Wirus w pamieci operacyjnej

system · 21 Grudzień 2007 18:08

Witam, robilem dzisiaj formata… zainstalowalem avasta… i wykrył mi jakiegos wirusa w pamieci operacyjnej, po czym wyskoczyla inf czy chce ponownie uruchomic, okazalo sie ze nie mam uprawnien, chociaz zarejestrowalem avasta… Daje log :

Logfile of HijackThis v1.99.1 Scan saved at 19:08:24, on 2007-12-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Fortun\Menu Start\Programy\Autostart\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Alwil Software\Avast4\ashSimpl.exe C:\DOCUME~1\Fortun\USTAWI~1\Temp\Rar$EX00.375\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM…\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM…\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM…\Run: [soundMAX] “C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” /tray O4 - HKLM…\Run: [VTTimer] VTTimer.exe O4 - HKLM…\Run: [VTTrayp] VTtrayp.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [Flashget] “C:\Program Files\FlashGet\FlashGet.exe” /min O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - Startup: trzA.tmp O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra ‘Tools’ menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

Ciuci · 21 Grudzień 2007 19:07

Usuń w HJT.

daj log z Conbo Fix

system · 21 Grudzień 2007 20:07

zrobiłem, do tego po skanowaniu w moim komputerze nie moge otworzyć z 2kliku innych partycji oprocz C: moge je otwierac tylko z prawego klik o otwórz…

Log;

ComboFix 07-12-21.4 - Fortun 2007-12-21 21:02:32.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.154 [GMT 1:00] Running from: C:\Documents and Settings\Fortun\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . E:\Autorun.inf F:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2007-11-21 to 2007-12-21 ))))))))))))))))))))))))))))))) . 2007-12-21 19:34 . 2007-12-21 19:45 2007-12-21 19:34 . 2007-12-21 19:51 617 --a------ C:\WINDOWS\wincmd.ini 2007-12-21 19:34 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\UC.PIF 2007-12-21 19:34 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\RAR.PIF 2007-12-21 19:34 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-12-21 19:34 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-12-21 19:34 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-12-21 19:34 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\LHA.PIF 2007-12-21 19:34 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\ARJ.PIF 2007-12-21 18:41 . 2007-12-21 18:41 2007-12-21 18:41 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-12-21 18:41 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-12-21 18:41 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-12-21 18:41 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-12-21 18:41 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-21 18:41 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-21 18:41 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-21 18:41 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-21 18:41 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-21 17:58 . 2007-12-21 17:58 160,344 --a------ C:\WINDOWS\system32\ts.dll 2007-12-21 17:52 . 2007-12-21 17:52 142,848 --a------ C:\WINDOWS\system32\mp4.dll 2007-12-21 17:51 . 2007-12-21 17:51 138,444 --a------ C:\WINDOWS\system32\mkx.dll 2007-12-21 17:51 . 2007-12-21 17:51 79,360 --a------ C:\WINDOWS\system32\mkzlib.dll 2007-12-21 15:58 . 2007-12-21 15:58 2007-12-21 15:58 . 2007-12-21 15:58 2007-12-21 15:58 . 2007-12-21 15:58 2007-12-21 15:51 . 2007-12-21 15:51 2007-12-21 15:51 . 2007-12-21 15:51 185,436 --a------ C:\WINDOWS\system32\CoreAVCDecoder.ax 2007-12-21 15:51 . 2007-12-21 15:51 23,552 --a------ C:\WINDOWS\system32\mkunicode.dll 2007-12-21 15:47 . 2007-12-21 15:47 2007-12-21 15:47 . 2007-12-21 15:47 2007-12-21 15:47 . 2007-02-16 10:54 65,536 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx 2007-12-21 15:47 . 2007-02-16 10:54 49,152 --a------ C:\WINDOWS\system32\QuickTime.qts 2007-12-21 15:37 . 2007-12-21 15:37 2007-12-21 15:16 . 2007-12-21 17:50 2007-12-21 15:16 . 2004-08-03 22:14 359,040 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.flg 2007-12-21 15:13 . 2007-12-21 15:13 1,158 --a------ C:\WINDOWS\mozver.dat 2007-12-21 15:09 . 2004-08-04 01:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-12-21 15:09 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-12-21 15:08 . 2001-08-17 21:13 27,165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys 2007-12-21 15:08 . 2001-08-17 22:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys 2007-12-21 15:08 . 2007-12-21 15:08 0 --a------ C:\WINDOWS\nsreg.dat 2007-12-21 15:07 . 2004-08-04 01:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2007-12-21 15:07 . 2004-08-04 00:07 44,672 --a------ C:\WINDOWS\system32\drivers\UAGP35.SYS 2007-12-21 15:05 . 2007-12-21 14:42 2007-12-21 15:05 . 2007-12-21 15:05 2007-12-21 15:05 . 2007-12-21 15:05 2007-12-21 15:05 . 2007-12-21 14:13 2007-12-21 15:05 . 2007-12-21 15:05 2007-12-21 15:05 . 2007-12-21 15:05 2007-12-21 15:05 . 2007-12-21 15:05 2007-12-21 15:05 . 2007-12-21 15:05 2007-12-21 15:05 . 2007-12-21 15:05 2007-12-21 15:05 . 2007-12-21 15:05 2007-12-21 15:05 . 2007-12-21 18:41 2007-12-21 15:05 . 2007-12-21 14:22 2007-12-21 15:05 . 2007-12-21 14:15 2007-12-21 15:05 . 2007-12-21 15:51 2007-12-21 15:03 . 2007-12-21 14:22 261 --a------ C:\WINDOWS\system32$winnt$.inf 2007-12-21 15:03 . 2007-12-21 14:11 211 —hs---- C:\boot.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-21 14:58 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-12-21 13:46 --------- d-----w C:\Program Files\DivX 2007-12-21 13:44 --------- d-----w C:\Program Files\Ahead 2007-12-21 13:42 --------- d-----w C:\Program Files\Common Files\Nero 2007-12-21 13:41 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2007-12-21 13:40 --------- d-----w C:\Program Files\Common Files\Ahead 2007-12-21 13:35 --------- d-----w C:\Program Files\Gadu-Gadu 2007-12-21 13:35 --------- d-----w C:\Documents and Settings\Fortun\Dane aplikacji\Gadu-Gadu 2007-12-21 13:34 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-21 13:33 --------- d-----w C:\Program Files\S3 2007-12-21 13:31 --------- d-----w C:\Program Files\Analog Devices 2007-12-21 13:28 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-12-21 13:19 --------- d-----w C:\Program Files\microsoft frontpage 2007-12-21 13:17 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-11-14 11:54] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “High Definition Audio Property Page Shortcut”=“HDAShCut.exe” [2004-10-27 15:21 C:\WINDOWS\system32\HdAShCut.exe] “SoundMAXPnP”=“C:\Program Files\Analog Devices\Core\smax4pnp.exe” [2005-05-20 10:11] “SoundMAX”=“C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” [2005-09-07 15:35] “VTTimer”=“VTTimer.exe” [2005-03-08 04:33 C:\WINDOWS\system32\VTTimer.exe] “VTTrayp”=“VTtrayp.exe” [2005-11-01 05:15 C:\WINDOWS\system32\VTTrayp.exe] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50] “Flashget”=“C:\Program Files\FlashGet\FlashGet.exe” [2007-09-25 09:10] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 14:00] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-03 23:44] R3 AEAudioService;AEAudio Service;C:\WINDOWS\system32\drivers\AEAudio.sys [2005-03-04 21:53] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 .

Gutek · 22 Grudzień 2007 00:19

Pobierz program SDFix

system · 22 Grudzień 2007 09:17

SDFix: Version 1.119 Run by Fortun on 2007-12-22 at 10:10 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-22 10:13:21 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … scanning hidden registry entries … [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,… scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] “C:\Program Files\Gadu-Gadu\gg.exe”=“C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny” “C:\Program Files\Skype\Phone\Skype.exe”=“C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype” [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Finished!

Gutek · 22 Grudzień 2007 21:27

Ja nic już nie widzę

filip849 · 2 Maj 2011 09:03

Kolego Avast to najgorszy śmieć

Będzie ci mówił o programach, że to wirus, a wcale tak nie będzie. Będzie próbował usuwać programy, które nie są wirusami.

Mojemu koledze usuną parę gier, które nie były wirusami tylko łączyły się z netem. Avast świruje dlatego, że było włamanie do sieci . Polecam czeskiego antywirusa AVG.

Acorus · 2 Maj 2011 13:21

Odezwał się specjalista.