Uciążliwy Wirus / smss.exe

[aiiidzzz]

Otóż niedawno podczas gry w cod4 wyskoczył mi raport o błędzie smss.exe po czym został zrestartowany komputer.

Po zalogowaniu się wszystko się wydawało w porządku do czasu póki nie włączyłem internetu. Pojawiła się otóż nowy proces o nazwie smss.exe (komputer) który po prostu zabierał 100% mojego procka i nie byłem w stanie korzystać z żadnego programu oraz internetu…

czytałem już tutaj temat windows-smss-exe-uciazliwy-wirus-t338548.html

lecz nie pomogło to

Log z HijacThis

http://wklej.org/id/205375/

Proszę o Pomoc

[deFco247]

Pokaż logi:

OTL

Przestawiasz w nim Processes i Modules na All oraz wklejasz w dolne białe okienko Custom Scans/Fixes :

netsvcs msconfig safebootminimal safebootnetwork %systemdrive%*.*

Klikasz Run Scan.

GMER

W GMER nic nie zmieniamy -> wciskamy Szukaj (skan potrwa kilkadziesiąt minut) -> po skanie Kopiuj.

W przypadku restartu w czasie skanowania odznacz Urządzenia oraz Pliki.

System Repair Engineer

[aiiidzzz]

Wybacz zapomniałem dodać iż ten proces mogę spokojnie wyłączyć

OTL

http://wklej.org/id/205408/

GMER

http://wklej.org/id/205404/

System Repair Engineer

http://wklej.org/id/205414/

[deFco247]

Z GMER-a dałeś nie ten log co trzeba. Skan ma być wykonany na zakładce Rootkit/Malware.

Uruchom SREng -> System Repair -> zakładka Browser Addons -> odszukaj i usuń:

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} {201F27D4-3704-41D6-89C1-AA35E39143ED} {3041D03E-FD4B-44E0-B742-2D9B88305F98} {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} {44627E97-789B-40D4-B5C2-58BD171129A1} {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} {92780B25-18CC-41C8-B9BE-3C9C571A8263} {E2E2DD38-D088-4134-82B7-F2BA38496583} {FB5F1910-F110-11D2-BB9E-00C04F795683}

[aiiidzzz]

Hmm… :-k usunąłem to co napisałeś ale po prostu poznikało mi parę ustawień tzn z TuneUpa

#-o tutaj (chyba prawidłowy :-D) scan GMERA

http://wklej.org/id/205524/

[asterisk]

smss.exe… C/Windows/smss.exe

Proszę zastosować się do tego Tematu i edytować własnego posta

w celu zmiany jego tytułu na konkretny.

W przeciwnym razie topic wyląduje w Śmietniku.

[deFco247]

Używałeś Combofixa, więc pokaż również log, który wtedy wyprodukował.

Poza tym ta infekcja Ci się wręcz strasznie rozmnożyła w folderze C:\Documents and Settings\Komputer

Jak przed usuwaniem OTL-em tam zajrzysz, to chyba dostaniesz zawału. ;]

W białe dolne okno Custom Scans/Fixes w OTL wklej:

:Processes Explorer.EXE :OTL IE - HKCU…\URLSearchHook: {ffa0793e-3980-4be4-8234-048fa665f700} - C:\Program Files\Softonic_English_FF\tbSof1.dll (Conduit Ltd.) FF - prefs.js…browser.search.defaultthis.engineName: “Softonic English FF Customized Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT2207613&SearchSource=3&q={searchTerms}” FF - prefs.js…browser.search.selectedEngine: “Softonic English FF Customized Web Search” FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT2207613&SearchSource=2&q=” [2009-05-19 10:33:14 | 00,000,900 | ---- | M] () – C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\p3x68b2l.default\searchplugins\conduit.xml O2 - BHO: (Softonic English FF Toolbar) - {ffa0793e-3980-4be4-8234-048fa665f700} - C:\Program Files\Softonic_English_FF\tbSof1.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (Softonic English FF Toolbar) - {ffa0793e-3980-4be4-8234-048fa665f700} - C:\Program Files\Softonic_English_FF\tbSof1.dll (Conduit Ltd.) O3 - HKCU…\Toolbar\WebBrowser: (Softonic English FF Toolbar) - {FFA0793E-3980-4BE4-8234-048FA665F700} - C:\Program Files\Softonic_English_FF\tbSof1.dll (Conduit Ltd.) O4 - HKLM…\Run: [32.exe] C:\WINDOWS\system32\nvscv32.exe () [2009-11-14 20:22:35 | 00,000,000 | —D | C] – C:\Qoobox [2009-11-14 20:15:27 | 00,021,504 | RHS- | M] () – C:\WINDOWS\smms.exe [2009-11-14 20:15:27 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\10720.exe [2009-11-14 19:51:53 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\18866.exe [2009-11-14 19:50:13 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\6277.exe [2009-11-14 19:31:05 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\25386.exe [2009-11-14 19:27:21 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\15922.exe [2009-11-14 19:25:25 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\30522.exe [2009-11-14 18:57:08 | 00,017,424 | ---- | M] () – C:\Documents and Settings\Komputer\28304.exe [2009-11-14 10:25:24 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\21924.exe [2009-11-13 21:12:24 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\17297.exe [2009-11-13 20:45:45 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\25219.exe [2009-11-13 20:22:03 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\8492.exe [2009-11-13 20:17:08 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\8262.exe [2009-11-13 20:00:23 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download21692.exe [2009-11-13 19:48:29 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\3752.exe [2009-11-13 19:43:22 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download17895.exe [2009-11-13 19:18:05 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\18569.exe [2009-11-13 17:26:02 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download8809.exe [2009-11-13 17:25:59 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\12410.exe [2009-11-13 08:30:56 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\32403.exe [2009-11-13 08:03:55 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\8837.exe [2009-11-13 07:42:11 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\28382.exe [2009-11-12 21:05:34 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\6909.exe [2009-11-12 21:05:34 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download12041.exe [2009-11-12 14:23:33 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\3991.exe [2009-11-12 14:23:29 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download24795.exe [2009-11-11 18:53:23 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\2850.exe [2009-11-11 18:53:23 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download25922.exe [2009-11-11 11:41:41 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\16554.exe [2009-11-11 11:15:44 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\20336.exe [2009-11-11 10:55:51 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\19924.exe [2009-11-11 10:35:13 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\4615.exe [2009-11-10 19:38:52 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\13967.exe [2009-11-10 19:38:45 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download6931.exe [2009-11-10 19:32:26 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download28566.exe [2009-11-10 19:32:25 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\15151.exe [2009-11-10 19:11:05 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\12043.exe [2009-11-10 18:46:03 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download4835.exe [2009-11-10 18:41:55 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download655.exe [2009-11-10 18:41:50 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\5259.exe [2009-11-10 17:59:22 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\25003.exe [2009-11-10 17:59:19 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download29176.exe [2009-11-10 10:21:20 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\9326.exe [2009-11-10 10:21:19 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download12212.exe [2009-11-09 22:29:48 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\5673.exe [2009-11-09 22:29:44 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download3343.exe [2009-11-09 08:34:59 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\28967.exe [2009-11-09 08:34:59 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download21930.exe [2009-11-08 20:23:33 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download25034.exe [2009-11-08 19:11:46 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\3768.exe [2009-11-08 19:11:41 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download3587.exe [2009-11-07 20:17:32 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\31610.exe [2009-11-07 20:17:31 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download9684.exe [2009-11-07 14:28:37 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download7418.exe [2009-11-07 12:08:13 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\389.exe [2009-11-07 12:08:08 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download11128.exe [2009-11-06 23:16:39 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download31915.exe [2009-11-06 23:16:33 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\16923.exe [2009-11-06 21:39:56 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\6577.exe [2009-11-06 21:39:55 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download10710.exe [2009-11-06 20:44:15 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\18509.exe [2009-11-06 20:44:14 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download489.exe [2009-11-06 20:00:40 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download29639.exe [2009-11-06 19:40:51 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\15628.exe [2009-11-06 18:53:52 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download12009.exe [2009-11-06 18:53:48 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\24937.exe [2009-11-06 17:18:05 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download11037.exe [2009-11-06 16:39:59 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\31473.exe [2009-11-06 16:31:13 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\20852.exe [2009-11-06 16:26:36 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\16695.exe [2009-11-06 14:22:57 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\31762.exe [2009-11-06 14:22:14 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download26670.exe [2009-11-06 11:02:39 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\14855.exe [2009-11-06 11:02:18 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download24818.exe [2009-11-05 18:57:56 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\22106.exe [2009-11-04 21:34:51 | 00,019,968 | ---- | M] () – C:\WINDOWS\System32\nvscv32.exe [2009-11-04 21:34:51 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download19515.exe [2009-11-03 20:41:26 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\2928.exe [2009-11-03 20:26:43 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\22894.exe [2009-11-03 17:11:36 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download9881.exe [2009-11-03 17:11:31 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\31053.exe [2009-11-03 13:27:52 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download27975.exe [2009-11-03 13:27:39 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\26154.exe [2009-11-02 19:58:44 | 00,019,968 | ---- | M] () – C:\Documents and Settings\Komputer\download21664.exe [2009-11-02 19:58:40 | 00,021,504 | ---- | M] () – C:\Documents and Settings\Komputer\10232.exe [2009-11-01 17:16:25 | 00,019,968 | ---- | M] () – C:\WINDOWS\c3a5m5p4s2taf2af.exe :Commands [emptytemp] [start explorer]

Run Fix. Restart, jeśli będzie potrzebny.

Potem log z usuwania oraz nowy log robiony opcją Run Scan.

[aiiidzzz]

Zrobiłem tak jak kazałeś proces się nie włączył =P~

pozostały mi jeszcze 2 jakieś zbędne pliki

20194.exe

20790.exe

OTL

Log z usuwania

http://wklej.org/id/206046/

scan

http://wklej.org/id/206052/

Combofix

http://wklej.org/id/206050/

[deFco247]

Masz pozostałości po Jeefo.

W OTL kliknij CleanUp.

Wyłącz i włącz Przywracanie Systemu na wszystkich dyskach. Instrukcja XP.

Wykonaj pełny skan DR WEB CureIt.

Pokaż raport z usuwania.

[aiiidzzz]

Dr.Web Nic nie znalazł

http://wklej.org/id/206210/

to by było na tyle smss.exe poszedł w krainę cyferek

dzięki wielkie =D> :cmok1: