Mam do was wielką prośbę ..
Coś się znowu stało z moim kompem.
Z tego co widać to ciężki przypadek. ; [
Cóż powiedzieć .. "antyvirus" nie działa, żaden program ochronny też nie ...
Mam avasta ... kiedy próbowałem go uruchomić ostatnim razem ... wyskoczyło mi że mam jakiś błąd ...
w prawym dolnym rogu na ikonce był taki czerwony znaczek. zaktualizowałem program i wszystko chwile działało i było ok ... po jakimś czasie w ten sam dzień kiedy uruchomiłem kompa po raz drugi avast wogóle nie działał. Próbowałem skanować wszystkim czym sie da .. i nic nie pomogło .. używałem óżnych programów ..
ale po ich włączeniu nic sie nie działo .. teraz połowa z nich .. a nawet większość jest zablokowana wyskakuje mi taki komunikat:
i tak jest z każdym programem którym próbuje to naprawić ..
tak jakby coś blokowało kompa ..
pamiętam że wszystko zaczeło sie od tego jak chciałem ściągnąć KEY`a do "VirtualDj"
niby normalna instalka a po dwukliku na nią znikneła z pulpitu i od tamtej pory wszystko sie psuje ; [
prosze pomóżcie ..
jedyne logi które uddało mi sie zdobyć to :
"Spyware Terminator v2.3.0.507 Logfile"
- Kod: Zaznacz wszystko
Logfile of Spyware Terminator v2.3.0.507 (db:3.001.016.000)
Scan Time: 2009-09-05 00:03:19 length: 72 s
Platform: WXP (5.1.0.2600)
User: Admin
Boot Mode: Safe
Scan type: Fast_Spyware_Scan
Scanned Objects: 53021 (Critical:0)
Filter: No System items, No Safe items, No Invalid items
Internet Settings
R - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R - HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
R - HKLM\Software\Microsoft\Internet Explorer\Search, CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
R - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, ProxyOverride = *.local
R - HKLM\System\CurrentControlSet\Services\Tcpip\Parameters, Domain =
R - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony, DomainName =
BHO
02 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - : C:\Program Files\Free Download Manager\iefdm2.dll
02 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - [Sun Microsystems, Inc.] : C:\Program Files\Java\jre6\bin\jp2ssv.dll
02 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - [Sun Microsystems, Inc.] : C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
StartUps
04 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, CTZDetec.exe : [Creative Technology Ltd.] : C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
04 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, dtkbqh : : C:\Documents and Settings\Monika\USTAWIENIA LOKALNE\DANE APLIKACJI\DTKBQH.EXE
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, LogitechCommunicationsManager : [Logitech Inc.] : C:\Program Files\Common Files\LOGISHRD\LCOMMGR\COMMUNICATIONS_HELPER.EXE
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, amd_dc_opt : [AMD] : C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
04 - HKLM\System\CurrentControlSet\Control\Session Manager, BootExecute : : C:\WINDOWS\system32\lsdelete.exe
04 - Startup: %STARTUPALL%\Belkin Wireless USB Utility.lnk [Belkin] : D:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
Shell Extensions
Desktop Explorer - {1CDB2949-8F65-4355-8456-263E7C208A5D} - [NVIDIA Corporation] : C:\WINDOWS\system32\nvshell.dll
- {1E9B04FB-F9E5-4718-997B-B8DA88302A47} - [NVIDIA Corporation] : C:\WINDOWS\system32\nvshell.dll
nView Desktop Context Menu - {1E9B04FB-F9E5-4718-997B-B8DA88302A48} - [NVIDIA Corporation] : C:\WINDOWS\system32\nvshell.dll
- {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} - [Sun Microsystems, Inc.] : C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll
- {087B3AE3-E237-4467-B8DB-5A38AB959AC9} - [Sun Microsystems, Inc.] : C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll
- {63542C48-9552-494A-84F7-73AA6A7C99C1} - [Sun Microsystems, Inc.] : C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll
- {3B092F0C-7696-40E3-A80F-68D74DA84210} - [Sun Microsystems, Inc.] : C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll
WinRAR - {B41DB860-8EE4-11D2-9906-E49FADC173CA} - : C:\Program Files\WinRAR\rarext.dll
Moje foldery udostępniania - {FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} - [Microsoft Corporation] : C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll
CLSID_WLMCMimeFilter - {0563DB41-F538-4B37-A92D-4659049B7766} - [Microsoft Corporation] : C:\Program Files\Windows Live\Mail\mailcomm.dll
- {06A2568A-CED6-4187-BB20-400B8C02BE5A} - [Microsoft Corporation] : C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
Windows Live Photo Gallery Import Autoplay Shim - {00F33137-EE26-412F-8D71-F84E4C2C6625} - [Microsoft Corporation] : C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
Windows Live Photo Gallery Viewer Shim - {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} - [Microsoft Corporation] : C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
Windows Live Photo Gallery Editor Shim - {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} - [Microsoft Corporation] : C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
Windows Live Photo Gallery Viewer Autoplay Shim - {00F30F90-3E96-453B-AFCD-D71989ECC2C7} - [Microsoft Corporation] : C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
iTunes - {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} - [Apple Inc.] : D:\Program Files\iTunes\iTunesMiniPlayer.dll
Protocol Handler
BackWeb GA Pluggable Protocol - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - [Logitech Inc.] : C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
- {828030A1-22C1-4009-854F-8E305202313F} - [Microsoft Corporation] : C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
- {828030A1-22C1-4009-854F-8E305202313F} - [Microsoft Corporation] : C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
IEProtocolHandler Class - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - [Skype Technologies] : C:\Program Files\Common Files\Skype\Skype4COM.dll
Windows Live Mail HTML Asynchronous Pluggable Protocol Handler - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - [Microsoft Corporation] : C:\Program Files\Windows Live\Mail\mailcomm.dll
Services
23 - [AMD, Inc.] : C:\WINDOWS\system32\DRIVERS\AmdLLD.sys
23 - [GEAR Software Inc.] : C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
23 - [NVIDIA Corporation] : C:\WINDOWS\system32\DRIVERS\nvata.sys
23 - [NVIDIA Corporation] : C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
23 - [NVIDIA Corporation] : C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
23 - : C:\WINDOWS\system32\Drivers\sptd.sys
Advanced Files Report
%SystemDiskRoot%\?\globalroot\Device\__max++>\0EDBB59A.x86.dll
%PROGRAMFILES%\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll [Sun Microsystems, Inc.] MD5=35BC8B9CFA8397EDE278BD4A3395141D SIZE=471040
%PROGRAMFILES%\OpenOffice.ux.pl 2.1.0\program\uwinapi.dll [Sun Microsystems, Inc.] MD5=20CCD5CC223EF2C1AA82B97B1D73675C SIZE=102400
%PROGRAMFILES%\OpenOffice.ux.pl 2.1.0\program\stlport_vc7145.dll [STLport Consulting, Inc.] [STLport Standard ANSI C++ Libarary] MD5=78C7F4F500BB809AF44F512D8B148FD2 SIZE=618496
%COMMONFILES%\Adobe\Acrobat\ActiveX\PDFShell.POL [Adobe Systems, Inc.] [Adobe PDF Shell Extension] MD5=2449DA6BA8F354B339F7577ACCC02183 SIZE=311296
%PROGRAMFILES%\WinRAR\rarext.dll MD5=00D368C41351328E08DD350F1C5B9BEF SIZE=129024
%SYSDIR%\CmdLineExt.dll [Sony DADC Austria AG.] MD5=E4DA8F4DCC53E979A25461F63499F712 SIZE=107888
D:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe [Belkin] [Belkin Wireless Client Utility] MD5=BAB365CB7ED672D5830D77CA9DB1B207 SIZE=1404928
%SYSDIR%\nvshell.dll [NVIDIA Corporation] [NVIDIA Desktop Explorer, Version 110.49] MD5=E3617AC4165F5F006EFFE355F10722F8 SIZE=466944
%PROGRAMFILES%\Windows Live\Messenger\fsshext.8.5.1302.1018.dll [Microsoft Corporation] [Messenger] MD5=8BDE1F61DFBAAE7A2916170E8B75FE0F SIZE=329240
%PROGRAMFILES%\Windows Live\Mail\mailcomm.dll [Microsoft Corporation] [Messenger] MD5=6A69BEDDD514F21B8A216B85EAF330B5 SIZE=858136
%PROGRAMFILES%\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe [Microsoft Corporation] [Windows Live Photo Gallery] MD5=86C67242AC4ADA2C20D0748157E3ED8C SIZE=227456
%PROGRAMFILES%\Windows Live\Photo Gallery\PhotoViewerShim.dll [Microsoft Corporation] [Windows Live Photo Gallery] MD5=024F4D95154039B2292F4B856A52AB7D SIZE=46112
%SYSDIR%\rundll32.exe "C:\Program Files\Windows Live\Photo Gallery\WLXPhotoViewer.dll",PhotoViewerComServer {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C}
%SYSDIR%\rundll32.exe "C:\Program Files\Windows Live\Photo Gallery\WLXPhotoViewer.dll",PhotoViewerComServer {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C}
%SYSDIR%\rundll32.exe "C:\Program Files\Windows Live\Photo Gallery\WLXPhotoViewer.dll",PhotoViewerComServer {00F374B7-B390-4884-B372-2FC349F2172B}
D:\Program Files\iTunes\iTunesMiniPlayer.dll [Apple Inc.] [iTunes] MD5=E09CFE267EA65AEEAE26B9D76CA1A2C8 SIZE=132392
%SYSDIR%\DRIVERS\AmdLLD.sys [AMD, Inc.] [Low Level Device Driver] MD5=E7314D43CD2BE981D8BC4826B50EAF05 SIZE=33280
%SYSDIR%\svchost.exe -k netsvcs
%SYSDIR%\svchost -k DcomLaunch
%SYSDIR%\svchost.exe -k NetworkService
%SYSDIR%\DRIVERS\GEARAspiWDM.sys [GEAR Software Inc.] [CD DVD Filter] MD5=AB8A6A87D9D7255C3884D5B9541A6E80 SIZE=15464
%SYSDIR%\svchost.exe -k LocalService
%SYSDIR%\DRIVERS\nvata.sys [NVIDIA Corporation] [NVIDIA nForce(TM) IDE Driver] MD5=9ECCD189A9554C30A0D18A429778C7BA SIZE=105088
%SYSDIR%\DRIVERS\NVENETFD.sys [NVIDIA Corporation] [NVENETFD] MD5=4D6F0D3FB17C1BA64942F415C73ADCDB SIZE=57856
%SYSDIR%\DRIVERS\nvnetbus.sys [NVIDIA Corporation] [NVNETBUS] MD5=921E63AA1E1A20302223D016ACAFB52B SIZE=20480
%SYSDIR%\svchost -k rpcss
%SYSDIR%\Drivers\sptd.sys SIZE=717296
%PROGRAMFILES%\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll [Logitech Inc.] [Logitech Desktop Messenger] MD5=8EC5211CEBB1D293B9E6F552F03C0659 SIZE=28711
%PROGRAMFILES%\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll [Microsoft Corporation] [Messenger] MD5=56319E6B4D190A2DEB4463A9CE4D4F74 SIZE=66072
%COMMONFILES%\Skype\Skype4COM.dll [Skype Technologies] [Skype4COM] MD5=BE8FC3EF67D58F8D711EA94F8C17D8F7 SIZE=1942824
%SYSDIR%\MACROMED\SHOCKWAVE 10\GTAPI.DLL MD5=AE5CDA196A69F583DD356E7487AF3B49 SIZE=52288
%SYSDIR%\pxdrv.dll [Sonic Solutions] [Px] MD5=C7FE0B22837423F70251AC63C5310E57 SIZE=510712
%SYSDIR%\pxwave.dll [Sonic Solutions] [PxWave] MD5=B0435AB58FC33FF1190177C6CE466409 SIZE=379640
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll [Microsoft Corporation] [Microsoft® Visual Studio® 2005] MD5=CB23B162AC655F24C6711A5F5DF348C6 SIZE=61440
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll [Microsoft Corporation] [Microsoft® Visual Studio® 2005] MD5=1B7524806D0270B81360C63A2FA047CB SIZE=1101824
%PROGRAMFILES%\Java\jre1.6.0_07\bin\JdbcOdbc.dll [Sun Microsystems, Inc.] [Java(TM) Platform SE 6 U7] MD5=F708430AE09C4102933E24CD6D12780D SIZE=36352
%PROGRAMFILES%\Java\jre1.6.0_07\bin\dcpr.dll [Sun Microsystems, Inc.] [Java(TM) Platform SE 6 U7] MD5=D6E7FFCD38ECDFE4BD8DCE29D8D1A654 SIZE=143360
%PROGRAMFILES%\Java\jre1.6.0_07\bin\ioser12.dll [Sun Microsystems, Inc.] [Java(TM) Platform SE 6 U7] MD5=5CF15BC4493299F6645DB27B51278D2A SIZE=12800
%PROGRAMFILES%\Java\jre1.6.0_07\bin\javacpl.cpl [Sun Microsystems, Inc.] [Java(TM) Platform SE 6 U7] MD5=370716E3CA99E6A4346F272DA56017C1 SIZE=73728
%PROGRAMFILES%\Java\jre1.6.0_07\bin\policytool.exe [Sun Microsystems, Inc.] [Java(TM) Platform SE 6 U7] MD5=1C0C6888952D9EC22A7B5C6FAD0E8160 SIZE=25600
%SYSDIR%\MFC71DEU.DLL [Microsoft Corporation] [Microsoft® Visual Studio .NET] MD5=C94D9D5B96D385586063093BAAD8F206 SIZE=65536
%SYSDIR%\MFC71JPN.DLL [Microsoft Corporation] [Microsoft® Visual Studio .NET] MD5=C3CA0BF342DD90C9012C77BCFFD9D43D SIZE=49152
%SYSDIR%\bdeadmin.cpl [Inprise Corporation] MD5=4BC02BD73338C3A26265F5C64DBEC770 SIZE=183808
%SYSDIR%\drivers\aswFsBlk.sys [ALWIL Software] [avast! Antivirus System] MD5=062287CEE536E8AF6680D33259DE6BD6 SIZE=20560
%SYSDIR%\drivers\aswRdr.sys [ALWIL Software] [avast! Antivirus System] MD5=06B360D8179959798D2BF054437DF923 SIZE=23152
%SYSDIR%\drivers\aswmon2.sys [ALWIL Software] [avast! Antivirus System] MD5=05960396794E51EBBB9507C86B8B009E SIZE=94160
%SYSDIR%\drivers\Awrtpd.sys [Lavasoft AB] [Ad-Watch Beta] MD5=124E75B7C483E5D646F99EF5ACFD61B8 SIZE=12960
End of Report
Usuń proces:
Przygotowywanie struktur
Usuwanie plików wyłaczone
Usuń Affiliate tracking cookie
Usunięty plik: C:\Documents and Settings\Monika\cookies\monika@advertising[1].txt
Usunięty plik: C:\Documents and Settings\Monika\cookies\monika@simply[1].txt
Usunięty plik: C:\Documents and Settings\Monika\cookies\monika@zedo[2].txt
Wykonane
FixIEDef
- Kod: Zaznacz wszystko
********************************************************************************
* *
* FixIEDef Log *
* Version 1.7.20.6860 *
* *
********************************************************************************
Created at 00:06:45 on Saturday, September 05, 2009
Time Zone :
Logged On User : Monika
Operating System : Microsoft Windows XP Home Edition Dodatek Service Pack 3
OS Version : 5.1.2600
System Langauge : Polish
Keyboard Layout : Polish
Processor : X86 AMD Athlon(tm) 64 Processor 3200+
System Drive : C:\
Windows Directory : C:\WINDOWS
System Directory : C:\WINDOWS\system32
System Drive Type : Fixed
System Drive Status : READY
System Drive Label : Dysk
System Drive Size : 30 GB
System Drive Free : 5.46 GB
Total Physical Memory: 2031 MB
Free Physical Memory : 1727 MB
Total Page File : 2031 MB
Free Page File : 3240 MB
Total Virtual Memory : 2048 MB
Free Virtual Memory : 1972 MB
Boot State : Fail-safe with network boot
--------------------------------------------------------------------------------
!!! userinit.exe is Clean !!!
--------------------------------------------------------------------------------
!!! Files that have been deleted !!!
C:\WINDOWS\system32\actskn45.ocx
--------------------------------------------------------------------------------
!!! Directories that have been removed !!!
No malicious directories to be removed
--------------------------------------------------------------------------------
!!! Registry entries that have been removed !!!
No malicious Registry entries found
================================================================================
All Done :)
ShadowPuterDude
Safe Surfing!!!
I jeszcze jedno .. od tamtego czasu na dysku "C" gdzie wszystkie te programy są zainstalowane ..
pojawia sie notatnik ``Bug`` a w nim takie coś:
- Kod: Zaznacz wszystko
PUSHD "C:\32788R22FWJFW\"
IF NOT EXIST C:\WINDOWS\system32\cmd.exe GOTO Not_NT
VER 1>VER00
C:\WINDOWS\system32\FIND.exe "Microsoft Windows [Version 5.2.3790]" VER00 1>NULL
IF NOT ERRORLEVEL 1 GOTO Not_NT
C:\WINDOWS\system32\FIND.exe "Windows XP" VER00 1>NULL
HANDLE 1>temp01
SED -r "/<Non-existant Process> pid: ([0-9]*) .*/!d; s//@Nircmd KillProcess \/\1/" temp01 1>temp00.bat
CALL temp00.bat
PV -o"%i\t%l" 1>temp02
SED "/\t.*\\nircmd\.inf$/!d; s///; s/./@pv -kfi &/" temp02 1>temp01.bat
CALL temp01.bat
DEL /Q temp0?.bat temp0? 2>NULL
=============================================
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Monika\Dane aplikacji
CFLDR=32788R22FWJFW
CLASSPATH=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=MONA-F0387C58DA
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Monika
KMD=CF24611.exe
LANG=pl
LOGONSERVER=\\MONA-F0387C58DA
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\32788R22FWJFW;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\WINDOWS\SYSTEM32;C:\WINDOWS;C:\WINDOWS\SYSTEM32\WBEM;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\GTK\2.0\bin;C:\Program Files\GTK2-Runtime\lib
PATHEXT=.cfexe;.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 79 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=4f02
ProgramFiles=C:\Program Files
PROMPT=$
QTJAVA=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
SAFEBOOT_OPTION=NETWORK
SESSIONNAME=Console
sfxcmd="C:\Documents and Settings\Monika\Pulpit\ComboFix.exe"
sfxname=C:\Documents and Settings\Monika\Pulpit\ComboFix.exe
SYSTEM=C:\WINDOWS\system32
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Monika\USTAWI~1\Temp
TMP=C:\DOCUME~1\Monika\USTAWI~1\Temp
USERDOMAIN=MONA-F0387C58DA
USERNAME=Monika
USERPROFILE=C:\Documents and Settings\Monika
windir=C:\WINDOWS
=============================================
IF NOT DEFINED sfxname GOTO END
nie wiem o co z tym chodzi .. ale prosze pomóżcie .. jestem zielony w tym ; [ licze na szybką pomoc
naprawde potrzebuje dostępu do komputera pilnie ...
dziękuje z góry
P ?