Jak to usunąć ?!?!?!


(Gutar) #1

Witam. Mam problem może pewnie to jakiś banał ale jestem początkujący :twisted: No więc antywirus Avast! wykrywa mi VBS: Malware gen w pliku C:\FOUND.007\FILE0016.CHK\x.htm ale nie moze go usunąc. do tego Przeskanowałem kompa BitDefender Free Online Virus Scan a to tego efekty:

C:\Documents and Settings\Michał\Ustawienia lokalne\Temp\JVM17.tmp=>Yahoo! Pool 2.osd: bad crc 

C:\Documents and Settings\Michał\Pulpit\hijackthis\backups\backup-20050102-123115-963: suspect Exploit.Html.MhtRedir.Gen 

C:\Documents and Settings\Michał\Pulpit\hijackthis\backups\backup-20050102-123115-963: disinfection failed 

C:\Program Files\Alwil Software\Avast4\DATA\moved\x.htm.vir: infected with Exploit.Html.Codebase.Exec.Gen 

C:\Program Files\Alwil Software\Avast4\DATA\moved\x.htm.vir: disinfection failed 

C:\System Volume Information\_restore{D008B63E-AF3E-4796-80D6-03525AB4541E}\RP65\A0051502.dll: suspect Trojan.Downloader.Small.Gen 

C:\System Volume Information\_restore{D008B63E-AF3E-4796-80D6-03525AB4541E}\RP65\A0051502.dll: disinfection failed 

C:\System Volume Information\_restore{D008B63E-AF3E-4796-80D6-03525AB4541E}\RP65\A0051503.dll: suspect Trojan.Downloader.Gen 

C:\System Volume Information\_restore{D008B63E-AF3E-4796-80D6-03525AB4541E}\RP65\A0051503.dll: disinfection failed 

C:\FOUND.007\FILE0016.CHK=>/x.htm: infected with Exploit.Html.Codebase.Exec.Gen 

C:\FOUND.007\FILE0016.CHK=>/x.htm: disinfection failed 

C:\FOUND.007\FILE0016.CHK=>/load.exe=>(FSG 2.0): infected with Trojan.Downloader.Small.YX 

C:\FOUND.007\FILE0016.CHK=>/load.exe=>(FSG 2.0): disinfection failed 

C:\FOUND.007\FILE0029.CHK: infected with HTML.MediaTickets.A 

C:\FOUND.007\FILE0029.CHK: disinfection failed 

C:\FOUND.007\FILE0031.CHK: infected with HTML.MediaTickets.A 

C:\FOUND.007\FILE0031.CHK: disinfection failed 

C:\FOUND.007\FILE0071.CHK=>MediaTicketsInstaller.ocx: bad crc 

C:\FOUND.007\FILE0072.CHK=>MediaTicketsInstaller.ocx: bad crc 

C:\FOUND.007\FILE0073.CHK: infected with Trojan.Downloader.Small.CF 

C:\FOUND.007\FILE0073.CHK: disinfection failed 

C:\FOUND.007\FILE0074.CHK: infected with Trojan.Downloader.Small.CF 

C:\FOUND.007\FILE0074.CHK: disinfection failed 

C:\FOUND.007\FILE0095.CHK: infected with Trojan.Downloader.Small.LX 

C:\FOUND.007\FILE0095.CHK: disinfection failed

Co z tym zrobić?? tutaj pytanie ... C:\FOUND.007 ... co to jest?? nie ma tych plikow tam gdzie podaje sciezka , nawet jak dam zeby pokazywalo ukryte foldery tak samo C:\System Volume Information :/:/:confused: obecny log:

Logfile of HijackThis v1.99.0

Scan saved at 17:00:10, on 2005-01-03

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\AVPersonal\AVWUPSRV.EXE

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

E:\CS\Steam.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\ACD Systems\ACDSee\ACDSee.exe

C:\Program Files\DCPlusPlus-0.401\DCPlusPlus.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Michał\Pulpit\hijackthis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [Steam] E:\CS\Steam.exe -silent

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: komentator - http://sport.onet.pl/komentator.cab

O16 - DPF: {112857FE-03FF-11D5-9A3F-0080C8D85044} (GameDesire Solitaires) - http://67.15.101.3/g_bin/pl/solitaire_2_0_0_18.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1104072705312

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab

O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab

O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_32.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_26.cab

O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4417/mcfscan.cab

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.2/g_bin/pl/billard8_2_0_0_20.cab

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GINBILLARD9 Class) - http://gryonline.wp.pl/files/billard9_2_0_0_6.cab

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.2/g_bin/pl/billard14_2_0_0_20.cab

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GINBILLARD8UK Class) - http://gryonline.wp.pl/files/billard8UK_2_0_0_6.cab

O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

(inż. Piniol) #2

ueuchom anrywirusa w trybie awaryjnym


(Qbek50) #3

najlepiej to usuń te pliki w Dosie. Np w NC :stuck_out_tongue:


(Marek Kozaczuk) #4

ustaw skanowanie podczas rozruchu a wtedy go usunie