trojan rdriv.sys - pomożcie.

**Posty:** 8 · przez **mariuszzz** 31 Mar 2008, 21:45

Nod32 wykrywa ale oczywiscie sobie z nim nie radzi

. W komunikacie jest ze rdriv.sys mial miejsce podczas próby otwarcia zbioru ccpa.exe .
Wklejam loga z HijackThis 2.0.2....moze wy wiecie co z tym zrobic. Z góry dzięki

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:30:43, on 2008-03-31
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\System32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\Eset\nod32kui.exe
C:\Tools\skrzynka bogiego\skrzynka.exe
C:\Tools\INCRED~1\bin\IMApp.exe
F:\WINDOWS\System32\drivers\CDAC11BA.EXE
F:\WINDOWS\System32\CTsvcCDA.exe
F:\Program Files\Eset\nod32krn.exe
F:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
F:\WINDOWS\System32\MsPMSPSv.exe
F:\WINDOWS\system32\cmd.exe
F:\WINDOWS\system32\ftp.exe
C:\Tools\Mozilla Firefox\firefox.exe
F:\WINDOWS\explorer.exe
F:\WINDOWS\system32\cleanmgr.exe
C:\Tools\Gadu-Gadu\gg.exe
C:\TOOLS\DAP\DAP.EXE
C:\instalki\HijackThis.exe
F:\WINDOWS\ccpa.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.onet.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.onet.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.onet.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.onet.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Tools\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {CAA4C623-7FB6-2E62-B329-2117576E21B9} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [nod32kui] "F:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [skrzynka bogiego] C:\Tools\skrzynka bogiego\skrzynka.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Tools\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Tools\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1214440339-412668190-839522115-1003\..\Run: [skrzynka bogiego] C:\Tools\skrzynka bogiego\skrzynka.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Tools\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Download with &DAP - C:\TOOLS\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\TOOLS\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Tools\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Tools\WinHTTrack\WinHTTrackIEBar.dll
O15 - Trusted IP range: 213.159.117.202
O15 - Trusted IP range: 213.159.117.202 (HKLM)
O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://C:\nosuch.mht!http://213.159.117.203/dl/adv407/x.chm::/load.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Filter hijack: text/html - {D63ECA19-EEE8-4A44-B735-B61BD59F43CA} - (no file)
O18 - Filter: text/plain - {D63ECA19-EEE8-4A44-B735-B61BD59F43CA} - (no file)
O23 - Service: Ati HotKey Poller - Unknown owner - F:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - F:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - F:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - F:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: system32 master (windowsys) - Unknown owner - F:\WINDOWS\ccpa.exe

--
End of file - 5345 bytes

**Posty:** 7838 · przez **Lukesh** 31 Mar 2008, 21:47

Zastosuj sie do wskazowek z tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
:arrow:

Zrob skan on-line www.ewido.com
:arrow:

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

zastosuj:
SDFix

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

:arrow:

Pokaz log z ComboFix: http://www.programosy.pl/program,combofix.html
:arrow:

na sam koniec wstaw logi z HJ: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 8 · przez **mariuszzz** 31 Mar 2008, 23:56

czytalem juz wczesniej ten temat...porty juz dawno mam poblokowane a SDFix u mnie nie chce działać....jak wciskam Y to wyskakuje brak 3 plików w System32 i każe wcisnąc "Unzip" zeby je dodać...dodaje...i tak w kółko. Skan na ewido wykrył sporo robaków ale rdriv.sys nie usunął....wciąż wyskakuje

. Pozostało mi tylko wrzucenie loga z HijackThis, dlatego też to zrobiłem.

**Posty:** 18165 · przez **wojtas** 01 Kwi 2008, 08:14

to daj loga z combofixa i potem nowego z hijacka

**Posty:** 8 · przez **mariuszzz** 01 Kwi 2008, 16:32

najpierw log z Combofix-a:

ComboFix 08-03-30.5 - HoUsEmuSic 2008-04-01 16:10:41.1 - FAT32x86

Running from: C:\instalki\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\WINDOWS\system32\hqghumea.dll
F:\WINDOWS\system32\plugin1.dat
F:\WINDOWS\system32\SysPr.prx

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_RDRIV

((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
.

2008-04-01 16:03 . 2008-04-01 16:03 62 --a------ F:\WINDOWS\system32\x
2008-04-01 11:35 . 2008-04-01 16:14 7,168 --a------ F:\WINDOWS\system32\rdriv.sys
2008-03-31 20:05 . 2008-03-31 20:11 352 --a------ F:\WINDOWS\system32\tmp.reg
2008-03-31 20:03 . 2007-09-05 23:22 289,144 --a------ F:\WINDOWS\system32\VCCLSID.exe
2008-03-31 20:03 . 2006-04-27 16:49 288,417 --a------ F:\WINDOWS\system32\SrchSTS.exe
2008-03-31 20:03 . 2008-03-28 23:19 86,528 --a------ F:\WINDOWS\system32\VACFix.exe
2008-03-31 20:03 . 2008-03-26 08:50 82,432 --a------ F:\WINDOWS\system32\IEDFix.exe
2008-03-31 20:03 . 2003-06-05 20:13 53,248 --a------ F:\WINDOWS\system32\Process.exe
2008-03-31 20:03 . 2004-07-31 17:50 51,200 --a------ F:\WINDOWS\system32\dumphive.exe
2008-03-31 20:03 . 2007-10-03 23:36 25,600 --a------ F:\WINDOWS\system32\WS2Fix.exe
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d--h----- F:\Documents and Settings\Administrator\Ustawienia lokalne
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Ulubione
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d--h----- F:\Documents and Settings\Administrator\Szablony
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Pulpit
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Moje dokumenty
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> dr------- F:\Documents and Settings\Administrator\Menu Start
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> dr-h----- F:\Documents and Settings\Administrator\Dane aplikacji
2008-03-31 19:48 . 2008-03-31 10:34 <DIR> d-------- F:\SDFix
2008-03-31 19:39 . 2008-03-31 19:41 151,552 --a------ F:\WINDOWS\system32\Java32.com
2008-03-31 19:05 . 2008-03-31 19:11 250 --a------ F:\WINDOWS\gmer.ini
2008-03-31 14:07 . 2008-03-31 14:07 424,960 -r-hs---- F:\WINDOWS\ccpa.exe
2008-03-28 06:37 . 2008-03-28 06:37 1,179,648 ---hs---- F:\WINDOWS\system32\redyLive.exe
2008-03-26 21:35 . 2008-03-26 21:35 <DIR> d--h----- F:\WINDOWS\$xpsp1hfm$
2008-03-26 21:35 . 2004-01-10 06:11 26,112 --a------ F:\WINDOWS\system32\xpsp1hfm.exe
2008-03-26 20:10 . 2008-03-26 20:10 6,428 --ah----- F:\WINDOWS\system32\bkfkque.exe
2008-03-26 20:09 . 2008-03-26 20:05 1,204,224 ---hs---- F:\WINDOWS\system32\msygl32.exe
2008-03-26 20:09 . 2008-03-26 20:09 33,952 --a------ F:\WINDOWS\system32\drivers\oreans32.sys
2008-03-24 18:07 . 2008-03-24 18:07 54,156 --ah----- F:\WINDOWS\QTFont.qfn
2008-03-24 18:07 . 2008-03-24 18:07 1,409 --a------ F:\WINDOWS\QTFont.for
2008-03-12 00:34 . 2008-03-12 00:35 <DIR> d-------- F:\Program Files\Shockwave.com
2008-03-06 18:30 . 2007-12-04 15:44 23,600 --a------ F:\WINDOWS\system32\drivers\TVICHW32.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 14:13 524,288 ---ha-w F:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2008-04-01 14:13 524,288 ---ha-w F:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2008-04-01 14:13 524,288 ---ha-w F:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2008-04-01 14:13 524,288 ---ha-w F:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2008-03-12 21:18 45,056 ----a-w F:\WINDOWS\NCUNINST.EXE
2008-01-17 17:06 1,594,396 ----a-w F:\WINDOWS\WANEUninstaller.exe
2005-11-10 20:04 54 ----a-w F:\Program Files\inc1.bat
2005-11-10 20:04 54 ----a-w F:\Program Files\bit3.bat
2005-11-10 20:04 54 ----a-w F:\Program Files\bit2.bat
2005-11-10 20:04 54 ----a-w F:\Program Files\bit.bat
2005-11-10 20:04 41 ----a-w F:\Program Files\sleep.bat
2005-11-10 20:04 0 ----a-w F:\Program Files\temp3.exe.txt
2005-11-10 20:04 0 ----a-w F:\Program Files\temp2.exe.txt
2005-11-10 20:04 0 ----a-w F:\Program Files\temp1.exe.txt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"skrzynka bogiego"="C:\Tools\skrzynka bogiego\skrzynka.exe" [2002-04-11 22:22 997888]
"IncrediMail"="C:\Tools\INCRED~1\bin\IncMail.exe" [2004-11-14 16:26 188459]
"Gadu-Gadu"="C:\Tools\Gadu-Gadu\gg.exe" [2006-01-31 14:25 2408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="F:\Program Files\Eset\nod32kui.exe" [2006-01-22 10:49 921600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 17:29 13312]
"Gadu-Gadu"="C:\Tools\Gadu-Gadu\gg.exe" [2006-01-31 14:25 2408448]
"IncrediMail"="C:\Tools\IncrediMail\bin\IncMail.exe" [2004-11-14 16:26 188459]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{35B2861B-2B26-4691-9FF0-09083722C736}"= F:\WINDOWS\System32\RadExe.dll [2004-11-28 22:39 212992]

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ Labtec Mouse Software 2.0.lnk]
path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Labtec Mouse Software 2.0.lnk
backup=F:\WINDOWS\pss\ Labtec Mouse Software 2.0.lnkCommon Startup

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdStatus Service]
F:\Program Files\AdStatus Service\AdStatServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-11-30 21:10 344064 F:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
F:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMExtreme]
C:\Tools\BMExtreme\BMExtreme.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2001-10-26 17:29 13312 F:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSetupPatch]
F:\PROGRA~1\Creative\Audio\CTSetup\CtSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cuub]
F:\Documents and Settings\HoUsEmuSic\Dane aplikacji\cruo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeskAd Service]
F:\Program Files\DeskAd Service\DeskAdServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Tools\Nero 7.0\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]
F:\Program Files\Internet Optimizer\optimize.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
F:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
F:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 F:\WINDOWS\System32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Booster]
C:\Tools\PC Booster\PCBooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\process.exe]
F:\WINDOWS\process.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qgevojqves`srinekagx]
F:\WINDOWS\System32\rlygomhac.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2004-12-18 22:40 98304 C:\tools\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\salm]
f:\temp\salm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Service Host]
F:\WINDOWS\System32\Services\{4A3A923F-06AF-4E05-B07D-E359AA50909E}\SVCHOST.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\System Service]
F:\WINDOWS\System32\msrexe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTime]
F:\WINDOWS\System32\systime.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2005-02-13 12:28 180269 F:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Tools\RegistryBooster 2\RegistryBooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinDLL (redyLive.exe)]
---hs---- 2008-03-28 06:37 1179648 F:\WINDOWS\System32\redyLive.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xwqxxcun]
--a------ 2001-10-26 17:30 10240 F:\WINDOWS\System32\r?gsvr32.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="F:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\tools\QuickTime\qttask.exe" -atboottime
"TkBellExe"="F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"DeskAd Service"=F:\Program Files\DeskAd Service\DeskAdServ.exe
"HydraVisionViewPort"=C:\Tools\ATI Technologies\ATI HydraVision\HydraMD.exe
"CTHelper"=CTHELPER.EXE
"Dent dash send extra"=F:\Documents and Settings\All Users\Dane aplikacji\Love tons dent dash\Cast chic.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

R0 AFPAnsi;G-DATA Ukrywacz Ansi;F:\WINDOWS\System32\Drivers\AFPAnsi.sys [2002-10-09 13:53]
R0 FO_PAnt;FotoOffice VirtualDisc Driver;F:\WINDOWS\System32\Drivers\FO_PAnt.sys [2003-07-17 12:56]
R1 moufiltr;Mouse Filter Driver;F:\WINDOWS\System32\drivers\moufiltr.sys [2003-01-23 14:29]
R1 oreans32;oreans32;F:\WINDOWS\system32\drivers\oreans32.sys [2008-03-26 20:09]
R2 PfDetNT;PfDetNT;F:\WINDOWS\System32\drivers\PfModNT.sys [2003-03-05 15:07]
R2 windowsys;system32 master;"F:\WINDOWS\ccpa.exe" [2008-03-31 14:07]
R3 rdriv;rdriv;F:\WINDOWS\system32\rdriv.sys [2008-04-01 16:14]
S3 lac97inf;lac97inf;F:\DOCUME~1\HOUSEM~1\USTAWI~1\Temp\lac97inf.sys []
S4 Tlanauds;Tlanauds;F:\WINDOWS\System32\drivers\rawwan.sys [2001-08-17 21:46]

*Newly Created Service* - RDRIV
.
Contents of the 'Scheduled Tasks' folder
"2008-03-26 18:00:02 F:\WINDOWS\Tasks\B30ACA65954D402D.job"
- f:\docume~1\housem~1\daneap~1\peakpl~1\locks setup 01.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-01 16:14:28
Windows 5.1.2600 FAT NTAPI

scanning hidden processes ...

? [1820]

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: F:\WINDOWS\system32\winlogon.exe
-> F:\WINDOWS\system32\Ati2evxx.dll

PROCESS: F:\WINDOWS\system32\lsass.exe
-> F:\Program Files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
F:\WINDOWS\System32\Ati2evxx.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\System32\drivers\CDAC11BA.EXE
F:\WINDOWS\System32\CTsvcCDA.exe
F:\Program Files\Eset\nod32krn.exe
C:\Tools\INCRED~1\bin\IMApp.exe
F:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
F:\WINDOWS\System32\MsPMSPSv.exe
F:\WINDOWS\System32\imapi.exe
F:\WINDOWS\system32\cleanmgr.exe
F:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-04-01 16:16:53 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-01 14:16:00
Pre-Run: 2,219,008 bajtów wolnych
Post-Run: 5,357,568 bajt˘w wolnych

a to z HijackThis v2.0.2 zrobiony zaraz po powyższym:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:23:17, on 2008-04-01
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\System32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\Eset\nod32kui.exe
C:\Tools\skrzynka bogiego\skrzynka.exe
F:\WINDOWS\System32\drivers\CDAC11BA.EXE
F:\WINDOWS\System32\CTsvcCDA.exe
F:\Program Files\Eset\nod32krn.exe
C:\Tools\INCRED~1\bin\IMApp.exe
F:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
F:\WINDOWS\System32\MsPMSPSv.exe
F:\WINDOWS\explorer.exe
F:\WINDOWS\System32\imapi.exe
F:\WINDOWS\system32\cleanmgr.exe
F:\WINDOWS\system32\rundll32.exe
C:\Tools\Gadu-Gadu\gg.exe
C:\Tools\Mozilla Firefox\firefox.exe
C:\instalki\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.onet.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.onet.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Tools\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [nod32kui] "F:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinDLL (slsass.exe)] rundll32.exe F:\WINDOWS\System32\slsass.exe,start
O4 - HKCU\..\Run: [skrzynka bogiego] C:\Tools\skrzynka bogiego\skrzynka.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Tools\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Tools\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1214440339-412668190-839522115-1003\..\Run: [skrzynka bogiego] C:\Tools\skrzynka bogiego\skrzynka.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Tools\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Download with &DAP - C:\TOOLS\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\TOOLS\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Tools\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Tools\WinHTTrack\WinHTTrackIEBar.dll
O15 - Trusted IP range: 213.159.117.202
O15 - Trusted IP range: 213.159.117.202 (HKLM)
O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://C:\nosuch.mht!http://213.159.117.203/dl/adv407/x.chm::/load.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Filter: text/plain - {D63ECA19-EEE8-4A44-B735-B61BD59F43CA} - (no file)
O23 - Service: Ati HotKey Poller - Unknown owner - F:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - F:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - F:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - F:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: system32 master (windowsys) - Unknown owner - F:\WINDOWS\ccpa.exe

--
End of file - 5257 bytes

**Posty:** 8001 · przez **Okocza** 01 Kwi 2008, 16:52

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: [WinDLL (slsass.exe)] rundll32.exe F:\WINDOWS\System32\slsass.exe,start O18 - Filter: text/plain - {D63ECA19-EEE8-4A44-B735-B61BD59F43CA} - (no file) O15 - Trusted IP range: 213.159.117.202 O15 - Trusted IP range: 213.159.117.202 (HKLM) O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://C:\nosuch.mht!http://213.159.117.203/dl/adv407/x.chm::/load.exe O23 - Service: system32 master (windowsys) - Unknown owner - F:\WINDOWS\ccpa.exe

to usuwasz. spróbuj teraz sdfixa zastosować.

**Posty:** 18165 · przez **wojtas** 01 Kwi 2008, 19:04

Otworz notatnik i wklej w nim to:

File::
F:\WINDOWS\system32\x
F:\WINDOWS\system32\rdriv.sys
F:\WINDOWS\ccpa.exe
F:\WINDOWS\system32\redyLive.exe
F:\WINDOWS\system32\xpsp1hfm.exe
F:\WINDOWS\system32\bkfkque.exe
F:\WINDOWS\system32\msygl32.exe
F:\Program Files\inc1.bat
F:\Program Files\bit3.bat
F:\Program Files\bit2.bat
F:\Program Files\bit.bat
F:\Program Files\sleep.bat
F:\Program Files\temp3.exe.txt
F:\Program Files\temp2.exe.txt
F:\Program Files\temp1.exe.txt
F:\WINDOWS\Tasks\B30ACA65954D402D.job

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\process.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qgevojqves`srinekagx]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\salm]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Service Host]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\System Service]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTime]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinDLL (redyLive.exe)]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xwqxxcun]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Dent dash send extra"=-

Driver::
rdriv
windowsys

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum oraz nowy log z hijacka

**Posty:** 8 · przez **mariuszzz** 01 Kwi 2008, 19:53

Najpierw zrobiłem to co napisal "okocza".....ale SDFixa nie udało sie włączyc....cały czas brakowalo 3 plików

pozniej zrobiłem wszystko z postu "wojtasa"....wklejam log z Combofixa:

ComboFix 08-03-30.5 - HoUsEmuSic 2008-04-01 19:23:38.2 - FAT32x86

Running from: C:\instalki\ComboFix.exe
Command switches used :: C:\instalki\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
F:\Program Files\bit.bat
F:\Program Files\bit2.bat
F:\Program Files\bit3.bat
F:\Program Files\inc1.bat
F:\Program Files\sleep.bat
F:\Program Files\temp1.exe.txt
F:\Program Files\temp2.exe.txt
F:\Program Files\temp3.exe.txt
F:\WINDOWS\ccpa.exe
F:\WINDOWS\system32\bkfkque.exe
F:\WINDOWS\system32\msygl32.exe
F:\WINDOWS\system32\rdriv.sys
F:\WINDOWS\system32\redyLive.exe
F:\WINDOWS\system32\x
F:\WINDOWS\system32\xpsp1hfm.exe
F:\WINDOWS\Tasks\B30ACA65954D402D.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\Program Files\bit.bat
F:\Program Files\bit2.bat
F:\Program Files\bit3.bat
F:\Program Files\inc1.bat
F:\Program Files\sleep.bat
F:\Program Files\temp1.exe.txt
F:\Program Files\temp2.exe.txt
F:\Program Files\temp3.exe.txt
F:\WINDOWS\ccpa.exe
F:\WINDOWS\system32\bkfkque.exe
F:\WINDOWS\system32\msygl32.exe
F:\WINDOWS\system32\rdriv.sys
F:\WINDOWS\system32\redyLive.exe
F:\WINDOWS\system32\xpsp1hfm.exe
F:\WINDOWS\Tasks\B30ACA65954D402D.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_RDRIV
-------\Legacy_WINDOWSYS
-------\Service_rdriv
-------\Service_windowsys

((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
.

2008-04-01 16:16 . 2008-04-01 16:16 81,920 ---hs---- F:\WINDOWS\system32\slsass.exe
2008-03-31 20:05 . 2008-03-31 20:11 352 --a------ F:\WINDOWS\system32\tmp.reg
2008-03-31 20:03 . 2007-09-05 23:22 289,144 --a------ F:\WINDOWS\system32\VCCLSID.exe
2008-03-31 20:03 . 2006-04-27 16:49 288,417 --a------ F:\WINDOWS\system32\SrchSTS.exe
2008-03-31 20:03 . 2008-03-28 23:19 86,528 --a------ F:\WINDOWS\system32\VACFix.exe
2008-03-31 20:03 . 2008-03-26 08:50 82,432 --a------ F:\WINDOWS\system32\IEDFix.exe
2008-03-31 20:03 . 2003-06-05 20:13 53,248 --a------ F:\WINDOWS\system32\Process.exe
2008-03-31 20:03 . 2004-07-31 17:50 51,200 --a------ F:\WINDOWS\system32\dumphive.exe
2008-03-31 20:03 . 2007-10-03 23:36 25,600 --a------ F:\WINDOWS\system32\WS2Fix.exe
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d--h----- F:\Documents and Settings\Administrator\Ustawienia lokalne
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Ulubione
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d--h----- F:\Documents and Settings\Administrator\Szablony
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Pulpit
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Moje dokumenty
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> dr------- F:\Documents and Settings\Administrator\Menu Start
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> dr-h----- F:\Documents and Settings\Administrator\Dane aplikacji
2008-03-31 19:48 . 2008-03-31 10:34 <DIR> d-------- F:\SDFix
2008-03-31 19:39 . 2008-03-31 19:41 151,552 --a------ F:\WINDOWS\system32\Java32.com
2008-03-31 19:05 . 2008-03-31 19:11 250 --a------ F:\WINDOWS\gmer.ini
2008-03-26 21:35 . 2008-03-26 21:35 <DIR> d--h----- F:\WINDOWS\$xpsp1hfm$
2008-03-26 20:09 . 2008-03-26 20:09 33,952 --a------ F:\WINDOWS\system32\drivers\oreans32.sys
2008-03-24 18:07 . 2008-03-24 18:07 54,156 --ah----- F:\WINDOWS\QTFont.qfn
2008-03-24 18:07 . 2008-03-24 18:07 1,409 --a------ F:\WINDOWS\QTFont.for
2008-03-12 00:34 . 2008-03-12 00:35 <DIR> d-------- F:\Program Files\Shockwave.com
2008-03-06 18:30 . 2007-12-04 15:44 23,600 --a------ F:\WINDOWS\system32\drivers\TVICHW32.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 17:25 524,288 ---ha-w F:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2008-04-01 17:25 524,288 ---ha-w F:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2008-04-01 17:25 524,288 ---ha-w F:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2008-04-01 17:25 524,288 ---ha-w F:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2008-03-12 21:18 45,056 ----a-w F:\WINDOWS\NCUNINST.EXE
2008-01-17 17:06 1,594,396 ----a-w F:\WINDOWS\WANEUninstaller.exe
.

((((((((((((((((((((((((((((( snapshot@2008-04-01_16.15.12.88 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-31 17:45:34 16,384 ----a-w F:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-04-01 14:16:34 16,384 ----a-w F:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-03-31 17:45:34 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
+ 2008-04-01 14:16:34 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
- 2008-03-31 17:45:34 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-01 14:16:34 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
- 2006-01-09 18:04:16 52,764 ----a-w F:\WINDOWS\system32\perfc009.dat
+ 2008-04-01 14:15:44 52,764 ----a-w F:\WINDOWS\system32\perfc009.dat
- 2006-01-09 18:04:16 67,078 ----a-w F:\WINDOWS\system32\perfc015.dat
+ 2008-04-01 14:15:44 67,078 ----a-w F:\WINDOWS\system32\perfc015.dat
- 2006-01-09 18:04:16 380,350 ----a-w F:\WINDOWS\system32\perfh009.dat
+ 2008-04-01 14:15:44 380,350 ----a-w F:\WINDOWS\system32\perfh009.dat
- 2006-01-09 18:04:16 435,978 ----a-w F:\WINDOWS\system32\perfh015.dat
+ 2008-04-01 14:15:44 435,978 ----a-w F:\WINDOWS\system32\perfh015.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"skrzynka bogiego"="C:\Tools\skrzynka bogiego\skrzynka.exe" [2002-04-11 22:22 997888]
"IncrediMail"="C:\Tools\INCRED~1\bin\IncMail.exe" [2004-11-14 16:26 188459]
"Gadu-Gadu"="C:\Tools\Gadu-Gadu\gg.exe" [2006-01-31 14:25 2408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="F:\Program Files\Eset\nod32kui.exe" [2006-01-22 10:49 921600]
"WinDLL (slsass.exe)"="F:\WINDOWS\System32\slsass.exe" [2008-04-01 16:16 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 17:29 13312]
"Gadu-Gadu"="C:\Tools\Gadu-Gadu\gg.exe" [2006-01-31 14:25 2408448]
"IncrediMail"="C:\Tools\IncrediMail\bin\IncMail.exe" [2004-11-14 16:26 188459]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{35B2861B-2B26-4691-9FF0-09083722C736}"= F:\WINDOWS\System32\RadExe.dll [2004-11-28 22:39 212992]

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ Labtec Mouse Software 2.0.lnk]
path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Labtec Mouse Software 2.0.lnk
backup=F:\WINDOWS\pss\ Labtec Mouse Software 2.0.lnkCommon Startup

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdStatus Service]
F:\Program Files\AdStatus Service\AdStatServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-11-30 21:10 344064 F:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
F:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMExtreme]
C:\Tools\BMExtreme\BMExtreme.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2001-10-26 17:29 13312 F:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSetupPatch]
F:\PROGRA~1\Creative\Audio\CTSetup\CtSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cuub]
F:\Documents and Settings\HoUsEmuSic\Dane aplikacji\cruo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeskAd Service]
F:\Program Files\DeskAd Service\DeskAdServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Tools\Nero 7.0\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
F:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
F:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 F:\WINDOWS\System32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Booster]
C:\Tools\PC Booster\PCBooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2004-12-18 22:40 98304 C:\tools\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2005-02-13 12:28 180269 F:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Tools\RegistryBooster 2\RegistryBooster.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="F:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\tools\QuickTime\qttask.exe" -atboottime
"TkBellExe"="F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"DeskAd Service"=F:\Program Files\DeskAd Service\DeskAdServ.exe
"HydraVisionViewPort"=C:\Tools\ATI Technologies\ATI HydraVision\HydraMD.exe
"CTHelper"=CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-01 19:27:05
Windows 5.1.2600 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: F:\WINDOWS\system32\winlogon.exe
-> F:\WINDOWS\system32\Ati2evxx.dll

PROCESS: F:\WINDOWS\system32\lsass.exe
-> F:\Program Files\Eset\pr_imon.dll

PROCESS: F:\WINDOWS\explorer.exe
-> C:\Tools\Gadu-Gadu\ggwhook.dll
.
------------------------ Other Running Processes ------------------------
.
F:\WINDOWS\System32\Ati2evxx.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\System32\rundll32.exe
F:\WINDOWS\System32\drivers\CDAC11BA.EXE
F:\WINDOWS\System32\CTsvcCDA.exe
C:\Tools\INCRED~1\bin\IMApp.exe
F:\Program Files\Eset\nod32krn.exe
F:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
F:\WINDOWS\System32\MsPMSPSv.exe
F:\WINDOWS\system32\cmd.exe
F:\WINDOWS\system32\ftp.exe
F:\WINDOWS\System32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-04-01 19:29:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-01 17:28:20
ComboFix2.txt 2008-04-01 14:16:56
Pre-Run: 3,849,216 bajtów wolnych
Post-Run: 3,761,152 bajt˘w wolnych

i log z HijackThis v2.0.2 :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:42:22, on 2008-04-01
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Safe mode

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\Explorer.EXE
C:\instalki\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.onet.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.onet.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Tools\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [nod32kui] "F:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [skrzynka bogiego] C:\Tools\skrzynka bogiego\skrzynka.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Tools\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Tools\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Gadu-Gadu] "C:\Tools\Gadu-Gadu\gg.exe" /tray (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [IncrediMail] C:\Tools\IncrediMail\bin\IncMail.exe /c (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Tools\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Download with &DAP - C:\TOOLS\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\TOOLS\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Tools\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Tools\WinHTTrack\WinHTTrackIEBar.dll
O15 - Trusted IP range: 213.159.117.202
O15 - Trusted IP range: 213.159.117.202 (HKLM)
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Ati HotKey Poller - Unknown owner - F:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - F:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - F:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - F:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 4191 bytes

**Posty:** 18165 · przez **wojtas** 01 Kwi 2008, 20:44

O15 - Trusted IP range: 213.159.117.202
O15 - Trusted IP range: 213.159.117.202 (HKLM)

Uruchamiasz HijackThis => klikasz Do a system scan only => pokaże się lista wpisów => stawiasz ptaszek przy wpisach, które wymieniłem => klikasz Fix checked i potwierdzasz usunięcie.

przeskanuj ten plik:

F:\WINDOWS\system32\Java32.com

tu:

http://www.virustotal.com/

i zapisz sobie raport ze skanu

wklej do notatnika:

File::
F:\WINDOWS\system32\slsass.exe
F:\DOCUME~1\HOUSEM~1\USTAWI~1\Temp\lac97inf.sys

Driver::
lac97inf

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinDLL (slsass.exe)"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum oraz raport ze skanu

**Posty:** 8 · przez **mariuszzz** 01 Kwi 2008, 23:37

Moj antywir (Nod32) wciaz pokazuje ze jest jakis trojan, tym razem (po tych wszystkich zabiegach) nie jest to juz rdriv.sys ale ccpa.exe

raport ze skanu Virus Total:

Antywirus Wersja Ostatnia aktualizacja Wynik
AntiVir 7.6.0.78 2008.04.01 HEUR/Malware
Avast 4.7.1098.0 2008.03.31 Win32:EggDrop-AC
AVG 7.5.0.516 2008.04.01 IRC/BackDoor.SdBot3.THV
BitDefender 7.2 2008.04.01 Trojan.Agent.AHOX
ClamAV 0.92.1 2008.04.01 Trojan.Mybot-8707
DrWeb 4.44.0.09170 2008.04.01 Win32.HLLW.MyBot
eSafe 7.0.15.0 2008.04.01 Suspicious File
F-Secure 6.70.13260.0 2008.04.01 Backdoor.Win32.Rbot.ecn
Kaspersky 7.0.0.125 2008.04.01 Backdoor.Win32.Rbot.ecn
Microsoft 1.3301 2008.04.01 Backdoor:Win32/Rbot
Norman 5.80.02 2008.04.01 W32/Spybot.CCJQ
Panda 9.0.0.4 2008.04.01 W32/Gaobot.OXI.worm
Rising 20.38.12.00 2008.04.01 Backdoor.Win32.Rbot.ecn
Sophos 4.28.0 2008.04.01 Sus/ComPack-C
Sunbelt 3.0.978.0 2008.03.18 VIPRE.Suspicious
Symantec 10 2008.04.01 W32.IRCbot
VirusBuster 4.3.26:9 2008.04.01 Worm.Rbot.UWM
Webwasher-Gateway 6.6.2 2008.04.01 Heuristic.Malware

Dodatkowe informacje
File size: 151552 bytes
MD5: c9554ba0d049605e3047777883c919f9
SHA1: 8e202f985640c0a519eba6a519310b74bc4009a6
PEiD: ASProtect v1.23 RC1
packers: ASProtect
packers: Aspack
packers: PE_Patch

log z ComboFixa:

ComboFix 08-03-30.5 - HoUsEmuSic 2008-04-01 23:22:14.3 - FAT32x86

Running from: C:\instalki\ComboFix.exe
Command switches used :: C:\instalki\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
F:\DOCUME~1\HOUSEM~1\USTAWI~1\Temp\lac97inf.sys
F:\WINDOWS\system32\slsass.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\WINDOWS\system32\slsass.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_LAC97INF
-------\Service_lac97inf

((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
.

2008-04-01 20:09 . 2008-04-01 20:09 1,134,592 ---hs---- F:\WINDOWS\system32\mysnlive.exe
2008-04-01 19:56 . 2008-04-01 19:56 <DIR> d--hs---- F:\FOUND.000
2008-03-31 20:05 . 2008-03-31 20:11 352 --a------ F:\WINDOWS\system32\tmp.reg
2008-03-31 20:03 . 2007-09-05 23:22 289,144 --a------ F:\WINDOWS\system32\VCCLSID.exe
2008-03-31 20:03 . 2006-04-27 16:49 288,417 --a------ F:\WINDOWS\system32\SrchSTS.exe
2008-03-31 20:03 . 2008-03-28 23:19 86,528 --a------ F:\WINDOWS\system32\VACFix.exe
2008-03-31 20:03 . 2008-03-26 08:50 82,432 --a------ F:\WINDOWS\system32\IEDFix.exe
2008-03-31 20:03 . 2003-06-05 20:13 53,248 --a------ F:\WINDOWS\system32\Process.exe
2008-03-31 20:03 . 2004-07-31 17:50 51,200 --a------ F:\WINDOWS\system32\dumphive.exe
2008-03-31 20:03 . 2007-10-03 23:36 25,600 --a------ F:\WINDOWS\system32\WS2Fix.exe
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d--h----- F:\Documents and Settings\Administrator\Ustawienia lokalne
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Ulubione
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d--h----- F:\Documents and Settings\Administrator\Szablony
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Pulpit
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Moje dokumenty
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> dr------- F:\Documents and Settings\Administrator\Menu Start
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> dr-h----- F:\Documents and Settings\Administrator\Dane aplikacji
2008-03-31 19:48 . 2008-03-31 10:34 <DIR> d-------- F:\SDFix
2008-03-31 19:39 . 2008-03-31 19:41 151,552 --a------ F:\WINDOWS\system32\Java32.com
2008-03-31 19:05 . 2008-03-31 19:11 250 --a------ F:\WINDOWS\gmer.ini
2008-03-26 21:35 . 2008-03-26 21:35 <DIR> d--h----- F:\WINDOWS\$xpsp1hfm$
2008-03-26 20:09 . 2008-03-26 20:09 33,952 --a------ F:\WINDOWS\system32\drivers\oreans32.sys
2008-03-24 18:07 . 2008-03-24 18:07 54,156 --ah----- F:\WINDOWS\QTFont.qfn
2008-03-24 18:07 . 2008-03-24 18:07 1,409 --a------ F:\WINDOWS\QTFont.for
2008-03-12 00:34 . 2008-03-12 00:35 <DIR> d-------- F:\Program Files\Shockwave.com
2008-03-06 18:30 . 2007-12-04 15:44 23,600 --a------ F:\WINDOWS\system32\drivers\TVICHW32.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 21:25 524,288 ---ha-w F:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2008-04-01 21:25 524,288 ---ha-w F:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2008-04-01 21:25 524,288 ---ha-w F:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2008-04-01 21:25 524,288 ---ha-w F:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2008-03-12 21:18 45,056 ----a-w F:\WINDOWS\NCUNINST.EXE
2008-01-17 17:06 1,594,396 ----a-w F:\WINDOWS\WANEUninstaller.exe
.

((((((((((((((((((((((((((((( snapshot@2008-04-01_16.15.12.88 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-31 17:45:34 16,384 ----a-w F:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-04-01 18:09:56 16,384 ----a-w F:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-03-31 17:45:34 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
+ 2008-04-01 18:09:56 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
- 2008-03-31 17:45:34 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-01 18:09:56 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
- 2006-01-09 18:04:16 52,764 ----a-w F:\WINDOWS\system32\perfc009.dat
+ 2008-04-01 14:15:44 52,764 ----a-w F:\WINDOWS\system32\perfc009.dat
- 2006-01-09 18:04:16 67,078 ----a-w F:\WINDOWS\system32\perfc015.dat
+ 2008-04-01 14:15:44 67,078 ----a-w F:\WINDOWS\system32\perfc015.dat
- 2006-01-09 18:04:16 380,350 ----a-w F:\WINDOWS\system32\perfh009.dat
+ 2008-04-01 14:15:44 380,350 ----a-w F:\WINDOWS\system32\perfh009.dat
- 2006-01-09 18:04:16 435,978 ----a-w F:\WINDOWS\system32\perfh015.dat
+ 2008-04-01 14:15:44 435,978 ----a-w F:\WINDOWS\system32\perfh015.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"skrzynka bogiego"="C:\Tools\skrzynka bogiego\skrzynka.exe" [2002-04-11 22:22 997888]
"IncrediMail"="C:\Tools\INCRED~1\bin\IncMail.exe" [2004-11-14 16:26 188459]
"Gadu-Gadu"="C:\Tools\Gadu-Gadu\gg.exe" [2006-01-31 14:25 2408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="F:\Program Files\Eset\nod32kui.exe" [2006-01-22 10:49 921600]
"WinDLL (mysnlive.exe)"="F:\WINDOWS\System32\mysnlive.exe" [2008-04-01 20:09 1134592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 17:29 13312]
"Gadu-Gadu"="C:\Tools\Gadu-Gadu\gg.exe" [2006-01-31 14:25 2408448]
"IncrediMail"="C:\Tools\IncrediMail\bin\IncMail.exe" [2004-11-14 16:26 188459]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{35B2861B-2B26-4691-9FF0-09083722C736}"= F:\WINDOWS\System32\RadExe.dll [2004-11-28 22:39 212992]

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ Labtec Mouse Software 2.0.lnk]
path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Labtec Mouse Software 2.0.lnk
backup=F:\WINDOWS\pss\ Labtec Mouse Software 2.0.lnkCommon Startup

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdStatus Service]
F:\Program Files\AdStatus Service\AdStatServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-11-30 21:10 344064 F:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
F:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMExtreme]
C:\Tools\BMExtreme\BMExtreme.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2001-10-26 17:29 13312 F:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSetupPatch]
F:\PROGRA~1\Creative\Audio\CTSetup\CtSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cuub]
F:\Documents and Settings\HoUsEmuSic\Dane aplikacji\cruo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeskAd Service]
F:\Program Files\DeskAd Service\DeskAdServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Tools\Nero 7.0\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
F:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
F:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 F:\WINDOWS\System32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Booster]
C:\Tools\PC Booster\PCBooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2004-12-18 22:40 98304 C:\tools\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2005-02-13 12:28 180269 F:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Tools\RegistryBooster 2\RegistryBooster.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="F:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\tools\QuickTime\qttask.exe" -atboottime
"TkBellExe"="F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"DeskAd Service"=F:\Program Files\DeskAd Service\DeskAdServ.exe
"HydraVisionViewPort"=C:\Tools\ATI Technologies\ATI HydraVision\HydraMD.exe
"CTHelper"=CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

R0 AFPAnsi;G-DATA Ukrywacz Ansi;F:\WINDOWS\System32\Drivers\AFPAnsi.sys [2002-10-09 13:53]
R0 FO_PAnt;FotoOffice VirtualDisc Driver;F:\WINDOWS\System32\Drivers\FO_PAnt.sys [2003-07-17 12:56]
R1 moufiltr;Mouse Filter Driver;F:\WINDOWS\System32\drivers\moufiltr.sys [2003-01-23 14:29]
R1 oreans32;oreans32;F:\WINDOWS\system32\drivers\oreans32.sys [2008-03-26 20:09]
R2 PfDetNT;PfDetNT;F:\WINDOWS\System32\drivers\PfModNT.sys [2003-03-05 15:07]
S4 Tlanauds;Tlanauds;F:\WINDOWS\System32\drivers\rawwan.sys [2001-08-17 21:46]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-01 23:26:20
Windows 5.1.2600 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: F:\WINDOWS\system32\winlogon.exe
-> F:\WINDOWS\system32\Ati2evxx.dll

PROCESS: F:\WINDOWS\system32\lsass.exe
-> F:\Program Files\Eset\pr_imon.dll

PROCESS: F:\WINDOWS\explorer.exe
-> C:\Tools\Gadu-Gadu\ggwhook.dll
.
------------------------ Other Running Processes ------------------------
.
F:\WINDOWS\System32\Ati2evxx.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\System32\rundll32.exe
C:\Tools\INCRED~1\bin\IMApp.exe
F:\WINDOWS\System32\drivers\CDAC11BA.EXE
F:\WINDOWS\System32\CTsvcCDA.exe
F:\Program Files\Eset\nod32krn.exe
F:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
F:\WINDOWS\System32\MsPMSPSv.exe
F:\WINDOWS\System32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-04-01 23:29:04 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-01 21:28:14
ComboFix3.txt 2008-04-01 14:16:56
ComboFix2.txt 2008-04-01 17:29:12
Pre-Run: 28,180,480 bajtów wolnych
Post-Run: 6,477,824 bajt˘w wolnych

**Posty:** 18165 · przez **wojtas** 02 Kwi 2008, 15:41

zainstaluj

http://www.programosy.pl/program,comodo-firewall.html

wklej do notatnika:

File::
F:\WINDOWS\system32\mysnlive.exe
F:\WINDOWS\system32\Java32.com

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinDLL (mysnlive.exe)"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 8 · przez **mariuszzz** 02 Kwi 2008, 16:09

niestety comodo nie moge zainstalowac bo nie mam SP2 a z kolei SP2 nie zainstaluje bo mam za malo miejsca na systemowym

juz nie moge z tym trojanem, wczoraj mi sie na chwile pokazalo okno odliczające 60sek. do zamknięcia systemu....cos tam było o procesie lsass.exe

a tu log z Combo:

ComboFix 08-03-30.5 - HoUsEmuSic 2008-04-02 16:00:45.4 - FAT32x86

Running from: C:\instalki\ComboFix.exe
Command switches used :: C:\instalki\CFScript.txt
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
F:\WINDOWS\system32\Java32.com
F:\WINDOWS\system32\mysnlive.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\WINDOWS\system32\Java32.com
F:\WINDOWS\system32\mysnlive.exe

.
((((((((((((((((((((((((( Files Created from 2008-03-02 to 2008-04-02 )))))))))))))))))))))))))))))))
.

2008-04-01 19:56 . 2008-04-01 19:56 <DIR> d--hs---- F:\FOUND.000
2008-03-31 20:05 . 2008-03-31 20:11 352 --a------ F:\WINDOWS\system32\tmp.reg
2008-03-31 20:03 . 2007-09-05 23:22 289,144 --a------ F:\WINDOWS\system32\VCCLSID.exe
2008-03-31 20:03 . 2006-04-27 16:49 288,417 --a------ F:\WINDOWS\system32\SrchSTS.exe
2008-03-31 20:03 . 2008-03-28 23:19 86,528 --a------ F:\WINDOWS\system32\VACFix.exe
2008-03-31 20:03 . 2008-03-26 08:50 82,432 --a------ F:\WINDOWS\system32\IEDFix.exe
2008-03-31 20:03 . 2003-06-05 20:13 53,248 --a------ F:\WINDOWS\system32\Process.exe
2008-03-31 20:03 . 2004-07-31 17:50 51,200 --a------ F:\WINDOWS\system32\dumphive.exe
2008-03-31 20:03 . 2007-10-03 23:36 25,600 --a------ F:\WINDOWS\system32\WS2Fix.exe
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d--h----- F:\Documents and Settings\Administrator\Ustawienia lokalne
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Ulubione
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d--h----- F:\Documents and Settings\Administrator\Szablony
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Pulpit
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> d-------- F:\Documents and Settings\Administrator\Moje dokumenty
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> dr------- F:\Documents and Settings\Administrator\Menu Start
2008-03-31 19:51 . 2004-12-04 12:56 <DIR> dr-h----- F:\Documents and Settings\Administrator\Dane aplikacji
2008-03-31 19:48 . 2008-03-31 10:34 <DIR> d-------- F:\SDFix
2008-03-31 19:05 . 2008-03-31 19:11 250 --a------ F:\WINDOWS\gmer.ini
2008-03-26 21:35 . 2008-03-26 21:35 <DIR> d--h----- F:\WINDOWS\$xpsp1hfm$
2008-03-26 20:09 . 2008-03-26 20:09 33,952 --a------ F:\WINDOWS\system32\drivers\oreans32.sys
2008-03-24 18:07 . 2008-03-24 18:07 54,156 --ah----- F:\WINDOWS\QTFont.qfn
2008-03-24 18:07 . 2008-03-24 18:07 1,409 --a------ F:\WINDOWS\QTFont.for
2008-03-12 00:34 . 2008-03-12 00:35 <DIR> d-------- F:\Program Files\Shockwave.com
2008-03-06 18:30 . 2007-12-04 15:44 23,600 --a------ F:\WINDOWS\system32\drivers\TVICHW32.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-12 21:18 45,056 ----a-w F:\WINDOWS\NCUNINST.EXE
2008-01-17 17:06 1,594,396 ----a-w F:\WINDOWS\WANEUninstaller.exe
.

((((((((((((((((((((((((((((( snapshot@2008-04-01_16.15.12.88 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-31 17:45:34 16,384 ----a-w F:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-04-01 18:09:56 16,384 ----a-w F:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-03-31 17:45:34 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
+ 2008-04-01 18:09:56 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
- 2008-03-31 17:45:34 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-01 18:09:56 32,768 ----a-w F:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
- 2006-01-09 18:04:16 52,764 ----a-w F:\WINDOWS\system32\perfc009.dat
+ 2008-04-01 14:15:44 52,764 ----a-w F:\WINDOWS\system32\perfc009.dat
- 2006-01-09 18:04:16 67,078 ----a-w F:\WINDOWS\system32\perfc015.dat
+ 2008-04-01 14:15:44 67,078 ----a-w F:\WINDOWS\system32\perfc015.dat
- 2006-01-09 18:04:16 380,350 ----a-w F:\WINDOWS\system32\perfh009.dat
+ 2008-04-01 14:15:44 380,350 ----a-w F:\WINDOWS\system32\perfh009.dat
- 2006-01-09 18:04:16 435,978 ----a-w F:\WINDOWS\system32\perfh015.dat
+ 2008-04-01 14:15:44 435,978 ----a-w F:\WINDOWS\system32\perfh015.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"skrzynka bogiego"="C:\Tools\skrzynka bogiego\skrzynka.exe" [2002-04-11 22:22 997888]
"IncrediMail"="C:\Tools\INCRED~1\bin\IncMail.exe" [2004-11-14 16:26 188459]
"Gadu-Gadu"="C:\Tools\Gadu-Gadu\gg.exe" [2006-01-31 14:25 2408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="F:\Program Files\Eset\nod32kui.exe" [2006-01-22 10:49 921600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 17:29 13312]
"Gadu-Gadu"="C:\Tools\Gadu-Gadu\gg.exe" [2006-01-31 14:25 2408448]
"IncrediMail"="C:\Tools\IncrediMail\bin\IncMail.exe" [2004-11-14 16:26 188459]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{35B2861B-2B26-4691-9FF0-09083722C736}"= F:\WINDOWS\System32\RadExe.dll [2004-11-28 22:39 212992]

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ Labtec Mouse Software 2.0.lnk]
path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Labtec Mouse Software 2.0.lnk
backup=F:\WINDOWS\pss\ Labtec Mouse Software 2.0.lnkCommon Startup

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdStatus Service]
F:\Program Files\AdStatus Service\AdStatServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-11-30 21:10 344064 F:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
F:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMExtreme]
C:\Tools\BMExtreme\BMExtreme.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2001-10-26 17:29 13312 F:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSetupPatch]
F:\PROGRA~1\Creative\Audio\CTSetup\CtSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cuub]
F:\Documents and Settings\HoUsEmuSic\Dane aplikacji\cruo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeskAd Service]
F:\Program Files\DeskAd Service\DeskAdServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Tools\Nero 7.0\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
F:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
F:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 F:\WINDOWS\System32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Booster]
C:\Tools\PC Booster\PCBooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2004-12-18 22:40 98304 C:\tools\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2005-02-13 12:28 180269 F:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Tools\RegistryBooster 2\RegistryBooster.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="F:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\tools\QuickTime\qttask.exe" -atboottime
"TkBellExe"="F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"DeskAd Service"=F:\Program Files\DeskAd Service\DeskAdServ.exe
"HydraVisionViewPort"=C:\Tools\ATI Technologies\ATI HydraVision\HydraMD.exe
"CTHelper"=CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-02 16:01:56
Windows 5.1.2600 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: F:\WINDOWS\system32\winlogon.exe
-> F:\WINDOWS\system32\Ati2evxx.dll

PROCESS: F:\WINDOWS\system32\lsass.exe
-> F:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-04-02 16:03:19
ComboFix-quarantined-files.txt 2008-04-02 14:02:30
ComboFix4.txt 2008-04-01 14:16:56
ComboFix3.txt 2008-04-01 17:29:12
ComboFix2.txt 2008-04-01 21:29:06
Pre-Run: 14,318,592 bajtów wolnych
Post-Run: 1,640,448 bajtów wolnych

**Posty:** 18165 · przez **wojtas** 02 Kwi 2008, 20:47

Wykonaj to co jest podane w tym temacie

gdzie CI jeszcze wykrywa wirusa?

**Posty:** 8 · przez **mariuszzz** 02 Kwi 2008, 21:48

WWDC zrobiłem juz dawno, prócz tego zabezbieczyc tez Seconfig-iem XP?

na razie NOD nie wykrywa...zobaczymy jak zrestartuje kompa.

**Posty:** 18165 · przez **wojtas** 02 Kwi 2008, 22:08

mariuszzz napisał(a):zabezbieczyc tez Seconfig-iem XP?

tak zrob to

mariuszzz napisał(a):na razie NOD nie wykrywa...zobaczymy jak zrestartuje kompa.

daj znac jak cos

trojan rdriv.sys - pomożcie.

trojan rdriv.sys - pomożcie.

Kto jest na forum