wirusy, proszę o sprawdzenie logów i pomoc

**Posty:** 5 · przez **resorte04** 04 Cze 2008, 13:51

Witam,

przeskanowałem cały komp Kasperskym online i znalazł mi trochę tego robactwa, podaje spis syfu, który znalazł : http://www.wklej.org/id/6f050a5ed2

Tutaj podaje logi z HijackThis : http://wklej.org/id/8ae03dfec5

A tutaj logi z Silent Runners : http://www.wklej.org/id/d41529ea9e

Bardzo proszę o sprawdzenie i poradzenie co dalej robić.

Niestety nie mogę zrobić skanowania ComboFixem, pojawia się już na tym niebieskim tle: " \USTAW~1\Temp\VGod.DLL było nieoczekiwane" i skanowanie stoi, mogę czekać godzine i nic.

Bardzo Proszę o Pomoc.

**Posty:** 3854 · przez **Dzi@dek** 04 Cze 2008, 17:56

Usuń w hijackthis:

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - E:\Sony Acid PRO 6.0c\Sony\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)

Daj log z DSS-a

Zastosuj SDFix . Po pobraniu uruchom go - rozpakuje się do C:\SDFix.
Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w trybie awaryjnym uruchom plik

RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zrestartuje.

Później wejdź do folderu C:\SDFix i wrzuć zawartość pliku Report.txt

Logi wstaw tutaj na forum nie w postaci linków.

**Posty:** 5 · przez **resorte04** 04 Cze 2008, 18:17

oto log z DSS

Kod: Zaznacz wszystko: # Deckard's System Scanner v20071014.68 # Run by (L) on 2008-06-04 17:52:36 # Computer is in Normal Mode. # -------------------------------------------------------------------------------- # # [color=red]Percentage of Memory in Use: 76% (more than 75%).[/color] # [color=red]Total Physical Memory: 480 MiB (512 MiB recommended).[/color] # [color=red]System Drive C: has 0.99 GiB (less than 15%) free.[/color] # # # -- HijackThis (run as (L).exe) ------------------------------------------------- # # Logfile of Trend Micro HijackThis v2.0.2 # Scan saved at 17:52, on 2008-06-04 # Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) # MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) # Boot mode: Normal # # Running processes: # C:\WINDOWS\System32\smss.exe # C:\WINDOWS\system32\winlogon.exe # C:\WINDOWS\system32\services.exe # C:\WINDOWS\system32\lsass.exe # C:\WINDOWS\system32\svchost.exe # C:\WINDOWS\System32\svchost.exe # C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe # C:\WINDOWS\Explorer.EXE # C:\WINDOWS\system32\spoolsv.exe # C:\WINDOWS\system32\RUNDLL32.EXE # C:\WINDOWS\RTHDCPL.EXE # C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe # C:\Program Files\Common Files\Real\Update_OB\realsched.exe # C:\Program Files\Eset\nod32kui.exe # C:\WINDOWS\system32\Rundll32.exe # C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe # C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe # C:\Program Files\Eset\nod32krn.exe # C:\WINDOWS\system32\nvsvc32.exe # C:\Program Files\Mozilla Firefox\firefox.exe # C:\WINDOWS\system32\wscntfy.exe # C:\WINDOWS\system32\wuauclt.exe # E:\Torrenty DOWNLOAD\POBIERALNIA\dss.exe # C:\PROGRA~1\TRENDM~1\HIJACK~1\(L).exe # # R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ # R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com # R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com # R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza # O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll # O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll # O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll # O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll # O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup # O4 - HKLM\..\Run: [nwiz] nwiz.exe /install # O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit # O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE # O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE # O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE # O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe # O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" # O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot # O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE # O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper # O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup # O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start # O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler # O8 - Extra context menu item: SYSTRAN Lookup - res://E:\SYSTRAN v6 (translator)\\GUIres.dll/lookup.js # O8 - Extra context menu item: SYSTRAN Translate - res://E:\SYSTRAN v6 (translator)\\GUIres.dll/translate.js # O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll # O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll # O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe # O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe # O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab # O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe # O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) # O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe # O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe # O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE # O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe # O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - E:\Sony Acid PRO 6.0c\Sony\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing) # O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe # O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe # # -- # End of file - 5140 bytes # # -- Files created between 2008-05-04 and 2008-06-04 ----------------------------- # # 2008-06-04 17:07:56 0 d-------- C:\Program Files\Trend Micro # 2008-06-03 21:09:40 68096 --a------ C:\WINDOWS\zip.exe # 2008-06-03 21:09:40 49152 --a------ C:\WINDOWS\VFind.exe # 2008-06-03 21:09:40 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> # 2008-06-03 21:09:40 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> # 2008-06-03 21:09:40 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> # 2008-06-03 21:09:40 98816 --a------ C:\WINDOWS\sed.exe # 2008-06-03 21:09:40 80412 --a------ C:\WINDOWS\grep.exe # 2008-06-03 21:09:40 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > # 2008-06-03 21:09:33 0 d-------- C:\Combo-Fix # 2008-06-03 17:16:53 0 d-------- C:\WINDOWS\system32\Kaspersky Lab # 2008-06-02 16:49:53 0 d-------- C:\WINDOWS\pss # 2008-06-01 10:25:33 0 d--hs---- C:\WINDOWS\CSC # 2008-05-31 16:21:58 57344 -ra------ C:\WINDOWS\system32\libsyslic1.dll <Not Verified; NGEN TEAM; libsyslic1.dll> # 2008-05-31 16:17:28 0 d-------- C:\WINDOWS\system32\URTTemp # 2008-05-28 17:20:11 0 d-------- C:\Program Files\Common Files\ACD Systems # 2008-05-26 20:46:56 0 d-------- C:\Program Files\The Logo Creator v5 # 2008-05-26 20:46:30 90112 --a------ C:\WINDOWS\unvise32.exe <Not Verified; MindVision Software; Installer VISE> # 2008-05-26 20:31:02 56 -r-hs---- C:\WINDOWS\system32\045893E407.sys # 2008-05-26 20:27:25 0 d-------- C:\Program Files\Common Files\Corel # 2008-05-26 20:18:08 3350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys # 2008-05-22 12:03:15 0 d-------- C:\Program Files\CCleaner # 2008-05-22 11:37:43 0 d-------- C:\Program Files\Lavasoft # 2008-05-22 11:36:51 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard # 2008-05-19 16:02:13 0 d-------- C:\Program Files\DFX # 2008-05-19 14:27:55 0 d-------- C:\WINDOWS\system32\Data # 2008-05-19 14:27:55 0 d-------- C:\Program Files\Creative # 2008-05-10 11:47:45 82432 --a------ C:\WINDOWS\system32\msxml4r.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1> # 2008-05-10 11:47:45 44544 --a------ C:\WINDOWS\system32\msxml4a.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1> # 2008-05-10 11:47:45 1230336 --a------ C:\WINDOWS\system32\msxml4.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP 1> # 2008-05-10 11:47:45 0 d-------- C:\Program Files\Intermedia Software # # # -- Find3M Report --------------------------------------------------------------- # # 2008-06-02 19:35:01 0 d-------- C:\Program Files\Mozilla Thunderbird # 2008-06-02 18:31:27 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\uTorrent # 2008-06-02 18:09:23 0 d-------- C:\Program Files\Soulseek # 2008-06-02 16:52:30 0 d-------- C:\Program Files\Google # 2008-06-02 16:48:45 0 d-------- C:\Program Files\Common Files # 2008-06-02 16:46:41 0 d-------- C:\Program Files\Common Files\InstallShield # 2008-06-02 16:46:29 0 d--h----- C:\Program Files\InstallShield Installation Information # 2008-06-02 16:42:43 0 d-------- C:\Program Files\eMule # 2008-06-02 16:41:35 0 d-------- C:\Program Files\Astonsoft # 2008-06-02 16:40:32 0 d-------- C:\Program Files\Image-Line # 2008-05-31 16:49:53 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\SYSTRAN # 2008-05-31 16:18:27 531488 --a------ C:\WINDOWS\system32\perfh015.dat # 2008-05-31 16:18:27 91246 --a------ C:\WINDOWS\system32\perfc015.dat # 2008-05-31 08:39:36 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\Intermedia Software # 2008-05-31 08:38:16 0 d-------- C:\Program Files\Nvu # 2008-05-28 17:22:57 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\ACD Systems # 2008-05-26 20:40:47 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\Help # 2008-05-26 20:30:40 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\Corel # 2008-05-19 16:08:24 0 d-------- C:\Program Files\Winamp # 2008-05-11 14:38:30 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\Thinstall # 2008-05-02 17:31:03 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\DeepBurner # 2008-05-02 11:00:33 0 d-------- C:\Program Files\DAEMON Tools Pro # 2008-04-28 18:35:17 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\DAEMON Tools Pro # 2008-04-24 20:48:08 0 d-------- C:\Program Files\JLC's Software # 2008-04-24 20:47:09 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\WebCompiler3 # 2008-04-24 20:13:43 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\JLC's Software # 2008-04-23 17:10:07 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\Nvu # 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\UC.PIF # 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\RAR.PIF # 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\PKZIP.PIF # 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\PKUNZIP.PIF # 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\NOCLOSE.PIF # 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\LHA.PIF # 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\ARJ.PIF # 2008-04-18 07:08:59 0 d-------- C:\Program Files\Steganos Internet Anonym 2006 # 2008-04-13 12:22:27 0 d-------- C:\Program Files\IDoser v4 # # # -- Registry Dump --------------------------------------------------------------- # # *Note* empty entries & legit default entries are not shown # # # [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] # "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-16 09:35] # "nwiz"="nwiz.exe" [2006-08-16 09:35 C:\WINDOWS\system32\nwiz.exe] # "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-16 09:35] # "RTHDCPL"="RTHDCPL.EXE" [2006-08-14 14:00 C:\WINDOWS\RTHDCPL.exe] # "SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe] # "Alcmtr"="ALCMTR.EXE" [2005-05-03 18:43 C:\WINDOWS\Alcmtr.exe] # "NeroCheck"="C:\WINDOWS\system32\\NeroCheck.exe" [2001-07-09 12:50] # "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25] # "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-27 15:21] # "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-29 09:39] # "P17Helper"="P17.dll" [2005-05-03 19:38 C:\WINDOWS\system32\P17.dll] # "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-03-20 18:34] # "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-20 18:34] # "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 18:34] # # [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] # "disableregistrytools"=0 (0x0) # # [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] # @="Service" # # [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] # @="Service" # # [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent] # "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" # # [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] # "C:\Program Files\Messenger\msmsgs.exe" /background # # [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] # C:\Program Files\Winamp\winampa.exe # # # [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b02b2136-0b34-11dc-a461-806d6172696f}] # AutoRun\command- D:\setup.exe # # # # # -- End of Deckard's System Scanner: finished at 2008-06-04 17:53:05 ------------

Niestety nie wychodzi to z tym SDFix-em. Robie w awaryjnym, ale po jakimś czasie wylącza sie te dosowe okienko i komp stoi.

**Posty:** 3854 · przez **Dzi@dek** 04 Cze 2008, 18:30

Wklej do notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\swsc.exe C:\WINDOWS\sed.exe C:\WINDOWS\grep.exe C:\WINDOWS\fdsv.exe C:\WINDOWS\system32\045893E407.sys Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b02b2136-0b34-11dc-a461-806d6172696f}]

Plik

Zapisz jako... :arrow:

CFScript - najlepiej jeśli zapiszesz w

takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik :arrow:

ComboFix.exe

Potwierdz

zrestartuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.

Daj nowe logi z Combofix oraz Hijackthis.

**Posty:** 5 · przez **resorte04** 04 Cze 2008, 18:38

niestety tak jak pisałem nie moge robić ComboFixem bo stoi i nic nie dzieje się do tego jakis komunikat pokazuje, jak opisane w moim poscie pierwszym

**Posty:** 3854 · przez **Dzi@dek** 04 Cze 2008, 18:40

niestety tak jak pisałem nie moge robić ComboFixem

Ale instrukcję powyższą możesz wykonać - po ściągnięciu combofix-a. ( zrób to )
I daj w takim razie nowy log z DSS i HJ

**Posty:** 5 · przez **resorte04** 04 Cze 2008, 18:47

robie tak i wlacza sie po prostu combofix tak jak bym normalnie go uruchamiał.

log z HJ :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:45:44, on 2008-06-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O8 - Extra context menu item: SYSTRAN Lookup - res://E:\SYSTRAN v6 (translator)\\GUIres.dll/lookup.js O8 - Extra context menu item: SYSTRAN Translate - res://E:\SYSTRAN v6 (translator)\\GUIres.dll/translate.js O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - E:\Sony Acid PRO 6.0c\Sony\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing) O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5110 bytes

a to log z DSS:

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by (L) on 2008-06-04 18:46:47 Computer is in Normal Mode. -------------------------------------------------------------------------------- [color=red]Percentage of Memory in Use: 79% (more than 75%).[/color] [color=red]Total Physical Memory: 480 MiB (512 MiB recommended).[/color] [color=red]System Drive C: has 0.89 GiB (less than 15%) free.[/color] -- HijackThis (run as (L).exe) ------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:46:49, on 2008-06-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe E:\Torrenty DOWNLOAD\POBIERALNIA\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\(L).exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O8 - Extra context menu item: SYSTRAN Lookup - res://E:\SYSTRAN v6 (translator)\\GUIres.dll/lookup.js O8 - Extra context menu item: SYSTRAN Translate - res://E:\SYSTRAN v6 (translator)\\GUIres.dll/translate.js O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - E:\Sony Acid PRO 6.0c\Sony\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing) O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5135 bytes -- Files created between 2008-05-04 and 2008-06-04 ----------------------------- 2008-06-04 18:06:26 0 d-------- C:\WINDOWS\ERUNT 2008-06-04 17:07:56 0 d-------- C:\Program Files\Trend Micro 2008-06-03 21:09:33 0 d-------- C:\Combo-Fix 2008-06-03 17:16:53 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-06-02 16:49:53 0 d-------- C:\WINDOWS\pss 2008-06-01 10:25:33 0 d--hs---- C:\WINDOWS\CSC 2008-05-31 16:21:58 57344 -ra------ C:\WINDOWS\system32\libsyslic1.dll <Not Verified; NGEN TEAM; libsyslic1.dll> 2008-05-31 16:17:28 0 d-------- C:\WINDOWS\system32\URTTemp 2008-05-28 17:20:11 0 d-------- C:\Program Files\Common Files\ACD Systems 2008-05-26 20:46:56 0 d-------- C:\Program Files\The Logo Creator v5 2008-05-26 20:46:30 90112 --a------ C:\WINDOWS\unvise32.exe <Not Verified; MindVision Software; Installer VISE> 2008-05-26 20:31:02 56 -r-hs---- C:\WINDOWS\system32\045893E407.sys 2008-05-26 20:27:25 0 d-------- C:\Program Files\Common Files\Corel 2008-05-26 20:18:08 3350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2008-05-22 12:03:15 0 d-------- C:\Program Files\CCleaner 2008-05-22 11:37:43 0 d-------- C:\Program Files\Lavasoft 2008-05-22 11:36:51 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-05-19 16:02:13 0 d-------- C:\Program Files\DFX 2008-05-19 14:27:55 0 d-------- C:\WINDOWS\system32\Data 2008-05-19 14:27:55 0 d-------- C:\Program Files\Creative 2008-05-10 11:47:45 82432 --a------ C:\WINDOWS\system32\msxml4r.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1> 2008-05-10 11:47:45 44544 --a------ C:\WINDOWS\system32\msxml4a.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1> 2008-05-10 11:47:45 1230336 --a------ C:\WINDOWS\system32\msxml4.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP 1> 2008-05-10 11:47:45 0 d-------- C:\Program Files\Intermedia Software -- Find3M Report --------------------------------------------------------------- 2008-06-02 19:35:01 0 d-------- C:\Program Files\Mozilla Thunderbird 2008-06-02 18:31:27 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\uTorrent 2008-06-02 18:09:23 0 d-------- C:\Program Files\Soulseek 2008-06-02 16:52:30 0 d-------- C:\Program Files\Google 2008-06-02 16:48:45 0 d-------- C:\Program Files\Common Files 2008-06-02 16:46:41 0 d-------- C:\Program Files\Common Files\InstallShield 2008-06-02 16:46:29 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-02 16:42:43 0 d-------- C:\Program Files\eMule 2008-06-02 16:41:35 0 d-------- C:\Program Files\Astonsoft 2008-06-02 16:40:32 0 d-------- C:\Program Files\Image-Line 2008-05-31 16:49:53 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\SYSTRAN 2008-05-31 16:18:27 531488 --a------ C:\WINDOWS\system32\perfh015.dat 2008-05-31 16:18:27 91246 --a------ C:\WINDOWS\system32\perfc015.dat 2008-05-31 08:39:36 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\Intermedia Software 2008-05-31 08:38:16 0 d-------- C:\Program Files\Nvu 2008-05-28 17:22:57 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\ACD Systems 2008-05-26 20:40:47 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\Help 2008-05-26 20:30:40 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\Corel 2008-05-19 16:08:24 0 d-------- C:\Program Files\Winamp 2008-05-11 14:38:30 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\Thinstall 2008-05-02 17:31:03 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\DeepBurner 2008-05-02 11:00:33 0 d-------- C:\Program Files\DAEMON Tools Pro 2008-04-28 18:35:17 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\DAEMON Tools Pro 2008-04-24 20:48:08 0 d-------- C:\Program Files\JLC's Software 2008-04-24 20:47:09 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\WebCompiler3 2008-04-24 20:13:43 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\JLC's Software 2008-04-23 17:10:07 0 d-------- C:\Documents and Settings\(L)\Dane aplikacji\Nvu 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\UC.PIF 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\RAR.PIF 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\PKZIP.PIF 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\LHA.PIF 2008-04-22 07:03:00 545 --a------ C:\WINDOWS\ARJ.PIF 2008-04-18 07:08:59 0 d-------- C:\Program Files\Steganos Internet Anonym 2006 2008-04-13 12:22:27 0 d-------- C:\Program Files\IDoser v4 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-16 09:35] "nwiz"="nwiz.exe" [2006-08-16 09:35 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-16 09:35] "RTHDCPL"="RTHDCPL.EXE" [2006-08-14 14:00 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe] "Alcmtr"="ALCMTR.EXE" [2005-05-03 18:43 C:\WINDOWS\Alcmtr.exe] "NeroCheck"="C:\WINDOWS\system32\\NeroCheck.exe" [2001-07-09 12:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-27 15:21] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-29 09:39] "P17Helper"="P17.dll" [2005-05-03 19:38 C:\WINDOWS\system32\P17.dll] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-03-20 18:34] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-20 18:34] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 18:34] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "disableregistrytools"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] AutoRun\command- D:\setup.exe -- End of Deckard's System Scanner: finished at 2008-06-04 18:47:14 ------------

**Posty:** 8001 · przez **Okocza** 04 Cze 2008, 19:56

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 5 · przez **resorte04** 05 Cze 2008, 08:20

już powinno być ok, bo Kaspersky nic już nie wykrywa.

Dzięki za pomoc.

wirusy, proszę o sprawdzenie logów i pomoc

wirusy, proszę o sprawdzenie logów i pomoc

Kto jest na forum