Witam:-)
Po włączeniu windowsa i zalogowaniu na konto użytkownika wywala mi komunikat o błędzie pliku services.exe
Po zraportowaniu błędu windows stwierdził, iż jest to wirus win32/small.CA
Przesyłam log abyście sprawdzili co i jak 
Pozdro Inerno
Usuń wpisy HJT.
Wyłącz komputer >>> wciśnij i trzymaj wciśnięty klawisz F5 lub F8 >>> włącz komputer >>> w momencie kiedy pojawi się ekran wyboru systemu puść klawisz F5 lub F8 i za pomocą strzałek wybierz pozycję Tryb awaryjny z obsługą linii komend >>> poczekaj na uruchomienie systemu, a następnie w linii komend wydaj następujące polecenia po czym komputer zostanie uruchomiony ponownie.
Opróżnij kosz.
Po wykonaniu pokaż nowy log z HijackThis i SilentRunners.
oto log z HJT
pozdro Inferno
Opróżnij Kosz.
Wpis zafixuj.
Pokaż następnie nowy log + log z Silent’a.
log z silent
“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by “{++}”
Startup items buried in registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
“ctfmon.exe” = “D:\WINDOWS\system32\ctfmon.exe” [MS]
“PowerBar” = ““D:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe” /AtBootTime” [“Cyberlink, Corp.”]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
“RemoteControl” = ““D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe”” [“Cyberlink Corp.”]
“NeroFilterCheck” = “D:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”]
“HP Software Update” = “D:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [“Hewlett-Packard Co.”]
“SunJavaUpdateSched” = ““D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe”” [“Sun Microsystems, Inc.”]
“avgnt” = ““D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe” /min” [“Avira GmbH”]
“NvCplDaemon” = “RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS]
“NvMediaCenter” = “RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit” [MS]
“SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”]
“Services” = “D:\RECYCLER\Services\services.exe” [file not found]
“Windows Defender” = ““C:\Program Files\Windows Defender\MSASCui.exe” -hide” [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided)
-> {HKLM…CLSID} = “Adobe PDF Reader Link Helper”
\InProcServer32(Default) = “D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided)
-> {HKLM…CLSID} = “SSVHelper Class”
\InProcServer32(Default) = “D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
“{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu”
-> {HKLM…CLSID} = “HyperTerminal Icon Ext”
\InProcServer32(Default) = “D:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”]
“{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer”
-> {HKLM…CLSID} = “Desktop Explorer”
\InProcServer32(Default) = “D:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”]
“{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu”
-> {HKLM…CLSID} = (no title provided)
\InProcServer32(Default) = “D:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”]
“{45AC2688-0253-4ED8-97DE-B5370FA7D48A}” = “Shell Extension for Malware scanning”
-> {HKLM…CLSID} = “Shell Extension for Malware scanning”
\InProcServer32(Default) = “D:\Program Files\AntiVir PersonalEdition Classic\shlext.dll” [“Avira GmbH”]
“{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension”
-> {HKLM…CLSID} = “WinRAR”
\InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data]
“{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class”
-> {HKLM…CLSID} = “DesktopContext Class”
\InProcServer32(Default) = “D:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”]
“{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu”
-> {HKLM…CLSID} = “nView Desktop Context Menu”
\InProcServer32(Default) = “D:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”]
“{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler”
-> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook”
\InProcServer32(Default) = “D:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL” [MS]
“{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler”
-> {HKLM…CLSID} = (no title provided)
\InProcServer32(Default) = “D:\Program Files\Microsoft Office\Office10\msohev.dll” [MS]
“{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” = “PowerISO”
-> {HKLM…CLSID} = “PowerISO”
\InProcServer32(Default) = “c:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”]
“{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper”
-> {HKLM…CLSID} = “NVIDIA CPL Extension”
\InProcServer32(Default) = “D:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<> “{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}” = “Microsoft AntiMalware ShellExecuteHook”
-> {HKLM…CLSID} = “Microsoft AntiMalware ShellExecuteHook”
\InProcServer32(Default) = “C:\PROGRA~1\WINDOW~1\MpShHook.dll” [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
“WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}”
-> {HKLM…CLSID} = “WPDShServiceObj Class”
\InProcServer32(Default) = “D:\WINDOWS\system32\WPDShServiceObj.dll” [MS]
HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info”
-> {HKLM…CLSID} = “PDF Shell Extension”
\InProcServer32(Default) = “D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”]
HKLM\Software\Classes*\shellex\ContextMenuHandlers\
PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}”
-> {HKLM…CLSID} = “PowerISO”
\InProcServer32(Default) = “c:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”]
Shell Extension for Malware scanning(Default) = “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}”
-> {HKLM…CLSID} = “Shell Extension for Malware scanning”
\InProcServer32(Default) = “D:\Program Files\AntiVir PersonalEdition Classic\shlext.dll” [“Avira GmbH”]
WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”
-> {HKLM…CLSID} = “WinRAR”
\InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}”
-> {HKLM…CLSID} = “PowerISO”
\InProcServer32(Default) = “c:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”]
WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”
-> {HKLM…CLSID} = “WinRAR”
\InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}”
-> {HKLM…CLSID} = “PowerISO”
\InProcServer32(Default) = “c:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”]
Shell Extension for Malware scanning(Default) = “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}”
-> {HKLM…CLSID} = “Shell Extension for Malware scanning”
\InProcServer32(Default) = “D:\Program Files\AntiVir PersonalEdition Classic\shlext.dll” [“Avira GmbH”]
WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”
-> {HKLM…CLSID} = “WinRAR”
\InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data]
Group Policies {policy setting}:
Note: detected settings may not have any effect.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
“shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001
{Shutdown: Allow system to be shut down without having to log on}
“undockwithoutlogon” = (REG_DWORD) hex:0x00000001
{Devices: Allow undock without having to log on}
Active Desktop and Wallpaper:
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
“Wallpaper” = “D:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp”
Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
“Wallpaper” = “D:\Documents and Settings\Kamil.KOCON\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp”
Enabled Screen Saver:
HKCU\Control Panel\Desktop\
“SCRNSAVE.EXE” = “D:\WINDOWS\system32\ssmypics.scr” [MS]
Startup items in “Kamil” & “All Users” startup folders:
D:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart
“DSLMON” -> shortcut to: “D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe” [empty string]
“HP Digital Imaging Monitor” -> shortcut to: “D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe” [“Hewlett-Packard Co.”]
Enabled Scheduled Tasks:
“MP Scheduled Scan” -> launches: “C:\Program Files\Windows Defender\MpCmdRun.exe Scan -RestrictPrivileges” [MS]
“WebReg psc 1500 series” -> launches: “D:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe “psc 1500 series”” [“Hewlett-Packard Co.”]
Winsock2 Service Provider DLLs:
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]
000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS]
000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
“MenuText” = “Sun Java Console”
“CLSIDExtension” = “{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}”
-> {HKCU…CLSID} = “Java Plug-in 1.6.0_01”
\InProcServer32(Default) = “D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”]
-> {HKLM…CLSID} = “Java Plug-in 1.6.0_01”
\InProcServer32(Default) = “D:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll” [“Sun Microsystems, Inc.”]
{E2E2DD38-D088-4134-82B7-F2BA38496583}\
“MenuText” = “@xpsp3res.dll,-20001”
“Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS]
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
“ButtonText” = “Messenger”
“MenuText” = “Windows Messenger”
“Exec” = “D:\Program Files\Messenger\msmsgs.exe” [MS]
Running Services (Display Name, Service Name, Path {Service DLL}):
AntiVir PersonalEdition Classic Guard, AntiVirService, ““D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe”” [“Avira GmbH”]
AntiVir PersonalEdition Classic Scheduler, AntiVirScheduler, ““D:\Program Files\AntiVir PersonalEdition Classic\sched.exe”” [“Avira GmbH”]
Machine Debug Manager, MDM, ““D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe”” [MS]
NVIDIA Display Driver Service, NVSvc, “D:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”]
Windows Defender, WinDefend, ““C:\Program Files\Windows Defender\MsMpEng.exe”” [MS]
Print Monitors:
HKLM\System\CurrentControlSet\Control\Print\Monitors\
HP Standard TCP/IP Port\Driver = “HpTcpMon.dll” [“Hewlett Packard”]
hpzlnt12\Driver = “hpzlnt12.dll” [“HP”]
<>: Suspicious data at a malware launch point.
-
This report excludes default entries except where indicated.
-
To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
- The search for DESKTOP.INI DLL launch points on all local fixed drives
took 34 seconds.
---------- (total run time: 106 seconds)
Złączono Posta : 19.05.2007 (Sob) 13:09
log z silent
A gdzie nowy log z Hijacka?
dałem stare logi
nowy z hjt
i nowy log z silent
P.s czy nie znamy się z forum pc format?
Już jest Ok czyli czysto 
No to dzkięki wszystkim:-)
Już jest dobrze.
mam problem w wielu programach wyskakuje mu błąd po zgłoszeniu raportu dostaje informacje o wiurusie win32/small.ca podaje loga z hijackthis