[log] - spyware

**Posty:** 7 · przez **iceice** 09 Lis 2008, 19:06

Czesc mam problem ze spywarem, wyglada to tak ze wyskakuje mi ciagle alert "You have security problem" i zacheca mnie do zainstalowania programu antyvirus 2009 ...jesli moglibyscie na to cos poradzic bylbym wdzieczny

a o to logi nie wiem czemu ale nie moge zainstalowac combofixa cos mi tam pisze ze nie moze zmienic nazwy z combofix na combofix[1]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:06:02, on 2008-11-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Intel\IDU\awServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Intel\IDU\iptray.exe C:\Program Files\Intel\IDU\awtray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\DOCUME~1\Marcin\USTAWI~1\Temp\a.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\DesktopEarth\DesktopEarth.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\DOCUME~1\Marcin\USTAWI~1\Temp\~tmpd.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\YYThro88.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=66020 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66020 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66020 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66020 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66020 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [ipTray.exe] "C:\Program Files\Intel\IDU\iptray.exe" O4 - HKLM\..\Run: [awTray.exe] "C:\Program Files\Intel\IDU\awtray.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSFox] C:\DOCUME~1\Marcin\USTAWI~1\Temp\a.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: DesktopEarth AutoStart.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O15 - Trusted Zone: http://www.mks.com.pl O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15031/CTPID.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Program Files\Intel\IDU\awServ.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Intel(R) Desktop Utilities Service (iHCService) - Unknown owner - C:\Program Files\Intel\IDU\IDUServ.exe (file missing) O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 7463 bytes

**Posty:** 7956 · przez **Magik** 09 Lis 2008, 19:09

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

odpal smitfrauda
specjalne-narzedzia-czyszczace-vt96631.html

i nastepnie sprobuj odpalic combofix

**Posty:** 7 · przez **iceice** 09 Lis 2008, 20:24

hej zastosowalem sie do wskazowek ale cos dlugo juz sprawdza ten sdfix pisze mi zebym byl cierpliwy i sprawdza melware czyli chyba tego trojana tylko ze robi to juz chyba ponad 20 min ...czekac dalej ? czy podjac jakas inna akcje?

Dodano Dzisiaj, 19:34:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Marcin on 2008-11-09 at 18:32 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\DOCUME~1\Marcin\USTAWI~1\Temp\a.exe - Deleted C:\DOCUME~1\Marcin\USTAWI~1\Temp\b.exe - Deleted C:\DOCUME~1\Marcin\USTAWI~1\Temp\c.exe - Deleted C:\WINDOWS\hosts - Deleted C:\WINDOWS\smdat32a.sys - Deleted C:\WINDOWS\system32\h@tkeysh@@k.dll - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Checking Files [/b]: Trojan Files Found: C:\DOCUME~1\Marcin\USTAWI~1\Temp\a.exe - Deleted C:\DOCUME~1\Marcin\USTAWI~1\Temp\b.exe - Deleted C:\DOCUME~1\Marcin\USTAWI~1\Temp\c.exe - Deleted C:\WINDOWS\hosts - Deleted C:\WINDOWS\smdat32a.sys - Deleted C:\WINDOWS\system32\h@tkeysh@@k.dll - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 19:16:33 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:4101e5f4 "s2"=dword:675f2723 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:f7,f6,4c,87,ff,a7,81,e5,ae,d9,c0,d6,99,43,7e,aa,ab,60,d0,c0,ac,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,fd,88,2c,25,1a,6d,40,f0,c5,22,3a,7c,ab,42,b8,1d,03,.. "khjeh"=hex:6d,9b,48,2d,fb,d8,27,dc,27,c4,f5,98,e6,36,2b,5c,4d,27,21,a6,cf,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:1a,68,cf,df,a0,09,f9,26,79,bc,da,cf,55,2e,67,27,23,9b,58,da,e9,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:e9,34,b0,9c,b2,de,e5,a9,86,b8,1b,55,3f,e9,1d,3a,4a,0c,73,f9,d1,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:54,69,ce,37,04,9a,c9,82,a6,b0,3f,cb,3a,65,74,1b,03,b5,81,a1,fd,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:f7,f6,4c,87,ff,a7,81,e5,ae,d9,c0,d6,99,43,7e,aa,ab,60,d0,c0,ac,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,fd,88,2c,25,1a,6d,40,f0,c5,22,3a,7c,ab,42,b8,1d,03,.. "khjeh"=hex:6d,9b,48,2d,fb,d8,27,dc,27,c4,f5,98,e6,36,2b,5c,4d,27,21,a6,cf,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:1a,68,cf,df,a0,09,f9,26,79,bc,da,cf,55,2e,67,27,23,9b,58,da,e9,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:e9,34,b0,9c,b2,de,e5,a9,86,b8,1b,55,3f,e9,1d,3a,4a,0c,73,f9,d1,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:54,69,ce,37,04,9a,c9,82,a6,b0,3f,cb,3a,65,74,1b,03,b5,81,a1,fd,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComputerDescriptions] "A\1A?B?A?A\1B?A?A\1"="GABINET" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\GigaByte\\VGA Utility Manager\\gvupdate.exe"="C:\\Program Files\\GigaByte\\VGA Utility Manager\\gvupdate.exe:*:Enabled:gvupdate" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Soulseek\\slsk.exe"="C:\\Program Files\\Soulseek\\slsk.exe:*:Enabled:SoulSeek" "C:\\Documents and Settings\\Marcin\\Pulpit\\slsk.exe"="C:\\Documents and Settings\\Marcin\\Pulpit\\slsk.exe:*:Enabled:SoulSeek" "C:\\Program Files\\Media Player Classic\\mplayerc.exe"="C:\\Program Files\\Media Player Classic\\mplayerc.exe:*:Enabled:Media Player Classic" "C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer" "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer" "C:\\Program Files\\BitTorrent\\btdownloadgui.exe"="C:\\Program Files\\BitTorrent\\btdownloadgui.exe:*:Enabled:btdownloadgui" "D:\\gry\\joint Operation\\Jointops.exe"="D:\\gry\\joint Operation\\Jointops.exe:*:Enabled:Jointops" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temporary Internet Files\\Content.IE5\\YTUVET6N\\emailpassword[1].exe"="C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temporary Internet Files\\Content.IE5\\YTUVET6N\\emailpassword[1].exe:*:Enabled:emailpassword[1]" "C:\\Program Files\\Bit Lord 1.1\\BitLord.exe"="C:\\Program Files\\Bit Lord 1.1\\BitLord.exe:*:Enabled:BitLord" "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temp\\Rar$EX15.829\\rmDC++0.403D[1]\\rmDC.exe"="C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temp\\Rar$EX15.829\\rmDC++0.403D[1]\\rmDC.exe:*:Enabled:rmDC" "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++" "C:\\Program Files\\America's Army\\System\\ArmyOps.exe"="C:\\Program Files\\America's Army\\System\\ArmyOps.exe:*:Enabled:ArmyOps" "C:\\Program Files\\Kazaa\\kazaa.exe"="C:\\Program Files\\Kazaa\\kazaa.exe:*:Disabled:Kazaa" "C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast" "C:\\Documents and Settings\\Marcin\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"="C:\\Documents and Settings\\Marcin\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopAdver" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent" "D:\\Program Files\\Steam\\steamapps\\tomason_1975\\counter-strike\\hl.exe"="D:\\Program Files\\Steam\\steamapps\\tomason_1975\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\NovaLogic\\Joint Operations Typhoon Rising\\Jointops.exe"="C:\\Program Files\\NovaLogic\\Joint Operations Typhoon Rising\\Jointops.exe:*:Enabled:Jointops" "C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temp\\powerfootball\\PowerFootball-D3D9.exe"="C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temp\\powerfootball\\PowerFootball-D3D9.exe:*:Enabled:PowerFootball-D3D9" "C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temp\\powerfootball\\PowerFootball-OpenGL.exe"="C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temp\\powerfootball\\PowerFootball-OpenGL.exe:*:Enabled:PowerFootball-OpenGL" "C:\\Documents and Settings\\Marcin\\Moje dokumenty\\utorrent.exe"="C:\\Documents and Settings\\Marcin\\Moje dokumenty\\utorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows" "C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temp\\Rar$EX17.407\\age of empires\\age of empires\\age2_x1.exe"="C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temp\\Rar$EX17.407\\age of empires\\age of empires\\age2_x1.exe:*:Enabled:Age of Empires II Expansion" "C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temp\\Rar$EX13.58469\\age of empires\\age of empires\\empires2.exe"="C:\\Documents and Settings\\Marcin\\Ustawienia lokalne\\Temp\\Rar$EX13.58469\\age of empires\\age of empires\\empires2.exe:*:Enabled:Age of Empires II" "C:\\Program Files\\Age of empire\\age of empires\\age of empires\\empires2.EXE"="C:\\Program Files\\Age of empire\\age of empires\\age of empires\\empires2.EXE:*:Enabled:Age of Empires II" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe" "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"="C:\\Program Files\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe:*:Enabled:VoipDiscount" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\WINDOWS\\system32\\muzapp.exe"="C:\\WINDOWS\\system32\\muzapp.exe:*:Enabled:MUZ AOD APP player" "C:\\Westwood\\Dune2000\\DUNE2000.DAT"="C:\\Westwood\\Dune2000\\DUNE2000.DAT:*:Enabled:Dune2000" "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"="C:\\Program Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Thu 8 Nov 2007 56 ..SHR --- "C:\WINDOWS\system32\942CD6B396.sys" Sun 15 Jun 2008 23 A.SH. --- "C:\WINDOWS\system32\ffedaf8_z.dll" Thu 8 Nov 2007 3,350 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Sun 27 Mar 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Fri 9 Sep 2005 952,832 A..H. --- "C:\Documents and Settings\Greg\Pulpit\zaĄczniki mgr\mgr\~WRL0004.tmp" Tue 17 Apr 2007 41,472 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL0905.tmp" Tue 17 Apr 2007 57,344 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL1202.tmp" Tue 17 Apr 2007 42,496 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL1630.tmp" Tue 17 Apr 2007 41,984 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL1675.tmp" Tue 17 Apr 2007 40,960 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL2104.tmp" Tue 17 Apr 2007 40,960 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL2410.tmp" Tue 17 Apr 2007 43,520 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL2684.tmp" Tue 17 Apr 2007 61,952 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL2740.tmp" Tue 17 Apr 2007 40,448 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL3059.tmp" Tue 17 Apr 2007 43,008 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL3427.tmp" Tue 17 Apr 2007 43,520 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL3472.tmp" Tue 17 Apr 2007 59,392 ...H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft\Word\~WRL3770.tmp" Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Marcin\Dane aplikacji\U3\temp\Launchpad Removal.exe" [b]Finished![/b]

**Posty:** 7956 · przez **Magik** 09 Lis 2008, 20:36

mam nadzieje ze robisz to w trybie awaryjnym

daj mu czas, jak bedzie sie pzredluzac odpal smitfrauda

nastepnie
http://www.atribune.org/ccount/click.php?id=4

http://securityresponse.symantec.com/avcenter/FixVundo.exe

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

i nastepnie sprobuj odpalic combofixa

edit
Sfix jest od trojanow :wink:

**Posty:** 7 · przez **iceice** 09 Lis 2008, 22:58

kurcze przeskanowalem tymi wszytkimi programami i nadal jak che zalaczyc tego combofixa pojawia sie błąd " Nie mozesz zmienic nazwy combofix na combofix[1] prosze uzyc innej nazwy najlepiej skladajacej sie z kilku liczb i cyfr"

wyglada na to ze nie ma juz tego wirusa ...ale moge sie mylic

**Posty:** 7956 · przez **Magik** 10 Lis 2008, 01:23

rozumiem ze combofixa sciagasz zlinkow podanych na forum

tak na oko nie da sie nizcego stwierdzic

skan
http://www.kaspersky.com/virusscanner
i
http://www.programosy.pl/program,avg-anti-spyware.html

wklejasz raporty na forum

**Posty:** 7 · przez **iceice** 13 Lis 2008, 19:50

+ Created at: 18:48:13 2008-11-13

Kod: Zaznacz wszystko: + Scan result: C:\Program Files\Altnet -> Adware.Altnet : Ignored. C:\Program Files\Altnet\Download Manager -> Adware.Altnet : Ignored. C:\Program Files\Altnet\My Altnet Shares -> Adware.Altnet : Ignored. C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection -> Adware.Altnet : Ignored. C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\bdcore.so.l.2.cab (incomplete) -> Adware.Altnet : Ignored. C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\plugins.cab.cab -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\ADM25.ADM25 -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\ADM25.ADM25.1 -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\ADM25.ADM25\CurVer -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\ADM4.ADM4 -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\ADM4.ADM4.1 -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\ADM4.ADM4\CurVer -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\AppID\adm.EXE -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\TopSearch.TSLink -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\TopSearch.TSLink.1 -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\TopSearch.TSLink\CLSID -> Adware.Altnet : Ignored. HKLM\SOFTWARE\Classes\TopSearch.TSLink\CurVer -> Adware.Altnet : Ignored. C:\Program Files\INSTAFINK -> Adware.Gator : Ignored. C:\Program Files\INSTAFINK\Cache -> Adware.Gator : Ignored. C:\Program Files\INSTAFINK\Cache\ErrorLog.txt -> Adware.Gator : Ignored. C:\Program Files\INSTAFINK\Cache\NewCfg -> Adware.Gator : Ignored. C:\Program Files\INSTAFINK\Cache\instafinktb0302.cfg -> Adware.Gator : Ignored. C:\Program Files\INSTAFINK\Uninstall.exe -> Adware.Gator : Ignored. HKLM\SOFTWARE\Gator.com -> Adware.Gator : Ignored. HKLM\SOFTWARE\Gator.com\AppInfo -> Adware.Gator : Ignored. HKLM\SOFTWARE\Gator.com\CMEII -> Adware.Gator : Ignored. HKLM\SOFTWARE\Gator.com\Gator -> Adware.Gator : Ignored. HKLM\SOFTWARE\Gator.com\Gator\dyn -> Adware.Gator : Ignored. HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH -> Adware.Gator : Ignored. HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH\_gs -> Adware.Gator : Ignored. HKLM\SOFTWARE\Classes\instafink.INSTAFINK -> Adware.InstaFinder : Ignored. HKLM\SOFTWARE\Classes\instafink.INSTAFINK\Clsid -> Adware.InstaFinder : Ignored. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\INSTAFINK -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38423 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38423\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38423\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38424 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38424\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38424\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38425 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38425\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38425\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38426 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38426\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38426\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38427 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38428 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38428\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38428\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38429 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38429\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38429\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38430 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38431 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38431\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38431\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38432 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38433 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38433\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38433\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38434 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38434\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38434\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38435 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38435\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38435\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38436 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38436\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38436\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38437 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38437\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38437\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38438 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38438\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38438\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38439 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38439\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38439\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38440 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38440\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38440\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38441 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38441\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38441\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38442 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38442\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38442\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38443 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38444 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38444\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38444\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38452 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38452\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38452\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38453 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38453\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38453\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38454 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38454\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38454\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38455 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38455\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38455\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38462 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38462\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38462\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38463 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38463\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38463\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38464 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38469 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38470 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38470\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38470\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38471 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38471\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38471\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38472 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38472\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38472\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38473 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38473\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38473\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38474 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38474\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38474\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38475 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38475\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38475\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38476 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38476\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38476\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38481 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38481\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38481\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38482 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38482\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38482\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38483 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38483\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38483\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38484 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38484\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38484\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38485 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38485\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38485\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38486 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38486\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38486\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38487 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38487\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38487\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38488 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38488\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38488\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38489 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38489\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38489\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38490 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38490\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38490\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38491 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38491\Objects -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Reports\38491\Objects\5 -> Adware.InstaFinder : Ignored. HKU\S-1-5-21-1123561945-1275210071-682003330-1003\Software\INSTAFINK\Stat -> Adware.InstaFinder : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@bwincom.122.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@deloitte.122.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@edsa.122.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@ice.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@livenation.122.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@microsoftwindows.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@msnbc.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@nielsen.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@onet.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@philips.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@sonyeurope.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marek\Cookies\marek@bwincom.122.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marek\Cookies\marek@edsa.122.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marek\Cookies\marek@metacafe.122.2o7[1].txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Marek\Cookies\marek@adbrite[1].txt -> TrackingCookie.Adbrite : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@advertising[2].txt -> TrackingCookie.Advertising : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@atdmt[2].txt -> TrackingCookie.Atdmt : Ignored. C:\Documents and Settings\NetworkService\Cookies\system@atdmt[2].txt -> TrackingCookie.Atdmt : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@connextra[9].txt -> TrackingCookie.Connextra : Ignored. C:\Documents and Settings\Marek\Cookies\marek@connextra[3].txt -> TrackingCookie.Connextra : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignored. C:\Documents and Settings\NetworkService\Cookies\system@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@www.etracker[1].txt -> TrackingCookie.Etracker : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@gamershell[1].txt -> TrackingCookie.Gamershell : Ignored. C:\Documents and Settings\Greg\Cookies\greg@hit.gemius[2].txt -> TrackingCookie.Gemius : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@hit.gemius[2].txt -> TrackingCookie.Gemius : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@hit.gemius[3].txt -> TrackingCookie.Gemius : Ignored. C:\Documents and Settings\Marek\Cookies\marek@hit.gemius[2].txt -> TrackingCookie.Gemius : Ignored. C:\Documents and Settings\NetworkService\Cookies\system@hit.gemius[2].txt -> TrackingCookie.Gemius : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@ehg-accenture.hitbox[1].txt -> TrackingCookie.Hitbox : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@ehg-chrysler.hitbox[2].txt -> TrackingCookie.Hitbox : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@ehg-deltatre.hitbox[2].txt -> TrackingCookie.Hitbox : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@ehg-futurepub.hitbox[1].txt -> TrackingCookie.Hitbox : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@ehg-imageforce.hitbox[1].txt -> TrackingCookie.Hitbox : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@hitbox[1].txt -> TrackingCookie.Hitbox : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@profiles.hitslink[1].txt -> TrackingCookie.Hitslink : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@mediaplex[1].txt -> TrackingCookie.Mediaplex : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@search.msn[1].txt -> TrackingCookie.Msn : Ignored. C:\Documents and Settings\Marek\Cookies\marek@search.msn[2].txt -> TrackingCookie.Msn : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@overture[2].txt -> TrackingCookie.Overture : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@ppms.popularix[2].txt -> TrackingCookie.Popularix : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@questionmarket[2].txt -> TrackingCookie.Questionmarket : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@revsci[1].txt -> TrackingCookie.Revsci : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@serving-sys[1].txt -> TrackingCookie.Serving-sys : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@spylog[1].txt -> TrackingCookie.Spylog : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@tacoda[2].txt -> TrackingCookie.Tacoda : Ignored. C:\Documents and Settings\Greg\Cookies\greg@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Ignored. C:\Documents and Settings\Marek\Cookies\marek@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@web-stat[1].txt -> TrackingCookie.Web-stat : Ignored. C:\Documents and Settings\Marek\Cookies\marek@web-stat[2].txt -> TrackingCookie.Web-stat : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@weborama[1].txt -> TrackingCookie.Weborama : Ignored. C:\Documents and Settings\Marek\Cookies\marek@weborama[1].txt -> TrackingCookie.Weborama : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@m.webtrends[2].txt -> TrackingCookie.Webtrends : Ignored. C:\Documents and Settings\Marek\Cookies\marek@m.webtrends[2].txt -> TrackingCookie.Webtrends : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Ignored. C:\Documents and Settings\Marek\Cookies\marek@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Ignored. C:\Documents and Settings\NetworkService\Cookies\system@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Ignored. C:\Documents and Settings\Marcin\Cookies\marcin@zedo[2].txt -> TrackingCookie.Zedo : Ignored. ::Report end

tym kasperskim jakos mi nie wychodzi skan zawiesza mi sie komp heh

**Posty:** 7956 · przez **Magik** 13 Lis 2008, 19:58

wklej do notatnika

Kod: Zaznacz wszystko: FOLDER:: C:\Program Files\Altnet

>>Plik>>Zapisz jako... >>> CFScript. Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe)

wyszysc cookies i pamiec podreczna IE

a co do rejestru odpal spybot S&D albo Adaware

**Posty:** 7 · przez **iceice** 13 Lis 2008, 22:24

Kod: Zaznacz wszystko: ComboFix 08-11-12.01 - Marcin 2008-11-13 20:39:49.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.203 [GMT 1:00] Uruchomiony z: c:\documents and settings\Marcin\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Marcin\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Altnet c:\program files\Altnet\My Altnet Shares\Bullguard Protection\bdcore.so.l.2.cab (incomplete) c:\program files\Altnet\My Altnet Shares\Bullguard Protection\plugins.cab.cab c:\program files\DITel\mazowieckie2007\images\html\wg\kontimex_2283387_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\marico_2284246_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\meble_targowa_2283485_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\meyer_2284008_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\mitexservice_2291268_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\oficyna_wydawnicza_mh_2284239_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\parkett_2284659_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\ppks_2283949_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\psa_2269597_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\ravbod_2284310_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\rockfin_2273073_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\rubikon_2284380_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\technokabel_1080337_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\urga_2284135_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\volumen_2283415_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\wytwarzanie_transport_2284159_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\zalpol_2283953_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\zeller_plastik_2284147_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wg\zto_2278003_pliki\_desktop.ini c:\program files\DITel\mazowieckie2007\images\html\wl\img_zlogo\_desktop.ini c:\program files\Mozilla Firefox\plugins\npclntax.dll c:\program files\Mozilla Firefox\plugins\NPMyGlSh.dll c:\program files\myglobalsearch c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST c:\program files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL c:\program files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL c:\program files\myglobalsearch\bar\Cache\[u]0[/u]00258D4.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]00275D2.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0028284.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0032915.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]003EF81.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]009AAEA.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]00BDD4A.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]00F3E19.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]01340F4.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0198B10.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]01FD1A1.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0205B62.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]033A1F4.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]05FDBFA.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0782989.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0AEDB4E.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0D2C6EC.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0E6B77A.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]125DD9D c:\program files\myglobalsearch\bar\Cache\[u]0[/u]138883D.bin c:\program files\myglobalsearch\bar\Cache\files.ini c:\program files\myglobalsearch\bar\History\search c:\program files\myglobalsearch\bar\Settings\prevcfg.htm c:\windows\IE4 Error Log.txt c:\windows\smdat32m.sys c:\windows\system32\lsprst7.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-13 do 2008-11-13 ))))))))))))))))))))))))))))))) . 2008-11-13 16:57 . 2008-11-13 16:57 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\Grisoft 2008-11-13 16:56 . 2008-11-13 16:56 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Grisoft 2008-11-13 16:56 . 2007-05-30 13:10 10,872 --a------ c:\windows\system32\drivers\AvgAsCln.sys 2008-11-09 20:05 . 2008-11-09 20:05 <DIR> d-------- C:\VundoFix Backups 2008-11-09 19:47 . 2008-11-09 19:47 3,542 --a------ c:\windows\system32\tmp.reg 2008-11-09 19:46 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe 2008-11-09 19:46 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe 2008-11-09 19:46 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe 2008-11-09 19:46 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe 2008-11-09 19:46 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe 2008-11-09 19:46 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe 2008-11-09 19:46 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe 2008-11-09 19:46 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe 2008-11-09 19:46 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe 2008-11-09 19:46 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe 2008-11-09 18:27 . 2008-11-09 18:27 <DIR> d-------- c:\windows\ERUNT 2008-11-09 18:12 . 2008-11-06 02:03 <DIR> d-------- C:\SDFix 2008-11-09 18:00 . 2008-11-09 18:00 <DIR> dr------- c:\documents and settings\NetworkService\Ulubione 2008-11-09 05:06 . 2008-07-18 22:07 270,880 --a------ c:\windows\system32\mucltui.dll 2008-11-09 05:06 . 2008-07-18 22:07 210,976 --a------ c:\windows\system32\muweb.dll 2008-11-09 05:06 . 2008-07-18 22:07 29,728 --a------ c:\windows\system32\mucltui.dll.mui 2008-11-08 22:32 . 2008-11-08 22:32 58,880 --a------ c:\windows\system32\YYThro88.exe 2008-11-08 18:41 . 2008-11-08 18:41 <DIR> d-------- c:\program files\Microsoft Silverlight 2008-11-08 17:19 . 2008-11-08 17:19 <DIR> d-------- C:\Ekspert Excel ćwiczenia . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-13 19:46 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\DNA 2008-11-13 15:45 --------- d-----w c:\program files\DNA 2008-11-13 07:36 --------- d-----w c:\program files\SokkerViewer 2008-11-11 23:10 --------- d-----w c:\program files\Mozilla Sunbird 2008-11-09 10:23 --------- d-----w c:\program files\Microsoft Works 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 22:42 --------- d-----w c:\program files\eMule 2008-09-30 09:05 --------- d-----w c:\program files\DesktopEarth 2008-09-23 16:35 --------- d-----w c:\program files\Microsoft.NET 2008-09-15 20:07 --------- d-----w c:\program files\NAPI-PROJEKT 2008-01-01 18:52 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2006-11-15 11:25 335,309 ----a-w c:\program files\utorrent.lng 2007-11-08 16:06 56 --sh--r c:\windows\system32\942CD6B396.sys 2008-06-15 19:57 23 --sha-w c:\windows\system32\ffedaf8_z.dll 2007-11-08 16:06 3,350 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-11-12 342336] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PRONoMgrWired"="c:\program files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2004-03-02 86016] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-05-07 172032] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "ipTray.exe"="c:\program files\Intel\IDU\iptray.exe" [2005-12-02 1687552] "awTray.exe"="c:\program files\Intel\IDU\awtray.exe" [2005-12-01 1305600] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-09 289064] "InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-03-24 1294446] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-03 116040] "!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "SoundMan"="SOUNDMAN.EXE" [2004-10-21 c:\windows\SOUNDMAN.EXE] "Skrót do strony właściwości High Definition Audio"="HDAudPropShortcut.exe" [2004-08-12 c:\windows\system32\Hdaudpropshortcut.exe] "AlcWzrd"="ALCWZRD.EXE" [2004-10-21 c:\windows\ALCWZRD.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\Marcin\Menu Start\Programy\Autostart\ DesktopEarth AutoStart.lnk - c:\documents and settings\Marcin\Dane aplikacji\Microsoft\Installer\{DBA5E973-660D-4CBE-A469-F5C37FBF0CE4}\_C1A9BF9D98647632ED5172.exe [2008-09-30 29926] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wincp18.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkp88.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winls28.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winql77.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winrw87.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wintt28.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvp44.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwh22.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winww47.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxi63.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxs01.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GigaByte\\VGA Utility Manager\\gvupdate.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Soulseek\\slsk.exe"= "c:\\Program Files\\Media Player Classic\\mplayerc.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Documents and Settings\\Marcin\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\BitTorrent\\bittorrent.exe"= "c:\\Program Files\\NovaLogic\\Joint Operations Typhoon Rising\\Jointops.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\Age of empire\\age of empires\\age of empires\\empires2.EXE"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9999:UDP"= 9999:UDP:IDU Service UDP Port "2804:TCP"= 2804:TCP:IDU Service TCP Port "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-19 78416] R1 OsaFsLoc;OsaFsLoc;c:\windows\system32\drivers\OsaFsLoc.sys [2005-11-11 12298] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 osaio;osaio;c:\windows\system32\drivers\osaio.sys [2005-06-30 7296] R3 V0260VID;Live! Cam Vista IM;c:\windows\system32\DRIVERS\V0260Vid.sys [2006-11-03 178913] S0 pvcmj;pvcmj;c:\windows\system32\drivers\vscu.sys [ ] S0 Wincp18;Wincp18;c:\windows\system32\Drivers\Wincp18.sys [ ] S0 Winkp88;Winkp88;c:\windows\system32\Drivers\Winkp88.sys [ ] S0 Winls28;Winls28;c:\windows\system32\Drivers\Winls28.sys [ ] S0 Winql77;Winql77;c:\windows\system32\Drivers\Winql77.sys [ ] S0 Winrw87;Winrw87;c:\windows\system32\Drivers\Winrw87.sys [ ] S0 Winsi30;Winsi30;c:\windows\system32\Drivers\Winsi30.sys [ ] S0 Wintt28;Wintt28;c:\windows\system32\Drivers\Wintt28.sys [ ] S0 Winvp44;Winvp44;c:\windows\system32\Drivers\Winvp44.sys [ ] S0 Winwh22;Winwh22;c:\windows\system32\Drivers\Winwh22.sys [ ] S0 Winww47;Winww47;c:\windows\system32\Drivers\Winww47.sys [ ] S0 Winxi63;Winxi63;c:\windows\system32\Drivers\Winxi63.sys [ ] S0 Winxs01;Winxs01;c:\windows\system32\Drivers\Winxs01.sys [ ] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\DRIVERS\k510bus.sys [2006-02-17 58288] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\DRIVERS\k510mdfl.sys [2006-02-17 8336] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\DRIVERS\k510mdm.sys [2006-02-17 94064] S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\k510mgmt.sys [2006-02-17 85408] S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\k510obex.sys [2006-02-17 83344] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26e8f5e6-19be-11db-8893-00111195476f}] \Shell\Auto\command - activexdebugger32.exe f \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f \Shell\explore\Command - activexdebugger32.exe f \Shell\open\Command - activexdebugger32.exe f [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eac6b0be-0014-11dd-9002-00111195476f}] \Shell\AutoRun\command - I:\LaunchU3.exe -a *Newly Created Service* - AVG_ANTI-SPYWARE_DRIVER *Newly Created Service* - AVG_ANTI-SPYWARE_GUARD *Newly Created Service* - PROCEXP90 . Zawartość folderu 'Zaplanowane zadania' 2008-11-13 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] . - - - - USUNIĘTO PUSTE WPISY - - - - SafeBoot-Winsu36.sys SafeBoot-Winuf71.sys ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-13 20:47:44 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-13 20:50:29 ComboFix-quarantined-files.txt 2008-11-13 19:50:25 Przed: 9 039 671 296 bajtów wolnych Po: 12,492,623,872 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 281 --- E O F --- 2008-11-12 18:09:

**Posty:** 7956 · przez **Magik** 13 Lis 2008, 22:33

przeskanuj pliki na virustotal.com i wklej raport

Kod: Zaznacz wszystko: c:\windows\system32\YYThro88.exe c:\windows\system32\ffedaf8_z.dll c:\windows\system32\942CD6B396.sys

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26e8f5e6-19be-11db-8893-00111195476f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eac6b0be-0014-11dd-9002-00111195476f}]

zapisz jako fix.reg i odpal

**Posty:** 7 · przez **iceice** 13 Lis 2008, 23:03

Kod: Zaznacz wszystko: Plik 942CD6B396.sys otrzymany 2008.11.13 22:01:10 (CET)Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.11.14.0 2008.11.13 - AntiVir 7.9.0.31 2008.11.13 - Authentium 5.1.0.4 2008.11.13 - Avast 4.8.1248.0 2008.11.13 - AVG 8.0.0.199 2008.11.13 - BitDefender 7.2 2008.11.13 - CAT-QuickHeal 10.00 2008.11.13 - ClamAV 0.94.1 2008.11.13 - DrWeb 4.44.0.09170 2008.11.13 - eSafe 7.0.17.0 2008.11.13 - eTrust-Vet 31.6.6204 2008.11.11 - Ewido 4.0 2008.11.13 - F-Prot 4.4.4.56 2008.11.12 - F-Secure 8.0.14332.0 2008.11.13 - Fortinet 3.117.0.0 2008.11.13 - GData 19 2008.11.13 - Ikarus T3.1.1.45.0 2008.11.13 - K7AntiVirus 7.10.524 2008.11.13 - Kaspersky 7.0.0.125 2008.11.13 - McAfee 5432 2008.11.13 - Microsoft 1.4104 2008.11.13 - NOD32 3610 2008.11.13 - Norman 5.80.02 2008.11.13 - Panda 9.0.0.4 2008.11.13 - PCTools 4.4.2.0 2008.11.13 - Prevx1 V2 2008.11.13 - Rising 21.03.31.00 2008.11.13 - SecureWeb-Gateway 6.7.6 2008.11.13 - Sophos 4.35.0 2008.11.13 - Sunbelt 3.1.1785.2 2008.11.11 - Symantec 10 2008.11.13 - TheHacker 6.3.1.1.151 2008.11.13 - TrendMicro 8.700.0.1004 2008.11.13 - VBA32 3.12.8.9 2008.11.13 - ViRobot 2008.11.13.1466 2008.11.13 - VirusBuster 4.5.11.0 2008.11.13 - Dodatkowe informacje File size: 56 bytes MD5...: d62f4d2a71c2c899c1fd5726cce025ec SHA1..: b73f023af5d54e9a504524c98ad3cde2beadfa0d SHA256: 299dd0817a02a8d6e630552b0b63866e617d1e766d848ae16d691e82496c76e0 SHA512: 0e5e44f6b1a14b7514129effd406a84bb799b321d5771d5b6563d2b95a83915b<BR>de459f5953eb5e560b524f2e240600838a2f2610b68c90b55c4bdd84a022b8af PEiD..: - TrID..: File type identification<BR>MS Flight Simulator Aircraft Performance Info (100.0%) PEInfo: -

Kod: Zaznacz wszystko: Plik ffedaf8_z.dll otrzymany 2008.11.13 22:04:17 (CET)Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.11.14.0 2008.11.13 - AntiVir 7.9.0.31 2008.11.13 - Authentium 5.1.0.4 2008.11.13 - Avast 4.8.1248.0 2008.11.13 - AVG 8.0.0.199 2008.11.13 - BitDefender 7.2 2008.11.13 - CAT-QuickHeal 10.00 2008.11.13 - ClamAV 0.94.1 2008.11.13 - DrWeb 4.44.0.09170 2008.11.13 - eSafe 7.0.17.0 2008.11.13 - eTrust-Vet 31.6.6204 2008.11.11 - Ewido 4.0 2008.11.13 - F-Prot 4.4.4.56 2008.11.12 - F-Secure 8.0.14332.0 2008.11.13 - Fortinet 3.117.0.0 2008.11.13 - GData 19 2008.11.13 - Ikarus T3.1.1.45.0 2008.11.13 - K7AntiVirus 7.10.524 2008.11.13 - Kaspersky 7.0.0.125 2008.11.13 - McAfee 5432 2008.11.13 - Microsoft 1.4104 2008.11.13 - NOD32 3610 2008.11.13 - Norman 5.80.02 2008.11.13 - Panda 9.0.0.4 2008.11.13 - PCTools 4.4.2.0 2008.11.13 - Prevx1 V2 2008.11.13 - Rising 21.03.31.00 2008.11.13 - SecureWeb-Gateway 6.7.6 2008.11.13 - Sophos 4.35.0 2008.11.13 - Sunbelt 3.1.1785.2 2008.11.11 - Symantec 10 2008.11.13 - TheHacker 6.3.1.1.151 2008.11.13 - TrendMicro 8.700.0.1004 2008.11.13 - VBA32 3.12.8.9 2008.11.13 - ViRobot 2008.11.13.1466 2008.11.13 - VirusBuster 4.5.11.0 2008.11.13 - Dodatkowe informacje File size: 23 bytes MD5...: 83a5b9b85312fdfc459a7aaa3e1a8a5a SHA1..: bb9c9901599339d72f9fd3e7b4fa2c6cf4f3896d SHA256: 3c65266bc8ab4f425c2d39296e751ef36b59adc032e3769e916d397f7f858ba7 SHA512: ea7e799914bd659d86e612c42507275743e171f299a58f8b5ca6453b2ca92463<BR>1cf7d2aea566838bfe824ee10f4ef21a8b93e58d541e6825c180ab9b4d599686 PEiD..: - TrID..: File type identification<BR>Unknown! PEInfo: -

c:\windows\system32\YYThro88.exe
ten plik nie chce mi sie przeskanowac jak go wyszukalem w starcie to mi wyskoczylo ostrzezenie o wirusie

**Posty:** 7956 · przez **Magik** 13 Lis 2008, 23:12

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: c:\windows\system32\YYThro88.exe

zapisz jako CFScript.txt (zapisz by ikonka CFScript.txt była obok ikonki ComboFix.exe) >> Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

usun z dysku recznie folder C: \Qoobox

**Posty:** 7 · przez **iceice** 14 Lis 2008, 12:28

ok zastosowałerm sie

Dzięki serdeczne za pomoc

pozdrawiam

[log] - spyware

[log] - spyware

[log] - spyware

Re: [log] - spyware

[log] - spyware

[log] - spyware

[log] - spyware

Re: [log] - spyware

[log] - spyware

Re: [log] - spyware

[log] - spyware

Re: [log] - spyware

[log] - spyware

Re: [log] - spyware

Kto jest na forum