Komp Sie Mnie Nie Slucha :(

[ZIBI_PL]

mam duzy problem. ojciec cos mi nasciagal na kompa. Niemoge wlaczyc zadnego atywirusa (po kliknieciu na ikonke nic sie niedzieje)

Zmienilem nazwe adaware.exe na adaware1.exe i sie wlaczylo. skan pokazal jeden pliczek ale niby go program usunal.

SpyBot wogule sie niewlacza, panda titanium 2005 to samo (jakis blad) niewiem co to moze byc. jakis wirus cyz cos. Wklejam log z HijackThis, moze cos wam to podpowiem bo ja niemam pojecia.

 

Logfile of HijackThis v1.99.1

Scan saved at 21:06:02, on 2005-12-01

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\kbdmexec.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Executive Software\Diskeeper\DkService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe

C:\Program Files\Winamp\winamp.exe

D:\Programy\totalcmd\TOTALCMD.EXE

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

D:\Programy\totalcmd\TOTALCMD.EXE

C:\DOCUME~1\Maniek\USTAWI~1\Temp\_tc\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.udpsoft.com/eye/doc.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: Shell=explorer.exe,kbdmexec.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\kbdmexec.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe

O4 - HKLM\..\Run: [Player ] C:\WINDOWS\system32\kbdmexec.exe

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [Player ] C:\WINDOWS\system32\kbdmexec.exe

O4 - Startup: Diskeeper 9 Professional Edition Registration.lnk = C:\Program Files\Executive Software\Diskeeper\ESIRegister.exe

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{B18B4749-86A4-4D5E-AC7F-E6DE66DA8D68}: NameServer = 194.204.159.1,194.204.152.34

O21 - SSODL: Player Security - {C6878C50-2AD8-478B-A6B0-C2A1FFD3C409} - C:\WINDOWS\system32\winshisn.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[SGJ]

kbdmexec.exe uruchamiany na wszystkie mozliwe sposoby to raczej nie jest cos normalnego w systemie.

[Kolobos]

Zakoncz proces:

C:\WINDOWS\system32\kbdmexec.exe

 

W hijackthis usun:

 

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.udpsoft.com/eye/doc.html

F2 - REG:system.ini: Shell=explorer.exe,kbdmexec.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\kbdmexec.exe

O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe

O4 - HKLM\..\Run: [Player ] C:\WINDOWS\system32\kbdmexec.exe

O4 - HKCU\..\Run: [Player ] C:\WINDOWS\system32\kbdmexec.exe <- usun plik

O21 - SSODL: Player Security - {C6878C50-2AD8-478B-A6B0-C2A1FFD3C409} - C:\WINDOWS\system32\winshisn.dll <- usun plik z dysku.

 

Sciagnij sobie tez ewido i przeskanuj system.

[ULLISSES]

Tryb awaryjny z obsługą sieci, MS AntiSpyware + MKS Online + Personal Antivirus (http://www.free-av.com)

 

Albo ogólnie:

http://forum.purepc.pl/Jak-Skutecznie-odsy...ma-t151728.html