Wirus bumerang

[Gość: Leszek]

Cześć. Mam w systemie backdoor.win32.agobot.gen i nie mogę się go pozbyć.Nie
pomogło nawet format c:. Zainfekowane pliki to winhlpp32.exe i rundl32.exe. Co
robić? Oto mój log

Logfile of HijackThis v1.99.1
Scan saved at 16:43:02, on 2005-03-25
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Home Edition\kav.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Home Edition\kavsvc.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\WINDOWS\SYSTEM32\notepad.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.interia.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
www.eu.microsoft.com/poland/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky
Anti-Virus Home Edition\kav.exe /minimize
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program
Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program
Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\Hewlett-Packard\HP
Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [NvCpl] rundl32.exe
O4 - HKLM\..\RunServices: [NvCpl] rundl32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O17 -
HKLM\System\CCS\Services\Tcpip\..\{2A5A2968-2320-4E29-BFC1-6B0BF57C7EF3}:
NameServer = 213.186.65.75,213.186.65.65
O17 -
HKLM\System\CS1\Services\Tcpip\..\{2A5A2968-2320-4E29-BFC1-6B0BF57C7EF3}:
NameServer = 213.186.65.75,213.186.65.65
O17 -
HKLM\System\CS2\Services\Tcpip\..\{2A5A2968-2320-4E29-BFC1-6B0BF57C7EF3}:
NameServer = 213.186.65.75,213.186.65.65
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky
Lab\Kaspersky Anti-Virus Home Edition\kavsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

[Gość: Kolobos]

Uruchom hijackthis i zaznacz te wpisy:

O4 - HKLM\..\Run: [NvCpl] rundl32.exe
O4 - HKLM\..\RunServices: [NvCpl] rundl32.exe

I Fix Checked.

Zainstaluj sobie SpywareBlaster , SpyBot S&D nie wchodz na podejrzane strony i
nie klikaj na nic w wyskakujacych okienkach.
Do tego masz stara wersje Internet Explorera i brak SP do windowsa wiec odwiedz
www.windowsupdate.com