Files\NETPLUS 2007-05-14 18:04:37 -------- d-----w C:\Program Files\Photoshop 7.0 CE 2007-05-13 14:48:50 -------- d-----w C:\Program Files\Torrent Master 2007-05-11 08:08:48 -------- d-----w C:\Program Files\Winamp 2007-05-11 06:05:56 -------- d-----w C:\DOCUME~1\Familia\DANEAP~1\MusicIP 2007-05-08 18:06:59 -------- d-----w C:\DOCUME~1\Familia\DANEAP~1\Gadu-Gadu 2007-05-08 18:06:27 -------- d-----w C:\Program Files\Gadu-Gadu 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-30 07:48:34 5,137 ----a-w C:\WINDOWS\unins000.dat 2007-04-30 07:32:40 972 ----a-w C:\WINDOWS\unins001.dat 2007-04-30 07:32:40 73,392 ----a-w C:\WINDOWS\unins001.exe 2007-04-23 00:15:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-04-23 00:02:36 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-04-19 21:45:05 3,012 ----a-w C:\WINDOWS\mozver.dat 2007-04-05 06:44:38 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-04-05 06:44:37 552 ----a-w C:\WINDOWS\system32\d3d8caps.dat ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2005-09-24 06:12 63136 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2006-12-15 03:23 440056 --a------ C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42] "nwiz"="nwiz.exe" [2005-08-02 10:35 C:\WINDOWS\system32\nwiz.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Dzieńdobry!"="C:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe" [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ClearRecentDocsOnExit"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}"="C:\WINDOWS\System32\xnvaogd.dll" [2007-07-04 20:52] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Color Calibration.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Color Calibration.lnk backup=C:\WINDOWS\pss\Color Calibration.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^MagicTune 3.6.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\MagicTune 3.6.lnk backup=C:\WINDOWS\pss\MagicTune 3.6.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Familia^Menu Start^Programy^Autostart^Xfire.lnk] path=C:\Documents and Settings\Familia\Menu Start\Programy\Autostart\Xfire.lnk backup=C:\WINDOWS\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CafeNews] C:\Program Files\CafeNews\CN.exe /autostart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative MediaSource Go] C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe /SCB [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dzieńdobry!] C:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\internetisoerrorwarn] C:\Documents and Settings\All Users\Dane aplikacji\EACH JUMP INTERNET ISO\bib two.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\liveeq] C:\DOCUME~1\Familia\DANEAP~1\TRAYTO~1\Keep User.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe *Newly Created Service* - NPKCRYPT ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-05 17:22:57 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-05 17:23:48 C:\ComboFix-quarantined-files.txt ... 2007-07-05 17:23 C:\ComboFix2.txt ... 2007-07-05 16:09 C:\ComboFix3.txt ... 2007-07-05 15:47 --- E O F ---

**Posty:** 18165 · przez **wojtas** 05 Lip 2007, 18:26

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

sciagnij killbox`a:

http://www.wiruskill.pl/forum/viewtopic.php?t=58

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\system32\xnvaogd.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

potem skasuj plik:

C:\dnsbak.reg

potem wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\internetisoerrorwarn]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\liveeq]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

te pliki:

C:\WINDOWS\X70phmgunin.exe
C:\WINDOWS\Z600phmgunin.exe

przeskanuj tu:
http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty oraz nowe logi

Autor postu otrzymał pochwałę

**Posty:** 4 · przez **sedes** 05 Lip 2007, 18:42

OK THX wielkie za pomoc wystarcczylo tylko zeskanowac tym smitfraudfix i juz smiga jak dawaniej THX jeszce raz i powchaly dal cibie offcoz

**Posty:** 18165 · przez **wojtas** 05 Lip 2007, 20:44

nie nie wykonac co kazalem i wroc z logami i raportami

problem ze spy albo virusem (virus pro)

problem ze spy albo virusem (Virus pro)

Kto jest na forum