Virus alert

**Posty:** 18 · przez **AanetaA** 30 Lip 2008, 03:15

No więc powiem tak jestem tu nowa

i nie bardzo wiem co do czego a mam strasny problem z komputerem :3:

już 2 dni sie staram jakoś to naprawić i nic ale dziś sie natknęłam na program HijackThis i wogóle dziś pierwszy raz przeczytałąm o tych logach

no i ściągnełam sobie ten program i zrobiłam tego loga tylko teraz niewiem co dalej bo ściągnełam sobie jakiegoś poważnego syfa na kompa a o formacie nawet nie chce myśleć

więc to jest mój log i czy mógły mi ktoś go sprawdzić

Kod: Zaznacz wszystko: [Logfile of HijackThis v1.99.1 Scan saved at 02:10: VIRUS ALERT!, on 2008-07-30 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\System32\PSIService.exe C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\Softwin\BitDefender10\bdagent.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\rhcn2rj0ejeg\rhcn2rj0ejeg.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Creative\Shared Files\CamTray.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\WINDOWS\RaUI.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\Program Files\Softwin\BitDefender10\vsserv.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Aneta\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: QXK Olive - {AEFFF7D6-917C-4D8D-A780-7C2D69F1B01A} - C:\WINDOWS\nfavxwdbsxb.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: fdkowvbp - {BF53502D-3BEF-4273-9925-89D7526A5F87} - C:\WINDOWS\fdkowvbp.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SMrhcn2rj0ejeg] C:\Program Files\rhcn2rj0ejeg\rhcn2rj0ejeg.exe O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\Aneta\USTAWI~1\Temp\scksexde.exe/r O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe" O4 - HKCU\..\Run: [Expressivo] "C:\Program Files\ivo\Expressivo\expressivo.exe" -t -nosplash O4 - Global Startup: Ralink Wireless Utility.lnk = C:\WINDOWS\RaUI.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100 O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\ O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll O21 - SSODL: eqvwamkl - {D36EE5BF-9BB6-4F02-B596-A0D24A046134} - C:\WINDOWS\eqvwamkl.dll O21 - SSODL: wnslvxtf - {96C70CE4-9407-48D9-BB55-5E89DBED60A7} - C:\WINDOWS\wnslvxtf.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing) O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing) O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing) O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Z góry dziękuje.

**Posty:** 7956 · przez **Magik** 30 Lip 2008, 14:10

AanetaA napisał(a):i przepraszam że sie podpiełąm pod czyjś temat

to nie rob tego na przyszlosc :!:

AanetaA napisał(a):Proszę o sprawdzenie loga

przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

popraw nazwe tego tematu

dalej

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 18 · przez **AanetaA** 30 Lip 2008, 17:35

Kod: Zaznacz wszystko: Więc tak to jest raport z SdFixa: [b]SDFix: Version 1.210 [/b] Run by Administrator on 2008-07-30 at 16:57 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: [b]Name [/b]: clbdriver [b]Path [/b]: \??\globalroot\systemroot\system32\drivers\vmdesched.sys clbdriver - Deleted Restoring Default Security Values Restoring Default Hosts File Restoring Default HomePage Value Restoring Default Desktop Components Value Restoring Default ScreenSaver value Restoring Windows ProductId To Remove Fake Virus Alert

to z HijackThis

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 17:17: VIRUS ALERT!, on 2008-07-30 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\PSIService.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Softwin\BitDefender10\bdagent.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\rhcn2rj0ejeg\rhcn2rj0ejeg.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Creative\Shared Files\CamTray.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\WINDOWS\RaUI.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\Program Files\Softwin\BitDefender10\vsserv.exe C:\Documents and Settings\Aneta\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: QXK Olive - {AEFFF7D6-917C-4D8D-A780-7C2D69F1B01A} - C:\WINDOWS\nfavxwdbsxb.dll (file missing) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: fdkowvbp - {BF53502D-3BEF-4273-9925-89D7526A5F87} - C:\WINDOWS\fdkowvbp.dll (file missing) O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SMrhcn2rj0ejeg] C:\Program Files\rhcn2rj0ejeg\rhcn2rj0ejeg.exe O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\Aneta\USTAWI~1\Temp\scksexde.exe/r O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe" O4 - HKCU\..\Run: [Expressivo] "C:\Program Files\ivo\Expressivo\expressivo.exe" -t -nosplash O4 - Global Startup: Ralink Wireless Utility.lnk = C:\WINDOWS\RaUI.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100 O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\ O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll O21 - SSODL: eqvwamkl - {D36EE5BF-9BB6-4F02-B596-A0D24A046134} - C:\WINDOWS\eqvwamkl.dll (file missing) O21 - SSODL: wnslvxtf - {96C70CE4-9407-48D9-BB55-5E89DBED60A7} - C:\WINDOWS\wnslvxtf.dll (file missing) O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing) O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing) O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing) O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing) a z ComboFixa to mi sie po jawił komunikat:ABORT - 07-11-08.1 a w nim Current date is 2008-07-30. This copy of ComboFix has espired. Please downald and updated copy. A i jeszce powiem że przy tym wirusie to sam mi sie ściągnął jakiś Antiwirus2008 którego za cholere sie nie da usunąć z komputera;/;/ sam sobie dyski skanuje i pisze ze mam ponad 2000 wirusów;/;/;/

**Posty:** 7956 · przez **Magik** 30 Lip 2008, 17:39

AanetaA napisał(a):A i jeszce powiem że przy tym wirusie to sam mi sie ściągnął jakiś Antiwirus2008 którego za cholere sie nie da usunąć z komputera;/;/ sam sobie dyski skanuje i pisze ze mam ponad 2000 wirusów;/;/;/

odpal SmitfraudFix'a
specjalne-narzedzia-czyszczace-vt96631.html

w trybie awaryjnym w HJT na fix te wpisy dajesz:

Kod: Zaznacz wszystko: C:\Program Files\rhcn2rj0ejeg\rhcn2rj0ejeg.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2 O2 - BHO: QXK Olive - {AEFFF7D6-917C-4D8D-A780-7C2D69F1B01A} - C:\WINDOWS\nfavxwdbsxb.dll (file missing) O3 - Toolbar: fdkowvbp - {BF53502D-3BEF-4273-9925-89D7526A5F87} - C:\WINDOWS\fdkowvbp.dll (file missing) O4 - HKLM\..\Run: [SMrhcn2rj0ejeg] C:\Program Files\rhcn2rj0ejeg\rhcn2rj0ejeg.exe O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\Aneta\USTAWI~1\Temp\scksexde.exe/r O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\ O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll O21 - SSODL: eqvwamkl - {D36EE5BF-9BB6-4F02-B596-A0D24A046134} - C:\WINDOWS\eqvwamkl.dll (file missing) O21 - SSODL: wnslvxtf - {96C70CE4-9407-48D9-BB55-5E89DBED60A7} - C:\WINDOWS\wnslvxtf.dll (file missing)

do tego
program-szukajacy-trojanow-i-malware-vt97108.html

+
to zamiast combofix'a wklej z DSS'a

i przestan uzywac IE-->zacznij Opere lub Firefox'a

**Posty:** 18 · przez **AanetaA** 30 Lip 2008, 19:19

No więc odpaliłam tego SmitfraudFix'a potem dałam na fix podane wpisy i zeskanowałałam tym programem FIxIEDef i jest lepiej juz mi nie wyskakuja te komunikaty i nie skanuja sie dyski tym dyrnym jakimś niby antywirusem tylko teraz tak- nie moge znalezc w sieci tego DSS'a bo mi pisze ze strona niedostępna czy jakoś tak no tak jakby te stronki z tym programem nie istniały;/;/;/ no ale dalej mi nie pokazuje moich dysków i programów w menu start;/;/;/

**Posty:** 8001 · przez **Okocza** 30 Lip 2008, 19:20

jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

masz tu opis i linki

**Posty:** 18 · przez **AanetaA** 30 Lip 2008, 20:41

Dzieki,tylko że nie chce mi ściągnąć tego dss'a bo we wszystkich linkach pisze mi że nie można wyświetlić strony;/;/ a combofix nie działą u mnie na kompie;/

**Posty:** 8001 · przez **Okocza** 30 Lip 2008, 20:50

http://www.sendspace.pl/file/R7DESlMW/

proszę, zuploadowałem na sendspace. teraz powinno pójsc

**Posty:** 18 · przez **AanetaA** 31 Lip 2008, 00:43

kurde nic z tego nie chce mi tego pobrać :oops:

a może okacza wysłałbyś mi to na poczte <prosi>

**Posty:** 7956 · przez **Magik** 31 Lip 2008, 00:52

Odpusc sobie IE, inaczej tego kompa zrobimy i za tydzien wrocisz spowrotem z logami

nie masz zadnego firewall'a,a BItDefender w wersji free pozostawia wiele do zyczenia :!:

probowalas sciagnac pod Firefoxem????

AanetaA napisał(a):wysłałbyś mi to na poczte

mail'a podaj :arrow:

**Posty:** 18 · przez **AanetaA** 31 Lip 2008, 01:11

Problem w tym że ten Firefox to mi sie włączyć nie chce a nie używałąm go bo mi wolniej w nim internet chodził;/ aaa niby mi już lepiej chodzi ale internet sie cały czas pieprzy już mi sił brakuje do tego kompa:(( a to mój e-mail anetaszpytma@wp.pl

**Posty:** 7956 · przez **Magik** 31 Lip 2008, 01:17

AanetaA napisał(a):a nie używałąm go bo mi wolniej w nim internet chodził;

dziw nad dziwy........Lisek jest nad IE pod kazdym wzgledem lepszy//masz predzej zawalony komp niz to wina FF'a.........a brak firewall'a i pozadnego AV bedzie sie mscil

mail poszedl :arrow:

AanetaA napisał(a):ale internet sie cały czas pieprzy

yyy to slownictwo............

**Posty:** 18 · przez **AanetaA** 31 Lip 2008, 16:10

To jest log z dss'a

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by Aneta on 2008-07-31 01:56:50 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 2 Restore Point(s) -- 2: 2008-07-30 23:56:54 UTC - RP2 - Deckard's System Scanner Restore Point 1: 2008-07-30 17:03:00 UTC - RP1 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Aneta.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 01:59: VIRUS ALERT!, on 2008-07-31 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\PSIService.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Softwin\BitDefender10\bdagent.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Creative\Shared Files\CamTray.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\WINDOWS\RaUI.exe C:\Program Files\Softwin\BitDefender10\vsserv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Aneta\Pulpit\dss.exe C:\DOCUME~1\ADMINI~1\Pulpit\Aneta.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe" O4 - HKCU\..\Run: [Expressivo] "C:\Program Files\ivo\Expressivo\expressivo.exe" -t -nosplash O4 - Global Startup: Ralink Wireless Utility.lnk = C:\WINDOWS\RaUI.exe O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100 O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing) O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing) O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing) O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing) -- HijackThis Fixed Entries (C:\DOCUME~1\ADMINI~1\Pulpit\backups\) ------------- backup-20080730-182551-204 O21 - SSODL: wnslvxtf - {96C70CE4-9407-48D9-BB55-5E89DBED60A7} - C:\WINDOWS\wnslvxtf.dll (file missing) backup-20080730-182551-351 O3 - Toolbar: fdkowvbp - {BF53502D-3BEF-4273-9925-89D7526A5F87} - C:\WINDOWS\fdkowvbp.dll (file missing) backup-20080730-182551-383 O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\ backup-20080730-182551-561 O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\Aneta\USTAWI~1\Temp\scksexde.exe/r backup-20080730-182551-572 O2 - BHO: QXK Olive - {AEFFF7D6-917C-4D8D-A780-7C2D69F1B01A} - C:\WINDOWS\nfavxwdbsxb.dll (file missing) backup-20080730-182551-655 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = backup-20080730-182551-747 O4 - HKLM\..\Run: [SMrhcn2rj0ejeg] C:\Program Files\rhcn2rj0ejeg\rhcn2rj0ejeg.exe backup-20080730-182551-817 O21 - SSODL: eqvwamkl - {D36EE5BF-9BB6-4F02-B596-A0D24A046134} - C:\WINDOWS\eqvwamkl.dll (file missing) backup-20080730-182551-900 O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll -- File Associations ----------------------------------------------------------- [color=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/color] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 AFPAnsi (G-DATA Ukrywacz Ansi) - c:\windows\system32\drivers\afpansi.sys <Not Verified; Alfa Corporation; AlfaFP (TM) 2003 Ansi Build for Windows NT/2K> R0 FO_PAnt (FotoOffice VirtualDisc Driver) - c:\windows\system32\drivers\fo_pant.sys R0 Winot40 - c:\windows\system32\drivers\winot40.sys (file missing) R1 bdpredir - c:\program files\softwin\bitdefender10\bdpredir.sys <Not Verified; Softwin SRL; BitDefender 10> S0 Winch62 - c:\windows\system32\drivers\winch62.sys (file missing) S0 Winfk16 - c:\windows\system32\drivers\winfk16.sys (file missing) S0 Winfk38 - c:\windows\system32\drivers\winfk38.sys (file missing) S0 Winhm38 - c:\windows\system32\drivers\winhm38.sys (file missing) S0 Winin40 - c:\windows\system32\drivers\winin40.sys (file missing) S0 Winot16 - c:\windows\system32\drivers\winot16.sys (file missing) S0 Winot51 - c:\windows\system32\drivers\winot51.sys (file missing) S0 Winty38 - c:\windows\system32\drivers\winty38.sys (file missing) S0 Winxd41 - c:\windows\system32\drivers\winxd41.sys (file missing) S3 ASFWHide - c:\docume~1\aneta\ustawi~1\temp\asfwhide (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S2 ekrn (Eset Service) - c:\program files\eset\eset smart security\ekrn.exe (file missing) -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Files created between 2008-06-30 and 2008-07-31 ----------------------------- 2008-07-31 00:23:00 16896 --a------ C:\WINDOWS\System32\WinCtrl32.dll 2008-07-30 18:38:34 2667 --a------ C:\WINDOWS\winaccestor.dat 2008-07-30 17:55:00 0 --------- C:\WINDOWS\System32\pphcj2rj0ejeg.exe 2008-07-30 16:53:33 0 d-------- C:\WINDOWS\ERUNT 2008-07-29 17:28:09 131072 --a------ C:\WINDOWS\System32\Epcmlib.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON CardMonitor Library> 2008-07-29 12:52:43 0 d--hs---- C:\WINDOWS\CSC 2008-07-28 18:47:57 34688 --a------ C:\WINDOWS\System32\mlJBusTK.dll 2008-07-28 18:47:47 34688 --a------ C:\WINDOWS\System32\qOiigDsr.dll 2008-07-28 18:30:29 0 d-------- C:\Program Files\rhcn2rj0ejeg 2008-07-28 18:26:37 110080 --a------ C:\WINDOWS\System32\lphcj2rj0ejeg.exe 2008-07-17 19:32:30 45 ---h----- C:\WINDOWS\dsez5521.dat 2008-07-17 19:32:18 0 d-------- C:\Program Files\PhotoFiltre Studio 2008-07-16 19:03:47 0 d-------- C:\WINDOWS\Sun 2008-07-16 19:02:58 0 d-------- C:\Program Files\Sun 2008-07-16 19:00:12 0 d-------- C:\Program Files\Java 2008-07-16 18:52:41 0 d-------- C:\Program Files\Common Files\Java 2008-07-15 18:44:39 0 --------- C:\WINDOWS\System32\mszsrn32.dll 2008-07-14 22:19:26 0 d-------- C:\Program Files\PCHealthCenter 2008-07-02 01:31:43 43698 --a------ C:\WINDOWS\System32\xvid-uninstall.exe 2008-07-02 01:31:26 0 d-------- C:\Program Files\AviSynth 2.5 2008-07-02 01:31:13 0 d-------- C:\Program Files\Gabest 2008-07-02 01:30:52 0 d-------- C:\Program Files\AutoGK 2008-06-30 19:48:43 0 d-------- C:\WINDOWS\System32\appmgmt -- Find3M Report --------------------------------------------------------------- 2008-07-31 01:59:47 0 d-------- C:\Documents and Settings\Aneta\Dane aplikacji\uTorrent 2008-07-31 01:57:25 81984 --a------ C:\WINDOWS\System32\bdod.bin 2008-07-30 02:10:13 359046 --a------ C:\WINDOWS\System32\perfh015.dat 2008-07-30 02:10:13 50968 --a------ C:\WINDOWS\System32\perfc015.dat 2008-07-29 17:42:57 0 d-------- C:\Program Files\AMT 2008-07-29 17:27:49 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-07-29 17:27:49 0 d-------- C:\Program Files\EPSON 2008-07-28 18:33:39 0 d-------- C:\Documents and Settings\Aneta\Dane aplikacji\TmpRecentIcons 2008-07-28 18:31:11 0 d-------- C:\Documents and Settings\Aneta\Dane aplikacji\rhcn2rj0ejeg 2008-07-24 18:37:03 2828 --ahs---- C:\WINDOWS\System32\KGyGaAvL.sys 2008-07-16 19:03:47 0 d-------- C:\Documents and Settings\Aneta\Dane aplikacji\Sun 2008-07-16 18:52:41 0 d-------- C:\Program Files\Common Files 2008-07-04 23:09:38 549 --a------ C:\Documents and Settings\Aneta\Dane aplikacji\AutoGK.ini 2008-06-30 19:55:53 0 d-------- C:\Documents and Settings\Aneta\Dane aplikacji\WinRAR 2008-06-17 12:45:59 0 d-------- C:\Documents and Settings\Aneta\Dane aplikacji\RaimaRadioPro 2008-06-17 12:41:57 0 d-------- C:\Program Files\RaimaRadioPro 2008-06-17 12:25:34 0 d-------- C:\Program Files\Common Files\element5 Shared 2008-06-17 00:59:41 0 d-------- C:\Documents and Settings\Aneta\Dane aplikacji\Bitdefender 2008-06-16 23:22:28 0 d-------- C:\Program Files\Cheetah Burner 2008-06-14 17:15:58 0 d-------- C:\Program Files\Ahead 2008-06-09 16:42:35 0 d-------- C:\Documents and Settings\Aneta\Dane aplikacji\ArcSoft 2008-06-04 15:36:11 0 d-------- C:\Documents and Settings\Aneta\Dane aplikacji\CyberLink 2008-06-04 15:32:54 0 d-------- C:\Program Files\SmartSound Software 2008-06-04 15:30:28 0 d-------- C:\Program Files\CyberLink 2008-06-04 15:29:39 0 d-------- C:\Program Files\QuickTime 2008-06-04 15:28:24 0 d-------- C:\Program Files\Common Files\InstallShield 2008-06-03 00:52:04 0 d-------- C:\Program Files\VS Revo Group 2008-06-02 22:42:48 0 d-------- C:\Documents and Settings\Aneta\Dane aplikacji\Ulead Systems 2008-06-02 22:18:50 0 d-------- C:\Program Files\Common Files\InterVideo 2008-06-02 22:18:16 0 d-------- C:\Program Files\Windows Media Components 2008-05-04 13:57:55 88 -r-hs---- C:\WINDOWS\System32\071776FBF0.sys 2008-04-30 00:54:49 44622 --a------ C:\WINDOWS\System32\unins000.dat 2008-04-30 00:53:56 684560 --a------ C:\WINDOWS\System32\unins000.exe <Not Verified; ; Inno Setup> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2008-03-20 00:36: VIRUS ALERT! 1267040 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2008-03-20 00:36: VIRUS ALERT! 1267040] [-HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-03 12:00: VIRUS ALERT!] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 08:57: VIRUS ALERT!] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54: VIRUS ALERT!] "NWEReboot"="" [] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40: VIRUS ALERT!] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 22:57: VIRUS ALERT!] "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 11:09: VIRUS ALERT!] "Corel File Shell Monitor"="C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2008-01-15 15:18: VIRUS ALERT!] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-06-04 15:29: VIRUS ALERT!] "NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 12:50: VIRUS ALERT!] "BDMCon"="C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe" [2007-04-02 16:48: VIRUS ALERT!] "BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49: VIRUS ALERT!] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27: VIRUS ALERT!] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 18:05: VIRUS ALERT!] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39: VIRUS ALERT!] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 03:54: VIRUS ALERT!] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32: VIRUS ALERT!] "Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CamTray.exe" [2005-10-27 12:00: VIRUS ALERT!] "Expressivo"="C:\Program Files\ivo\Expressivo\expressivo.exe" [] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Ralink Wireless Utility.lnk - C:\WINDOWS\RaUI.exe [2008-04-27 11:52:23] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) "DisableRegistryTools"=0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) "DisableRegistryTools"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoToolbarCustomize"=1 (0x1) "NoStartMenuMorePrograms"=1 (0x1) "NoSetFolders"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WinCtrl32] WinCtrl32.dll 2008-07-31 00:26: VIRUS ALERT! 16896 C:\WINDOWS\system32\WinCtrl32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=sockspy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winch62.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk16.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk38.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winhm38.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winin40.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winot16.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winot40.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winot51.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winty38.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxd41.sys] @="Driver" -- End of Deckard's System Scanner: finished at 2008-07-31 02:01:12 ------------

Dodano Dzisiaj, 16:17:
BigDefender to mam ściągnięty z totrentów z kodem więc tak jakby "nie jest za free"'P

**Posty:** 7956 · przez **Magik** 31 Lip 2008, 16:17

na fix:

Kod: Zaznacz wszystko: O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll

do tego odpal smitfraudfix

specjalne-narzedzia-czyszczace-vt96631.html

+
program-szukajacy-trojanow-i-malware-vt97108.html

do tego

sciagnij The Avenger
narzedzia-do-usuwania-plikow-vt96629.html

wklej do notatnika

Kod: Zaznacz wszystko: Files to delete: C:\WINDOWS\System32\mlJBusTK.dll C:\WINDOWS\System32\qOiigDsr.dll C:\Program Files\rhcn2rj0ejeg C:\WINDOWS\System32\lphcj2rj0ejeg.exe C:\WINDOWS\dsez5521.dat C:\WINDOWS\System32\mszsrn32.dll

i wklej ten skrypt w avenger//instrukcja w linku powyzej

**Posty:** 684 · przez **djarta** 31 Lip 2008, 16:22

Pobierz The Avenger

Wklej do notatnika taki tekst:

Kod: Zaznacz wszystko: Files to delete: C:\WINDOWS\System32\WinCtrl32.dll C:\WINDOWS\System32\pphcj2rj0ejeg.exe C:\WINDOWS\System32\mlJBusTK.dll C:\WINDOWS\System32\qOiigDsr.dll C:\WINDOWS\System32\lphcj2rj0ejeg.exe Folders to delete: C:\Program Files\rhcn2rj0ejeg C:\Program Files\PCHealthCenter Registry keys to delete: HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WinCtrl32]

Kopiujesz - klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

**Posty:** 18 · przez **AanetaA** 31 Lip 2008, 17:35

ok tylko mam problem ze ściągnięciem go znowu;/;/;/ mogłby mi ktoś go wysłać na poczte <prosi>

**Posty:** 7956 · przez **Magik** 31 Lip 2008, 17:37

AanetaA napisał(a):ok tylko mam problem ze ściągnięciem go znowu;/;/;/ mogłby mi ktoś go wysłać na poczte <prosi>

poszlo

**Posty:** 684 · przez **djarta** 31 Lip 2008, 17:38

A czy możesz uruchomić ComboFixa?Lepiej dla mnie by było.

**Posty:** 18 · przez **AanetaA** 31 Lip 2008, 17:50

ComboFixa nie dam rady otworzyć bo jakieś błędy sie pojawiają;/;/ a za programik dziękuje bardzo:)
a to jest raport:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "clbdriver" found!
ImagePath: \??\globalroot\systemroot\system32\drivers\vmdesched.sys
Start Type: 1 (System)

Rootkit scan completed.

File "C:\WINDOWS\System32\WinCtrl32.dll" deleted successfully.

Error: file "C:\WINDOWS\System32\pphcj2rj0ejeg.exe" not found!
Deletion of file "C:\WINDOWS\System32\pphcj2rj0ejeg.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\WINDOWS\System32\mlJBusTK.dll" deleted successfully.
File "C:\WINDOWS\System32\qOiigDsr.dll" deleted successfully.
File "C:\WINDOWS\System32\lphcj2rj0ejeg.exe" deleted successfully.
Folder "C:\Program Files\rhcn2rj0ejeg" deleted successfully.
Folder "C:\Program Files\PCHealthCenter" deleted successfully.

Error: registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WinCtrl32]" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WinCtrl32]" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Completed script processing.

*******************

Finished! Terminate.

i ten antywirus sie usunął nareszcie:)))))) tylko dalej mi dysków nie pokazuje i programów w menu start i dalej jest temn napis koło zegara "virus alert";/

**Posty:** 7956 · przez **Magik** 31 Lip 2008, 17:52

AanetaA napisał(a):i ten antywirus sie usunął nareszcie:)))))) tylko dalej mi dysków nie pokazuje i programów w menu start i dalej jest temn napis koło zegara "virus alert";/

odpal Smitfraudfix'a
specjalne-narzedzia-czyszczace-vt96631.html

Kto jest na forum