Powracające trojany - proszę o sprawdzenie loga

**Posty:** 22 · przez **napi100** 05 Sty 2009, 22:01

Witam
Od jakiegoś czasu Avast wykrywa Trojany, mimo opcji "usuń" powracają.
Próbowałem usuwać programem Malwarebytes'Anti-Malware, nie pomogło...
Nie mam pojęcia jak je usunąć, proszę o pomoc.

Log HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:46:52, on 2009-01-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe e:\Program Files\Alwil Software\Avast4\aswUpdSv.exe e:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre6\bin\jusched.exe E:\Program Files\DialNet\winpppoverethernet.exe E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe E:\Program Files\DAEMON Tools Lite\daemon.exe E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\spoolsv.exe E:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe E:\Program Files\Nero 7\InCD\InCDsrv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\svchost.exe e:\Program Files\DialNet\WrOS.EXE e:\Program Files\Alwil Software\Avast4\ashMaiSv.exe e:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe E:\Program Files\Mozilla Firefox\firefox.exe E:\Program Files\Malwarebytes' Anti-Malware\mbam.exe G:\Programy\BEZPIECZEŃSTWO\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - e:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [a-winpoet-service] "e:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [avast!] e:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - e:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - e:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{21720234-8390-45FE-BC02-DB225BE45A2F}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - e:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - e:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - e:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - e:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - E:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Nero 7\InCD\InCDsrv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: DataBases Management Service (msclcosd) - Unknown owner - C:\WINDOWS\system32\msclco.exe O23 - Service: NBService - Nero AG - E:\Program Files\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - e:\Program Files\DialNet\WrOS.EXE -- End of file - 6157 bytes

Log ComboFix

Kod: Zaznacz wszystko: ComboFix 09-01-05.02 - Piotr Michalski 2009-01-05 20:15:10.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.147 [GMT 1:00] Uruchomiony z: c:\documents and settings\Piotr Michalski\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Install.txt . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NOYTCYR -------\Legacy_WSLDOEKD ((((((((((((((((((((((((( Pliki utworzone od 2008-12-05 do 2009-01-05 ))))))))))))))))))))))))))))))) . 2009-01-02 21:26 . 2009-01-03 18:45 386 --a------ c:\windows\QTW.ini 2009-01-02 15:50 . 2009-01-04 16:08 54,156 --ah----- c:\windows\QTFont.qfn 2009-01-02 15:50 . 2009-01-02 15:50 1,409 --a------ c:\windows\QTFont.for 2008-12-31 20:14 . 2008-12-31 20:14 <DIR> d-------- c:\program files\Google 2008-12-22 17:57 . 2008-12-22 18:45 <DIR> d-------- c:\documents and settings\Piotr Michalski\Dane aplikacji\IcoFX 2008-12-20 15:39 . 2008-12-20 15:39 <DIR> d-------- c:\documents and settings\Piotr Michalski\Dane aplikacji\TrojanHunter 2008-12-20 15:35 . 2008-12-20 15:43 <DIR> d-------- c:\program files\TrojanHunter 5.0 2008-12-20 09:40 . 2008-12-20 16:20 4,005,920 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-12-20 09:40 . 2008-12-20 16:20 52,196 --ahs---- c:\windows\system32\drivers\fidbox.idx . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2060-08-18 17:02 1,496,064 ------w c:\windows\system32\CC3250MT.DLL 2060-08-18 16:40 909,824 ------w c:\windows\system32\cp3245mt.dll 2060-08-18 16:40 24,064 ------w c:\windows\system32\borlndmm.dll 2009-01-04 16:43 --------- d-----w c:\documents and settings\Piotr Michalski\Dane aplikacji\Azureus 2009-01-03 17:52 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-03 17:51 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-15 15:35 --------- d-----w c:\program files\Bonjour 2008-12-03 18:52 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2008-12-03 18:52 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2008-12-03 11:53 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-12-03 11:53 --------- d-----w c:\program files\Java 2008-11-30 11:33 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Malwarebytes 2008-11-30 11:33 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\DivX 2008-11-30 11:04 --------- d-----w c:\documents and settings\Piotr Michalski\Dane aplikacji\Malwarebytes 2008-11-30 11:03 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2008-11-30 10:09 --------- d-----w c:\program files\SkanerOnline 2008-11-25 20:26 --------- d-----w c:\documents and settings\Piotr Michalski\Dane aplikacji\DivX 2008-11-10 07:45 --------- d-----w c:\documents and settings\Piotr Michalski\Dane aplikacji\PC Suite 2008-11-09 17:00 102,400 ----a-w c:\windows\DUMP6f73.tmp 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx0c.dll 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx07.dll 2008-10-28 22:35 815,104 ----a-w c:\windows\system32\divx_xx0a.dll 2008-10-28 22:35 802,816 ----a-w c:\windows\system32\divx_xx11.dll 2008-10-28 22:35 684,032 ----a-w c:\windows\system32\DivX.dll 2008-09-28 08:26 24,432 ----a-w c:\documents and settings\Piotr Michalski\Dane aplikacji\GDIPFONTCACHEV1.DAT 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "DAEMON Tools Lite"="e:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-17 490952] "SpybotSD TeaTimer"="e:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-03 136600] "a-winpoet-service"="e:\program files\DialNet\winpppoverethernet.exe" [2007-07-06 405504] "avast!"="e:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "QuickTime Task"="e:\program files\QuickTime\qttask.exe" [2008-11-16 155648] "AtiPTA"="atiptaxx.exe" [2004-11-12 c:\windows\system32\atiptaxx.exe] "Resume copy"="copyfstq.exe" [2008-07-16 c:\windows\copyfstq.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.l3codec"= l3codecp.acm "VIDC.I420"= i420vfw.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\BlueSoleil.lnk backup=c:\windows\pss\BlueSoleil.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^InterVideo WinCinema Manager.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\InterVideo WinCinema Manager.lnk backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-01-15 15:14 147456 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2006-12-08 09:56 1053184 e:\program files\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2004-06-16 05:03 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2004-06-16 05:03 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-03-23 12:20 227328 e:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-11-16 18:15 155648 e:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-07-16 13:14 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --------- 2001-05-29 10:02 124416 c:\windows\soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Reader Speed Launcher"="e:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "e:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-16 111184] R3 FPD;Fine Point Packet Service;c:\windows\system32\drivers\fpd.sys [2008-07-16 30336] R3 WrKPoET2000;WrKPoET2000;e:\program files\DialNet\WrKPoET2000.sys [2008-07-16 52214] R3 WRSWanDD;WinPoET PPPoE Adapter;c:\windows\system32\drivers\WrKPoETNic2000.sys [2008-07-16 65604] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-07-16 20560] R4 TopWinPoETDriver;WinPoET PPPoE Optimized Driver;c:\windows\system32\drivers\WrKPoET2000.sys [2008-07-16 52214] S3 utezotiz;AVZ Kernel Driver;\??\c:\windows\system32\Drivers\utezotiz.sys --> c:\windows\system32\Drivers\utezotiz.sys [?] --- Other Services/Drivers In Memory --- *Deregistered* - InCDrec *Deregistered* - msclcosd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87b28fb1-6bb6-11dd-912e-00030d000001}] \Shell\AutoRun\command - N:\InstallTomTomHOME.exe . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ IE: E&ksport do programu Microsoft Excel - e:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000 c:\windows\Downloaded Program Files\ewidoOnlineScan.dll - O16 -: {193C772A-87BE-4B19-A7BB-445B226FE9A1} hxxp://downloads.ewido.net/ewidoOnlineScan.cab c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} hxxp://www.mks.com.pl/skaner/SkanerOnline.cab c:\windows\Downloaded Program Files\SkanerOnline.inf FF - ProfilePath - c:\documents and settings\Piotr Michalski\Dane aplikacji\Mozilla\Firefox\Profiles\6k5wh9x4.default\ FF - plugin: e:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF - plugin: e:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll FF - plugin: e:\program files\DivXWEB\DivX Player\npDivxPlayerPlugin.dll FF - plugin: e:\program files\DivXWEB\DivX Web Player\npdivx32.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin2.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin3.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin4.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin5.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin6.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin7.dll FF - plugin: e:\program files\Real\RealPlayer\Netscape6\nppl3260.dll FF - plugin: e:\program files\Real\RealPlayer\Netscape6\nprjplug.dll FF - plugin: e:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-05 20:21:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(676) c:\windows\system32\Ati2evxx.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe e:\program files\Alwil Software\Avast4\aswUpdSv.exe e:\program files\Alwil Software\Avast4\ashServ.exe c:\windows\system32\ati2evxx.exe e:\program files\IVT Corporation\BlueSoleil\BTNtService.exe e:\program files\Nero 7\InCD\InCDsrv.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\windows\system32\wdfmgr.exe e:\program files\DialNet\WrOS.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-01-05 20:24:42 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-01-05 19:24:37 Przed: 4 439 756 800 bajtów wolnych Po: 4,419,280,896 bajtów wolnych 191

Log Awast

Kod: Zaznacz wszystko: 2008-12-01 09:40:05 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\EM170RIS\msusd[1].bin" file. 2008-12-01 09:44:22 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnhoed.exe" file. 2008-12-01 09:58:39 SYSTEM 1380 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\EM170RIS\msusd[2].bin" file. 2008-12-01 09:59:34 SYSTEM 1380 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnhoed.exe" file. 2008-12-01 15:59:49 SYSTEM 1380 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnhoed.exe" file. 2008-12-02 14:10:00 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\EM170RIS\msusd[3].bin" file. 2008-12-02 14:10:38 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnhoed.exe" file. 2008-12-02 20:10:58 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnhoed.exe" file. 2008-12-03 07:42:45 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msckco.exe" file. 2008-12-03 10:17:26 SYSTEM 1384 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msckco.exe" file. 2008-12-03 10:54:27 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msckco.exe" file. 2008-12-04 14:38:39 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msckco.exe" file. 2008-12-06 17:13:31 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\msuse[1].bin" file. 2008-12-06 17:19:49 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-06 23:20:03 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-07 08:11:28 SYSTEM 1420 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-07 14:12:45 SYSTEM 1420 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-07 20:13:13 SYSTEM 1420 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-08 17:32:53 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-09 16:58:12 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-10 16:41:57 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-14 13:17:27 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\MRPDUZDA\w[1].bin" file. 2008-12-14 13:17:55 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_165081224508.bk" file. 2008-12-14 13:18:13 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\w[1].bin" file. 2008-12-14 13:18:26 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_569397283511.bk" file. 2008-12-14 13:18:48 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\TDXREHW7\w[1].bin" file. 2008-12-14 13:18:58 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_844011583356.bk" file. 2008-12-14 13:19:16 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_547033614990.bk" file. 2008-12-14 13:19:31 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\EM170RIS\w1[1].bin" file. 2008-12-14 13:19:41 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_72783163.bk" file. 2008-12-14 13:19:56 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\MRPDUZDA\w1[1].bin" file. 2008-12-14 13:20:04 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_667209748754.bk" file. 2008-12-14 13:20:24 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\w1[1].bin" file. 2008-12-14 13:20:33 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_880751132736.bk" file. 2008-12-14 13:20:53 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_350004400796.bk" file. 2008-12-14 13:21:12 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\TDXREHW7\w2[1].bin" file. 2008-12-14 13:21:32 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_574585780681.bk" file. 2008-12-14 13:21:59 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\EM170RIS\w2[1].bin" file. 2008-12-14 13:22:10 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_681750140279.bk" file. 2008-12-14 13:22:34 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_424257481187.bk" file. 2008-12-14 13:23:11 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_163140492493.bk" file. 2008-12-14 13:23:26 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_51671680201.bk" file. 2008-12-14 13:23:53 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_567617146336.bk" file. 2008-12-14 13:24:12 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_84343947772.bk" file. 2008-12-14 13:24:26 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_783398418404.bk" file. 2008-12-14 13:24:39 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_33673244024.bk" file. 2008-12-14 13:26:08 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_772756706941.bk" file. 2008-12-14 13:26:48 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_900486865491.bk" file. 2008-12-14 13:27:02 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_578354746879.bk" file. 2008-12-14 13:27:25 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_562278216379.bk" file. 2008-12-14 13:27:52 SYSTEM 1352 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_576041601872.bk" file. 2008-12-14 13:44:33 SYSTEM 1404 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-14 19:44:52 SYSTEM 1404 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-15 16:18:39 SYSTEM 1388 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-16 10:10:13 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-16 17:26:24 SYSTEM 1420 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-17 16:59:35 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-18 17:36:50 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-18 23:37:09 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-19 12:40:00 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-19 13:12:49 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-19 17:03:01 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-20 09:29:43 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-20 10:10:45 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\E2Z0DJ70\abtest[1].jpg" file. 2008-12-20 13:31:33 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\udxfytw.sys" file. 2008-12-20 15:30:42 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\msuse[1].bin" file. 2008-12-20 15:31:11 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-20 18:49:39 SYSTEM 1384 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-21 00:50:00 SYSTEM 1384 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-21 06:50:42 SYSTEM 1384 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-21 15:22:36 SYSTEM 1384 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-21 21:23:07 SYSTEM 1384 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-23 17:13:10 SYSTEM 1388 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-23 23:16:15 SYSTEM 1388 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-26 21:42:40 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-27 08:47:18 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-27 14:47:32 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-27 22:15:36 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-28 19:47:31 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-29 11:34:22 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-29 17:34:50 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-29 23:35:25 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-30 05:35:57 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-30 17:01:19 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-30 23:02:05 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-31 17:46:43 SYSTEM 1424 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2008-12-31 23:40:56 SYSTEM 1424 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-01 05:34:35 SYSTEM 1424 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-01 15:32:56 SYSTEM 1424 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-01 21:33:27 SYSTEM 1424 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-01 23:16:46 SYSTEM 1388 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-02 14:10:14 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-02 20:10:32 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-03 02:11:03 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-03 13:33:07 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-03 19:33:28 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-05 10:08:44 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\EM170RIS\w[1].bin" file. 2009-01-05 10:09:25 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_410517480354.bk" file. 2009-01-05 10:09:45 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\EM170RIS\w[2].bin" file. 2009-01-05 10:09:57 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_64235010387.bk" file. 2009-01-05 10:10:35 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\w[1].bin" file. 2009-01-05 10:10:44 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_53381246982.bk" file. 2009-01-05 10:11:05 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_804854384078.bk" file. 2009-01-05 10:11:19 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\TDXREHW7\w1[1].bin" file. 2009-01-05 10:11:30 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_75154353181.bk" file. 2009-01-05 10:11:46 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\MRPDUZDA\w1[1].bin" file. 2009-01-05 10:11:57 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_726696288972.bk" file. 2009-01-05 10:13:11 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\MRPDUZDA\w1[2].bin" file. 2009-01-05 10:13:23 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_37260928985.bk" file. 2009-01-05 10:13:43 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_207833567045.bk" file. 2009-01-05 10:13:58 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\w2[1].bin" file. 2009-01-05 10:14:07 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_62956471046.bk" file. 2009-01-05 10:14:36 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\w2[2].bin" file. 2009-01-05 10:14:59 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_848299253953.bk" file. 2009-01-05 10:15:33 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_6639539319.bk" file. 2009-01-05 10:16:16 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_304163701101.bk" file. 2009-01-05 10:16:40 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_864411729103.bk" file. 2009-01-05 10:17:12 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_38769358503.bk" file. 2009-01-05 10:17:31 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_515285385853.bk" file. 2009-01-05 10:17:36 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\tpszxyd.sys" file. 2009-01-05 10:17:36 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\tpszxyd.sys" file. 2009-01-05 10:17:36 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_833228313464.bk" file. 2009-01-05 10:31:59 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\tpszxyd.sys" file. 2009-01-05 10:36:24 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\EM170RIS\w[3].bin" file. 2009-01-05 10:48:38 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_534374486183.bk" file. 2009-01-05 10:48:55 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\MRPDUZDA\w[1].bin" file. 2009-01-05 10:52:09 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_196447256959.bk" file. 2009-01-05 10:57:53 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\w[2].bin" file. 2009-01-05 10:58:45 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_5302443247.bk" file. 2009-01-05 10:59:03 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_200537267840.bk" file. 2009-01-05 10:59:08 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\tpszxyd.sys" file. 2009-01-05 10:59:08 SYSTEM 1392 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\tpszxyd.sys" file. 2009-01-05 12:20:29 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\tpszxyd.sys" file. 2009-01-05 12:21:10 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\EM170RIS\w[4].bin" file. 2009-01-05 12:21:20 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_422510880144.bk" file. 2009-01-05 12:21:37 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\MRPDUZDA\w[2].bin" file. 2009-01-05 12:21:47 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_895293516822.bk" file. 2009-01-05 12:22:08 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\w[3].bin" file. 2009-01-05 12:22:18 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_65003226330.bk" file. 2009-01-05 12:22:39 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_127392559535.bk" file. 2009-01-05 12:22:53 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\TDXREHW7\w1[2].bin" file. 2009-01-05 12:23:05 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_340216544591.bk" file. 2009-01-05 12:23:22 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\w1[1].bin" file. 2009-01-05 12:23:30 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_541370202326.bk" file. 2009-01-05 12:23:49 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\MRPDUZDA\w1[3].bin" file. 2009-01-05 12:23:59 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_880704808709.bk" file. 2009-01-05 12:24:19 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_494327747287.bk" file. 2009-01-05 12:24:34 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\w2[3].bin" file. 2009-01-05 12:24:45 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_603647227259.bk" file. 2009-01-05 12:25:11 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\TDXREHW7\w2[1].bin" file. 2009-01-05 12:25:20 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_54964193664.bk" file. 2009-01-05 12:25:39 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_42953361052.bk" file. 2009-01-05 12:26:26 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_541133534259.bk" file. 2009-01-05 12:27:05 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_576692717911.bk" file. 2009-01-05 12:27:22 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_653196115875.bk" file. 2009-01-05 12:27:40 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_746112349296.bk" file. 2009-01-05 12:27:51 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_313848694052.bk" file. 2009-01-05 12:28:02 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_306240403736.bk" file. 2009-01-05 12:28:19 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_11466048228.bk" file. 2009-01-05 12:28:36 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_870225599515.bk" file. 2009-01-05 12:28:47 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_96750473535.bk" file. 2009-01-05 12:29:13 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_4932559318.bk" file. 2009-01-05 12:29:30 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp5_211964631728.bk" file. 2009-01-05 12:30:14 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp0_108118777826.bk" file. 2009-01-05 12:30:25 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp1_627937479070.bk" file. 2009-01-05 12:30:40 SYSTEM 1384 Sign of "Win32:Refpron-C [Trj]" has been found in "C:\WINDOWS\TEMP\tmp3_82555140455.bk" file. 2009-01-05 18:37:21 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\msuse[4].bin" file. 2009-01-05 18:39:10 SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\msnloed.exe" file. 2009-01-05 19:51:14 SYSTEM 1392 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Y0S4I9DM\msuse[4].bin" file.

Dziękuję za pomoc.

**Posty:** 18165 · przez **wojtas** 05 Sty 2009, 22:19

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 22 · przez **napi100** 06 Sty 2009, 23:04

Wszystko zrobione oprócz skanu online

Mimo wielu prób skaner zawiesza się a na dolnym pasku wyskakuję info "Błąd na stronie"...

Załączam log z FixIEDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.7238 * * * ******************************************************************************** Created at 21:42:04 on Tuesday, January 06, 2009 Time Zone : Logged On User : Piotr Michalski Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Procesor Intel Celeron System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 9.52 GB System Drive Free : 4.66 GB Total Physical Memory: 511 MB Free Physical Memory : 245 MB Total Page File : 511 MB Free Page File : 864 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1972 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

i HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:00:01, on 2009-01-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe e:\Program Files\Alwil Software\Avast4\aswUpdSv.exe e:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE E:\Program Files\DialNet\winpppoverethernet.exe E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe E:\Program Files\DAEMON Tools Lite\daemon.exe E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe G:\Programy\BEZPIECZEŃSTWO\HijackThis\HijackThis.exe E:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe E:\Program Files\Nero 7\InCD\InCDsrv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\mabidwe.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\soxpeca.exe C:\WINDOWS\system32\svchost.exe e:\Program Files\DialNet\WrOS.EXE e:\Program Files\Alwil Software\Avast4\ashMaiSv.exe e:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\wuauclt.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - e:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [a-winpoet-service] "e:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [avast!] e:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - e:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - e:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - e:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - e:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - e:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - e:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - E:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Nero 7\InCD\InCDsrv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: mabidwe Service (mabidwe) - Unknown owner - C:\WINDOWS\system32\mabidwe.exe O23 - Service: DataBases Management Service (msclcosd) - Unknown owner - C:\WINDOWS\system32\msclco.exe O23 - Service: NBService - Nero AG - E:\Program Files\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: soxpeca Service (soxpeca) - Unknown owner - C:\WINDOWS\system32\soxpeca.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - e:\Program Files\DialNet\WrOS.EXE -- End of file - 5960 bytes

**Posty:** 18165 · przez **wojtas** 07 Sty 2009, 17:10

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\soxpeca.exe

Driver::
soxpeca

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 22 · przez **napi100** 07 Sty 2009, 19:06

Udał mi się zeskanować w końcu Kaspersky'm pod Firefoxem :banan:

Daje log

Kod: Zaznacz wszystko: *RAPORT KASPERSKY ONLINE SCANNER 7.0* środa, 7 styczeń 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Tuesday, January 06, 2009 20:18:46 Liczba wpisów: 1572953 *Ustawienia skanowania* Typ bazy danych użytej do skanowania rozszerzona Skanuj archiwa tak Skanuj pocztowe bazy danych tak *Obszar skanowania* Mój komputer A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ *Statystyki skanowania* Przeskanowanych plików 133241 Nazwa zagrożenia 2 Zainfekowanych obiektów 2 Podejrzanych obiektów 0 Czas skanowania 05:44:36 *Nazwa pliku* *Nazwa zagrożenia* *Liczba zagrożeń* C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\IHSDE543\msuse[1].bin Zainfekowany: Trojan-Downloader.Win32.Agent.bame 1 C:\WINDOWS\system32\udxfytw.sys Zainfekowany: Trojan-Clicker.Win32.VBScobb.fh 1 * Wybrany obszar został przeskanowany.*

i log ComboFix

Kod: Zaznacz wszystko: ComboFix 09-01-06.02 - Piotr Michalski 2009-01-07 17:48:13.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.118 [GMT 1:00] Uruchomiony z: c:\documents and settings\Piotr Michalski\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Piotr Michalski\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: c:\windows\system32\soxpeca.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Install.txt c:\windows\system32\comsa32.sys c:\windows\system32\mabidwe.exe c:\windows\system32\soxpeca.exe c:\windows\system32\tmp0_465569702789.bk c:\windows\system32\tmp2_582406768207.bk c:\windows\system32\udxfytw.sys . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_AFISICX -------\Legacy_MABIDWE -------\Legacy_NOYTCYR -------\Legacy_ROYTCTM -------\Legacy_SOXPECA -------\Legacy_TDYDOWKC -------\Legacy_WSLDOEKD -------\Service_mabidwe -------\Service_soxpeca ((((((((((((((((((((((((( Pliki utworzone od 2008-12-07 do 2009-01-07 ))))))))))))))))))))))))))))))) . 2009-01-06 21:40 . 2009-01-06 21:40 <DIR> d-------- c:\windows\ERUNT 2009-01-06 21:40 . 2009-01-06 21:40 <DIR> d-------- C:\ERDNT 2009-01-06 21:40 . 2009-01-06 21:40 <DIR> d-------- C:\!FixIEDef 2009-01-02 21:26 . 2009-01-03 18:45 386 --a------ c:\windows\QTW.ini 2009-01-02 15:50 . 2009-01-04 16:08 54,156 --ah----- c:\windows\QTFont.qfn 2009-01-02 15:50 . 2009-01-02 15:50 1,409 --a------ c:\windows\QTFont.for 2008-12-31 20:14 . 2008-12-31 20:14 <DIR> d-------- c:\program files\Google 2008-12-25 04:47 . 2008-05-08 02:03 453,632 --a------ c:\windows\system32\SetACL.ocx 2008-12-22 17:57 . 2008-12-22 18:45 <DIR> d-------- c:\documents and settings\Piotr Michalski\Dane aplikacji\IcoFX 2008-12-20 15:39 . 2008-12-20 15:39 <DIR> d-------- c:\documents and settings\Piotr Michalski\Dane aplikacji\TrojanHunter 2008-12-20 15:35 . 2008-12-20 15:43 <DIR> d-------- c:\program files\TrojanHunter 5.0 2008-12-20 09:40 . 2008-12-20 16:20 4,005,920 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-12-20 09:40 . 2008-12-20 16:20 52,196 --ahs---- c:\windows\system32\drivers\fidbox.idx . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2060-08-18 17:02 1,496,064 ------w c:\windows\system32\CC3250MT.DLL 2060-08-18 16:40 909,824 ------w c:\windows\system32\cp3245mt.dll 2060-08-18 16:40 24,064 ------w c:\windows\system32\borlndmm.dll 2009-01-04 16:43 --------- d-----w c:\documents and settings\Piotr Michalski\Dane aplikacji\Azureus 2009-01-03 17:52 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-03 17:51 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-15 15:35 --------- d-----w c:\program files\Bonjour 2008-12-03 18:52 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2008-12-03 18:52 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2008-12-03 11:53 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-12-03 11:53 --------- d-----w c:\program files\Java 2008-11-30 11:33 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Malwarebytes 2008-11-30 11:33 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\DivX 2008-11-30 11:04 --------- d-----w c:\documents and settings\Piotr Michalski\Dane aplikacji\Malwarebytes 2008-11-30 11:03 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2008-11-30 10:09 --------- d-----w c:\program files\SkanerOnline 2008-11-25 20:26 --------- d-----w c:\documents and settings\Piotr Michalski\Dane aplikacji\DivX 2008-11-10 07:45 --------- d-----w c:\documents and settings\Piotr Michalski\Dane aplikacji\PC Suite 2008-11-09 17:00 102,400 ----a-w c:\windows\DUMP6f73.tmp 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx0c.dll 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx07.dll 2008-10-28 22:35 815,104 ----a-w c:\windows\system32\divx_xx0a.dll 2008-10-28 22:35 802,816 ----a-w c:\windows\system32\divx_xx11.dll 2008-10-28 22:35 684,032 ----a-w c:\windows\system32\DivX.dll 2008-09-28 08:26 24,432 ----a-w c:\documents and settings\Piotr Michalski\Dane aplikacji\GDIPFONTCACHEV1.DAT 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "DAEMON Tools Lite"="e:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-17 490952] "SpybotSD TeaTimer"="e:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "a-winpoet-service"="e:\program files\DialNet\winpppoverethernet.exe" [2007-07-06 405504] "avast!"="e:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "Resume copy"="copyfstq.exe" [2008-07-16 c:\windows\copyfstq.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.l3codec"= l3codecp.acm "VIDC.I420"= i420vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\BlueSoleil.lnk backup=c:\windows\pss\BlueSoleil.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^InterVideo WinCinema Manager.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\InterVideo WinCinema Manager.lnk backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-01-15 15:14 147456 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2006-12-08 09:56 1053184 e:\program files\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2004-06-16 05:03 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2004-06-16 05:03 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-03-23 12:20 227328 e:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-11-16 18:15 155648 e:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-12-03 12:53 136600 c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-07-16 13:14 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA] --a------ 2004-11-12 01:10 344064 c:\windows\system32\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --------- 2001-05-29 10:02 124416 c:\windows\soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Reader Speed Launcher"="e:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "e:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-16 111184] R3 FPD;Fine Point Packet Service;c:\windows\system32\drivers\fpd.sys [2008-07-16 30336] R3 WrKPoET2000;WrKPoET2000;e:\program files\DialNet\WrKPoET2000.sys [2008-07-16 52214] R3 WRSWanDD;WinPoET PPPoE Adapter;c:\windows\system32\drivers\WrKPoETNic2000.sys [2008-07-16 65604] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-07-16 20560] R4 TopWinPoETDriver;WinPoET PPPoE Optimized Driver;c:\windows\system32\drivers\WrKPoET2000.sys [2008-07-16 52214] S3 utezotiz;AVZ Kernel Driver;\??\c:\windows\system32\Drivers\utezotiz.sys --> c:\windows\system32\Drivers\utezotiz.sys [?] --- Other Services/Drivers In Memory --- *Deregistered* - InCDrec *Deregistered* - msclcosd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87b28fb1-6bb6-11dd-912e-00030d000001}] \Shell\AutoRun\command - N:\InstallTomTomHOME.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93df37b2-5651-11dd-9116-000e2e69b29f}] \Shell\AutoRun\command - I:\Autorun.exe . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ IE: E&ksport do programu Microsoft Excel - e:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000 c:\windows\Downloaded Program Files\ewidoOnlineScan.dll - O16 -: {193C772A-87BE-4B19-A7BB-445B226FE9A1} hxxp://downloads.ewido.net/ewidoOnlineScan.cab c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} hxxp://www.mks.com.pl/skaner/SkanerOnline.cab c:\windows\Downloaded Program Files\SkanerOnline.inf FF - ProfilePath - c:\documents and settings\Piotr Michalski\Dane aplikacji\Mozilla\Firefox\Profiles\6k5wh9x4.default\ FF - plugin: e:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF - plugin: e:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll FF - plugin: e:\program files\DivXWEB\DivX Player\npDivxPlayerPlugin.dll FF - plugin: e:\program files\DivXWEB\DivX Web Player\npdivx32.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin2.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin3.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin4.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin5.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin6.dll FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin7.dll FF - plugin: e:\program files\Real\RealPlayer\Netscape6\nppl3260.dll FF - plugin: e:\program files\Real\RealPlayer\Netscape6\nprjplug.dll FF - plugin: e:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-07 17:55:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(676) c:\windows\system32\Ati2evxx.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe e:\program files\Alwil Software\Avast4\aswUpdSv.exe e:\program files\Alwil Software\Avast4\ashServ.exe c:\windows\system32\ati2evxx.exe e:\program files\IVT Corporation\BlueSoleil\BTNtService.exe e:\program files\Nero 7\InCD\InCDsrv.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\windows\system32\wdfmgr.exe e:\program files\DialNet\WrOS.exe e:\program files\Alwil Software\Avast4\ashMaiSv.exe e:\program files\Alwil Software\Avast4\ashWebSv.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-01-07 17:59:38 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-01-07 16:59:33 Przed: 4 828 045 312 bajtów wolnych Po: 4,884,393,984 bajtów wolnych 214

**Posty:** 18165 · przez **wojtas** 07 Sty 2009, 22:57

wydaje sie byc ok..

**Posty:** 22 · przez **napi100** 08 Sty 2009, 09:05

Mam wrażenie, że system faktycznie trochę lepiej chodzi

Avast wykrywa jeszcze co jakiś czas pliki: msnloed.exe i msuse[1].bin jako trojany.
Za każdym razem usuwam ale powracają.
Zastanawiam się czy to na pewno wirusy?
Dziękuję bardzo za pomoc.

**Posty:** 18165 · przez **wojtas** 08 Sty 2009, 21:08

jak pojawia sie te pliki to przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow plikow

**Posty:** 22 · przez **napi100** 08 Sty 2009, 22:06

Ten to chyba jednak wirus...???

Log z http://virusscan.jotti.org/

Kod: Zaznacz wszystko: File: msnloed.exe Status: INFECTED/MALWARE MD5: 04960cb12e18e8f4cad93ef278ef29e9 Scan taken on 08 Jan 2009 19:54:54 (GMT) A-Squared Found Trojan-Dropper.Agent!IK AntiVir Found TR/ATRAPS.Gen ArcaVir Found nothing Avast Found Win32:Trojan-gen {Other} AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found Troj.Downloader.W32.Agent.bam Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found Trojan-Downloader.Win32.Agent.bame G DATA Found Win32:Trojan-gen Ikarus Found nothing Kaspersky Anti-Virus Found Trojan-Downloader.Win32.Agent.bame NOD32 Found nothing Norman Virus Control Found W32/Atraps.BUY Panda Antivirus Found Trj/Downloader.MDW Sophos Antivirus Found Troj/Sacom-Gen VirusBuster Found nothing VBA32 Found Win32 Shadow Driver Install (probable variant)

Log z http://www.virustotal.com/pl/

Kod: Zaznacz wszystko: Plik msnboed.exe otrzymany 2009.01.05 23:25:27 (CET) Obecny status: zakończono Wynik: 13/37 (35.14%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik a-squared 4.0.0.73 2009.01.05 Trojan.Win32.Adpclient!IK AhnLab-V3 2009.1.5.3 2009.01.05 - AntiVir 7.9.0.45 2009.01.05 TR/ATRAPS.Gen Authentium 5.1.0.4 2009.01.05 - Avast 4.8.1281.0 2009.01.05 Win32:Trojan-gen {Other} AVG 8.0.0.199 2009.01.05 Dropper.Bravix BitDefender 7.2 2009.01.05 - CAT-QuickHeal 10.00 2009.01.05 Win32.PWS.Gamania.gen!D.8 ClamAV 0.94.1 2009.01.05 - Comodo 878 2009.01.05 - DrWeb 4.44.0.09170 2009.01.05 - eTrust-Vet 31.6.6289 2009.01.02 - Ewido 4.0 2008.12.31 - F-Prot 4.4.4.56 2009.01.05 - Fortinet 3.117.0.0 2009.01.05 - GData 19 2009.01.05 Win32:Trojan-gen {Other} Ikarus T3.1.1.45.0 2009.01.05 Trojan.Win32.Adpclient K7AntiVirus 7.10.576 2009.01.05 - Kaspersky 7.0.0.125 2009.01.05 Trojan-Downloader.Win32.Agent.bame McAfee 5486 2009.01.05 - McAfee+Artemis 5486 2009.01.05 - Microsoft 1.4205 2009.01.05 Trojan:Win32/Adpclient NOD32 3740 2009.01.05 - Norman 5.80.02 2009.01.02 - Panda 9.0.0.4 2009.01.05 Suspicious file PCTools 4.4.2.0 2009.01.05 - Prevx1 V2 2009.01.05 - Rising 21.11.02.00 2009.01.05 - SecureWeb-Gateway 6.7.6 2009.01.05 Trojan.ATRAPS.Gen Sophos 4.37.0 2009.01.05 Troj/Sacom-Gen Sunbelt 3.2.1809.2 2008.12.22 - Symantec 10 2009.01.05 - TheHacker 6.3.1.4.205 2009.01.05 - TrendMicro 8.700.0.1004 2009.01.05 - VBA32 3.12.8.10 2009.01.05 suspected of Win32 Shadow Driver Install ViRobot 2009.1.5.1544 2009.01.05 - VirusBuster 4.5.11.0 2009.01.05 - Dodatkowe informacje File size: 59904 bytes MD5...: 04960cb12e18e8f4cad93ef278ef29e9 SHA1..: 60bd883897fb666b137c5c81c3ae73ca875db84f SHA256: a793235fc9bc2c4dc23ab759a0fd7a27fee657129735b980d4cd260090d7b609 SHA512: 0b2aa38beb8e6f9c48ebbc86cc079f40f95acbdb51a45f12864edc3d722f1962 0b8fbce5a39b4dc0ded6259105242c4c01bf8e8d808dfcf5495ebbd28d9fcb93 ssdeep: 1536:n5qBVsvDFV4CD19AwE+lPkZnIl1xlvCBRQ9:gVMDHpDjlr1xsBRQ9 PEiD..: - TrID..: File type identification Win32 Executable Borland Delphi 7 (70.1%) Win32 Executable Borland Delphi 6 (27.5%) Win32 Executable Generic (0.8%) Win32 Dynamic Link Library (generic) (0.7%) Win16/32 Executable Delphi generic (0.2%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x40bb74 timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992) machinetype.......: 0x14c (I386) ( 8 sections ) name viradd virsiz rawdsiz ntrpy md5 CODE 0x1000 0xabd0 0xac00 6.50 39d3ee4e06a341270048b00832c1cf6e DATA 0xc000 0x5c0 0x600 3.79 c3c45781c6ccd7ec6c63db2a58bb1934 BSS 0xd000 0x921 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .idata 0xe000 0x91a 0xa00 4.30 0c46885dbc0551af9fc11ca435516589 .tls 0xf000 0x8 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .rdata 0x10000 0x18 0x200 0.19 83a6775154b3c520864a4ba5cc4dd077 .reloc 0x11000 0xf20 0x1000 6.50 b51f372e32fa089ec2b537da9f57125f .rsrc 0x12000 0x1800 0x1800 3.43 3a7cf0a24210f367c0c05e409fc263d7 ( 8 imports ) > kernel32.dll: DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetCurrentThreadId, WideCharToMultiByte, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, CreateFileA, CloseHandle > user32.dll: GetKeyboardType, LoadStringA, MessageBoxA, CharNextA > advapi32.dll: RegQueryValueExA, RegOpenKeyExA, RegCloseKey > oleaut32.dll: SysFreeString > kernel32.dll: TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA > kernel32.dll: lstrcmpiA, WriteFile, WaitForSingleObject, VirtualQuery, TerminateProcess, SystemTimeToFileTime, Sleep, SetFileTime, SetFilePointer, MoveFileA, LocalFileTimeToFileTime, LoadLibraryA, GetVersionExA, GetThreadLocale, GetTempPathA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetDiskFreeSpaceA, GetCPInfo, GetACP, FreeLibrary, FindNextFileA, FindFirstFileA, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, DeleteFileA, CreateProcessA, CreateMutexA, CreateFileA, CopyFileA, CloseHandle > version.dll: VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA > user32.dll: MessageBoxA, LoadStringA, GetSystemMetrics, CharNextA ( 0 exports ) CWSandbox info: http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=04960cb12e18e8f4cad93ef278ef29e9

**Posty:** 8001 · przez **Okocza** 08 Sty 2009, 22:18

skasuj. wykrywaja wirusy.

**Posty:** 22 · przez **napi100** 08 Sty 2009, 22:31

Dzięki Okocza, ale powinieneś przeczytać wszystkie posty.
Ten plik aktywuję się kilka razy dziennie i mimo usuwania powraca

**Posty:** 8001 · przez **Okocza** 08 Sty 2009, 23:01

napi100, a usuwasz w awaryjnym z wyłączonym przywracaniem systemu... ?

**Posty:** 22 · przez **napi100** 09 Sty 2009, 18:40

Niestety to też nie pomaga

**Posty:** 18165 · przez **wojtas** 09 Sty 2009, 20:08

Wykonaj skan Dr. Web CureIt

zainstaluj:

http://www.programosy.pl/program,comodo-firewall.html

Wykonaj to co jest podane w tym temacie

skasuj pliki i zobacz czy beda wracaly.. jesli tak daj nowego loga z combo i hijacka

Autor postu otrzymał pochwałę

**Posty:** 22 · przez **napi100** 10 Sty 2009, 15:18

Dr. Web CureIt wykrył kilka plików, usunięte.
Comodo zainstalowane, msnloed.exe usunięty, dodatkowo zablokowałem plik w Defense+.
Porty zablokowane w WWDC.
Na razie wszystko wygląda dobrze, brak ataków, Awast spokojny

Dziękuję Wojtas za pomoc.

**Posty:** 2 · przez **Aniaaa** 11 Sty 2009, 14:15

Witam, od jakiegoś czasu wyłącza mi się sam explorer, tzn znika na moment pasek.. czytałam już dość dużo o tym, no i mam ten log z Combofixa tylko co dalej to nie mam pojęcia, proszę o pomoc

Kod: Zaznacz wszystko: ComboFix 09-01-10.03 - Ania 2009-01-11 13:03:11.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.767.340 [GMT 1:00] Uruchomiony z: c:\documents and settings\Ania\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Ania\Ania.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-11 do 2009-01-11 ))))))))))))))))))))))))))))))) . 2009-01-10 13:10 . 2009-01-10 13:10 <DIR> d-------- c:\program files\CCleaner 2009-01-09 20:32 . 2009-01-09 20:32 <DIR> d-------- c:\program files\Ulead Systems 2009-01-09 20:18 . 2009-01-09 20:18 <DIR> d-------- c:\program files\Windows Media Components 2009-01-09 14:45 . 2009-01-10 09:46 <DIR> d-------- c:\program files\DC++ 2009-01-09 13:56 . 2009-01-09 14:01 1,512 --a------ c:\windows\unins000.dat 2009-01-06 11:59 . 2009-01-06 12:00 <DIR> d-------- c:\program files\VSO 2009-01-06 11:35 . 2009-01-06 11:37 <DIR> d-------- c:\program files\Common Files\Ulead Systems 2009-01-06 11:32 . 2009-01-06 11:32 <DIR> d-------- c:\program files\Corel 2009-01-06 11:31 . 2009-01-06 11:31 <DIR> d-------- c:\documents and settings\Ania\Dane aplikacji\InstallShield 2008-12-27 15:30 . 2008-12-27 15:35 <DIR> d-------- c:\documents and settings\Ania\Dane aplikacji\VSO 2008-12-23 23:22 . 2008-12-23 23:22 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-12-23 22:31 . 2009-01-06 13:29 <DIR> d-------- c:\documents and settings\Ania\Dane aplikacji\Ulead Systems 2008-12-23 21:41 . 2008-12-23 21:41 <DIR> d-------- c:\program files\Common Files\InterVideo 2008-12-23 21:41 . 2008-04-01 21:40 209,040 --a------ c:\windows\system32\IVIresizeW7.dll 2008-12-23 21:41 . 2008-04-01 21:40 204,944 --a------ c:\windows\system32\IVIresizeA6.dll 2008-12-23 21:41 . 2008-04-01 21:40 196,752 --a------ c:\windows\system32\IVIresizeP6.dll 2008-12-23 21:41 . 2008-04-01 21:40 196,752 --a------ c:\windows\system32\IVIresizeM6.dll 2008-12-23 21:41 . 2008-04-01 21:40 192,656 --a------ c:\windows\system32\IVIresizePX.dll 2008-12-23 21:41 . 2008-04-01 21:40 24,720 --a------ c:\windows\system32\IVIresize.dll 2008-12-23 21:38 . 2009-01-09 20:17 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Ulead Systems 2008-12-23 21:37 . 2009-01-09 20:16 <DIR> d--h----- c:\program files\InstallShield Installation Information 2008-12-21 17:55 . 2008-12-21 17:55 <DIR> d-------- c:\documents and settings\Ania\Dane aplikacji\AquaSoft 2008-12-21 17:53 . 2008-12-21 17:53 <DIR> d--h----- c:\documents and settings\All Users\Dane aplikacji\{8D875FC5-7147-49C8-8D56-7682E8D71C9C} 2008-12-21 17:52 . 2008-12-21 17:52 <DIR> d-------- c:\program files\Common Files\AquaSoft 2008-12-13 19:27 . 2008-12-23 23:08 181,785 --a------ c:\program files\LRCEditor.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-11 11:24 --------- d-----w c:\documents and settings\Ania\Dane aplikacji\skypePM 2009-01-11 11:24 --------- d-----w c:\documents and settings\Ania\Dane aplikacji\Skype 2009-01-10 16:57 --------- d-----w c:\documents and settings\Ania\Dane aplikacji\Zoner 2009-01-06 10:48 --------- d-----w c:\program files\Google 2008-12-30 22:07 --------- d-----w c:\program files\Gadu-Gadu 2008-12-23 22:42 1,049,719 ----a-w c:\program files\wrar361pl.exe 2008-12-23 22:10 2,224,317 ----a-w c:\program files\MP3GainFULLinstall_0.9.8.exe 2008-12-23 22:08 789,605 ----a-w c:\program files\mcw10.exe 2008-12-23 22:06 14,794,272 ----a-w c:\program files\IE7-WindowsXP-x86-plk.exe 2008-12-23 22:00 723,967 ----a-w c:\program files\CzasoWylv1.exe 2008-12-14 18:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-12-01 16:13 --------- d-----w c:\program files\Common Files\Adobe 2008-12-01 14:51 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\FLEXnet 2008-11-23 13:51 --------- d-----w c:\program files\Xilisoft 2008-11-23 13:51 --------- d-----w c:\program files\QuickTime 2008-11-22 00:26 --------- d-----w c:\program files\Photodex Presenter 2008-11-22 00:26 --------- d-----w c:\program files\Photodex 2008-11-22 00:26 --------- d-----w c:\documents and settings\Ania\Dane aplikacji\Netscape 2008-11-20 22:02 --------- d-----w c:\program files\CzasoWyłącznik 2008-11-15 09:06 --------- d-----w c:\documents and settings\Ania\Dane aplikacji\Photodex 2008-11-11 08:56 --------- d-----w c:\program files\Common Files\Skype 2008-10-27 14:22 410,976 ----a-w c:\windows\system32\deploytk.dll 2008-10-23 14:51 24,064 ----a-w c:\windows\autoload.exe 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-05-26 49152] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-19 196608] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-05-26 4640768] "nwiz"="nwiz.exe" [2003-05-26 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoFileAssociate"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3iv2"= 3ivxVfWCodec.dll "VIDC.HFYU"= huffyuv.dll "VIDC.VP31"= vp31vfw.dll "msacm.dvacm"= c:\progra~1\COMMON~1\Ulead Systems\Vio\Dvacm.acm "msacm.MPEGacm"= c:\progra~1\COMMON~1\Ulead Systems\MPEG\MPEGacm.acm "msacm.ulmp3acm"= c:\progra~1\COMMON~1\Ulead Systems\MPEG\ulmp3acm.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-10-24 111184] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-10-24 20560] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ uInternet Settings,ProxyOverride = *.local IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 TCP: {EA0B83B5-600C-48D6-9A59-41AB5E705163} = 85.198.192.6 FF - ProfilePath - c:\documents and settings\Ania\Dane aplikacji\Mozilla\Firefox\Profiles\ii9wf790.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ FF - plugin: c:\documents and settings\Ania\Dane aplikacji\Mozilla\plugins\npPxPlay.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-11 13:04:49 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-01-11 13:06:10 ComboFix-quarantined-files.txt 2009-01-11 12:06:06 Przed: 9 038 450 688 bajtów wolnych Po: 9,030,340,608 bajtów wolnych 139 --- E O F --- 2008-10-31 19:12:56 [code][/code]

**Posty:** 18165 · przez **wojtas** 11 Sty 2009, 14:43

Aniaaa, załoz swoj wlasny temat