prozba o sprawdzenie loga..

**Posty:** 3 · przez **undertaker_x** 15 Paź 2005, 20:46

To moj pierwszy post wiec witam bardzo serdecznie wszystkich. I od razu prozba. mam problem z kompem a mianowice mial troche swinstwa z ktorym sobei poradzilem ale cos jeszcze zostalo i nie wiem co.. i zaobserwowalem rowniez ze ie nie laduje mi takich stron jak www.rajdy4x4.pl/forum , www.allegro.pl i wiekszosci forum (naszczescie programosy.pl smigaja)

oto log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:34:57, on 2005-10-15 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\WINDOWS\system32\usbn.exe C:\WINDOWS\System32\??rvices.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Wanadoo\EspaceWanadoo.exe C:\Program Files\Wanadoo\ComComp.exe C:\Program Files\Wanadoo\Watch.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Grabowski\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada Plus wita Cie w Internecie R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {3617F1E3-0034-62EA-05E1-16AADA9094AB} - C:\WINDOWS\System32\nxhog.dll (file missing) O2 - BHO: (no name) - {4E189548-3C9F-541A-A2AB-72FCDF53EBFE} - C:\WINDOWS\System32\xnppb.dll (file missing) O2 - BHO: (no name) - {A87F48BB-EB68-89E6-5964-FE24B2260EA6} - C:\WINDOWS\System32\qmjwac.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {B1B64BED-B069-D9E5-5534-FBA42A6746A2} - C:\WINDOWS\System32\sqhpivh.dll (file missing) O2 - BHO: (no name) - {D04D7D75-8AA3-BA24-9858-CD57D5D223FC} - C:\WINDOWS\System32\vmhjnd.dll O2 - BHO: (no name) - {E0604F75-A793-F910-B56C-8B7AE1940EC9} - C:\WINDOWS\System32\vmhjnd.dll O2 - BHO: (no name) - {E5604D75-A790-8F10-B568-FD7AE5E20ECC} - C:\WINDOWS\System32\vmhjnd.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [usbn] C:\WINDOWS\system32\usbn.exe -go -c200 -w4 O4 - HKLM\..\Run: [t7mjekg6] C:\WINDOWS\System32\t7mjekg6.exe O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [Advanced Tools Check] D:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE O4 - HKLM\..\Run: [28ohqh9l] C:\WINDOWS\System32\28ohqh9l.exe O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O4 - HKCU\..\Run: [Aruo] "C:\Program Files\nucp\oodu.exe" -vt mt O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe O4 - HKCU\..\Run: [Uuevnbs] C:\WINDOWS\System32\??rvices.exe O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sysvcs.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms-its:mhtml:file://c:\adsuntdt.mht!http://adextension.com/ext2/lca.chm::/bridge-c46.cab O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O16 - DPF: {2DF91772-19DC-47AE-B52F-B8E2FE545625} (Spd2 Class) - http://www.lemontv.pl/lmctrls.cab O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/bin/cortcore.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{85151CF9-D79A-41EE-8CD3-5DDD8F99FEBB}: NameServer = 194.204.152.34 217.98.63.164 O20 - Winlogon Notify: avpu32 - C:\WINDOWS\SYSTEM32\avpu32.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

z gory dzieki za pomoc..
pozdrawam Robert.

przez **jeff** 15 Paź 2005, 21:05

masz dużo syfu, przeskanuj dysk tym i wywal wszystko :

Panda

Kaspersky

mks_vir

CWShredder 2.15

SpyBot - Search & Destroy v1.4 PL

Ad-aware SE Personal 1.06

PestPatrol

potem wrzuc log z HijackThis

**Posty:** 3 · przez **undertaker_x** 16 Paź 2005, 09:43

Panda : uzylem - 6 wirusow z czego jeden zdezynfekowany, parenascie programow szpiegujacych z czego zaden nie usuniety ani nic.

kasperski : albo sie nie znam ale nei wiem jak przeskanowac caly dysk, skoro mozna tam tylko sprawdzic pojednynczy plik.

mks_vir : nic nie wykryl :]

cwsshedder : uzyty i cos tam zrobil

spybot : nie laczy sie ze stronka..

ad-aware - uzyty przedwczoraj i wyczyszczyl wszystko

pestPatrol : poszedl i poczyscil

a teraz log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 09:35:56, on 2005-10-16 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\WINDOWS\system32\usbn.exe C:\PROGRA~1\PESTPA~1\PPControl.exe C:\PROGRA~1\PESTPA~1\PPMemCheck.exe C:\PROGRA~1\PESTPA~1\CookiePatrol.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Wanadoo\EspaceWanadoo.exe C:\Program Files\Wanadoo\ComComp.exe C:\Program Files\Wanadoo\Watch.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\msiexec.exe C:\WINDOWS\system32\??rvices.exe C:\Documents and Settings\Grabowski\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada Plus wita Cie w Internecie R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {3617F1E3-0034-62EA-05E1-16AADA9094AB} - C:\WINDOWS\System32\nxhog.dll (file missing) O2 - BHO: (no name) - {4E189548-3C9F-541A-A2AB-72FCDF53EBFE} - C:\WINDOWS\System32\xnppb.dll (file missing) O2 - BHO: (no name) - {A87F48BB-EB68-89E6-5964-FE24B2260EA6} - C:\WINDOWS\System32\qmjwac.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {B1B64BED-B069-D9E5-5534-FBA42A6746A2} - C:\WINDOWS\System32\sqhpivh.dll (file missing) O2 - BHO: (no name) - {D04D7D75-8AA3-BA24-9858-CD57D5D223FC} - C:\WINDOWS\System32\vmhjnd.dll O2 - BHO: (no name) - {E0604F75-A793-F910-B56C-8B7AE1940EC9} - C:\WINDOWS\System32\vmhjnd.dll O2 - BHO: (no name) - {E5604D75-A790-8F10-B568-FD7AE5E20ECC} - C:\WINDOWS\System32\vmhjnd.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [usbn] C:\WINDOWS\system32\usbn.exe -go -c200 -w4 O4 - HKLM\..\Run: [t7mjekg6] C:\WINDOWS\System32\t7mjekg6.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [Advanced Tools Check] D:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE O4 - HKLM\..\Run: [28ohqh9l] C:\WINDOWS\System32\28ohqh9l.exe O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM\..\RunOnce: [Pest Cleaning] "C:\Program Files\PestPatrol\ppclean.exe" "clean" "ts:20051015214844" "cws" "2" O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O4 - HKCU\..\Run: [Aruo] "C:\Program Files\nucp\oodu.exe" -vt mt O4 - HKCU\..\Run: [Uuevnbs] C:\WINDOWS\System32\??rvices.exe O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sysvcs.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O16 - DPF: {2DF91772-19DC-47AE-B52F-B8E2FE545625} (Spd2 Class) - http://www.lemontv.pl/lmctrls.cab O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/bin/cortcore.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{85151CF9-D79A-41EE-8CD3-5DDD8F99FEBB}: NameServer = 194.204.152.34 217.98.63.164 O20 - Winlogon Notify: avpu32 - C:\WINDOWS\SYSTEM32\avpu32.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

**Posty:** 6 · przez **fuksiara** 16 Paź 2005, 10:45

pozwolę sobie wtrącić kilka słow .
Kilka wątków nizej miałam ten sam problem Progsik który usuwa wpis

Kod: Zaznacz wszystko: O20 - Winlogon Notify: avpu32 - C:\WINDOWS\SYSTEM32\avpu32.dll

to BlackLight Beta z tej stronki http://f-secure.com/

A jesli chodzi o kaspersky skaner online który w pełni przeskanuje Twojego kompa znajdziesz go tu http://www.kaspersky.com/virusscanner
Poki nie usuniesz tego wpisu zaden skaner ci nie zadziała

przez **Tom@szek** 16 Paź 2005, 13:33

undertaker_x napisał(a):spybot : nie laczy sie ze stronka..

ftp://fx1.hrz.uni-dortmund.de/sw_data/su1669/spybotsd/spybotsd14.exe

przez **jeff** 16 Paź 2005, 14:02

jedziemy

start do trybu awaryjnego z wyłączonym przywracaniem sysa.
Kasujesz ręcznie pogrubione pliki:

C:\WINDOWS\system32\usbn.exe
C:\WINDOWS\system32\??rvices.exe
C:\WINDOWS\System32\nxhog.dll
C:\WINDOWS\System32\xnppb.dll
C:\WINDOWS\System32\qmjwac.dl
C:\WINDOWS\System32\sqhpivh.dll
C:\WINDOWS\System32\vmhjnd.dll
C:\WINDOWS\System32\t7mjekg6.exe
C:\WINDOWS\System32\28ohqh9l.exe
"C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
C:\Program Files\nucp\oodu.exe
C:\WINDOWS\System32\sysvcs.exe
C:\WINDOWS\System32\vbsys2.dll

potem kasujesz w Hijacku

O2 - BHO: (no name) - {3617F1E3-0034-62EA-05E1-16AADA9094AB} - C:\WINDOWS\System32\nxhog.dll (file missing)
O2 - BHO: (no name) - {4E189548-3C9F-541A-A2AB-72FCDF53EBFE} - C:\WINDOWS\System32\xnppb.dll (file missing)
O2 - BHO: (no name) - {A87F48BB-EB68-89E6-5964-FE24B2260EA6} - C:\WINDOWS\System32\qmjwac.dll (file missing)
O2 - BHO: (no name) - {B1B64BED-B069-D9E5-5534-FBA42A6746A2} - C:\WINDOWS\System32\sqhpivh.dll (file missing
O2 - BHO: (no name) - {D04D7D75-8AA3-BA24-9858-CD57D5D223FC} - C:\WINDOWS\System32\vmhjnd.dll
O2 - BHO: (no name) - {E0604F75-A793-F910-B56C-8B7AE1940EC9} - C:\WINDOWS\System32\vmhjnd.dll
O2 - BHO: (no name) - {E5604D75-A790-8F10-B568-FD7AE5E20ECC} - C:\WINDOWS\System32\vmhjnd.dl
O4 - HKLM\..\Run: [usbn] C:\WINDOWS\system32\usbn.exe -go -c200 -w4
O4 - HKLM\..\Run: [t7mjekg6] C:\WINDOWS\System32\t7mjekg6.exe
O4 - HKLM\..\Run: [28ohqh9l] C:\WINDOWS\System32\28ohqh9l.exe
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [Aruo] "C:\Program Files\nucp\oodu.exe" -vt mt
O4 - HKCU\..\Run: [Uuevnbs] C:\WINDOWS\System32\??rvices.exe
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sysvcs.exe
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {2DF91772-19DC-47AE-B52F-B8E2FE545625} (Spd2 Class) - http://www.lemontv.pl/lmctrls.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O20 - Winlogon Notify: avpu32 - C:\WINDOWS\SYSTEM32\avpu32.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll

O20 - Winlogon Notify: avpu32 - C:\WINDOWS\SYSTEM32\avpu32.dll

kasujesz w/g wskazań Sylwi

usuwanie plików z pytajnikiem:

http://www.searchengines.pl/phpbb203/index.php?showtopic=12510&st=30?entry106066

**Posty:** 3 · przez **undertaker_x** 19 Paź 2005, 00:12

dzieki wszystkim za pomoc... po wywaleniu wszystkiego komp smiga jak nowy...

jeszcze raz thx for all...

przez **jeff** 19 Paź 2005, 05:25

wrzuć loga kontrolnego :mrgreen:

prozba o sprawdzenie loga..

Prozba o sprawdzenie loga..

Kto jest na forum