Przechwycone hasła ftp z total commander

**Posty:** 1340 · przez **eSpEY** 05 Lis 2009, 17:11

Witam... w ostatnim tygodniu wykradziono mi wszystkie hasła ftp z TC (to jest jakiś plik na WINDOWS)
z 50 rożnych IP dodaje teraz mi do wszystkich stron reklamę/ramkę ruskich stron. Pozmieniałem jak najwięcej haseł, lecz nie wiem kiedy je wykradziono... Bo możliwe że podczas zmiany Firewalla... Ale na wszelki wypadek chcę, wiedzieć czy nie mam jakiegoś shitu na kompie:
http://nt.interia.pl/raport/wirusy/wirus-atakuje/news/wstrzykuje-stronom-zlosliwy-kod-przez-ftp,1291303,6003
^^jestem ofiarą tego wydarzenia. ...

HTJ:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:55:32, on 2009-11-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\RTHDCPL.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe c:\program files\avira\antivir personaledition classic\avscan.exe C:\Documents and Settings\Admin\Pulpit\OTL.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Ratlerek.lnk = C:\WINDOWS\RTHDCPL.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NMSAccess - Unknown owner - d:\Program Files\BurnAware Free\NMSAccess32.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 1929 bytes

SilenRun.

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 59, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "ZoneAlarm Client" = ""C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"" ["Check Point Software Technologies LTD"] "Regedit32" = "C:\WINDOWS\system32\regedit.exe" [file not found] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Uniwersalne urządzenia Plug and Play" -> {HKLM...CLSID} = "Uniwersalne urządzenia Plug and Play" \InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "D:\01_Programy\7-ZIP\7-zip.dll" ["Igor Pavlov"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{e76568e0-c853-11d3-b155-0000e214c1a8}" = "Shell Extension for DrWeb" -> {HKLM...CLSID} = "Shell Extension for DrWeb" \InProcServer32\(Default) = "C:\Program Files\DrWeb\DrWShExt.dll" [file not found] "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" = "AQQ File Transfer Shell Extension" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "e:\PROGRA~1\WapSter\AQQ\System\AQQSHE~1.DLL" [file not found] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{52B87208-9CCF-42C9-B88E-069281105805}" = "Trojan Remover Shell Extension" -> {HKLM...CLSID} = "Trojan Remover Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TROJAN~1\Trshlex.dll" ["Simply Super Software"] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] "{0DE61CCE-8443-11D9-9CEC-0050BA012D9B}" = "LaunchShellMenu extension" -> {HKLM...CLSID} = "LaunchMenu Class" \InProcServer32\(Default) = "E:\Program Files\Java\bin\LaunchShellMenu.dll" [empty string] "{00001111-0039-1101-8310-9020AF3E9456}" = "FotoBatch Context Menu Shell Extension" -> {HKLM...CLSID} = "FotoBatch Context Menu Shell Extension" \InProcServer32\(Default) = "C:\DOCUME~1\Admin\Pulpit\prace\csns\Pluginy\EMMODE~1\MCSHLEX.dll" [null data] "{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}" = "dBpoweramp Music Converter" -> {HKLM...CLSID} = "dMCIShell Class" \InProcServer32\(Default) = "E:\Program Files\Steam\SteamApps\mpower_93\condition zero\czero_polish\dBpoweramp\dMCShell.dll" ["Illustrate"] "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "E:\Program Files\ICQLite\ICQLiteShell.dll" [empty string] "{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}" = "My Labtec Pictures" -> {HKLM...CLSID} = "My Labtec Pictures" \InProcServer32\(Default) = "C:\Program Files\Logitech\Video\Namespc2.dll" ["Labtec Inc."] "{10677009-C23C-4FC2-A62C-29323A2201F0}" = "AQQ File Transfer Shell Extension" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "D:\01_Programy\Jabber\System\AQQShellExt.dll" [null data] "{79BC0345-1015-11D2-A299-006008312725}" = "blue.shell" -> {HKLM...CLSID} = "///FAST project settings" \InProcServer32\(Default) = "D:\Program Files\Pinnacle\VideoSpin\Programs\BlueShellExt.dll" [file not found] "{EE75AC21-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device" -> {HKLM...CLSID} = "Siemens Device" \InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\bin\PhoneExplorer.dll" [empty string] "{EE75AC22-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device ContextMenuHandler" -> {HKLM...CLSID} = "Siemens Device ContextMenuHandler" \InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\bin\PhoneExplorer.dll" [empty string] "{EE75AC23-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device PropertySheetHandlers" -> {HKLM...CLSID} = "Siemens Device PropertySheetHandler" \InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\bin\PhoneExplorer.dll" [empty string] "{1C311AAA-D8B1-4A0A-BEE5-2387FEC583DA}" = "ShellPlusContextMenu" -> {HKLM...CLSID} = "Burn4Freecontext menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\B4FM.dll" ["Ikysasoft s.r.l. uninominale"] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Aedebug\ <<!>> "Debugger" = "C:\Program Files\Borland\Delphi7\Bin\bordbg70.exe -aeargs %ld %ld" [file not found] HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"| [file not found] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] {FED7043D-346A-414D-ACD7-550D052499A7}\(Default) = "dBpoweramp Column Handler" -> {HKLM...CLSID} = "dBpShell Class" \InProcServer32\(Default) = "E:\Program Files\Steam\SteamApps\mpower_93\condition zero\czero_polish\dBpoweramp\dBShell.dll" ["Illustrate"] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "D:\01_Programy\7-ZIP\7-zip.dll" ["Igor Pavlov"] AQQFileTransfer\(Default) = "{10677009-C23C-4FC2-A62C-29323A2201F0}" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "D:\01_Programy\Jabber\System\AQQShellExt.dll" [null data] Ashampoo Magical Security Shell Extension\(Default) = "{E7BC3CE1-0CA1-41eb-BD77-2340BA86D05F}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Ashampoo\Ashampoo Magical Security\ashppcor.dll" [null data] avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] DrWMenuHandlers\(Default) = "{e76568e0-c853-11d3-b155-0000e214c1a8}" -> {HKLM...CLSID} = "Shell Extension for DrWeb" \InProcServer32\(Default) = "C:\Program Files\DrWeb\DrWShExt.dll" [file not found] FotoBatch\(Default) = "{00001111-0039-1101-8310-9020AF3E9456}" -> {HKLM...CLSID} = "FotoBatch Context Menu Shell Extension" \InProcServer32\(Default) = "C:\DOCUME~1\Admin\Pulpit\prace\csns\Pluginy\EMMODE~1\MCSHLEX.dll" [null data] ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "E:\Program Files\ICQLite\ICQLiteShell.dll" [empty string] JavaLauncher\(Default) = "{0DE61CCE-8443-11D9-9CEC-0050BA012D9B}" -> {HKLM...CLSID} = "LaunchMenu Class" \InProcServer32\(Default) = "E:\Program Files\Java\bin\LaunchShellMenu.dll" [empty string] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] Notepad++\(Default) = "{120B94B5-2E6A-4F13-94D0-414BCB64FA0F}" -> {HKLM...CLSID} = "Notepad++" \InProcServer32\(Default) = "C:\Program Files\Notepad++\nppcm.dll" ["Burgaud.com"] PandoShellExt\(Default) = "{9C150845-2A2D-44CC-90B3-AA03480AA3D2}" -> {HKLM...CLSID} = "PDShellExt Class" \InProcServer32\(Default) = "C:\Program Files\Pando Networks\Pando\PandoShellExt.dll" ["TODO: <Company name>"] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] Trojan Remover\(Default) = "{52B87208-9CCF-42C9-B88E-069281105805}" -> {HKLM...CLSID} = "Trojan Remover Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TROJAN~1\Trshlex.dll" ["Simply Super Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "D:\01_Programy\7-ZIP\7-zip.dll" ["Igor Pavlov"] Ashampoo Magical Security Shell Extension\(Default) = "{E7BC3CE1-0CA1-41eb-BD77-2340BA86D05F}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Ashampoo\Ashampoo Magical Security\ashppcor.dll" [null data] ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "E:\Program Files\ICQLite\ICQLiteShell.dll" [empty string] JavaLauncher\(Default) = "{0DE61CCE-8443-11D9-9CEC-0050BA012D9B}" -> {HKLM...CLSID} = "LaunchMenu Class" \InProcServer32\(Default) = "E:\Program Files\Java\bin\LaunchShellMenu.dll" [empty string] PandoShellExt\(Default) = "{9C150845-2A2D-44CC-90B3-AA03480AA3D2}" -> {HKLM...CLSID} = "PDShellExt Class" \InProcServer32\(Default) = "C:\Program Files\Pando Networks\Pando\PandoShellExt.dll" ["TODO: <Company name>"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] DrWMenuHandlers\(Default) = "{e76568e0-c853-11d3-b155-0000e214c1a8}" -> {HKLM...CLSID} = "Shell Extension for DrWeb" \InProcServer32\(Default) = "C:\Program Files\DrWeb\DrWShExt.dll" [file not found] FineReader\(Default) = "{AC0DD14A-8F29-4F88-BE1D-0F0ED1B06C9F}" -> {HKLM...CLSID} = "FineReaderExplorerContextMenuHandler" \InProcServer32\(Default) = "C:\Program Files\ABBYY FineReader 6.0\FECMenu.dll" ["ABBYY (BIT Software)"] JavaLauncher\(Default) = "{0DE61CCE-8443-11D9-9CEC-0050BA012D9B}" -> {HKLM...CLSID} = "LaunchMenu Class" \InProcServer32\(Default) = "E:\Program Files\Java\bin\LaunchShellMenu.dll" [empty string] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] Trojan Remover\(Default) = "{52B87208-9CCF-42C9-B88E-069281105805}" -> {HKLM...CLSID} = "Trojan Remover Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TROJAN~1\Trshlex.dll" ["Simply Super Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ ShellPlusContextMenu\(Default) = "{1C311AAA-D8B1-4A0A-BEE5-2387FEC583DA}" -> {HKLM...CLSID} = "Burn4Freecontext menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\B4FM.dll" ["Ikysasoft s.r.l. uninominale"] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoSMHelp" = (REG_DWORD) dword:0x00000001 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} "ForceStartMenuLogoff" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS] Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ ACDSeeShowPicturesOnArrival\ "Provider" = "ACDSee" "InvokeProgID" = "ACDSee.AutoPlayHandler" "InvokeVerb" = "Open" HKLM\SOFTWARE\Classes\ACDSee.AutoPlayHandler\shell\Open\command\(Default) = ""C:\Program Files\ACD Systems\ACDSee\5.0\ACDSee5.exe" "%1"" ["ACD Systems, Ltd."] AlcoholAutoPlayV2.BurnDisc\ "Provider" = "Alcohol 120%" "InvokeProgID" = "AlcoholAutoPlayV2" "InvokeVerb" = "BurnDisc" HKLM\SOFTWARE\Classes\AlcoholAutoPlayV2\shell\BurnDisc\command\(Default) = ""E:\Program Files\Alkohol\Alcohol 120\Alcohol.exe" %1" ["Alcohol Soft Development Team"] AlcoholAutoPlayV2.ReadDisc\ "Provider" = "Alcohol 52%" "InvokeProgID" = "AlcoholAutoPlayV2" "InvokeVerb" = "ReadDisc" HKLM\SOFTWARE\Classes\AlcoholAutoPlayV2\shell\ReadDisc\command\(Default) = ""E:\Program Files\Alcohol Soft\Alcohol 52\Alcohol.exe" %1" ["Alcohol Soft Development Team"] BridgeCS3ImportMediaOnArrival\ "Provider" = "Adobe Bridge CS3" "InvokeProgID" = "Adobe.adobebridge" "InvokeVerb" = "launch" HKLM\SOFTWARE\Classes\Adobe.adobebridge\shell\launch\command\(Default) = "C:\Program Files\Adobe\Adobe Bridge CS3\bridgeproxy.exe -v %1" ["Adobe Systems, Inc."] BurnAware\ "Provider" = "BurnAware" "InvokeProgID" = "BurnAwareOpen" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\BurnAwareOpen\shell\open\command\(Default) = ""d:\Program Files\BurnAware Free\burnaware.exe"" ["Burnaware Technologies"] CDBurnerXP\ "Provider" = "CDBurnerXP" "InvokeProgID" = "CDBurnerXPOpen" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\CDBurnerXPOpen\shell\open\command\(Default) = ""C:\Program Files\CDBurnerXP\cdbxpp.exe"" [null data] dMCAudioCDInput\ "Provider" = "dMC Audio CD Input" "InvokeProgID" = "dMC.AudioCD.Autorun" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\dMC.AudioCD.Autorun\shell\open\command\(Default) = ""E:\Program Files\Steam\SteamApps\mpower_93\condition zero\czero_polish\dBpoweramp\CDGrab.exe"" ["Illustrate"] DVDDecrypterPlayDVDMovieOnArrival\ "Provider" = "DVD Decrypter" "InvokeProgID" = "DVDDecrypter" "InvokeVerb" = "Decrypt using DVD Decrypter" HKLM\SOFTWARE\Classes\DVDDecrypter\shell\Decrypt using DVD Decrypter\Command\(Default) = ""E:\Program Files\DVD Decrypter\DVDDecrypter.exe" /MODE READ /SOURCE "%1"" ["LIGHTNING UK!"] LightScribeOnArrivalAP\ "Provider" = "LightScribe Direct Disc Labeling" "InvokeProgID" = "LightScribe.AutoPlayHandler" "InvokeVerb" = "LabelLightScribeDisc" HKLM\SOFTWARE\Classes\LightScribe.AutoPlayHandler\shell\LabelLightScribeDisc\command\(Default) = "C:\Program Files\Common Files\LightScribe\LsLauncher.exe" ["Hewlett-Packard Company"] LogitechQuickSync\ "Provider" = "Logitech QuickSync" "InvokeProgID" = "Applications\QSync.exe" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\Applications\QSync.exe\shell\open\command\(Default) = ""C:\Program Files\Logitech\Video\QSync.exe"" ["Labtec Inc."] NeroAutoPlay2CDAudio\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "HandleCDBurningOnArrival_CDAudio" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_CDAudio\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /w /New:AudioCD /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2CopyCD\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "PlayCDAudioOnArrival_CopyCD" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayCDAudioOnArrival_CopyCD\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /w /Dialog:DiscCopy /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2DataDisc\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "HandleCDBurningOnArrival_DataDisc" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_DataDisc\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /w /New:ISODisc /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2LaunchNeroStartSmart\ "Provider" = "Nero StartSmart" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "HandleCDBurningOnArrival_LaunchNeroStartSmart" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_LaunchNeroStartSmart\command\(Default) = "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart.exe /AutoPlay /Drive:%L" ["Ahead Software AG"] PDirDVArrival\ "Provider" = "PowerDirector" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = ""C:\Program Files\CyberLink\PowerDirector\PDR.exe" /DV" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] PDVDPlayDVDMovieOnArrival\ "Provider" = "PowerDVD" "InvokeProgID" = "DVD" "InvokeVerb" = "PlayWithPowerDVD" HKLM\SOFTWARE\Classes\DVD\shell\PlayWithPowerDVD\Command\(Default) = ""C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" "%l"" ["CyberLink Corp."] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "e:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] Startup items in "Admin" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\Admin\Menu Start\Programy\A\Autostart "Ratlerek" -> shortcut to: "C:\WINDOWS\RTHDCPL.exe" ["Realtek Semiconductor Corp."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 22 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" [file not found] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" [file not found] "{4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2}" -> {HKLM...CLSID} = "Alcohol Toolbar" \InProcServer32\(Default) = "C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll" [file not found] Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{B0DE3308-5D5A-470D-81B9-634FC078393B}\(Default) = "Ask Toolbar Quick View" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] Miscellaneous IE Hijack Points ------------------------------ HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\ <<H>> "Tabs" = "C:\Documents and Settings\Admin\Dane aplikacji\MEGAUPLOADTOOLBAR\tabwelcome.html" [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."] NMSAccess, NMSAccess, "d:\Program Files\BurnAware Free\NMSAccess32.exe" [null data] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Check Point Software Technologies LTD"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."] PDF995 Monitor\Driver = "pdf995mon.dll" [null data] ---------- (launch time: 2009-11-05 15:22:19) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 56 seconds, including 4 seconds for message boxes)

OLT#1 http://wklejto.pl/46322
OLT#2 http://wklejto.pl/46323
pw:n1
Polecone mi już zostało zaktualizować TC.

Ciekawi mnie też program Brun4Free

http://virusscan.jotti.org/pl/scanresult/a66ab93b277926ce9b29ee7d359cbf341fb1492a
1 antyvirus mówi że trojan... tak samo mój ZA.

**Posty:** 18165 · przez **wojtas** 05 Lis 2009, 18:27

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Regedit32] C:\WINDOWS\System32\regedit.exe File not found
O32 - AutoRun File - [2008-08-30 10:56:30 | 00,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-06-12 11:40:11 | 00,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008-08-30 10:56:30 | 00,000,000 | RHSD | M] - E:\autorun.inf -- [ NTFS ]

:Files
C:\WINDOWS\System32\restorer32_a.exe
C:\Documents and Settings\Admin\restorer32_a.exe

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

**Posty:** 3620 · przez **MaTi** 05 Lis 2009, 18:36

eSpEY, w TC nie miej zapisanych haseł... Jest wirus/trojan który przechwytuje wszystkie hasła z TC, a dalej to już sam wiesz co robi dopisuje kod ... gdzie się da. Używaj programu FileZilla. Ewentualnie TC ale hasła w głowie, co raczej nie jest możliwe do 50 kont...

**Posty:** 1340 · przez **eSpEY** 05 Lis 2009, 20:55

MaTi napisał(a):żywaj programu FileZilla.

Wirus też go atakuje...

Combofixa zaraz uruchomię.

Dodano Dzisiaj, 9:05 pm:

Kod: Zaznacz wszystko: All processes killed Error: Unable to interpret <[emptytemp]> in the current context! Error: Unable to interpret <[start explorer]> in the current context! OTL by OldTimer - Version 3.1.3.3 log created on 11052009_195825 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Dodano Dzisiaj, 10:29 pm:

Kod: Zaznacz wszystko: ComboFix 09-11-05.01 - Admin 2009-11-05 20:29.7.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.1015.702 [GMT 1:00] Uruchomiony z: c:\documents and settings\Admin\Pulpit\LOGI ITP\ComboFixx.exe AV: avast! antivirus 4.7.1098 [VPS 071213-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7} AV: System antywirusowy NOD32 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} FW: ZoneAlarm Pro Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} * Rezydentny antywirus jest aktywny . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Admin\Dane aplikacji\.# c:\documents and settings\Admin\Dane aplikacji\wiaserva.log c:\documents and settings\Admin\oashdihasidhasuidhiasdhiashdiuasdhasd C:\text.txt c:\windows\d.ini c:\windows\system32\aston.mt c:\windows\system32\gaopdxcounter c:\windows\system32\gaopdxklvmlrqmitaaisditndxjdbwwrgmymov.dll c:\windows\system32\ieuinit.inf c:\windows\system32\Ijl11.dll c:\windows\system32\nvaux32.dll c:\windows\system32\REGLOAD.exe c:\windows\system32\wmdmpmsvc.dll c:\windows\system32\wmnt.dll c:\windows\system32\wshell.dll Zainfekowana kopia c:\windows\system32\drivers\atapi.sys została znaleziona. Problem naprawiono Plik odzyskano z - Kitty ate it :p Zainfekowana kopia c:\windows\system32\drivers\AGP440.sys została znaleziona. Problem naprawiono Plik odzyskano z - c:\windows\ServicePackFiles\i386\agp440.sys . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_QUADRASERV.SYS -------\Service_gaopdxserv.sys -------\Service_quadraserv.sys ((((((((((((((((((((((((( Pliki utworzone od 2009-10-05 do 2009-11-05 ))))))))))))))))))))))))))))))) . 2009-11-05 19:13 . 2009-11-05 19:16 -------- d-----w- C:\ComboFixx 2009-11-05 15:12 . 2009-11-05 15:12 -------- d-----w- C:\_OTL 2009-11-04 18:18 . 2009-11-04 18:18 233243 ----a-w- c:\windows\Burn4Free_Toolbar_Uninstaller_8937.exe 2009-11-04 18:18 . 2009-11-04 18:18 -------- d-----w- c:\program files\Burn4Free Toolbar 2009-11-04 17:00 . 2009-10-27 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll 2009-10-30 19:43 . 2008-10-09 13:25 69008 ----a-w- c:\windows\system32\zlcomm.dll 2009-10-30 19:43 . 2008-10-09 13:25 106384 ----a-w- c:\windows\system32\zlcommdb.dll 2009-10-30 19:43 . 2008-10-09 13:25 1221008 ----a-w- c:\windows\system32\zpeng25.dll 2009-10-30 19:43 . 2009-10-30 19:43 -------- d-----w- c:\program files\Zone Labs 2009-10-30 19:39 . 2009-10-30 19:39 -------- d-----w- c:\program files\COMODO 2009-10-26 17:43 . 2009-10-26 17:43 -------- d-----w- c:\windows\tessdata 2009-10-26 17:43 . 2009-10-26 17:43 -------- d-----w- c:\program files\Softi Software 2009-10-26 17:43 . 2009-10-26 17:43 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Softi Software 2009-10-11 19:58 . 2009-10-11 19:58 1078 ----a-r- c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_4ae13d6c.exe 2009-10-11 19:58 . 2009-10-11 19:58 1078 ----a-r- c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_2cd672ae.exe 2009-10-11 19:58 . 2009-10-11 19:58 1078 ----a-r- c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_294823.exe 2009-10-11 19:58 . 2009-10-11 19:58 1078 ----a-r- c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_18be6784.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-05 15:13 . 2006-11-08 22:15 -------- d-----w- c:\program files\totalcmd 2009-11-04 12:26 . 2004-07-17 09:36 28400 ----a-w- c:\windows\system32\drivers\secdrv.sys 2009-11-02 22:41 . 2006-11-14 15:11 4212 ---ha-w- c:\windows\system32\zllictbl.dat 2009-10-30 19:39 . 2007-04-18 19:37 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-10-30 06:05 . 2007-01-05 14:32 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Skype 2009-10-28 21:38 . 2008-09-17 19:05 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\ipla 2009-10-28 17:49 . 2008-03-22 10:28 -------- d-----w- c:\program files\ESET 2009-10-26 17:36 . 2007-08-06 12:41 39936 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE 2009-10-26 17:36 . 2009-03-16 17:56 30720 ---h--r- c:\windows\CdaC13BA.EXE 2009-10-26 17:36 . 2009-03-16 17:56 112128 ---h--r- c:\windows\CdaC14BA.DLL 2009-10-25 08:28 . 2001-10-26 16:15 88618 ----a-w- c:\windows\system32\perfc015.dat 2009-10-25 08:28 . 2001-10-26 16:15 499958 ----a-w- c:\windows\system32\perfh015.dat 2009-10-21 05:11 . 2007-12-25 21:31 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\mIRC 2009-10-20 21:16 . 2008-11-08 20:33 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\BitTorrent 2009-10-20 21:10 . 2006-12-11 19:17 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\uTorrent 2009-10-20 13:04 . 2006-11-08 21:51 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-10-19 20:43 . 2006-11-08 21:55 404032 ----a-w- c:\documents and settings\Admin\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-10-17 23:33 . 2008-06-16 08:13 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\temp 2009-10-11 20:08 . 2004-08-03 22:44 219648 ----a-w- c:\windows\system32\uxtheme.dll 2009-10-04 08:47 . 2007-04-19 05:28 40266623 ----a-w- c:\windows\Internet Logs\tvDebug.zip 2009-10-02 21:47 . 2009-10-02 21:47 2692 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Midi Decoder.dat 2009-10-02 21:46 . 2008-07-29 22:37 225656 ----a-w- c:\windows\system32\SpoonUninstall.exe 2009-10-01 05:19 . 2007-08-06 12:49 -------- d-----w- c:\program files\Lexmark 1200 Series 2009-09-25 20:35 . 2009-09-25 20:35 -------- d-----w- c:\program files\Samsung 2009-09-24 17:57 . 2009-09-24 17:57 -------- d-----w- c:\program files\CrystalDiskInfo 2009-09-20 14:11 . 2008-05-21 19:05 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\TrackMania 2009-09-18 20:15 . 2009-09-18 20:15 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\REAPER 2009-09-16 19:26 . 2007-10-03 18:23 -------- d-----w- c:\program files\Common Files\Borland Shared 2009-09-16 17:19 . 2009-09-06 17:31 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll 2009-09-14 11:47 . 2008-06-21 14:17 -------- d-----w- c:\program files\SWiSH v2.0 2009-09-12 09:05 . 2009-09-12 09:05 94208 ----a-w- c:\documents and settings\Admin\Dane aplikacji\FileSubmit\81938\install\decoder.dll 2009-09-12 09:05 . 2009-09-12 09:05 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\FileSubmit 2009-09-10 18:19 . 2007-09-09 14:17 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Tlen.pl 2009-08-16 15:08 . 2004-01-22 18:06 178176 ----a-w- c:\windows\system32\unrar.dll 2007-08-11 20:57 . 2007-08-11 20:56 4 ----a-w- c:\program files\2007-08-11 22_55.gps.bin 2007-08-11 20:56 . 2007-08-11 20:56 0 ----a-w- c:\program files\2007-08-11 22_55.gps 2007-03-31 15:20 . 2007-03-20 20:50 868 --sha-w- c:\windows\system32\regnessem_nsm.dat . ------- Sigcheck ------- [7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\atapi.sys [-] 2004-08-03 21:59 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys [7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\atapi.sys [7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-06-15 6803456] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-10-09 981904] c:\documents and settings\Admin\Menu Start\Programy\A\Autostart\ Ratlerek.lnk - c:\windows\RTHDCPL.exe [2006-11-8 16875008] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Remote Controller.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Remote Controller.lnk backup=c:\windows\pss\Remote Controller.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^TV Scheduler.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\TV Scheduler.lnk backup=c:\windows\pss\TV Scheduler.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^TVRMVCR.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\TVRMVCR.lnk backup=c:\windows\pss\TVRMVCR.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^uninstall-ubuntu.exe] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\uninstall-ubuntu.exe backup=c:\windows\pss\uninstall-ubuntu.exeCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "RichVideo"=2 (0x2) "PnkBstrB"=2 (0x2) "PnkBstrA"=2 (0x2) "NMSAccessU"=2 (0x2) "MDM"=2 (0x2) "LightScribeService"=2 (0x2) "JavaQuickStarterService"=2 (0x2) "IDriverT"=3 (0x3) "CesarFTP"=2 (0x2) "avast! Web Scanner"=3 (0x3) "avast! Mail Scanner"=3 (0x3) "avast! Antivirus"=2 (0x2) "aswUpdSv"=2 (0x2) "idsvc"=3 (0x3) "vsmon"=2 (0x2) "npggsvc"=3 (0x3) "C-DillaCdaC11BA"=2 (0x2) "AntiVirService"=2 (0x2) "AntiVirScheduler"=2 (0x2) "NOD32krn"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableOvverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\eMule\\emule.exe"= "e:\\Program Files\\Valve\\hl.exe"= "e:\\Program Files\\Tlen.pl\\tlen.exe"= "e:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "c:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "e:\\Program Files\\ICQ6\\ICQ.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "e:\\Program Files\\BitTorrent\\bittorrent.exe"= "c:\\Documents and Settings\\Admin\\Pulpit\\_STEAM\\CT\\Ventrilo.exe"= "c:\\Program Files\\uTorrent\\utorrent.exe"= "%windir%\\system32\\sessmgr.exe"= "e:\\Program Files\\Steam\\SteamApps\\common\\trackmania nations forever\\TmForever.exe"= "e:\\Program Files\\Steam\\SteamApps\\common\\trackmania nations forever\\TmForeverLauncher.exe"= "c:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 R0 BootScreen;BootScreen;\SystemRoot\\SystemRoot\System32\drivers\vidstub.sys --> \SystemRoot\\SystemRoot\System32\drivers\vidstub.sys [?] R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R1 drwebnet;SpIDer Guard boot hook driver for Windows NT;c:\windows\system32\drivers\drwebnet.sys [2007-09-07 5200] R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-03-22 15424] R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-09-11 12672] R2 dvdmmg;dvdmmg;c:\windows\system32\drivers\dvdmmg.sys [2007-09-06 5504] R2 IOPort;IOPort;c:\windows\system32\drivers\Ioport.sys [2009-03-17 6144] R2 Vcs;Vcs support;c:\windows\system32\drivers\Vcs.sys [2007-05-11 6852] R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2006-09-26 21920] S2 BT878;BtCap, WDM Video Capture;c:\windows\system32\drivers\BT878.SYS [2009-02-13 99206] S2 BTTUNER;BtTuner, WDM TV Tuner;c:\windows\system32\drivers\BTTUNER.SYS [2009-02-13 21824] S2 BTXBAR;BtXBar, WDM Crossbar;c:\windows\system32\drivers\BTXBAR.SYS [2009-02-13 12796] S2 SPIDER;SpIDer FS Monitor for Windows NT; [x] S3 dTVdrvNT;dTVdrvNT; [x] S3 PID_0920;Labtec WebCam(PID_0920);c:\windows\system32\drivers\LV532AV.SYS [2008-10-13 163328] S4 CesarFTP;CesarFTP FTP Server;e:\_webserv\ftp\WebServ(ftp).exe -S --> e:\_webserv\ftp\WebServ(ftp).exe -S [?] S4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S4 spidernt;SpIDer Guard for Windows NT;c:\program files\DrWeb\SPIDERNT.EXE [2007-09-07 74752] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - MBR *Deregistered* - mbr . . ------- Skan uzupełniający ------- . uSearchURL,(Default) = hxxp://www.google.com/search?q=%s LSP: c:\windows\system32\imon.dll FF - ProfilePath - c:\documents and settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\el5yxvdp.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\documents and settings\Admin\Dane aplikacji\Mozilla\plugins\npoctoshape.dll FF - plugin: c:\documents and settings\Admin\Ustawienia lokalne\Dane aplikacji\Octoshape\Octoshape Streaming Services\octoprogram-L03-NMS0808270_SUA_900\npoctoshape.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPBRIDGE.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPCARDS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npCortona.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPDARTS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npImagine.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMAKAOV2.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPPOKER.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPROULETTE.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSLOTS70.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSLOTS80.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSLOTS90.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPWORDS.dll FF - plugin: e:\program files\Real Alternative\browser\plugins\nppl3260.dll FF - plugin: e:\program files\Real Alternative\browser\plugins\nprpjplug.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- . - - - - USUNIĘTO PUSTE WPISY - - - - AddRemove-Age of Empires Expansion Trial 1.00 - e:\program files\Microsoft Games\Age of Empires Expansion Trial\UNINSTX.EXE AddRemove-AimSpiceV2 - c:\documents and settings\admin\pulpit\ele\programy do edycji układów scalonych\aim_prog\DeIsL1.isu AddRemove-AP Guitar Tuner 1.02 - e:\program files\Audio Phonics AddRemove-AP Instrument Tuner 1.02 - e:\program files\Audio Phonics AddRemove-AP Tuner 3.06 - e:\program files\Audio Phonics AddRemove-Borland C++Builder 1.0 - d:\program files\Borland\CBuilder\DeIsL1.isu AddRemove-Bridge Builder PL - c:\bridge builder pl\gra\Uninstal.exe AddRemove-CEAW EDITOR 1.04 - e:\tata\ww2\ceaw_editor_v1.04\CEAW Editor\edytor\uninstall.exe AddRemove-Commander - Europe At War 1.04 - e:\tata\ww2\Commander - Europe At War\uninstall.exe AddRemove-Edytor HTML 1.20_is1 - c:\documents and settings\Admin\Pulpit\Edytor HTML 1.20\unins000.exe AddRemove-HyperCam 2 - e:\_nagr\UnHyCam2.exe AddRemove-Jalbum_0 - c:\documents and settings\Admin\Pulpit\prace\_TPD\OK\beta-3\JAlbum\Uninstall.exe AddRemove-LGeneral_is1 - e:\tata\LGeneral\Panzer\unins000.exe AddRemove-LMS - c:\c_dilla\setup\cdunin16.exe AddRemove-Pop-a-BMP-to-ICO_is1 - c:\documents and settings\Admin\Pulpit\prace\csns\Pluginy\eMMODE\unins000.exe AddRemove-Railroad Pioneer - d:\02_gry\RAILRO~1\unwise.exe AddRemove-SCDNAS - c:\documents and settings\Admin\Pulpit\Radio\uninst-dnas.exe AddRemove-Simutrans_is1 - d:\02_gry\transport PL\Simutrans\unins000.exe AddRemove-SzopaTrackViewer_is1 - c:\tata\EU07-pliki\Szopa Track Viewer\unins000.exe AddRemove-Throttle_is1 - e:\program files\Throttle\unins000.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-05 21:01 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86F4FE00]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\atapi -> 0x86f4fe00 Warning: possible MBR rootkit infection ! user & kernel MBR OK Use "Recovery Console" command "fixmbr" to clear infection ! ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet006\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-823518204-1682526488-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_USERS\S-1-5-21-823518204-1682526488-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F98EB7EA-A9B0-DAA6-EEBE-E0AE5931233F}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "gabcmafhonhfbo"=hex:61,69,6d,6b,69,68,65,6e,6f,62,6f,64,63,6a,67,6c,6f,67,61, 6c,70,67,67,6b,67,66,6c,65,68,61,66,66,6e,6c,6c,67,62,65,6d,6b,6a,6f,62,6f,\ [HKEY_USERS\S-1-5-21-823518204-1682526488-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{FB88F1EF-E1F8-02AE-5014-95F43117FA9C}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "hanlnbaddkojflfd"=hex:65,61,6a,6e,6b,70,63,67,65,61,00,00 "hanlnbadfeeilooo"=hex:65,61,6a,6e,6b,70,63,67,65,61,00,00 "iablfehoepjekbglkk"=hex:69,61,61,69,66,68,70,6e,6a,62,61,65,68,61,6f,67,65,65, 00,c0 "halkcllehbfhdona"=hex:69,61,62,69,69,67,69,6b,66,66,6e,6a,64,6f,62,68,61,66, 00,c0 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FB88F1EF-E1F8-02AE-5014-95F43117FA9C}\InProcServer32*] "japkkhifchgpnpgjgjpn"=hex:69,61,61,69,66,68,70,6e,6a,62,61,65,68,61,6f,67,65, 65,00,c0 "iapkeljkbnppdmmibo"=hex:69,61,62,69,69,67,69,6b,66,66,6e,6a,64,6f,62,68,61,66, 00,c0 . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\LEXBCES.EXE c:\windows\system32\LEXPPS.EXE d:\program files\BurnAware Free\NMSAccess32.exe c:\windows\system32\nvsvc32.exe c:\windows\System32\snmp.exe c:\windows\system32\wdfmgr.exe . ************************************************************************** . Czas ukończenia: 2009-11-05 21:20 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-11-05 20:20 ComboFix2.txt 2007-09-10 17:10 Przed: 4 355 293 184 bajtów wolnych Po: 4 206 866 432 bajtów wolnych Current=6 Default=6 Failed=4 LastKnownGood=7 Sets=1,2,3,4,5,6,7 - - End Of File - - 75EEB50241AB8CAF8DE7A1B167D1C629

**Posty:** 18165 · przez **wojtas** 06 Lis 2009, 17:46

te plik/i :

c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_4ae13d6c.exe
c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_2cd672ae.exe
c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_294823.exe
c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_18be6784.exe

przeskanuj tu
http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie )

wpisz w konsoli odzyskiwania fixmbr

**Posty:** 1340 · przez **eSpEY** 06 Lis 2009, 18:17

http://virusscan.jotti.org/pl/scanresult/caf91960a982a1b00b9c1aa76e5778fb566a4efe/e856870d3f7a006b8e48ce7887a750b1b9883863
http://virusscan.jotti.org/pl/scanresult/caf91960a982a1b00b9c1aa76e5778fb566a4efe/15974ef7bf5e2ad6032d0bda9c629ebb91354757
http://virusscan.jotti.org/pl/scanresult/c0cb9fc13ff5a8c0cf5192e1669062d0b6efa6e6
http://virusscan.jotti.org/pl/scanresult/caf91960a982a1b00b9c1aa76e5778fb566a4efe/e28c2aa96478f17aae4200f0c0160c3ce7e0ed9b

Optymalizację wykonuję zawsze gdy coś najpierw sam działam i okresowo co jakiś czas...

Skan started.

wojtas napisał(a):wpisz w konsoli odzyskiwania fixmbr

[/quote]
tego nie kumam...:>

**Posty:** 1903 · przez **MichuPower** 06 Lis 2009, 18:22

eSpEY napisał(a):tego nie kumam...:>

Wkładasz płytkę z XP, przy oknie wyboru klikasz R i wpisujesz podaną komendę.

**Posty:** 1340 · przez **eSpEY** 06 Lis 2009, 18:27

MaxPower napisał(a):Wkładasz płytkę z XP, przy oknie wyboru klikasz R i wpisujesz podaną komendę.

no to rezygnuję... :lipa:

**Posty:** 18165 · przez **wojtas** 06 Lis 2009, 18:50

to bylo zainstalować z combofixem konsole

dawał taką opcję

**Posty:** 1340 · przez **eSpEY** 06 Lis 2009, 19:01

wojtas napisał(a):to bylo zainstalować z combofixem konsole dawał taką opcję

zainstalowałem...

Dodano Dzisiaj, 11:37 am:

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.41 Wersja bazy definicji: 3111 Windows 5.1.2600 Dodatek Service Pack 2 2009-11-06 22:28:27 mbam-log-2009-11-06 (22-28-23).txt Typ skanowania: Pełne skanowanie (C:\|D:\|E:\|) Przeskanowane obiekty: 689924 Upłynęło: 3 hour(s), 55 minute(s), 11 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 1 Zainfekowane foldery: 0 Zainfekowane pliki: 10 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> No action taken. Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: C:\!KillBox\_gaopdxklvmlrqmitaaisditndxjdbwwrgmymov.dll (Rootkit.TDSS) -> No action taken. C:\Program Files\EasyBurning\compare.exe (Malware.Packer) -> No action taken. C:\qoobox\Quarantine\C\WINDOWS\system32\gaopdxklvmlrqmitaaisditndxjdbwwrgmymov.dll.vir (Rootkit.TDSS) -> No action taken. C:\Documents and Settings\Admin\Pulpit\LOGI ITP\Hack\hideipplatinumv3keygen.exe (Trojan.Downloader) -> No action taken. C:\Documents and Settings\Admin\Pulpit\LOGI ITP\Hack\com\Hide The IP 2.1.1\HideIPSetup.exe (Adware.EShoper) -> No action taken. C:\Documents and Settings\Admin\Pulpit\Śmietnik\Winamp5.0+keymaker_NGEN.exe (Trojan.Downloader) -> No action taken. D:\02_Gry\TV\TV.Station.Manager.v1.1.WinAll.Cracked-CRD\TSMTrial.exe (Adware.EShoper) -> No action taken. E:\Program Files\Selteco\Alligator Flash Designer 7\keygen.exe (Trojan.Downloader) -> No action taken. E:\Program Files\Selteco\Alligator Flash Designer 7 PL\keygen.exe (Trojan.Downloader) -> No action taken. E:\Program Files\Selteco\Alligator Flash Designer 7.9\KeyGen [ Selteco Alligator Flash Designer 7.0.0.7 ].exe (Trojan.Downloader) -> No action taken.

Kwarantanna, a potem usunięte wszystkie.

Dodano Dzisiaj, 7:44 pm:
i co poszło wszystko sobie bo nie wiem czy moge się logować do banku czy na allegro