Na pulpicie jest falszywa tapeta antywirusa. Skanowalem antywirusem nie pomoglo-pomocy. Z gory bardzo dziekuje.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:48:13, on 2008-09-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Winamp3\winampa.exe C:\WINDOWS\system32\lphccmcj0ep1l.exe C:\Program Files\Creative\ShareDLL\MediaDet.Exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\pphccmcj0ep1l.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\imapi.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll (file missing) O4 - HKLM…\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM…\Run: [updReg] C:\WINDOWS\Updreg.exe O4 - HKLM…\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM…\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE O4 - HKLM…\Run: [CTAvTray] C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE O4 - HKLM…\Run: [APVXDWIN] “C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE” /s O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [LanguageShortcut] “C:\Program Files\CyberLink\PowerDVD\Language\Language.exe” O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [WinampAgent] “C:\Program Files\Winamp3\winampa.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe” O4 - HKLM…\Run: [lphccmcj0ep1l] C:\WINDOWS\system32\lphccmcj0ep1l.exe O4 - HKLM…\Run: [sMrhc9mcj0ep1l] C:\Program Files\rhc9mcj0ep1l\rhc9mcj0ep1l.exe O4 - HKLM…\RunOnce: [CTAVTray] C:\Program Files\Creative\SBLive\Program\CTAvStub.EXE EAX.AVI O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [Expressivo] “C:\Program Files\ivo\Expressivo Demo\expressivo.exe” -t O4 - HKCU…\Run: [amva] C:\WINDOWS\system32\amvo.exe O4 - HKCU…\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe O4 - HKCU…\Run: [iPLA!] C:\Program Files\ipla\ipla.exe /autorun O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘?’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘?’) O4 - HKUS\S-1-5-21-1606980848-220523388-682003330-1004…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background (User ‘?’) O4 - HKUS\S-1-5-21-1606980848-220523388-682003330-1004…\Run: [amva] C:\WINDOWS\system32\amvo.exe (User ‘?’) O4 - HKUS\S-1-5-21-1606980848-220523388-682003330-1004…\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe (User ‘?’) O4 - HKUS\S-1-5-21-1606980848-220523388-682003330-1004…\Run: [iPLA!] C:\Program Files\ipla\ipla.exe /autorun (User ‘?’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘?’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - S-1-5-21-1606980848-220523388-682003330-1004 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User ‘?’) O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virus … nicode.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan … stubie.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/vi … ebscan.cab O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Program uruchamiający proces serwera DCOM DcomLaunchhelpsvc (DcomLaunchhelpsvc) - Unknown owner - C:\WINDOWS\ O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe O23 - Service: Telefonia TapiSrvUMWdf (TapiSrvUMWdf) - Unknown owner - C:\WINDOWS\ O23 - Service: Telefonia TapiSrvUMWdf TapiSrvUMWdfRDSessMgr (TapiSrvUMWdfRDSessMgr) - Unknown owner - C:\WINDOWS\ O23 - Service: Klient śledzenia łączy rozproszonych TrkWksPlugPlay (TrkWksPlugPlay) - Unknown owner - C:\WINDOWS\ O23 - Service: Klient śledzenia łączy rozproszonych TrkWksWmiApSrv (TrkWksWmiApSrv) - Unknown owner - C:\WINDOWS\ O23 - Service: WebClient WebClientNetman (WebClientNetman) - Unknown owner - C:\WINDOWS\ O23 - Service: WebClient WebClientRpcSs (WebClientRpcSs) - Unknown owner - C:\WINDOWS\ O24 - Desktop Component 0: (no name) - http://www.svt.pl/animacje/gwiazdy/galeria/star_3.gif O24 - Desktop Component 1: (no name) - http://www.gryzonie.pl/min/PF/lezac.jpg – End of file - 9137 bytes
Leon1
(Leon$)
18 Wrzesień 2008 19:23
#2
wpisy
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll (file missing) O4 - HKLM…\Run: [lphccmcj0ep1l] C:\WINDOWS\system32\lphccmcj0ep1l.exe O4 - HKLM…\Run: [sMrhc9mcj0ep1l] C:\Program Files\rhc9mcj0ep1l\rhc9mcj0ep1l.exe O4 - HKCU…\Run: [Expressivo] “C:\Program Files\ivo\Expressivo Demo\expressivo.exe” -t O4 - HKCU…\Run: [amva] C:\WINDOWS\system32\amvo.exe O4 - HKCU…\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe O4 - HKCU…\Run: [iPLA!] C:\Program Files\ipla\ipla.exe /autorun O4 - HKUS\S-1-5-21-1606980848-220523388-682003330-1004…\Run: [amva] C:\WINDOWS\system32\amvo.exe (User ‘?’) O4 - HKUS\S-1-5-21-1606980848-220523388-682003330-1004…\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe (User ‘?’) O4 - HKUS\S-1-5-21-1606980848-220523388-682003330-1004…\Run: [iPLA!] C:\Program Files\ipla\ipla.exe /autorun (User ‘?’) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan … stubie.cab O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
usuń HijackThisem >> Fix checked
Pobierz Combofix http://www.searchengines.pl/index.php?s … ntry395642 ale nie włączaj.
Podczas pobierania i skanu Combofixem proszę wyłączyć wszelkie zapory i antywirusy
Otwórz notatnik i wklej
zapisz jako CFScript.txt (zapisz by ikonka CFScript.txt była obok ikonki ComboFix.exe) >> Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe
http://img.wklej.org/images/88953CFScri … iemoes.gif
Powinno rozpocząć się usuwanie
Potem log z usuwania Combofix
asterisk
(Asterisk)
18 Wrzesień 2008 19:25
#3
Logi zamieszczamy na serwerze zewnętrznym.
Tutaj dajemy linka