witam,

Moj AVG Free Edition wykrywa wirusa Collected.5.L, daje mu usuń (albo przenieś do kosza) i jest to wykonywane, ale za chwile to mi sie znowu pojawia. I caly czas info jest ze wirus wykryty w –> C:\Documents And Setings\user\msdirectx.sys.
Czy ktos zyczliwy moglby mi pomoc? Z gory dziekuje.

Oto moj logfile z hjt:

Logfile of HijackThis v1.99.1
Scan saved at 9:04:49 PM, on 11/20/2005
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\System32\mgabg.exe
C:\WINNT\System32\xpjava.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\PDesk\PDesk.exe
C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINNT\System32\carpserv.exe
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\system32\cmd.exe
C:\Documents and Settings\miro\Pulpit\hjt\hijackthis.exe

R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 – HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
F2 – REG:system.ini: UserInit=userinit.exe,xpjava.exe
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:\WINNT\System32\msdxm.ocx
O4 – HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 – HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 – HKLM\..\Run: [CreativeMixer] C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE /t
O4 – HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 – HKLM\..\Run: [CARPService] carpserv.exe
O4 – HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 – HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 – HKLM\..\Run: [Network Access] winssh.exe
O4 – HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 – HKLM\..\RunServices: [mouse] mouse.exe
O4 – HKLM\..\RunServices: [Network Access] winssh.exe
O4 – HKLM\..\RunServices: [steam] steam.exe
O4 – HKCU\..\Run: [CTFMON.EXE] C:\WINNT\System32\ctfmon.exe
O4 – HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 – Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 – Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:\WINNT\web\related.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:\WINNT\web\related.htm
O12 – Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 – Service: AVG7 Alert Manager Server (Avg7Alrt) – GRISOFT, s.r.o. – C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 – Service: AVG7 Update Service (Avg7UpdSvc) – GRISOFT, s.r.o. – C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 – Service: MGABGEXE – Matrox Graphics Inc. – C:\WINNT\System32\mgabg.exe
O23 – Service: Mouse Hardware Sync (mousehs) – Unknown owner – C:\WINNT\System32\mousehs.exe (file missing)
O23 – Service: PostgreSQL Database Server 8.0 (pgsql–8.0) – PostgreSQL Global Development Group – C:\Program Files\PostgreSQL\8.0\bin\pg_ctl.exe
O23 – Service: Windows HWinfo Loader – Unknown owner – C:\WINNT\iexplre.exe (file missing)

pozdrawiam, miro