Wirus

Quenthel · 9 Marzec 2006 18:48

Mialam i mam dalej,gdyz nie wszystkie pliki dalo sie usunac wirusa-trojana downloadera,skasowal mi ponad pol zawartosci dysku c-min cale program files! Antywirus nie moze usunac ani wyleczyc kilku plikow a sciezka jaka podaja tak naprawde nie istnieje.Co powinnam zrobic.Daje loga do sprawdzenia

Logfile of HijackThis v1.99.1 Scan saved at 19:46:50, on 2006-03-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\UXVlbnRoZWw\command.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Instalki\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM…\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [smcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [i downloaded pirated Software from P2P] C:\WINDOWS\system32\0106.exe O4 - HKLM…\Run: [keyboard] c:\keyboard1.exe O4 - HKLM…\Run: [mousepad] C:\mousepad1.exe O4 - HKLM…\Run: [gimmysmileys] c:\gimmysmileys1.exe O4 - HKLM…\RunOnce: [Register urlmon.dll] C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\urlmon.dll O4 - HKLM…\RunOnce: [Register hlink.dll] C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\hlink.dll O4 - HKLM…\RunOnce: [Register oleaut32.dll] C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\oleaut32.dll O4 - HKLM…\RunOnce: [iE 3.0 RegSvr schannel.dll] C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\schannel.dll O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [immr] C:\PROGRA~1\COMMON~1\immr\immrm.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O15 - Trusted Zone: http://www.mks.com.pl O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UXVlbnRoZWw\command.exe (file missing) O23 - Service: ewido security suite control - Unknown owner - C:\Program Files\ewido anti-malware\ewidoctrl.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing) O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing) O23 - Service: Sygate Personal Firewall Pro (SmcService) - Unknown owner - C:\Program Files\Sygate\SPF\smc.exe (file missing)

kuz5 · 9 Marzec 2006 19:34

Usuń: (wszystko oczywiście robisz w trybie awaryjnym z wyłączonym przywracaniem systemu)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com O4 - HKLM…\Run: [i downloaded pirated Software from P2P] C:\WINDOWS\system32\0106.exe O4 - HKLM…\Run: [keyboard] c:\keyboard1.exe O4 - HKLM…\Run: [mousepad] C:\mousepad1.exe O4 - HKLM…\Run: [gimmysmileys] c:\gimmysmileys1.exe O4 - HKCU…\Run: [immr] C:\PROGRA~1\COMMON~1\immr\immrm.exe

Skoś resztki:

Start => Uruchom => wpisz services.msc => zatrzymaj i wyłącz usługi Command Service i Network Monitor następnie odpalasz HijackThis Misc Tools => Delete NT service => wpisz cmdService => Ok i zresetuj komputer.

Pliki na czerwono usun ręcznie z dysku

Te wpisy powinny same zniknąć:

Masz jeszcze na kompie te aplikacje ??

Gutek · 9 Marzec 2006 22:47

Możesz dac po usuwaniu tego co kuz5 napisał jeszcze log z silenta - masz