Aplikacja nie została właściwie zainicjowana

**Posty:** 14 · przez **Bujo** 16 Gru 2008, 00:09

Witam
mam pewien problem z komputerem.Po starcie systemu wyskakuje mi błąd cli.exe o treści Aplikacja nie została własciwie zainicjowana bląd (0xc000007b) i nie mam pojęcia co z tym zrobić.Komp mi strasznie zamula mam prawie non stop 100% zużycia procesora, nie moge zainstalować niektórych programów np. Ygoow , pojawiaja mi się na partycji foldery z róznym cyferkami i literkami.Jakby ktoś mógl mi pomóc o to mój log

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:43:17, on 2008-12-15 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe C:\PROGRA~1\DrWeb\SpiderNT.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\DrWeb\spiderml.exe C:\PROGRA~1\DrWeb\spidernt.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\DrWeb\DRWEBSCD.EXE C:\Windows\wkssvr.exe E:\Programy\daemon\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe E:\Programy\instalki\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: D - {AE5619CA-D637-3A0E-B048-83627B096D00} - C:\WINDOWS\system32\xwr97477.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [VGAUtil] C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [SpIDerMail] "C:\Program Files\DrWeb\spiderml.exe" O4 - HKLM\..\Run: [SpIDerNT] C:\PROGRA~1\DrWeb\spidernt.exe /agent O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [MSN] C:\Windows\wkssvr.exe O4 - HKLM\..\Run: [DrWebScheduler] "C:\Program Files\DrWeb\DRWEBSCD.EXE" O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Programy\daemon\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{119DB209-BDE9-4DC0-8A17-046948CA8590}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\..\{119DB209-BDE9-4DC0-8A17-046948CA8590}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip\..\{119DB209-BDE9-4DC0-8A17-046948CA8590}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS3\Services\Tcpip\..\{119DB209-BDE9-4DC0-8A17-046948CA8590}: NameServer = 194.204.159.1,194.204.152.34 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: SpIDer Guard for Windows NT (spidernt) - Doctor Web, Ltd. - C:\PROGRA~1\DrWeb\SpiderNT.exe -- End of file - 4730 bytes

Z góry dzięki za pomoc i pozdrawiam

**Posty:** 8001 · przez **Okocza** 16 Gru 2008, 16:02

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 14 · przez **Bujo** 16 Gru 2008, 18:27

oto report z SDfixa

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by BujaCzek on 2008-12-16 at 16:55 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\wkssvr.exe - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-16 17:00:21 Windows 5.1.2600 Dodatek Service Pack 3 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 scanning hidden files ... C:\WINDOWS\imsins.BAK 2711 bytes C:\WINDOWS\inf\oem10.inf C:\WINDOWS\inf\oem10.PNF C:\WINDOWS\$NtUninstallKB951978$ C:\WINDOWS\$NtUninstallKB951978$\cscript.exe 147456 bytes executable C:\WINDOWS\$NtUninstallKB951978$\jscript.dll 512000 bytes executable C:\WINDOWS\$NtUninstallKB951978$\scrobj.dll 180224 bytes executable C:\WINDOWS\$NtUninstallKB951978$\scrrun.dll 172032 bytes executable C:\WINDOWS\$NtUninstallKB951978$\spuninst C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe 234360 bytes executable C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.inf 7268 bytes C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.txt 1658 bytes C:\WINDOWS\$NtUninstallKB951978$\spuninst\updspapi.dll 398200 bytes executable C:\WINDOWS\$NtUninstallKB951978$\vbscript.dll 434176 bytes executable C:\WINDOWS\$NtUninstallKB951978$\wscript.exe 163840 bytes executable C:\WINDOWS\$NtUninstallKB951978$\wshext.dll 90112 bytes executable C:\WINDOWS\$NtUninstallKB951978$\wshom.ocx 135168 bytes executable C:\WINDOWS\$NtUninstallKB954459$ C:\WINDOWS\$NtUninstallKB954459$\msxml6.dll 1306624 bytes executable C:\WINDOWS\$NtUninstallKB954459$\spuninst C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe 234360 bytes executable C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.inf 5152 bytes C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.txt 360 bytes C:\WINDOWS\$NtUninstallKB954459$\spuninst\updspapi.dll 398200 bytes executable C:\WINDOWS\LastGood C:\WINDOWS\LastGood\INF C:\WINDOWS\LastGood\INF\oem10.inf 0 bytes C:\WINDOWS\LastGood\INF\oem10.PNF 0 bytes scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 28 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-vga.exe"="C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-vga.exe:*:Enabled:Menu" "\\??\\C:\\WINDOWS\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS\\system32\\winlogon.exe:*:enabled:@shell32.dll,-1" "E:\\Programy\\BitComet\\BitComet.exe"="E:\\Programy\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "E:\\gry\\fm\\fm.exe"="E:\\gry\\fm\\fm.exe:*:Disabled:Football Manager 2009" "E:\\gry\\pes\\pes2009.exe"="E:\\gry\\pes\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: [b]Finished![/b]

Log z Combofixa

Kod: Zaznacz wszystko: ComboFix 08-12-15.05 - BujaCzek 2008-12-16 17:11:51.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.2047.1640 [GMT 1:00] Uruchomiony z: e:\programy\instalki\ComboFix.exe * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-16 do 2008-12-16 ))))))))))))))))))))))))))))))) . 2008-12-16 16:53 . 2008-12-16 16:53 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-12-16 16:51 . 2008-12-16 16:51 <DIR> d-------- c:\windows\ERUNT 2008-12-16 16:46 . 2008-12-16 16:46 <DIR> d-------- C:\32788R22FWJFW.0.tmp 2008-12-16 16:41 . 2008-12-16 17:04 <DIR> d-------- C:\SDFix 2008-12-15 22:13 . 2008-12-15 22:13 <DIR> d-------- c:\windows\system32\pl 2008-12-15 22:06 . 2008-04-14 21:45 2,977,792 -----c--- c:\windows\system32\dllcache\wmploc.dll 2008-12-15 22:03 . 2008-04-14 00:10 10,240 --------- c:\windows\system32\drivers\sffp_mmc.sys 2008-12-15 22:01 . 2006-12-29 00:31 19,569 --a------ c:\windows\[u]0[/u]05578_.tmp 2008-12-15 20:18 . 2008-12-15 22:13 <DIR> d-------- c:\windows\system32\pl-PL 2008-12-15 20:17 . 2008-12-15 20:17 <DIR> d-------- c:\program files\MSBuild 2008-12-15 20:13 . 2008-12-15 20:18 <DIR> d-------- c:\windows\system32\XPSViewer 2008-12-15 20:13 . 2008-12-15 20:13 <DIR> d-------- c:\program files\Reference Assemblies 2008-12-15 18:12 . 2008-12-15 18:12 <DIR> d---s---- c:\documents and settings\BujaCzek\UserData 2008-12-15 18:06 . 2008-12-15 18:06 <DIR> d-------- c:\program files\SystemRequirementsLab 2008-12-13 13:08 . 2008-12-13 13:08 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\KONAMI 2008-12-13 12:34 . 2008-12-13 12:33 27,848,704 --a------ c:\windows\system32\xa683062.exe 2008-12-13 12:34 . 2008-12-13 12:34 27,840,512 --a------ c:\windows\system32\xa706390.exe 2008-12-13 12:34 . 2008-12-13 12:34 27,840,512 --a------ c:\windows\system32\xa703609.exe 2008-12-13 12:33 . 2008-12-13 12:33 27,848,704 --a------ c:\windows\system32\xa673218.exe 2008-12-13 12:33 . 2008-12-13 12:33 27,848,704 --a------ c:\windows\system32\xa646875.exe 2008-12-13 12:33 . 2008-12-13 12:33 27,848,704 --a------ c:\windows\system32\xa644859.exe 2008-12-13 12:30 . 2008-12-13 12:30 27,840,512 --a------ c:\windows\system32\xa499531.exe 2008-12-13 12:30 . 2008-12-13 12:30 27,840,512 --a------ c:\windows\system32\xa494890.exe 2008-12-13 12:28 . 2008-10-16 02:02 3,088,896 -----c--- c:\windows\system32\dllcache\mshtml.dll 2008-12-13 12:28 . 2008-10-16 02:02 1,499,136 -----c--- c:\windows\system32\dllcache\shdocvw.dll 2008-12-13 12:28 . 2008-10-16 02:02 668,672 -----c--- c:\windows\system32\dllcache\wininet.dll 2008-12-13 12:28 . 2008-10-16 02:02 619,520 -----c--- c:\windows\system32\dllcache\urlmon.dll 2008-12-13 12:27 . 2008-12-13 12:27 27,840,512 --a------ c:\windows\system32\xa289953.exe 2008-12-13 12:27 . 2008-12-13 12:27 27,840,512 --a------ c:\windows\system32\xa289921.exe 2008-12-13 12:27 . 2008-12-13 12:27 27,840,512 --a------ c:\windows\system32\xa288328.exe 2008-12-13 12:27 . 2008-12-13 12:27 27,840,512 --a------ c:\windows\system32\xa276843.exe 2008-12-13 12:25 . 2008-12-13 12:25 27,848,704 --a------ c:\windows\system32\xa161125.exe 2008-12-13 12:25 . 2008-12-13 12:25 27,840,512 --a------ c:\windows\system32\xa173203.exe 2008-12-13 12:24 . 2008-12-13 12:24 27,848,704 --a------ c:\windows\system32\xa111875.exe 2008-12-13 12:24 . 2008-12-13 12:24 27,848,704 --a------ c:\windows\system32\xa105062.exe 2008-12-13 00:11 . 2008-12-13 00:11 27,840,512 --a------ c:\windows\system32\xa2220937.exe 2008-12-13 00:11 . 2008-12-13 00:11 27,840,512 --a------ c:\windows\system32\xa2220171.exe 2008-12-12 23:54 . 2008-12-12 23:54 27,840,512 --a------ c:\windows\system32\xa1181250.exe 2008-12-12 23:54 . 2008-12-12 23:54 27,840,512 --a------ c:\windows\system32\xa1177703.exe 2008-12-12 23:54 . 2008-12-12 23:54 176,128 --a------ c:\windows\system32\xwr97477.dll 2008-12-12 23:54 . 2008-12-12 23:54 176,128 --a------ c:\windows\system32\wr97477.dll 2008-12-12 22:34 . 2008-12-12 22:55 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2008-12-12 22:31 . 2008-03-05 15:56 3,786,760 --a------ c:\windows\d3dx9_37.dll 2008-12-12 22:00 . 2004-08-22 16:31 155,136 --a------ c:\windows\system32\drivers\d347bus.sys 2008-12-12 22:00 . 2004-08-22 16:31 5,248 --a------ c:\windows\system32\drivers\d347prt.sys 2008-12-12 21:59 . 2008-12-12 21:59 <DIR> d-------- c:\windows\Downloaded Installations 2008-12-12 17:38 . 2008-12-12 17:39 <DIR> d--h----- c:\program files\Zero G Registry 2008-12-12 17:38 . 2008-12-12 17:38 <DIR> d-------- c:\program files\Sports Interactive 2008-12-12 17:38 . 2008-12-12 17:38 <DIR> d--h----- c:\documents and settings\BujaCzek\InstallAnywhere 2008-12-12 16:32 . 2008-12-12 22:34 <DIR> d-------- c:\documents and settings\BujaCzek\Dane aplikacji\Sports Interactive 2008-12-12 14:57 . 2008-12-12 14:57 421 --a------ c:\windows\ODBC.INI 2008-12-12 14:56 . 2003-06-19 01:31 17,920 --a------ c:\windows\system32\mdimon.dll 2008-12-12 14:35 . 2008-12-12 14:53 <DIR> d-------- c:\windows\SHELLNEW 2008-12-12 14:35 . 2008-12-12 14:35 <DIR> d-------- c:\program files\Microsoft.NET 2008-12-11 16:13 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-12-11 16:09 . 2008-12-16 17:01 1,393 --a------ c:\windows\imsins.BAK 2008-12-11 15:39 . 2008-12-11 15:40 <DIR> d-------- c:\program files\DAEMON Tools Toolbar 2008-12-11 15:26 . 2008-10-03 11:17 247,326 -----c--- c:\windows\system32\dllcache\strmdll.dll 2008-12-10 19:39 . 2008-12-10 19:40 <DIR> d-------- c:\program files\NAPI-PROJEKT 2008-12-09 18:08 . 2008-12-09 18:08 <DIR> d-------- c:\documents and settings\BujaCzek\Dane aplikacji\Media Player Classic 2008-12-09 17:01 . 2008-12-09 17:01 <DIR> d-------- c:\program files\Real Alternative 2008-12-09 17:01 . 2003-03-19 04:14 499,712 --a------ c:\windows\system32\msvcp71.dll 2008-12-09 14:52 . 2008-12-09 14:52 <DIR> d-------- c:\program files\MSXML 4.0 2008-12-09 14:36 . 2008-12-10 13:42 <DIR> d-------- c:\program files\Odkurzacz 2008-12-08 21:12 . 2008-12-08 21:12 <DIR> d-------- c:\program files\Nero 2008-12-08 21:11 . 2008-12-08 21:36 <DIR> d-------- c:\program files\Common Files\Nero 2008-12-08 21:11 . 2008-12-08 21:39 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-07 21:14 . 2008-12-07 21:14 <DIR> d-------- c:\documents and settings\BujaCzek\Dane aplikacji\Gadu-Gadu 2008-12-07 17:35 . 2008-12-07 17:35 <DIR> d-------- c:\program files\Gadu-Gadu 2008-12-07 17:35 . 2008-12-07 21:15 <DIR> d-------- c:\documents and settings\BujaCzek\Gadu-Gadu 2008-12-07 15:45 . 2008-12-09 13:09 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-07 13:23 . 2008-12-07 13:23 4,096 --a------ c:\windows\d3dx.dat 2008-12-07 00:54 . 2008-12-07 00:54 118,784 --a------ c:\windows\system32\ac3acm.acm 2008-12-06 21:45 . 2003-02-28 18:26 139,536 --a------ c:\windows\system32\javaee.dll 2008-12-06 12:43 . 2008-06-14 18:36 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-12-06 12:42 . 2008-08-14 11:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys 2008-12-06 12:41 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2008-12-06 12:40 . 2008-12-06 12:40 <DIR> d-------- c:\documents and settings\BujaCzek\Dane aplikacji\COWON 2008-12-06 12:39 . 2008-08-14 14:26 2,190,464 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-12-06 12:39 . 2008-08-14 14:26 2,146,816 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-12-06 12:39 . 2008-08-14 14:26 2,067,328 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-12-06 12:39 . 2008-08-14 14:26 2,025,472 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-12-06 12:35 . 2008-04-11 20:06 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll 2008-12-06 12:35 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-12-06 12:35 . 2008-05-01 15:37 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll 2008-12-06 12:35 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys 2008-12-06 12:33 . 2008-12-06 12:33 13,730 --a------ c:\windows\system32\wpa.bak 2008-12-06 12:32 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-12-06 12:30 . 2008-12-16 14:52 <DIR> d--h----- c:\windows\$hf_mig$ 2008-12-06 12:25 . 2008-12-06 12:25 <DIR> d-------- c:\documents and settings\BujaCzek\Dane aplikacji\DAEMON Tools 2008-12-06 12:25 . 2008-12-06 12:25 717,296 --a------ c:\windows\system32\drivers\sptd.sys 2008-12-06 12:13 . 2008-09-15 16:27 1,846,656 -----c--- c:\windows\system32\dllcache\win32k.sys 2008-12-06 12:13 . 2008-09-04 17:46 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-12-06 12:02 . 2006-01-19 13:33 422,160 --a------ c:\windows\system32\spider.cpl 2008-12-06 12:02 . 2008-12-06 12:02 9,728 --a----t- c:\windows\system32\DRWEBSP.DLL 2008-12-06 12:02 . 2005-10-17 03:33 5,856 --a------ c:\windows\system32\drivers\drwebnet.sys 2008-12-06 12:01 . 2008-12-16 17:19 <DIR> d-------- c:\windows\system32\Lang 2008-12-06 12:01 . 2008-12-06 12:01 940,794 --a------ c:\windows\system32\LoopyMusic.wav 2008-12-06 12:01 . 2008-12-06 12:01 146,650 --a------ c:\windows\system32\BuzzingBee.wav . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-16 16:19 23,524 ----a-w c:\windows\system32\drivers\GVTDrv.sys 2008-12-16 16:16 21,504 ----a-w c:\windows\system32\svchost.exe 2008-12-16 16:16 1,042,432 ----a-w c:\windows\explorer.exe 2008-12-12 13:49 --------- d-----w c:\program files\DrWeb 2008-12-06 23:54 892,928 ----a-w c:\windows\system32\iconv.dll 2008-12-06 11:32 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-06 10:46 --------- d-----w c:\program files\Realtek 2008-12-06 10:46 --------- d-----w c:\program files\AMD 2008-12-06 10:44 --------- d-----w c:\documents and settings\BujaCzek\Dane aplikacji\ATI 2008-12-06 10:40 --------- d-----w c:\program files\GigaByte 2008-12-06 10:40 --------- d-----w c:\program files\ATI Technologies 2008-12-06 10:38 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-06 10:07 155,995 ----a-w c:\windows\java\Packages\73P7LNLB.ZIP 2008-12-06 10:00 --------- d-----w c:\program files\microsoft frontpage 2008-12-06 09:57 --------- d-----w c:\program files\Usługi online 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 01:02 668,672 ----a-w c:\windows\system32\wininet.dll 2008-10-03 10:17 247,326 ----a-w c:\windows\system32\strmdll.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE5619CA-D637-3A0E-B048-83627B096D00}] 2008-12-12 23:54 176128 --a------ c:\windows\system32\xwr97477.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 22528] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 272384] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1702400] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-03 352256] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-05-04 40960] "VGAUtil"="c:\program files\GigaByte\VGA Utility Manager\G-VGA.exe" [2004-09-17 561152] "SpIDerMail"="c:\program files\DrWeb\spiderml.exe" [2006-11-27 167528] "SpIDerNT"="c:\progra~1\DrWeb\spidernt.exe" [2006-05-02 130048] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "DrWebScheduler"="c:\program files\DrWeb\DRWEBSCD.EXE" [2006-05-10 136704] "DAEMON Tools-1033"="e:\programy\daemon\daemon.exe" [2004-08-22 90112] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe] "RTHDCPL"="RTHDCPL.EXE" [2005-07-13 c:\windows\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 22528] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i263_32.drv [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GigaByte\\VGA Utility Manager\\G-vga.exe"= "e:\\Programy\\BitComet\\BitComet.exe"= "e:\\gry\\pes\\pes2009.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R1 drwebnet;SpIDer Guard boot hook driver for Windows NT;c:\windows\system32\drivers\drwebnet.sys [2008-12-06 5856] R2 SPIDER;SpIDer FS Monitor for Windows NT;\??\c:\progra~1\DrWeb\spider.sys [2008-12-06 310992] R2 spidernt;SpIDer Guard for Windows NT;c:\progra~1\DrWeb\SpiderNT.exe [2008-12-06 130048] R3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2008-12-06 23524] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\autorun.exe . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 LSP: %SystemRoot%\system32\DRWEBSP.DLL TCP: {119DB209-BDE9-4DC0-8A17-046948CA8590} = 194.204.159.1,194.204.152.34 O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd c:\windows\Downloaded Program Files\sysreqlab_srl.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.srtest.com/srl_bin/sysreqlab_srl.cab c:\windows\Downloaded Program Files\sysreqlab.osd . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-16 17:19:16 Windows 5.1.2600 Dodatek Service Pack 3 NTFS detected NTDLL code modification: ZwOpenFile skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(704) c:\windows\system32\DRWEBSP.DLL c:\windows\system32\Ati2evxx.dll - - - - - - - > 'lsass.exe'(760) c:\windows\system32\DRWEBSP.DLL . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-12-16 17:21:12 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-16 16:21:09 Przed: 1 219 457 024 bajtów wolnych Po: 1,254,604,800 bajtów wolnych WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptOut 230 --- E O F --- 2008-12-16 16:02:18

Log z Hijacka

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:26:40, on 2008-12-16 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\DrWeb\SpiderNT.exe C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\DrWeb\spiderml.exe C:\PROGRA~1\DrWeb\spidernt.exe C:\Program Files\DrWeb\DRWEBSCD.EXE E:\Programy\daemon\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE E:\Programy\instalki\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: D - {AE5619CA-D637-3A0E-B048-83627B096D00} - C:\WINDOWS\system32\xwr97477.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [VGAUtil] C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SpIDerMail] "C:\Program Files\DrWeb\spiderml.exe" O4 - HKLM\..\Run: [SpIDerNT] C:\PROGRA~1\DrWeb\spidernt.exe /agent O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [DrWebScheduler] "C:\Program Files\DrWeb\DRWEBSCD.EXE" O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Programy\daemon\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{119DB209-BDE9-4DC0-8A17-046948CA8590}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\..\{119DB209-BDE9-4DC0-8A17-046948CA8590}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip\..\{119DB209-BDE9-4DC0-8A17-046948CA8590}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS3\Services\Tcpip\..\{119DB209-BDE9-4DC0-8A17-046948CA8590}: NameServer = 194.204.159.1,194.204.152.34 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: SpIDer Guard for Windows NT (spidernt) - Doctor Web, Ltd. - C:\PROGRA~1\DrWeb\SpiderNT.exe -- End of file - 4688 bytes

**Posty:** 8001 · przez **Okocza** 16 Gru 2008, 18:35

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: File:: C:\32788R22FWJFW.0.tmp c:\windows\[u]0[/u]05578_.tmp c:\windows\system32\xa683062.exe c:\windows\system32\xa706390.exe c:\windows\system32\xa703609.exe c:\windows\system32\xa673218.exe c:\windows\system32\xa646875.exe c:\windows\system32\xa644859.exe c:\windows\system32\xa499531.exe c:\windows\system32\xa289953.exe c:\windows\system32\xa289921.exe c:\windows\system32\xa288328.exe c:\windows\system32\xa276843.exe c:\windows\system32\xa161125.exe c:\windows\system32\xa173203.exe c:\windows\system32\xa111875.exe c:\windows\system32\xa105062.exe c:\windows\system32\xa2220937.exe c:\windows\system32\xa2220171.exe c:\windows\system32\xa1181250.exe c:\windows\system32\xa1177703.exe c:\windows\system32\xwr97477.dll c:\windows\system32\wr97477.dll c:\windows\system32\xa494890.exe Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE5619CA-D637-3A0E-B048-83627B096D00}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

przeskanuj plik:

c:\windows\java\Packages\73P7LNLB.ZIP

na www.virustotal.com

**Posty:** 14 · przez **Bujo** 16 Gru 2008, 19:23

Nowy Log z Combofixa

Kod: Zaznacz wszystko: ComboFix 08-12-15.05 - BujaCzek 2008-12-16 17:48:55.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.2047.1650 [GMT 1:00] Uruchomiony z: e:\programy\instalki\ComboFix.exe Użyto następujących komend :: c:\documents and settings\BujaCzek\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania * Resident AV is active FILE :: C:\32788R22FWJFW.0.tmp c:\windows\[u]0[/u]05578_.tmp c:\windows\system32\wr97477.dll c:\windows\system32\xa105062.exe c:\windows\system32\xa111875.exe c:\windows\system32\xa1177703.exe c:\windows\system32\xa1181250.exe c:\windows\system32\xa161125.exe c:\windows\system32\xa173203.exe c:\windows\system32\xa2220171.exe c:\windows\system32\xa2220937.exe c:\windows\system32\xa276843.exe c:\windows\system32\xa288328.exe c:\windows\system32\xa289921.exe c:\windows\system32\xa289953.exe c:\windows\system32\xa494890.exe c:\windows\system32\xa499531.exe c:\windows\system32\xa644859.exe c:\windows\system32\xa646875.exe c:\windows\system32\xa673218.exe c:\windows\system32\xa683062.exe c:\windows\system32\xa703609.exe c:\windows\system32\xa706390.exe c:\windows\system32\xwr97477.dll . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\wr97477.dll c:\windows\system32\xa105062.exe c:\windows\system32\xa111875.exe c:\windows\system32\xa1177703.exe c:\windows\system32\xa1181250.exe c:\windows\system32\xa161125.exe c:\windows\system32\xa173203.exe c:\windows\system32\xa2220171.exe c:\windows\system32\xa2220937.exe c:\windows\system32\xa276843.exe c:\windows\system32\xa288328.exe c:\windows\system32\xa289921.exe c:\windows\system32\xa289953.exe c:\windows\system32\xa494890.exe c:\windows\system32\xa499531.exe c:\windows\system32\xa644859.exe c:\windows\system32\xa646875.exe c:\windows\system32\xa673218.exe c:\windows\system32\xa683062.exe c:\windows\system32\xa703609.exe c:\windows\system32\xa706390.exe c:\windows\system32\xwr97477.dll [COLOR=RED] . . . jest zainfekowany!![/COLOR] [COLOR=RED] . . . jest zainfekowany!![/COLOR] [COLOR=RED] . . . jest zainfekowany!![/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-16 do 2008-12-16 ))))))))))))))))))))))))))))))) . 2008-12-16 16:53 . 2008-12-16 16:53 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-12-16 16:51 . 2008-12-16 16:51 <DIR> d-------- c:\windows\ERUNT 2008-12-16 16:46 . 2008-12-16 16:46 <DIR> d-------- C:\32788R22FWJFW.0.tmp 2008-12-16 16:41 . 2008-12-16 17:04 <DIR> d-------- C:\SDFix 2008-12-15 22:13 . 2008-12-15 22:13 <DIR> d-------- c:\windows\system32\pl 2008-12-15 22:06 . 2008-04-14 21:45 2,977,792 -----c--- c:\windows\system32\dllcache\wmploc.dll 2008-12-15 22:03 . 2008-04-14 00:10 10,240 --------- c:\windows\system32\drivers\sffp_mmc.sys 2008-12-15 22:01 . 2006-12-29 00:31 19,569 --a------ c:\windows\[u]0[/u]05578_.tmp 2008-12-15 20:18 . 2008-12-15 22:13 <DIR> d-------- c:\windows\system32\pl-PL 2008-12-15 20:17 . 2008-12-15 20:17 <DIR> d-------- c:\program files\MSBuild 2008-12-15 20:13 . 2008-12-15 20:18 <DIR> d-------- c:\windows\system32\XPSViewer 2008-12-15 20:13 . 2008-12-15 20:13 <DIR> d-------- c:\program files\Reference Assemblies 2008-12-15 18:12 . 2008-12-15 18:12 <DIR> d---s---- c:\documents and settings\BujaCzek\UserData 2008-12-15 18:06 . 2008-12-15 18:06 <DIR> d-------- c:\program files\SystemRequirementsLab 2008-12-13 13:08 . 2008-12-13 13:08 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\KONAMI 2008-12-13 12:28 . 2008-10-16 02:02 3,088,896 -----c--- c:\windows\system32\dllcache\mshtml.dll 2008-12-13 12:28 . 2008-10-16 02:02 1,499,136 -----c--- c:\windows\system32\dllcache\shdocvw.dll 2008-12-13 12:28 . 2008-10-16 02:02 668,672 -----c--- c:\windows\system32\dllcache\wininet.dll 2008-12-13 12:28 . 2008-10-16 02:02 619,520 -----c--- c:\windows\system32\dllcache\urlmon.dll 2008-12-12 22:34 . 2008-12-12 22:55 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2008-12-12 22:31 . 2008-03-05 15:56 3,786,760 --a------ c:\windows\d3dx9_37.dll 2008-12-12 22:00 . 2004-08-22 16:31 155,136 --a------ c:\windows\system32\drivers\d347bus.sys 2008-12-12 22:00 . 2004-08-22 16:31 5,248 --a------ c:\windows\system32\drivers\d347prt.sys 2008-12-12 21:59 . 2008-12-12 21:59 <DIR> d-------- c:\windows\Downloaded Installations 2008-12-12 17:38 . 2008-12-12 17:39 <DIR> d--h----- c:\program files\Zero G Registry 2008-12-12 17:38 . 2008-12-12 17:38 <DIR> d-------- c:\program files\Sports Interactive 2008-12-12 17:38 . 2008-12-12 17:38 <DIR> d--h----- c:\documents and settings\BujaCzek\InstallAnywhere 2008-12-12 16:32 . 2008-12-12 22:34 <DIR> d-------- c:\documents and settings\BujaCzek\Dane aplikacji\Sports Interactive 2008-12-12 14:57 . 2008-12-12 14:57 421 --a------ c:\windows\ODBC.INI 2008-12-12 14:56 . 2003-06-19 01:31 17,920 --a------ c:\windows\system32\mdimon.dll 2008-12-12 14:35 . 2008-12-12 14:53 <DIR> d-------- c:\windows\SHELLNEW 2008-12-12 14:35 . 2008-12-12 14:35 <DIR> d-------- c:\program files\Microsoft.NET 2008-12-11 16:13 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-12-11 16:09 . 2008-12-16 17:01 1,393 --a------ c:\windows\imsins.BAK 2008-12-11 15:39 . 2008-12-11 15:40 <DIR> d-------- c:\program files\DAEMON Tools Toolbar 2008-12-11 15:26 . 2008-10-03 11:17 247,326 -----c--- c:\windows\system32\dllcache\strmdll.dll 2008-12-10 19:39 . 2008-12-10 19:40 <DIR> d-------- c:\program files\NAPI-PROJEKT 2008-12-09 18:08 . 2008-12-09 18:08 <DIR> d-------- c:\documents and settings\BujaCzek\Dane aplikacji\Media Player Classic 2008-12-09 17:01 . 2008-12-09 17:01 <DIR> d-------- c:\program files\Real Alternative 2008-12-09 17:01 . 2003-03-19 04:14 499,712 --a------ c:\windows\system32\msvcp71.dll 2008-12-09 14:52 . 2008-12-09 14:52 <DIR> d-------- c:\program files\MSXML 4.0 2008-12-09 14:36 . 2008-12-10 13:42 <DIR> d-------- c:\program files\Odkurzacz 2008-12-08 21:12 . 2008-12-08 21:12 <DIR> d-------- c:\program files\Nero 2008-12-08 21:11 . 2008-12-08 21:36 <DIR> d-------- c:\program files\Common Files\Nero 2008-12-08 21:11 . 2008-12-08 21:39 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-07 21:14 . 2008-12-07 21:14 <DIR> d-------- c:\documents and settings\BujaCzek\Dane aplikacji\Gadu-Gadu 2008-12-07 17:35 . 2008-12-07 17:35 <DIR> d-------- c:\program files\Gadu-Gadu 2008-12-07 17:35 . 2008-12-07 21:15 <DIR> d-------- c:\documents and settings\BujaCzek\Gadu-Gadu 2008-12-07 15:45 . 2008-12-09 13:09 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-07 13:23 . 2008-12-07 13:23 4,096 --a------ c:\windows\d3dx.dat 2008-12-07 00:54 . 2008-12-07 00:54 118,784 --a------ c:\windows\system32\ac3acm.acm 2008-12-06 21:45 . 2003-02-28 18:26 139,536 --a------ c:\windows\system32\javaee.dll 2008-12-06 12:43 . 2008-06-14 18:36 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-12-06 12:42 . 2008-08-14 11:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys 2008-12-06 12:41 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2008-12-06 12:40 . 2008-12-06 12:40 <DIR> d-------- c:\documents and settings\BujaCzek\Dane aplikacji\COWON 2008-12-06 12:39 . 2008-08-14 14:26 2,190,464 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-12-06 12:39 . 2008-08-14 14:26 2,146,816 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-12-06 12:39 . 2008-08-14 14:26 2,067,328 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-12-06 12:39 . 2008-08-14 14:26 2,025,472 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-12-06 12:35 . 2008-04-11 20:06 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll 2008-12-06 12:35 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-12-06 12:35 . 2008-05-01 15:37 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll 2008-12-06 12:35 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys 2008-12-06 12:33 . 2008-12-06 12:33 13,730 --a------ c:\windows\system32\wpa.bak 2008-12-06 12:32 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-12-06 12:30 . 2008-12-16 14:52 <DIR> d--h----- c:\windows\$hf_mig$ 2008-12-06 12:25 . 2008-12-06 12:25 <DIR> d-------- c:\documents and settings\BujaCzek\Dane aplikacji\DAEMON Tools 2008-12-06 12:25 . 2008-12-06 12:25 717,296 --a------ c:\windows\system32\drivers\sptd.sys 2008-12-06 12:13 . 2008-09-15 16:27 1,846,656 -----c--- c:\windows\system32\dllcache\win32k.sys 2008-12-06 12:13 . 2008-09-04 17:46 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-12-06 12:02 . 2006-01-19 13:33 422,160 --a------ c:\windows\system32\spider.cpl 2008-12-06 12:02 . 2008-12-06 12:02 9,728 --a----t- c:\windows\system32\DRWEBSP.DLL 2008-12-06 12:02 . 2005-10-17 03:33 5,856 --a------ c:\windows\system32\drivers\drwebnet.sys 2008-12-06 12:01 . 2008-12-16 18:19 <DIR> d-------- c:\windows\system32\Lang 2008-12-06 12:01 . 2008-12-06 12:01 940,794 --a------ c:\windows\system32\LoopyMusic.wav 2008-12-06 12:01 . 2008-12-06 12:01 146,650 --a------ c:\windows\system32\BuzzingBee.wav . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-16 17:19 23,524 ----a-w c:\windows\system32\drivers\GVTDrv.sys 2008-12-16 17:16 65,024 ----a-w c:\windows\system32\spoolsv.exe 2008-12-16 17:16 21,504 ----a-w c:\windows\system32\svchost.exe 2008-12-16 17:16 1,042,432 ----a-w c:\windows\explorer.exe 2008-12-12 13:49 --------- d-----w c:\program files\DrWeb 2008-12-06 23:54 892,928 ----a-w c:\windows\system32\iconv.dll 2008-12-06 11:32 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-06 10:46 --------- d-----w c:\program files\Realtek 2008-12-06 10:46 --------- d-----w c:\program files\AMD 2008-12-06 10:44 --------- d-----w c:\documents and settings\BujaCzek\Dane aplikacji\ATI 2008-12-06 10:40 --------- d-----w c:\program files\GigaByte 2008-12-06 10:40 --------- d-----w c:\program files\ATI Technologies 2008-12-06 10:38 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-06 10:07 155,995 ----a-w c:\windows\java\Packages\73P7LNLB.ZIP 2008-12-06 10:00 --------- d-----w c:\program files\microsoft frontpage 2008-12-06 09:57 --------- d-----w c:\program files\Usługi online 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 01:02 668,672 ----a-w c:\windows\system32\wininet.dll 2008-10-03 10:17 247,326 ----a-w c:\windows\system32\strmdll.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll . ((((((((((((((((((((((((((((( snapshot@2008-12-16_17.20.31.92 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-14 21:51:44 57,856 ------w c:\windows\ServicePackFiles\i386\spoolsv.exe + 2008-04-14 21:51:44 65,024 ------w c:\windows\ServicePackFiles\i386\spoolsv.exe - 2008-04-14 21:51:04 188,416 ----a-w c:\windows\system32\accwiz.exe + 2008-04-14 21:51:04 195,584 ----a-w c:\windows\system32\accwiz.exe - 2008-04-14 21:51:10 9,728 ----a-w c:\windows\system32\Com\comrepl.exe + 2008-04-14 21:51:10 16,896 ----a-w c:\windows\system32\Com\comrepl.exe - 2008-04-14 21:51:10 6,144 ----a-w c:\windows\system32\Com\comrereg.exe + 2008-04-14 21:51:10 13,312 ----a-w c:\windows\system32\Com\comrereg.exe - 2008-12-16 16:19:04 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat + 2008-12-16 17:18:29 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat - 2008-12-16 16:19:04 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-12-16 17:18:29 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2008-12-16 16:19:04 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2008-12-16 17:18:29 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat - 2001-10-30 12:00:00 18,432 ----a-w c:\windows\system32\diskperf.exe + 2001-10-30 12:00:00 25,600 ----a-w c:\windows\system32\diskperf.exe - 2008-04-14 21:51:14 17,920 ----a-w c:\windows\system32\dvdupgrd.exe + 2008-04-14 21:51:14 25,088 ----a-w c:\windows\system32\dvdupgrd.exe - 2008-04-14 21:51:18 20,992 ------w c:\windows\system32\faxpatch.exe + 2008-04-14 21:51:18 28,160 ------w c:\windows\system32\faxpatch.exe - 2008-04-14 21:51:18 21,504 ----a-w c:\windows\system32\fontview.exe + 2008-04-14 21:51:18 28,672 ----a-w c:\windows\system32\fontview.exe - 2008-04-14 21:51:20 34,304 ----a-w c:\windows\system32\ie4uinit.exe + 2008-04-14 21:51:20 41,472 ----a-w c:\windows\system32\ie4uinit.exe - 2008-04-14 21:51:22 56,832 ----a-w c:\windows\system32\ipconfig.exe + 2008-04-14 21:51:22 64,000 ----a-w c:\windows\system32\ipconfig.exe - 2008-04-14 21:51:26 1,414,656 ----a-w c:\windows\system32\mmc.exe + 2008-04-14 21:51:26 1,421,824 ----a-w c:\windows\system32\mmc.exe - 2008-04-14 21:51:32 124,928 ----a-w c:\windows\system32\net1.exe + 2008-04-14 21:51:32 132,096 ----a-w c:\windows\system32\net1.exe - 2008-04-14 21:51:36 20,992 ----a-w c:\windows\system32\qprocess.exe + 2008-04-14 21:51:36 28,160 ----a-w c:\windows\system32\qprocess.exe - 2008-04-14 21:51:42 32,866 ------w c:\windows\system32\slrundll.exe + 2008-04-14 21:51:42 41,058 ------w c:\windows\system32\slrundll.exe - 2001-10-30 12:00:00 13,312 ----a-w c:\windows\system32\tcmsetup.exe + 2001-10-30 12:00:00 20,480 ----a-w c:\windows\system32\tcmsetup.exe - 2001-10-30 12:00:00 17,920 ----a-w c:\windows\system32\tsshutdn.exe + 2001-10-30 12:00:00 25,088 ----a-w c:\windows\system32\tsshutdn.exe . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 22528] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 272384] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1702400] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-03 352256] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-05-04 40960] "VGAUtil"="c:\program files\GigaByte\VGA Utility Manager\G-VGA.exe" [2004-09-17 561152] "SpIDerMail"="c:\program files\DrWeb\spiderml.exe" [2006-11-27 167528] "SpIDerNT"="c:\progra~1\DrWeb\spidernt.exe" [2006-05-02 130048] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "DrWebScheduler"="c:\program files\DrWeb\DRWEBSCD.EXE" [2006-05-10 136704] "DAEMON Tools-1033"="e:\programy\daemon\daemon.exe" [2004-08-22 90112] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe] "RTHDCPL"="RTHDCPL.EXE" [2005-07-13 c:\windows\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 22528] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i263_32.drv [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\GigaByte\\VGA Utility Manager\\G-vga.exe"= "e:\\Programy\\BitComet\\BitComet.exe"= "e:\\gry\\pes\\pes2009.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R1 drwebnet;SpIDer Guard boot hook driver for Windows NT;c:\windows\system32\drivers\drwebnet.sys [2008-12-06 5856] R2 SPIDER;SpIDer FS Monitor for Windows NT;\??\c:\progra~1\DrWeb\spider.sys [2008-12-06 310992] R2 spidernt;SpIDer Guard for Windows NT;c:\progra~1\DrWeb\SpiderNT.exe [2008-12-06 130048] R3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2008-12-06 23524] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\autorun.exe . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 LSP: %SystemRoot%\system32\DRWEBSP.DLL TCP: {119DB209-BDE9-4DC0-8A17-046948CA8590} = 194.204.159.1,194.204.152.34 O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd c:\windows\Downloaded Program Files\sysreqlab_srl.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.srtest.com/srl_bin/sysreqlab_srl.cab c:\windows\Downloaded Program Files\sysreqlab.osd . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-16 18:18:43 Windows 5.1.2600 Dodatek Service Pack 3 NTFS detected NTDLL code modification: ZwOpenFile skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(704) c:\windows\system32\DRWEBSP.DLL c:\windows\system32\Ati2evxx.dll - - - - - - - > 'lsass.exe'(760) c:\windows\system32\DRWEBSP.DLL . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe . ************************************************************************** . Czas ukończenia: 2008-12-16 18:21:43 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-16 17:21:37 ComboFix2.txt 2008-12-16 16:21:15 Przed: 1 219 620 864 bajtów wolnych Po: 952,782,848 bajtów wolnych 299 --- E O F --- 2008-12-16 16:02:18

**Posty:** 8001 · przez **Okocza** 16 Gru 2008, 19:27

Kod: Zaznacz wszystko: c:\windows\[u]0[/u]05578_.tmp C:\32788R22FWJFW.0.tmp

pobierz killboxa i usuń te pliki nim..

Okocza napisał(a):przeskanuj plik:

c:\windows\java\Packages\73P7LNLB.ZIP

na www.virustotal.com

wykonane?

**Posty:** 14 · przez **Bujo** 16 Gru 2008, 20:31

tak zeskanowalem i te pliki juz usunelem

**Posty:** 18165 · przez **wojtas** 16 Gru 2008, 20:58

przeskanuj kompa :

http://www.programosy.pl/program,dr-web-cureit.html oraz Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 14 · przez **Bujo** 17 Gru 2008, 19:05

zrobilem ten skan ale nie umiem dodac zalacznika z raportem cos jest nie tak

**Posty:** 8001 · przez **Okocza** 17 Gru 2008, 19:16

Bujo, nie dawaj załącznika tylko wklej w tag 'code'

**Posty:** 14 · przez **Bujo** 18 Gru 2008, 19:02

ten raport ma za duzo wyrazow wiec wzucilem go na speedysare tu masz link
http://www.speedyshare.com/146877784.html

**Posty:** 18165 · przez **wojtas** 18 Gru 2008, 19:31

przeskanuj ten pliki:

E:\Programy\fotoshop\Help\1_14_8_1.html
C:\Program Files\Adobe\Reader 8.0\Reader\HowTo\ENU\version.html

tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

**Posty:** 14 · przez **Bujo** 19 Gru 2008, 01:34

to jest ze strony http://virusscan.jotti.org/ plik version.html tego drugiego nie skanowalem bo to usunelem

Kod: Zaznacz wszystko: Scan taken on 18 Dec 2008 23:30:23 (GMT) A-Squared Found nothing AntiVir Found HTML/Dldr.Iframe.K ArcaVir Found nothing Avast Found HTML:Iframe-gen AVG Antivirus Found nothing BitDefender Found Generic.Virtob.2.C7B4DE8B ClamAV Found HTML.Mefir CPsecure Found W32.W.Mefir.R Dr.Web Found nothing F-Prot Antivirus Found HTML/IFrame F-Secure Anti-Virus Found Worm.Win32.Mefir.p G DATA Found HTML:Iframe-gen Ikarus Found Worm.Win32.Mefir.p Kaspersky Anti-Virus Found Worm.Win32.Mefir.p NOD32 Found Win32/Virut.NAT Norman Virus Control Found HTML/Virut.gen Panda Antivirus Found nothing Sophos Antivirus Found Troj/Fujif-Gen VirusBuster Found nothing VBA32 Found nothing

a to ten sam plik ze strony http://www.virustotal.com/

Kod: Zaznacz wszystko: Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 - - - AntiVir - - HTML/Dldr.Iframe.K Authentium - - HTML/IFrame Avast - - HTML:Iframe-gen AVG - - - BitDefender - - Generic.Virtob.1.C7B4DE8B CAT-QuickHeal - - - ClamAV - - - DrWeb - - - eSafe - - - eTrust-Vet - - HTML/Ofinpa.A Ewido - - - F-Prot - - HTML/IFrame F-Secure - - HTML/Virut.gen Fortinet - - HTML/Iframe.YT!tr Ikarus - - - Kaspersky - - Worm.Win32.Mefir.p McAfee - - - Microsoft - - Exploit:HTML/IframeRef.gen NOD32v2 - - Win32/Virut.NAT Norman - - HTML/Virut.gen Panda - - - Prevx1 - - - Rising - - Trojan.DL.Script.HTML.IeFrame.f Sophos - - - Sunbelt - - - Symantec - - Trojan.Maliframe!html TheHacker - - - VBA32 - - - VirusBuster - - - Webwasher-Gateway - - Script.Dldr.Iframe.K Dodatkowe informacje MD5: 703b624382fa3457e9f9aa8967cbd162 SHA1: e06affcb9329284ced0464b9c5c05acf17f403aa SHA256: e4d0a9f8beef5927b58eb0c9257831c2013968a18ef9521ebcb08baaa812d47f SHA512: 61a77fed6f1f93dba69cb2d11af7a60ca54174aef1462f15eefd7e0797717d6ad90e73b437da7808ad7bc5e79c3d36cd2fd8afd8d8e85d23c4ae0a53bcff9c4e

**Posty:** 18165 · przez **wojtas** 19 Gru 2008, 18:42

wszystkie pliki co wskazał raport usun do kosza i wroc z nowym raportem

**Posty:** 14 · przez **Bujo** 20 Gru 2008, 12:02

to mam usunac ten plik version.html i zrobic skan calego kompa??

**Posty:** 8001 · przez **Okocza** 20 Gru 2008, 12:06

tak, usuń ten plik, zrób scan całego kompa NOD32 on-line lub Kasperskym

**Posty:** 14 · przez **Bujo** 20 Gru 2008, 16:55

http://www.speedyshare.com/558615934.html tu jest link do raportu

**Posty:** 18165 · przez **wojtas** 20 Gru 2008, 18:02

wszystkie pliki co raport wskazał !

**Posty:** 14 · przez **Bujo** 20 Gru 2008, 18:16

tak wszystkie

**Posty:** 18165 · przez **wojtas** 20 Gru 2008, 18:18

jesli je usuniesz wroc z raportem