System Defender Security Center

[wilston]

Ostatni non stop wyskakuje mi takie okienko z nazwa jak w temacie i niewiem co to jest, otwiera mi sie doslownie co 10 minut jak sie tego pozbyc ???

Prosze o pomoc w tej sprawie

[wilston]

widze ze nie znajde tutaj pomocy czyzby nikt niewiedzial jak zrobic zeby nie otwieralo mi sie samoczynnie okienko z natarczywie infoprujacym mnie (poslancem ?) zeby zainstalowac System Defender Security Center

[huber2t]

Podaj logi na forum hijackthis

[wilston]

ok zaraz je tam podam :)dzieki

[wilston]

zrobilem tego loga tylko niewiem czy tutaj moge go wkleic,ale coz wkleje go :

Logfile of HijackThis v1.99.1

Scan saved at 12:23:48, on 2008-03-22

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\acs.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Gigabyte\Gigabyte GN-WPEAG Wireless PCI Adapter\GNConfig.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\Program Files\Grisoft\AVG7\avgcc.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[huber2t]

Podaj cały log a nie jego część

[wilston]

sorki niezauwazylem ze nie doszdl caly juz daje caly

Logfile of HijackThis v1.99.1

Scan saved at 12:23:48, on 2008-03-22

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\acs.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Gigabyte\Gigabyte GN-WPEAG Wireless PCI Adapter\GNConfig.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\Program Files\Grisoft\AVG7\avgcc.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Documents and Settings\Wilston\Pulpit\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sokker.org/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adtest.gadu-gadu.pl/clickmain.as ... pl/cennik/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll

O2 - BHO: GNX Rolex - {6F5F722F-7CFB-4EC3-A768-2662D76A631E} - C:\WINDOWS\drnpfdxkvw.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O4 - HKLM..\Run: [ACU] "C:\Program Files\Gigabyte\Gigabyte GN-WPEAG Wireless PCI Adapter\GNConfig.exe" -nogui

O4 - HKLM..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM..\Run: [P2P Networking] C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART

O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler

O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM..\Run: [salestart] "C:\Program Files\Common Files\0\stm.exe" dm=http://0000000000000000000000000000000000000000 ad=http://0000000000000000000000000000000000000000 sd=http://paistutta.0000000000000000000000000000000000000000

O4 - HKLM..\Run: [bm] "C:\Program Files\Common Files\TrustedAntivirus\bm.exe" dm=http://trustedantivirus.com ad=http://trustedantivirus.com sd=http://ykeeper.trustedantivirus.com

O4 - HKLM..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - Startup: .protected

O4 - Global Startup: .protected

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O21 - SSODL: altvxvm - {3E3C855C-C626-4FEF-8EB2-A9CCF9ACABBE} - C:\WINDOWS\altvxvm.dll (file missing)

O21 - SSODL: bokpkov - {A4F08C2A-B15D-4F9E-8C6F-D920CD73C049} - C:\WINDOWS\bokpkov.dll (file missing)

O23 - Service: Gigabyte Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

[huber2t]

chyba masz dwa antywirusy

fix

O2 - BHO: GNX Rolex - {6F5F722F-7CFB-4EC3-A768-2662D76A631E} - C:\WINDOWS\drnpfdxkvw.dll (file missing)

O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\0\stm.exe" dm=http://0000000000000000000000000000000000000000 ad=http://0000000000000000000000000000000000000000 sd=http://paistutta.0000000000000000000000000000000000000000

O4 - Startup: .protected

O4 - Global Startup: .protected

[wilston]

to zle jak sie ma 2lub 3 antywirusy?? Mam Avasta i wczoraj zainstalowalem takie cos:AVG Anti-Spyware oraz AVG Free Edytion

[wilston]

a co z tym logiem ??? jest jakis robak lub wirus co przez niego wyskakuje mi ten System Defender ?

[huber2t]

wtedy Antywirusy sie kolidują nawzajem i wtedy mogą być fałszywe alarmy

[wilston]

no tak ok ale ten co mi wyskakiwal System Defender mialem wtedy tylko 1 antywirusa avasta

[xulu]

to zle jak sie ma 2lub 3 antywirusy?? Mam Avasta i wczoraj zainstalowalem takie cos:AVG Anti-Spyware oraz AVG Free Edytion

To bardzo źle jak sie ma kilka antywirusów .

"" zainstalowalem takie cos:AVG Anti-Spyware ""

to nie przeszkadza ale jeśli sie zdecydowałeś na instalacje AVG Free Edytion powinieneś odinstalować avasta .

Co do logów , poradzę ci lekturę:

:arrow: viewtopic.php?f=16&t=36654

i odpowiedni dzial :

:arrow: viewforum.php?f=16

[addmir]

wilston ,

fix w hijack:

O2 - BHO: GNX Rolex - {6F5F722F-7CFB-4EC3-A768-2662D76A631E} - C:\WINDOWS\drnpfdxkvw.dll (file missing) O4 - HKLM..\Run: [P2P Networking] C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM..\Run: [salestart] "C:\Program Files\Common Files\0\stm.exe" dm=http://0000000000000000000000000000000000000000 ad=http://0000000000000000000000000000000000000000 sd=http://paistutta.0000000000000000000000000000000000000000 O4 - HKLM..\Run: [bm] "C:\Program Files\Common Files\TrustedAntivirus\bm.exe" dm=http://trustedantivirus.com ad=http://trustedantivirus.com sd=http://ykeeper.trustedantivirus.com O4 - Startup: .protected O4 - Global Startup: .protected O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O21 - SSODL: altvxvm - {3E3C855C-C626-4FEF-8EB2-A9CCF9ACABBE} - C:\WINDOWS\altvxvm.dll (file missing) O21 - SSODL: bokpkov - {A4F08C2A-B15D-4F9E-8C6F-D920CD73C049} - C:\WINDOWS\bokpkov.dll (file missing)

Pobierz ComboFix, ale nie uruchamiaj

Wklej do notatnika:

File::

C:\WINDOWS\bokpkov.dll

C:\WINDOWS\altvxvm.dll

C:\WINDOWS\drnpfdxkvw.dll

Plik -> zapisz jako -> CFScript.txt

Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu ->

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum + nowy log z HijackThis.

Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: **** Qoobox

Logi dajesz na http://www.wklej.org