Logi - Wirus "HELPERMNEW1WINC4" ciągle powraca

Mam wir o nazwie HELPERMNEW1WINC4 jak go skasuje to i tak wraca! Co robić??? szukałam w necie i nic! Za pomoc wielkie dzięki!!

Jeśli wirus jest naprawdę groźny i wykorzystuje jakąś lukę w systemie to pewnie jest na niego jakaś łatka tak jak na Sasera itp.

Przydałby się log z HijackThis na początek. W menedżerze zlokalizuj proces o nazwie "_HELPERMLM4.EXE" , "HELPERMNEW1WINC4.EXE" lub podobnie, jeśli się da zamknij, następnie odszukaj podejrzane pliki np.

%systemdir%\ 00049671.EXE
HELPERMFEE.EXE
HELPERMLM4.EXE
HELPERLMDM.EXE
_HELPERMLM4.EXE
%systemdir%\HELPERMFCEE.EXE
%systemdir%\HELPERLRSYS1.EXE
HELPERLRSYS4.EXE
HELPERLRSYS5.EXE
%systemdir%\HELPERLSSRVC.EXE
%systemdir%\HELPERL1SVCHOST.EXE
HELPERL4SVCHOST.EXE
%systemdir%\HELPERMNEW1WINC.EXE
HELPERMNEWWINC1.EXE
HELPERMNEW1WINC4.EXE

Infekcja może być powiązana z Mailbot.BH dlatego sprawdź czy masz w program files katalog Mailbot.MH i wpis w rejestrze
HKEY_LOCAL_MACHINE \ Software \ Mailbot.BH

Tak czy inaczej czekamy na log z HJT, nie zaszkodzi wcześniej zainstalować coś na spyware np. SpyBot Search&Destroy i przeczyścić.

wykaz z HJT

Logfile of HijackThis v1.99.1
Scan saved at 19:43:02, on 2007-02-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:/WINDOWS/System32/smss.exe
C:/WINDOWS/system32/winlogon.exe
C:/WINDOWS/system32/services.exe
C:/WINDOWS/system32/lsass.exe
C:/WINDOWS/system32/svchost.exe
C:/WINDOWS/System32/svchost.exe
C:/WINDOWS/system32/spoolsv.exe
C:/WINDOWS/Explorer.EXE
D:/Avast4/aswUpdSv.exe
D:/Avast4/ashServ.exe
D:/AVG Anti-Spyware 7.5/guard.exe
C:/Program Files/Kerio/Personal Firewall 4/kpf4ss.exe
C:/WINDOWS/SOUNDMAN.EXE
C:/Program Files/Common Files/Microsoft Shared/VS7Debug/mdm.exe
C:/WINDOWS/TBPanel.exe
C:/WINDOWS/System32/nvsvc32.exe
D:/CyberLink/PowerDVD/PDVDServ.exe
D:/Alcohol Soft/Alcohol 120/StarWind/StarWindService.exe
C:/Program Files/Thomson/SpeedTouch USB/Dragdiag.exe
C:/Program Files/Java/jre1.5.0_08/bin/jusched.exe
C:/Program Files/Google/Google Desktop Search/GoogleDesktop.exe
D:/Avast4/ashDisp.exe
C:/Program Files/Kerio/Personal Firewall 4/kpf4gui.exe
D:/Winamp/winampa.exe
C:/WINDOWS/system32/rundll32.exe
D:/AVG Anti-Spyware 7.5/avgas.exe
C:/Program Files/Google/Google Desktop Search/GoogleDesktopIndex.exe
C:/WINDOWS/system32/ctfmon.exe
C:/Program Files/Kerio/Personal Firewall 4/kpf4gui.exe
C:/Tlen.pl/tlen.exe
C:/Program Files/Google/Google Desktop Search/GoogleDesktopCrawl.exe
C:/WINDOWS/system32/mnew1winc4.exe
D:/Avast4/ashMaiSv.exe
D:/Avast4/ashWebSv.exe
C:/WINDOWS/system32/mnew1winc4.exe
C:/Program Files/Mozilla Firefox/firefox.exe
C:/Documents and Settings/Sylwia Brzezinska/Pulpit/HijackThis.exe

R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Page = about:blank
R0 - HKLM/Software/Microsoft/Internet Explorer/Main,Start Page = [url=http://www.tweaks.pl/open.php?url=http://www.forexmaxi.com]http://www.forexmaxi.com[/url]
R0 - HKLM/Software/Microsoft/Internet Explorer/Search,SearchAssistant = about:blank
R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:/SPYBOT~1/SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:/Program Files/Java/jre1.5.0_08/bin/ssv.dll
O4 - HKLM/../Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM/../Run: [Gainward] C:/WINDOWS/TBPanel.exe /A
O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup
O4 - HKLM/../Run: [nwiz] nwiz.exe /install
O4 - HKLM/../Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM/../Run: [RemoteControl] d:/CyberLink/PowerDVD/PDVDServ.exe
O4 - HKLM/../Run: [DemonStarter] C:/Program Files/PWN/Definicje/Bin/Starter.exe
O4 - HKLM/../Run: [SpeedTouch USB Diagnostics] "C:/Program Files/Thomson/SpeedTouch USB/Dragdiag.exe" /icon
O4 - HKLM/../Run: [SunJavaUpdateSched] C:/Program Files/Java/jre1.5.0_08/bin/jusched.exe
O4 - HKLM/../Run: [Google Desktop Search] "C:/Program Files/Google/Google Desktop Search/GoogleDesktop.exe" /startup
O4 - HKLM/../Run: [avast!] D:/Avast4/ashDisp.exe
O4 - HKLM/../Run: [Nero Pro] neropro.exe
O4 - HKLM/../Run: [mysvcig38] mysvcc.exe
O4 - HKLM/../Run: [WinampAgent] d:/Winamp/winampa.exe
O4 - HKLM/../Run: [NeroFilterCheck] C:/WINDOWS/system32/NeroCheck.exe
O4 - HKLM/../Run: [[url="http://www.download.net.pl/44/BearShare-Free/"]BearShare[/url]] "d:/[url="http://www.download.net.pl/44/BearShare-Free/"]BearShare[/url]/[url="http://www.download.net.pl/44/BearShare-Free/"]BearShare[/url].exe" /pause
O4 - HKLM/../Run: [KernelFaultCheck] %systemroot%/system32/dumprep 0 -k
O4 - HKLM/../Run: [I downloaded pirated Software from P2P ] FIFA Football 2007
O4 - HKLM/../Run: [!AVG Anti-Spyware] "D:/AVG Anti-Spyware 7.5/avgas.exe" /minimized
O4 - HKLM/../RunServices: [Nero Pro] neropro.exe
O4 - HKLM/../RunServices: [mysvcig38] mysvcc.exe
O4 - HKCU/../Run: [CTFMON.EXE] C:/WINDOWS/system32/ctfmon.exe
O4 - HKCU/../Run: [MSMSGS] "C:/Program Files/Messenger/msmsgs.exe" /background
O4 - HKCU/../Run: [lr4newmc] C:/WINDOWS/system32/lrsys4.exe
O4 - HKCU/../Run: [MSl4] C:/WINDOWS/system32/l4svchost.exe
O4 - HKCU/../Run: [lrtsm] C:/WINDOWS/system32/qttsk.exe
O4 - HKCU/../Run: [ssvl1] C:/WINDOWS/system32/lmdm.exe
O4 - HKCU/../Run: [Komunikator] C:/Tlen.pl/tlen.exe
O4 - HKCU/../Run: [mlrnew1c4] C:/WINDOWS/system32/mnew1winc4.exe
O4 - HKCU/../Run: [Gadu-Gadu] "C:/Program Files/Gadu-Gadu/gg.exe" /tray
O4 - Startup: Start Firewall.lnk = C:/WINDOWS/system32/net.exe
O6 - HKCU/Software/Policies/Microsoft/Internet Explorer/Control Panel present
O6 - HKLM/Software/Policies/Microsoft/Internet Explorer/Control Panel present
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:/MICROS~1/Office10/EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/Program Files/Java/jre1.5.0_08/bin/ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/Program Files/Java/jre1.5.0_08/bin/ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:/Program Files/Messenger/msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:/Program Files/Messenger/msmsgs.exe
O17 - HKLM/System/CCS/Services/Tcpip/../{3A38F5E2-81C7-41C9-80FB-33BB4C7B1456}: NameServer = 213.241.79.37 83.238.255.76
O20 - AppInit_DLLs: C:/PROGRA~1/Google/GOOGLE~1/GOEC62~1.DLL
O20 - Winlogon Notify: App Management - C:/WINDOWS/system32/igrtrmgr.dll (file missing)
O20 - Winlogon Notify: Hints - C:/WINDOWS/system32/diconfig.dll (file missing)
O20 - Winlogon Notify: Media Center - C:/WINDOWS/system32/h6n00g5me6.dll (file missing)
O20 - Winlogon Notify: Reliability - C:/WINDOWS/system32/dqcpcsvc.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:/Avast4/aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - D:/Avast4/ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:/Avast4/ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:/Avast4/ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:/AVG Anti-Spyware 7.5/guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:/Program Files/Common Files/InstallShield/Driver/11/Intel 32/IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:/Program Files/Kerio/Personal Firewall 4/kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:/WINDOWS/System32/nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:/Alcohol Soft/Alcohol 120/StarWind/StarWindService.exe
O23 - Service: Sysinfo Helper Service (Sysinfo Helper) - Unknown owner - C:/WINDOWS/System32/sysinfo.exe (file missing)
O23 - Service: Win32 Kernel Update (Win32Kernel) - Unknown owner - C:/WINDOWS/win32host.exe (file missing)
O23 - Service: Windows Binary Reader - Unknown owner - C:/WINDOWS/system32/smsc.exe (file missing)
O23 - Service: ľ2:ˇ/
wů:GźÂˇsiÖ (€?
) - Unknown owner - C:/WINDOWS/loadll.exe (file missing)

Coś jeszcze mam zrobić????