Trojan tr/crypt.xpack.gen

**Posty:** 52 · przez **msgarden** 15 Paź 2009, 00:59

Witam,
jak w temacie, AV wynalazł mi coś takiego. Mógłby mi ktoś doradzić jak to usunąć? Szukałem w internecie na ten temat informacji, ale nie znam się zbytnio na tym i wolę zapytać :-|

Podaję link do loga z RSIT, ponieważ był za długi aby go wkleić: http://wklej.org/id/175675/

**Posty:** 8001 · przez **Okocza** 15 Paź 2009, 12:21

msgarden, daj log z combofixa

**Posty:** 52 · przez **msgarden** 15 Paź 2009, 12:36

oto on:

Kod: Zaznacz wszystko: ComboFix 09-10-14.01 - MikA 2009-10-15 0:15.1.2 - NTFSx86 Microsoft® Windows Vista™ Business 6.0.6001.1.1250.48.1045.18.1789.999 [GMT 2:00] Uruchomiony z: c:\users\MikA\Desktop\ComboFix.exe AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} SP: AntiVir Desktop *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-918056312-2952985149-2686913973-500 . ((((((((((((((((((((((((( Pliki utworzone od 2009-09-14 do 2009-10-14 ))))))))))))))))))))))))))))))) . 2009-10-14 22:25 . 2009-10-14 22:25 -------- d-----w- c:\users\Default\AppData\Local\temp 2009-10-13 20:42 . 2009-10-13 20:42 -------- d-----w- c:\programdata\Diskeeper Corporation 2009-10-13 20:42 . 2009-10-13 20:42 -------- d-----w- c:\program files\Diskeeper Corporation 2009-10-11 18:04 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2009-10-11 18:04 . 2008-03-08 04:21 1695744 ----a-w- c:\windows\system32\gameux.dll 2009-10-11 18:04 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-10-11 14:57 . 2009-10-11 14:57 -------- d-----w- c:\program files\Easy CD-DA Extractor 11 2009-10-11 14:57 . 2009-10-11 14:57 -------- d-----w- c:\windows\Easy CD-DA Extractor 11.0.3 2009-10-10 13:01 . 2009-10-10 13:01 -------- d-----w- c:\program files\AIMP2 2009-10-07 21:42 . 2009-10-14 21:29 -------- d-----w- c:\users\MikA\AppData\Roaming\Skype 2009-10-07 21:41 . 2009-10-07 21:41 -------- d-----w- c:\program files\Skype 2009-10-07 21:41 . 2009-10-07 21:41 -------- d-----w- c:\program files\Common Files\Skype 2009-10-04 18:26 . 2009-10-04 18:31 -------- d-----w- c:\program files\SubEdit-Player 2009-10-04 17:55 . 2009-10-04 17:56 -------- d-----w- c:\users\MikA\AppData\Roaming\Media Player Classic 2009-10-04 17:53 . 2007-09-04 16:56 164352 ----a-w- c:\windows\system32\unrar.dll 2009-10-04 17:53 . 2008-01-10 12:15 755027 ----a-w- c:\windows\system32\xvidcore.dll 2009-10-04 17:53 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll 2009-10-04 17:53 . 2008-01-10 12:16 159839 ----a-w- c:\windows\system32\xvidvfw.dll 2009-10-04 17:53 . 2008-07-25 08:34 81920 ----a-w- c:\windows\system32\dpl100.dll 2009-10-04 17:53 . 2008-07-23 16:50 3596288 ----a-w- c:\windows\system32\qt-dx331.dll 2009-10-04 17:53 . 2008-07-25 08:34 683520 ----a-w- c:\windows\system32\divx.dll 2009-10-04 17:53 . 2008-06-12 18:36 7680 ----a-w- c:\windows\system32\ff_vfw.dll 2009-10-04 17:53 . 2004-01-11 22:00 348160 ----a-w- c:\windows\system32\msvcr71.dll 2009-10-04 17:53 . 2009-10-04 17:53 -------- d-----w- c:\program files\K-Lite Codec Pack 2009-10-03 21:47 . 2009-10-03 21:46 411368 ----a-w- c:\windows\system32\deploytk.dll 2009-10-03 21:46 . 2009-10-03 21:46 -------- d-----w- c:\program files\Java 2009-10-03 14:41 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe 2009-09-30 20:54 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll 2009-09-30 20:54 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe 2009-09-30 20:54 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2009-09-30 20:54 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll 2009-09-30 20:53 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll 2009-09-30 20:53 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll 2009-09-30 20:53 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll 2009-09-30 20:53 . 2009-08-06 17:23 171608 ----a-w- c:\windows\system32\wuwebv.dll 2009-09-30 20:53 . 2009-08-06 16:44 33792 ----a-w- c:\windows\system32\wuapp.exe 2009-09-27 14:06 . 2003-06-18 23:31 17920 ----a-w- c:\windows\system32\mdimon.dll 2009-09-27 14:04 . 2009-09-27 14:04 -------- d-----w- c:\windows\PCHEALTH 2009-09-27 14:04 . 2009-09-27 14:04 -------- d-----w- c:\program files\Microsoft.NET 2009-09-26 21:00 . 2009-10-14 18:02 -------- d-----w- c:\users\MikA\AppData\Roaming\skypePM 2009-09-26 20:58 . 2009-10-07 21:41 -------- d-----w- c:\programdata\Skype 2009-09-25 22:06 . 2009-09-25 22:06 -------- d-----w- c:\users\MikA\AppData\Roaming\Ashampoo 2009-09-25 21:57 . 2009-09-25 21:57 -------- d-----w- c:\users\MikA\AppData\Local\ashampoo 2009-09-25 21:57 . 2009-09-25 21:57 -------- d-----w- c:\programdata\ashampoo 2009-09-25 21:56 . 2009-09-25 21:56 -------- d-----w- c:\program files\Ashampoo 2009-09-25 18:41 . 2009-09-25 18:41 -------- d-----w- c:\users\MikA\AppData\Roaming\Gadu-Gadu 2009-09-25 18:28 . 2009-09-25 18:28 -------- d-----w- c:\program files\Gadu-Gadu 2009-09-25 11:16 . 2008-08-28 03:40 712704 ----a-w- c:\windows\system32\WindowsCodecs.dll 2009-09-25 11:16 . 2008-08-28 03:40 347136 ----a-w- c:\windows\system32\WindowsCodecsExt.dll 2009-09-25 11:16 . 2008-08-28 03:40 425472 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll 2009-09-25 11:16 . 2008-09-18 04:56 125952 ----a-w- c:\windows\system32\wersvc.dll 2009-09-25 11:16 . 2008-09-18 04:56 147456 ----a-w- c:\windows\system32\Faultrep.dll 2009-09-25 11:11 . 2008-04-05 03:34 15360 ----a-w- c:\windows\system32\pacerprf.dll 2009-09-25 11:11 . 2008-04-05 01:21 72192 ----a-w- c:\windows\system32\drivers\pacer.sys 2009-09-25 11:10 . 2008-04-18 05:48 269312 ----a-w- c:\windows\system32\es.dll 2009-09-25 11:10 . 2008-08-02 03:26 36864 ----a-w- c:\windows\system32\cdd.dll 2009-09-25 11:10 . 2008-08-02 01:01 625152 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys 2009-09-25 11:10 . 2008-06-26 03:29 565248 ----a-w- c:\windows\system32\emdmgmt.dll 2009-09-25 11:10 . 2008-06-26 03:29 45056 ----a-w- c:\windows\system32\dataclen.dll 2009-09-25 11:10 . 2008-05-20 02:07 148480 ----a-w- c:\windows\system32\drivers\nwifi.sys 2009-09-25 11:10 . 2008-05-08 21:59 90112 ----a-w- c:\windows\system32\wshext.dll 2009-09-25 11:10 . 2008-05-08 21:59 430080 ----a-w- c:\windows\system32\vbscript.dll 2009-09-25 11:10 . 2008-05-08 21:59 180224 ----a-w- c:\windows\system32\scrobj.dll 2009-09-25 11:10 . 2008-05-08 21:59 172032 ----a-w- c:\windows\system32\scrrun.dll 2009-09-25 11:10 . 2008-05-08 21:59 155648 ----a-w- c:\windows\system32\wscript.exe 2009-09-25 11:10 . 2008-05-08 21:58 135168 ----a-w- c:\windows\system32\cscript.exe 2009-09-24 23:08 . 2009-09-24 23:08 -------- d-----w- c:\windows\system32\OEM 2009-09-24 23:08 . 2009-09-24 13:25 -------- d-----w- c:\windows\PANTHER 2009-09-24 23:07 . 2009-10-14 12:40 662112 ----a-w- c:\windows\system32\perfh015.dat 2009-09-24 23:07 . 2009-10-14 12:40 126908 ----a-w- c:\windows\system32\perfc015.dat 2009-09-24 23:07 . 2009-09-24 23:06 37468 ----a-w- c:\windows\system32\perfd015.dat 2009-09-24 23:07 . 2009-09-24 23:06 332832 ----a-w- c:\windows\system32\perfi015.dat 2009-09-24 23:06 . 2009-09-24 23:06 -------- d-----w- c:\windows\system32\pl 2009-09-24 23:06 . 2009-09-24 23:06 -------- d-----w- c:\windows\pl-PL 2009-09-24 23:06 . 2009-09-24 17:13 -------- d-----w- c:\windows\system32\drivers\pl-PL 2009-09-24 23:06 . 2009-09-24 17:13 -------- d-----w- c:\windows\system32\wbem\pl-PL 2009-09-24 20:32 . 2009-09-24 20:33 -------- d-----w- c:\users\MikA\AppData\Roaming\PCToolsFirewallPlus 2009-09-24 20:30 . 2009-09-30 08:44 87656 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2009-09-24 20:30 . 2009-08-24 12:05 206256 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2009-09-24 20:29 . 2009-09-30 08:45 97208 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys 2009-09-24 20:29 . 2009-09-30 08:45 229304 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2009-09-24 20:29 . 2009-09-30 08:45 70280 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys 2009-09-24 20:29 . 2009-09-24 20:30 -------- d-----w- c:\program files\Common Files\PC Tools 2009-09-24 20:29 . 2009-08-14 10:44 32552 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys 2009-09-24 20:29 . 2009-07-29 07:54 46592 ----a-w- c:\windows\system32\drivers\pctNdis.sys 2009-09-24 20:29 . 2009-09-30 08:45 115088 ----a-w- c:\windows\system32\drivers\pctplfw.sys 2009-09-24 20:29 . 2009-10-10 08:52 -------- d-----w- c:\program files\PC Tools Firewall Plus 2009-09-24 19:27 . 2009-09-26 20:48 -------- d-----w- c:\users\MikA\Gadu-Gadu 2009-09-24 19:21 . 2009-10-07 21:33 -------- d-----w- c:\users\MikA\AppData\Roaming\COWON 2009-09-24 19:09 . 2009-09-24 19:09 -------- d-----w- c:\program files\7-Zip 2009-09-24 18:56 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll 2009-09-24 18:22 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2009-09-24 18:22 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll 2009-09-24 18:22 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll 2009-09-24 18:22 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll 2009-09-24 18:22 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe 2009-09-24 18:22 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll 2009-09-24 18:22 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe 2009-09-24 18:14 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll 2009-09-24 18:14 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll 2009-09-24 18:14 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll 2009-09-24 18:13 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll 2009-09-24 18:13 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll 2009-09-24 18:12 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll 2009-09-24 18:12 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll 2009-09-24 18:11 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll 2009-09-24 18:01 . 2009-09-24 18:01 -------- d-----w- c:\program files\uTorrent 2009-09-24 18:00 . 2009-10-14 21:39 -------- d-----w- c:\users\MikA\AppData\Roaming\uTorrent 2009-09-24 17:54 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys 2009-09-24 17:54 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll 2009-09-24 17:54 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll 2009-09-24 17:54 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll 2009-09-24 17:54 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll 2009-09-24 17:54 . 2009-07-17 14:35 71680 ----a-w- c:\windows\system32\atl.dll 2009-09-24 17:54 . 2008-10-21 05:25 296960 ----a-w- c:\windows\system32\gdi32.dll 2009-09-24 17:54 . 2009-06-10 12:11 2868224 ----a-w- c:\windows\system32\mf.dll 2009-09-24 17:54 . 2008-12-06 04:42 376832 ----a-w- c:\windows\system32\winhttp.dll 2009-09-24 17:53 . 2008-08-27 01:05 212480 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys 2009-09-24 17:53 . 2009-06-04 12:34 2066432 ----a-w- c:\windows\system32\mstscax.dll 2009-09-24 17:53 . 2009-06-10 12:12 160256 ----a-w- c:\windows\system32\wkssvc.dll 2009-09-24 17:53 . 2008-06-06 03:27 38912 ----a-w- c:\windows\system32\xolehlp.dll 2009-09-24 17:53 . 2008-06-06 03:27 562176 ----a-w- c:\windows\system32\msdtcprx.dll 2009-09-24 17:53 . 2008-06-26 03:29 303616 ----a-w- c:\windows\system32\wmpeffects.dll 2009-09-24 17:53 . 2009-09-24 17:53 -------- d-----w- c:\program files\VS Revo Group 2009-09-24 17:51 . 2008-02-29 07:14 19000 ----a-w- c:\windows\system32\kd1394.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-11 14:36 . 2009-10-11 14:36 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf 2009-09-30 08:45 . 2009-09-30 08:45 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat 2009-09-30 08:44 . 2009-09-30 08:44 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat 2009-09-29 14:40 . 2009-09-29 14:40 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2009-09-27 14:11 . 2009-09-24 13:30 53736 ----a-w- c:\users\MikA\AppData\Local\GDIPFONTCACHEV1.DAT 2009-09-26 21:00 . 2009-09-26 21:00 56 ---ha-w- c:\programdata\ezsidmv.dat 2009-09-24 19:56 . 2009-09-24 13:30 1356 ----a-w- c:\users\MikA\AppData\Local\d3d9caps.dat 2009-09-24 17:15 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar 2009-09-24 17:15 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar 2009-09-24 17:15 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-09-24 17:15 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration 2009-09-24 17:15 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery 2009-09-24 17:15 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal 2009-09-24 17:15 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender 2009-09-24 16:58 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll 2009-09-24 16:58 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll 2009-09-24 14:00 . 2009-09-24 13:51 -------- d-----w- c:\program files\Common Files\InstallShield 2009-09-24 13:51 . 2009-09-24 13:51 -------- d-----w- c:\program files\Broadcom 2009-09-24 13:50 . 2009-09-24 13:50 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_Apfiltr_01001.Wdf 2009-09-24 13:27 . 2009-09-24 13:27 -------- d-sh--we c:\programdata\Ulubione 2009-09-24 13:27 . 2009-09-24 13:27 -------- d-sh--we c:\programdata\Szablony 2009-09-24 13:27 . 2009-09-24 13:27 -------- d-sh--we c:\programdata\Pulpit 2009-09-24 13:27 . 2009-09-24 13:27 -------- d-sh--we c:\programdata\Menu Start 2009-09-24 13:27 . 2009-09-24 13:27 -------- d-sh--we c:\programdata\Dokumenty 2009-09-24 13:27 . 2009-09-24 13:27 -------- d-sh--we c:\programdata\Dane aplikacji 2009-08-14 17:07 . 2009-09-24 17:55 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys 2009-08-14 16:29 . 2009-09-24 17:55 104960 ----a-w- c:\windows\system32\netiohlp.dll 2009-08-14 16:29 . 2009-09-24 17:55 17920 ----a-w- c:\windows\system32\netevent.dll 2009-08-14 14:16 . 2009-09-24 17:55 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE 2009-08-14 14:16 . 2009-09-24 17:55 17920 ----a-w- c:\windows\system32\ROUTE.EXE 2009-08-14 14:16 . 2009-09-24 17:55 11264 ----a-w- c:\windows\system32\MRINFO.EXE 2009-08-14 14:16 . 2009-09-24 17:55 27136 ----a-w- c:\windows\system32\NETSTAT.EXE 2009-08-14 14:16 . 2009-09-24 17:55 19968 ----a-w- c:\windows\system32\ARP.EXE 2009-08-14 14:16 . 2009-09-24 17:55 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE 2009-08-14 14:16 . 2009-09-24 17:55 10240 ----a-w- c:\windows\system32\finger.exe 2009-07-18 16:06 . 2009-09-24 17:50 827904 ----a-w- c:\windows\system32\wininet.dll 2009-07-18 16:01 . 2009-09-24 17:50 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-07-18 09:46 . 2009-09-24 17:50 26624 ----a-w- c:\windows\system32\ieUnatt.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-09-12 155648] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-09-30 2971608] "S3Trayp"="S3trayp.exe" - c:\windows\System32\s3trayp.exe [2008-07-08 204800] "S3Funkey"="S3Funkey.exe" - c:\windows\System32\S3Funkey.exe [2008-03-05 102400] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{6A2AFC2F-6273-4D63-9894-9EC21D406367}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{9061D7C1-2C5A-4102-A7B6-D1EFAFE48165}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{01335CD0-1A8A-465B-A4FF-A19D9D4F57B6}"= c:\program files\Skype\Phone\Skype.exe:Skype [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi.sys [2009-09-24 229304] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-09-24 108289] R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\System32\drivers\PCTAppEvent.sys [2009-09-24 87656] R3 PCTFW-DNS;PCTools Firewall - DNS driver;c:\windows\System32\drivers\pctNdis-DNS.sys [2009-09-24 32552] R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\System32\drivers\pctNdis-PacketFilter.sys [2009-09-24 70280] R3 pctNDIS;PC Tools Driver;c:\windows\System32\drivers\pctNdis.sys [2009-09-24 46592] R3 S3GIGP;S3GIGP;c:\windows\System32\drivers\VTGKModeDX32.sys [2009-09-24 814592] S3 pctplfw;pctplfw;c:\windows\System32\drivers\pctplfw.sys [2009-09-24 115088] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc . . ------- Skan uzupełniający ------- . IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 TCP: {735E34CB-EBEF-4CC7-9B7A-AA1035EAAF0D} = 217.30.129.149 217.30.137.200 FF - ProfilePath - c:\users\MikA\AppData\Roaming\Mozilla\Firefox\Profiles\bnisrm01.default\ FF - prefs.js: browser.startup.homepage - www.google.pl FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-15 00:25 Windows 6.0.6001 Service Pack 1 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Czas ukończenia: 2009-10-14 0:28 ComboFix-quarantined-files.txt 2009-10-14 22:28 Przed: 10 071 101 440 bajtów wolnych Po: 13 502 083 072 bajtów wolnych 250 --- E O F --- 2009-10-12 21:34

**Posty:** 18165 · przez **wojtas** 15 Paź 2009, 20:40

2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie )

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 52 · przez **msgarden** 16 Paź 2009, 16:09

zrobiłem wojtas tak jak zalecałeś, nic nie znaleziono.
Raport:

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0: scan report Friday, October 16, 2009 Operating system: Microsoft Windows Vista Business Edition, 32-bit Service Pack 1 (build 6001) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, October 16, 2009 12:38:25 Records in database: 3006654 -------------------------------------------------------------------------------- Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Objects scanned: 97169 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 01:55:43 No threats found. Scanned area is clean. Selected area has been scanned.

wątek uważam za zamknięty. Thx