wirusssssss

[igor198989]

witam jestem tu 1 raz mam taki problem wyskoczyl mi kompunkat ze mam wirusa i w tej samej chwili zminila mi sie tapeta na pulpicie jak chce ja zminic poprostu niemoge;/;/ nawet niemoge wybrac tapete

wchodzac na dysk c sa 2 wirusy usunelem 1 z drugim jes problem ponoiewaz pisze ze program jest uzywany przez inna osobe lub program

prosze o szybka odpowiedz z gory dziekuje

[olej3232]

Znajdź w opcjach programu antywirusoweg coś typu skanuj podczas rozruchu. Zaznacz tą opcję i uruchom kompa ponownie!

[igor198989]

a niemoge skanowac dyskow bez wylaczania komputera bo juz go wlaczylem i wylaczylem ale bez skanowania

[CatchMe]

Wklej logi z HijackThis i ComboFix.

[igor198989]

yyyyyy niewiem o co chodzi ?

[CatchMe]

http://www.forumpc.pl/viewtopic.php?t=11017

http://www.forumpc.pl/viewtopic.php?t=11018

[igor198989]

Logfile of HijackThis v1.99.1

Scan saved at 14:50:22, on 2007-07-13

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:WINDOWSSystem32smss.exe

C:WINDOWSsystem32winlogon.exe

C:WINDOWSsystem32services.exe

C:WINDOWSsystem32lsass.exe

C:WINDOWSsystem32Ati2evxx.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSSystem32svchost.exe

C:WINDOWSsystem32spoolsv.exe

C:WINDOWSsystem32Ati2evxx.exe

C:WINDOWSExplorer.EXE

C:WINDOWSATKKBService.exe

C:Program FilesCommon FilesG DATAAVKProxyAVKProxy.exe

C:Program FilesAntiVirenKit 2006AVKService.exe

C:Program FilesAntiVirenKit 2006AVKWCtl.exe

C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe

C:WINDOWSsystem32HPZipm12.exe

C:Program FilesWinampwinampa.exe

C:Program FilesD-Toolsdaemon.exe

C:WINDOWSsystem32ctfmon.exe

C:Program FilesMessengermsmsgs.exe

C:Program FilesIpwindowsipwins.exe

C:WINDOWSsystem32FNTS~1wuaclt.exe

C:Program FilesF?nts??rvices.exe

C:winstall.exe

C:Program FilesHPDigital Imagingbinhpqtra08.exe

C:WINDOWSsystem32RaConfig.exe

C:Program FilesOperaOpera.exe

C:Program FilesHPDigital ImagingbinhpqSTE08.exe

C:WINDOWSsystem32wuauclt.exe

E:hijackthisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://google.bearshare.com/pl/

R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza

R3 - URLSearchHook: Share_Accelerator_MM - {4596013b-6c31-408b-a266-deae5c086dc2} - C:Program FilesShare_Accelerator_MMtbShar.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:ActiveXAcroIEHelper.dll

O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:Program FilesShoppingReportBin2.0.22ShoppingReport.dll

O2 - BHO: Share_Accelerator_MM - {4596013b-6c31-408b-a266-deae5c086dc2} - C:Program FilesShare_Accelerator_MMtbShar.dll

O2 - BHO: (no name) - {4E3814FF-F669-FBEE-1C67-828DC92082C3} - C:WINDOWSsystem32fwm.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.5.0_09binssv.dll

O3 - Toolbar: Share_Accelerator_MM - {4596013b-6c31-408b-a266-deae5c086dc2} - C:Program FilesShare_Accelerator_MMtbShar.dll

O4 - HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe

O4 - HKLM..Run: [DAEMON Tools-1033] "C:Program FilesD-Toolsdaemon.exe" -lang 1033

O4 - HKLM..RunServices: [winlog] winlog.exe

O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe

O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background

O4 - HKCU..Run: [ipWins] C:Program FilesIpwindowsipwins.exe

O4 - HKCU..Run: [Prra] "C:WINDOWSsystem32FNTS~1wuaclt.exe" -vt yazb

O4 - HKCU..Run: [Lfocp] "C:Program FilesF?nts??rvices.exe"

O4 - HKCU..Run: [Windows installer] C:winstall.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:Readerreader_sl.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imagingbinhpqtra08.exe

O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE

O4 - Global Startup: RaConfig.lnk = C:WINDOWSsystem32RaConfig.exe

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_09binssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_09binssv.dll

O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:Program FilesShoppingReportBin2.0.22ShoppingReport.dll

O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:Program FilesShoppingReportBin2.0.22ShoppingReport.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe

O12 - Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:WINDOWSATKKBService.exe

O23 - Service: AVKProxy - G DATA Software AG - C:Program FilesCommon FilesG DATAAVKProxyAVKProxy.exe

O23 - Service: AVK Service (AVKService) - Unknown owner - C:Program FilesAntiVirenKit 2006AVKService.exe

O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C:Program FilesAntiVirenKit 2006AVKWCtl.exe

O23 - Service: Pml Driver HPZ12 - HP - C:WINDOWSsystem32HPZipm12.exe

hijack this

[CatchMe]

Masz dużo "syfu".

C:Program FilesIpwindowsipwins.exe

C:WINDOWSsystem32FNTS~1wuaclt.exe

C:Program FilesF?nts??rvices.exe

C:winstall.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://google.bearshare.com/pl/

O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:Program FilesShoppingReportBin2.0.22ShoppingReport.dll

O2 - BHO: (no name) - {4E3814FF-F669-FBEE-1C67-828DC92082C3} - C:WINDOWSsystem32fwm.dll

O4 - HKLM..RunServices: [winlog] winlog.exe

O4 - HKCU..Run: [ipWins] C:Program FilesIpwindowsipwins.exe

O4 - HKCU..Run: [Prra] "C:WINDOWSsystem32FNTS~1wuaclt.exe" -vt yazb

O4 - HKCU..Run: [Lfocp] "C:Program FilesF?nts??rvices.exe"

O4 - HKCU..Run: [Windows installer] C:winstall.exe

O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:Program FilesShoppingReportBin2.0.22ShoppingReport.dll

O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:Program FilesShoppingReportBin2.0.22ShoppingReport.dll

USUWANIE:

Zablokuj porty programami WWDC i Seconfig XP

Użyj: http://www.outerinfo.com/OiUninstaller.exe

Użyj: SmitFraudFix z opcji 2 w trybie awaryjnym.

- Log z pracy programu znajduje się tutaj: C:raport.txt - wklej go na forum.

Zastosuj i wklej raporty: VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone

:arrow: Po zabiegach wklejasz logi z ComboFix i HijackThis.

Musisz użyć każdego narzędzia po kolei. Pamiętaj.