Syf na kompie, wirus nie do usuniecia

Mate121 · 8 Czerwiec 2007 18:30

Witam. Mam problem, bo komp mi strasznie zamula, skanuje kompa NOD32 i nic nie wykrywa, skanując kompa programem BitDefender wykrywa wirusa w systemie, ale nie chce go skasować ;/ ;/ ;/

Co kilka chwil wystepuje błąd explorer.exe i okno (program wykonał nieprawidłową operacje)

Z góry dzięki za szybką odpowiedz.

Pozdrawiam

Logfile of HijackThis v1.99.1 Scan saved at 20:24:34, on 2007-06-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Softwin\BitDefender10\bdmcon.exe C:\Program Files\Softwin\BitDefender10\bdagent.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MarBit\ALLPlayer\ALLPlayer.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Softwin\BitDefender10\vsserv.exe C:\Program Files\Softwin\BitDefender10\bdlite.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Pablo\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM…\Run: [NVMixerTray] “C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe” O4 - HKLM…\Run: [unlockerAssistant] “C:\Program Files\Unlocker\UnlockerAssistant.exe” -H O4 - HKLM…\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe O4 - HKLM…\Run: [DAEMON Tools-1033] “C:\Program Files\D-Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [bDMCon] “C:\Program Files\Softwin\BitDefender10\bdmcon.exe” /reg O4 - HKLM…\Run: [bDAgent] “C:\Program Files\Softwin\BitDefender10\bdagent.exe” O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup … 7355959531 O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file:///C:/Program%20Files/AutoCAD%202002/AcDcToday.ocx O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file:///C:/Program%20Files/AutoCAD%202002/InstBanr.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file:///C:/Program%20Files/AutoCAD%202002/AcPreview.ocx O17 - HKLM\System\CCS\Services\Tcpip…{AC1CB977-A1AF-4A28-9F6C-E9E57F1685E0}: NameServer = 150.254.5.4 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing) O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing) O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing) O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “NVMixerTray” = ““C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe”” [“NVIDIA Corporation”] “UnlockerAssistant” = ““C:\Program Files\Unlocker\UnlockerAssistant.exe” -H” [null data] “nTrayFw” = “C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe” [“NVIDIA Corporation”] “DAEMON Tools-1033” = ““C:\Program Files\D-Tools\daemon.exe” -lang 1033” [“DAEMON’S HOME”] “BDMCon” = ““C:\Program Files\Softwin\BitDefender10\bdmcon.exe” /reg” [“SOFTWIN S.R.L.”] “BDAgent” = ““C:\Program Files\Softwin\BitDefender10\bdagent.exe”” [“SOFTWIN S.R.L.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” = “UnlockerShellExtension” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <> “AppInit_DLLs” = “sockspy.dll” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data] Default executables: -------------------- HKLM\Software\Classes.scr(Default) = “AutoCADScriptFile” <> HKLM\Software\Classes\AutoCADScriptFile\shell\open\command(Default) = "C:\WINDOWS\NOTEPAD.EXE “%1"” [MS] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoSharedDocuments” = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Remove Shared Documents from My Computer} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Pablo\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\logon.scr” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SYSTEMROOT%\system32\nvappfilter.dll [“NVIDIA”], 01 - 16, 33 %SystemRoot%\system32\mswsock.dll [MS], 17 - 20, 23 - 32 %SystemRoot%\system32\rsvpsp.dll [MS], 21 - 22 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.6.0_01” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.6.0_01” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll” [“Sun Microsystems, Inc.”] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {E2E2DD38-D088-4134-82B7-F2BA38496583}\ “MenuText” = “@xpsp3res.dll,-20001” “Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ BitDefender Communicator, XCOMM, ““C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe” /service” [“SOFTWIN S.R.L”] BitDefender Desktop Update Service, LIVESRV, ““C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe” /service” [“SOFTWIN S.R.L.”] BitDefender Scan Server, bdss, ““C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe” /service” [null data] BitDefender Virus Shield, VSSERV, ““C:\Program Files\Softwin\BitDefender10\vsserv.exe” /service” [“SOFTWIN S.R.L.”] ForceWare Intelligent Application Manager (IAM), ForceWare Intelligent Application Manager (IAM), “C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe” [empty string] ForceWare IP service, nSvcIp, “C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe” [“NVIDIA”] ForceWare user log service, nSvcLog, “C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe” [“NVIDIA”] Forceware Web Interface, ForcewareWebInterface, ““C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe” -k runservice” [“Apache Software Foundation”] LightScribeService Direct Disc Labeling Service, LightScribeService, ““C:\Program Files\Common Files\LightScribe\LSSrvc.exe”” [“Hewlett-Packard Company”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 63 seconds, including 4 seconds for message boxes)

dorzucam loga z BitDefender

//----------------------------------------------------------------- // // Product BitDefender Antivirus v10 // Product 10.2 // // Created on: 08/06/2007 20:07:25 // //----------------------------------------------------------------- Virus Statistics Scan path : C:\ D:\ E:\ Folders : 6923 Files : 122246 Memory processes scanned : 13 Archives : 299 Runtime packers : 3512 Identified viruses : 1 Infected files : 5 Memory processes infected : 0 Suspect files : 0 Warnings : 0 Disinfected files : 0 Deleted files : 2 Moved files : 0 I/O errors : 30 Scan time : 00:37:32 Scan speed (files/sec) : 54 Spyware Statistics Registry keys scanned : 1766 Registry keys infected : 2 Cookies scanned : 437 Cookies infected : 0 Spyware files infected : 0 Spyware threats detected : 2 Virus definitions : 560763 Scan plugins : 16 Archive plugins : 41 Unpack plugins : 6 Mail plugins : 6 System plugins : 5 Virus scan options Detection [X] Scan boot sectors [X] Memory Processes [] Scan archives [X] Scan runtime packers [X] Scan email File mask [] Programs [X] All files [] User defined extensions: [] Exclude extensions: ; Action Infected objects [] Ignore [X] Disinfect [] Delete [] Move to quarantine [] Prompt user Second action [] Ignore [] Delete [X] Move to quarantine [] Prompt user Virus scan options [X] Enable warnings [X] Enable heuristics [] Show all files in log [X] Report file: C:\Documents and Settings\All Users\Dane aplikacji\Bitdefender\Desktop\Profiles\Logs\full_scan\1181326045.log Spyware scan options [X] Scan for riskware [] Skip dial and applications from scan [X] Registry keys [X] Cookies Summary: =>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET Detected: magne3t =>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET Deleted Archive repacking successfully completed (actions successfully applied) =>HKEY_CLASSES_ROOT\MAGNET Detected: magne2t =>HKEY_CLASSES_ROOT\MAGNET Deleted Archive repacking successfully completed (actions successfully applied) E:\uczelnia\sprawozdania\Visiual basic\cw 2\chata w polu.nws=>(MIME part)=>(MIME part) Infected: Exploit.Html.Filedownload.H E:\uczelnia\sprawozdania\Visiual basic\cw 2\chata w polu.nws=>(MIME part)=>(MIME part) Disinfection failed E:\uczelnia\sprawozdania\Visiual basic\cw 2\chata w polu.nws=>(MIME part)=>(MIME part) Move failed E:\uczelnia\sprawozdania\Visiual basic\cw 3\chlopakow\instrukcja obsługi lodówki.nws=>(MIME part)=>(MIME part) Infected: Exploit.Html.Filedownload.H E:\uczelnia\sprawozdania\Visiual basic\cw 3\chlopakow\instrukcja obsługi lodówki.nws=>(MIME part)=>(MIME part) Disinfection failed E:\uczelnia\sprawozdania\Visiual basic\cw 3\chlopakow\instrukcja obsługi lodówki.nws=>(MIME part)=>(MIME part) Move failed E:\uczelnia\sprawozdania\Visiual basic\cw 4\INNE\PQPB.NWS=>(MIME part)=>(MIME part) Infected: Exploit.Html.Filedownload.H E:\uczelnia\sprawozdania\Visiual basic\cw 4\INNE\PQPB.NWS=>(MIME part)=>(MIME part) Disinfection failed E:\uczelnia\sprawozdania\Visiual basic\cw 4\INNE\PQPB.NWS=>(MIME part)=>(MIME part) Move failed E:\uczelnia\sprawozdania\Wstęp do fizyki komputerowej - wykł\wykl inf\README.NWS=>(MIME part)=>(MIME part) Infected: Exploit.Html.Filedownload.H E:\uczelnia\sprawozdania\Wstęp do fizyki komputerowej - wykł\wykl inf\README.NWS=>(MIME part)=>(MIME part) Disinfection failed E:\uczelnia\sprawozdania\Wstęp do fizyki komputerowej - wykł\wykl inf\README.NWS=>(MIME part)=>(MIME part) Move failed E:\uczelnia\sprawozdania\Wstęp do fizyki komputerowej - wykł\WYKL1\Slajd 11_pliki\navbar1_pliki\BECK.NWS=>(MIME part)=>(MIME part) Infected: Exploit.Html.Filedownload.H E:\uczelnia\sprawozdania\Wstęp do fizyki komputerowej - wykł\WYKL1\Slajd 11_pliki\navbar1_pliki\BECK.NWS=>(MIME part)=>(MIME part) Disinfection failed E:\uczelnia\sprawozdania\Wstęp do fizyki komputerowej - wykł\WYKL1\Slajd 11_pliki\navbar1_pliki\BECK.NWS=>(MIME part)=>(MIME part) Move failed

qrczak13 · 8 Czerwiec 2007 21:34

Daj log z ComboFix.

Mate121 · 9 Czerwiec 2007 12:47

“Pablo” - 2007-06-09 14:40:34 Dodatek Service Pack 2 NTFS ComboFix 07-06-3B - Running from: “C:\Documents and Settings\Pablo\Pulpit” ((((((((((((((((((((((((( Files Created from 2007-05-09 to 2007-06-09 ))))))))))))))))))))))))))))))) 2007-06-07 14:02 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2007-06-07 14:02 2007-06-07 14:00 2007-06-05 00:45 2007-06-04 22:15 2007-06-04 22:12 304,128 --a------ C:\WINDOWS\IsUninst.exe 2007-06-04 22:12 299,520 --a------ C:\WINDOWS\uninst.exe 2007-06-04 22:12 225,280 --a------ C:\WINDOWS\system32\awrtl30.dll 2007-06-04 22:12 111,616 --------- C:\WINDOWS\system32\Ltih30tb.dll 2007-06-04 22:12 2007-06-04 22:12 2007-06-04 22:07 2007-06-04 22:07 2007-06-04 22:06 2007-06-04 22:06 2007-05-30 20:44 53,693 -ra------ C:\WINDOWS\UNDPX2K.sys 2007-05-30 20:44 135,168 -ra------ C:\WINDOWS\UNDPX2K.exe 2007-05-30 20:15 2007-05-29 01:01 2007-05-20 16:59 2007-05-12 04:05 8,704 --a------ C:\WINDOWS\system32\kbdjpn.dll 2007-05-12 04:05 8,192 --a------ C:\WINDOWS\system32\kbdkor.dll 2007-05-12 04:05 6,144 --a------ C:\WINDOWS\system32\kbd106.dll 2007-05-12 04:05 6,144 --a------ C:\WINDOWS\system32\kbd101c.dll 2007-05-12 04:05 6,144 --a------ C:\WINDOWS\system32\kbd101b.dll 2007-05-12 04:05 5,632 --a------ C:\WINDOWS\system32\kbd103.dll 2007-05-10 00:33 2007-05-09 22:22 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-09 12:39:42 -------- d-----w C:\DOCUME~1\Pablo\DANEAP~1\uTorrent 2007-06-09 12:39:36 -------- d-----w C:\Program Files\DC++ 2007-06-05 10:43:03 86,968 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-06-05 10:43:03 494,308 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-06-04 19:45:07 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-18 03:47:22 -------- d-----w C:\Program Files\Google 2007-05-09 22:36:27 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-04-26 11:22:15 -------- d-----w C:\Program Files\MarBit 2007-04-25 21:25:19 -------- d-----w C:\Program Files\LizardTech 2007-04-25 19:24:57 -------- d-----w C:\Program Files\Microsoft.NET 2007-04-25 16:49:07 -------- d-----w C:\Program Files\RAR Password Cracker 2007-04-25 16:44:26 -------- d-----w C:\Program Files\ElcomSoft 2007-04-25 12:27:13 -------- d-----w C:\Program Files\Common Files\SWF Studio 2007-04-25 12:26:59 -------- d-----w C:\Program Files\Riva 2007-04-25 12:19:29 -------- d-----w C:\Program Files\YouTube Video Downloader 2007-04-23 20:11:49 -------- d-----w C:\Program Files\MSBuild 2007-04-23 20:08:25 -------- d-----w C:\Program Files\Reference Assemblies 2007-04-23 20:07:08 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-04-20 19:17:56 -------- d-----w C:\DOCUME~1\Pablo\DANEAP~1\Real 2007-04-18 17:23:13 -------- d-----w C:\DOCUME~1\Pablo\DANEAP~1\Media Player Classic 2007-04-18 17:23:02 -------- d-----w C:\Program Files\Real Alternative 2007-04-18 17:23:00 -------- d-----w C:\Program Files\Media Player Classic 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-12 23:45:04 -------- d-----w C:\Program Files\Messenger 2007-04-11 14:23:44 2,934 ----a-w C:\WINDOWS\mozver.dat 2007-04-11 01:32:08 -------- d-----w C:\Program Files\uTorrent 2007-04-11 01:29:21 -------- d-----w C:\DOCUME~1\Pablo\DANEAP~1\Google 2007-04-11 00:06:31 -------- d-----w C:\Program Files\Gadu-Gadu 2007-04-10 23:54:37 -------- d-----w C:\Program Files\ACE Mega CoDecS Pack 2007-04-10 23:51:10 -------- d-----w C:\DOCUME~1\Pablo\DANEAP~1\Talkback 2007-04-10 23:50:17 0 ----a-w C:\WINDOWS\nsreg.dat 2007-04-10 23:46:54 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-10 23:46:51 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-10 23:44:20 -------- d-----w C:\Program Files\D-Tools 2007-04-10 23:44:06 -------- d-----w C:\Program Files\Foxit Software 2007-04-10 23:25:40 -------- d-----w C:\Program Files\sony 2007-04-10 23:18:56 -------- d-----w C:\Program Files\Ahead 2007-04-10 23:18:22 -------- d-----w C:\Program Files\Common Files\LightScribe 2007-04-10 23:13:54 -------- d-----w C:\Program Files\Common Files\Nero 2007-04-10 23:12:46 -------- d-----w C:\Program Files\Common Files\Ahead 2007-04-10 23:04:02 -------- d-----w C:\Program Files\NVIDIA Corporation 2007-04-10 23:03:26 -------- d-----w C:\Program Files\Malicious Software Removal Tool 2007-04-10 23:03:26 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-04-10 23:00:53 -------- d-----w C:\Program Files\MSXML 4.0 2007-04-10 22:57:41 -------- d-----w C:\Program Files\Common Files\NVIDIA Shared 2007-04-10 22:40:13 -------- d-----w C:\Program Files\HighMAT CD Writing Wizard 2007-04-10 22:32:32 -------- d-----w C:\Program Files\AutoPatcher 2007-04-10 21:55:28 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-10 21:55:16 0 --sha-r C:\MSDOS.SYS 2007-04-10 21:55:16 0 --sha-r C:\IO.SYS 2007-04-10 21:55:16 0 ----a-w C:\CONFIG.SYS 2007-04-10 21:55:16 0 ----a-w C:\AUTOEXEC.BAT 2007-04-10 21:54:22 -------- d–h--w C:\Program Files\WindowsUpdate 2007-04-10 21:54:21 -------- d-----w C:\Program Files\Usługi online 2007-04-10 21:53:46 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-10 21:53:39 -------- d-----w C:\Program Files\Movie Maker 2007-04-10 21:53:04 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-10 21:52:55 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-04-10 21:52:49 -------- d-----w C:\Program Files\Windows NT 2007-03-23 04:07:56 1,683,280 ------w C:\WINDOWS\system32\XpsSvcs.dll 2007-03-23 04:07:54 583,504 ------w C:\WINDOWS\system32\XPSSHHDR.dll 2007-03-22 18:25:02 124,928 ------w C:\WINDOWS\system32\prntvpt.dll 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NVMixerTray”=“C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe” [2004-12-20 17:12] “UnlockerAssistant”=“C:\Program Files\Unlocker\UnlockerAssistant.exe” [2006-09-07 19:19] “nTrayFw”=“C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe” [2005-02-24 17:26] “DAEMON Tools-1033”=“C:\Program Files\D-Tools\daemon.exe” [2004-08-22 17:05] “BDMCon”=“C:\Program Files\Softwin\BitDefender10\bdmcon.exe” [2007-06-07 19:02] “BDAgent”=“C:\Program Files\Softwin\BitDefender10\bdagent.exe” [2007-03-26 15:49] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-04-11 02:42] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 18:24] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 14:00] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoRecentDocsMenu”=1 (0x1) “NoSharedDocuments”=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “appinit_dlls”=sockspy.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “ose”=3 (0x3) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* ************************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-09 14:43:06 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … ************************************************************************** Completion time: 2007-06-09 14:44:21 — E O F —

Joan · 9 Czerwiec 2007 13:48

ja tutaj nic nie widzę. podmień explorera z płyty XP.

Odpalasz Konsolę odzyskiwania i wpisujesz komende:

expand X:\i386\explorer.ex_ C:\WINDOWS\explorer.exe

(zamiast X podstaw literę CD-ROMu)

podaj lokalizacje wykrywanego wirusa

Mate121 · 9 Czerwiec 2007 14:17

poza tym BitDefender znajduje

pisze niby ze skasował, ale to samo jest co każde skanowanie które robie ostatnim czasy co godzine ;/ ;/ ;/

kumpel mówi ze moge go mieć na ramach

mam athlona ;/ ;/ ;/

Joan · 9 Czerwiec 2007 14:48

Skan AVG AntiSpyware 7.5 po update, wklej raport.