znów trojan win32:trojan-gen {other}

**Posty:** 13 · przez **adriansolka** 09 Lip 2008, 14:50

Hej:) Problem mam jak wyżej. Też mam trojana o nazwie Win32:Trojan-gen {Other}:/ Nic go nie rusza...

Przesyłam loga z hijacka i proszę o pomoc. Z góry dzięki.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:51:26, on 2008-07-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programmi\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe
C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Programmi\Alwil Software\Avast4\ashDisp.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\lphc5mbj0e3c5.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\Gadu-Gadu\gg.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\snmp.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Creative\MediaSource\RemoteControl\OSDMenu.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Mozilla Firefox 2 Beta 2\firefox.exe
C:\Programmi\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: sqvgnrpx - {1BFB720F-B45D-43FF-8AE1-54C86718DE99} - C:\WINDOWS\sqvgnrpx.dll (file missing)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\Programmi\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avast!] "C:\Programmi\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programmi\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [lphc5mbj0e3c5] C:\WINDOWS\system32\lphc5mbj0e3c5.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmi\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [SMrhc1mbj0e3c5] C:\Programmi\rhc1mbj0e3c5\rhc1mbj0e3c5.exe
O4 - HKLM\..\Run: [SMshc3mbj0e3c5] C:\Programmi\shc3mbj0e3c5\shc3mbj0e3c5.exe
O4 - HKLM\..\Run: [48c197fc] rundll32.exe "C:\WINDOWS\system32\syjpqtes.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Programmi\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programmi\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

--
End of file - 8124 bytes

**Posty:** 18165 · przez **wojtas** 09 Lip 2008, 14:55

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 7956 · przez **Magik** 09 Lip 2008, 15:31

daj na fix:

Kod: Zaznacz wszystko: C:\WINDOWS\system32\lphc5mbj0e3c5.exe O4 - HKLM\..\Run: [lphc5mbj0e3c5] C:\WINDOWS\system32\lphc5mbj0e3c5.exe O4 - HKLM\..\Run: [48c197fc] rundll32.exe "C:\WINDOWS\system32\syjpqtes.dll",b O4 - HKLM\..\Run: [SMshc3mbj0e3c5] C:\Programmi\shc3mbj0e3c5\shc3mbj0e3c5.exe O4 - HKLM\..\Run: [SMrhc1mbj0e3c5] C:\Programmi\rhc1mbj0e3c5\rhc1mbj0e3c5.exe

**Posty:** 13 · przez **adriansolka** 09 Lip 2008, 15:35

Co do tych programów...to problem jest taki, ze nie mogę zapisać na dysku tych plików. Klikam na pobierz, pojawia się okno z możliościa zapisu (xp). Potem klikam właśnie Zapisz...ale nie pojawia mi się już drugie okno...Zapisz jako:/ Kursor zamienia się wi klepsydrę, a gdy ruszę myszką po prostu znika:/

**Posty:** 7956 · przez **Magik** 09 Lip 2008, 15:39

adriansolka napisał(a):Problem jest taki, ze nie mogę zapisać na dysku tych plików. Klikam na pobierz, pojawia się okno z możliościa zapisu (xp). Potem klikam właśnie Zapisz...ale nie pojawia mi się już drugie okno...Zapisz jako:/

Usun najpierw te wpisy powyzej :arrow:

w trybie awaryjnym

sproobuj pod IE sciagnac Sdfix'a i combo

**Posty:** 13 · przez **adriansolka** 09 Lip 2008, 16:08

Nowy log wygląda tak.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:07:11, on 2008-07-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programmi\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe
C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Programmi\Alwil Software\Avast4\ashDisp.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\File comuni\Teleca Shared\CapabilityManager.exe
C:\Programmi\Gadu-Gadu\gg.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\snmp.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\Creative\MediaSource\RemoteControl\OSDMenu.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Mozilla Firefox 2 Beta 2\firefox.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: sqvgnrpx - {1BFB720F-B45D-43FF-8AE1-54C86718DE99} - C:\WINDOWS\sqvgnrpx.dll (file missing)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\Programmi\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avast!] "C:\Programmi\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programmi\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmi\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Programmi\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programmi\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

--
End of file - 7559 bytes

Ale nie jestem pewien czy wszystko jest teraz ok:/

**Posty:** 8001 · przez **Okocza** 09 Lip 2008, 16:12

Kod: Zaznacz wszystko: R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O3 - Toolbar: sqvgnrpx - {1BFB720F-B45D-43FF-8AE1-54C86718DE99} - C:\WINDOWS\sqvgnrpx.dll (file missing)

to na fix w hj i koniecznie log z combofixa lub dss'a

**Posty:** 13 · przez **adriansolka** 09 Lip 2008, 17:01

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:59:14, on 2008-07-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\snmp.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programmi\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe
C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Programmi\Alwil Software\Avast4\ashDisp.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\File comuni\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\Gadu-Gadu\gg.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Creative\MediaSource\RemoteControl\OSDMenu.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Mozilla Firefox 2 Beta 2\firefox.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar3.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\Programmi\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avast!] "C:\Programmi\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programmi\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmi\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Programmi\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programmi\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

--
End of file - 7335 bytes

Tak wygląda nowy log z hijacka. Scan combem zrobiłem...ale mam w folderze dwa pliki tekstowe- report( mniejszy) i report system. Który wam wrzucić?

wrzucam ten:)

SDFix: Version 1.204
Run by Adrian Solka on 2008-07-09 at 16:49

Microsoft Windows XP [Versione 5.1.2600]
Running From: C:\DOCUME~1\ADRIAN~1\Desktop\SDFix\SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\DOCUME~1\ADRIAN~1\IMPOST~1\Temp\privacy_danger\index.htm - Deleted
C:\DOCUME~1\ADRIAN~1\IMPOST~1\Temp\privacy_danger\images\capt.gif - Deleted
C:\DOCUME~1\ADRIAN~1\IMPOST~1\Temp\privacy_danger\images\danger.jpg - Deleted
C:\DOCUME~1\ADRIAN~1\IMPOST~1\Temp\privacy_danger\images\down.gif - Deleted
C:\DOCUME~1\ADRIAN~1\IMPOST~1\Temp\privacy_danger\images\spacer.gif - Deleted
C:\WINDOWS\gpefaowr.exe - Deleted

Folder C:\DOCUME~1\ADRIAN~1\IMPOST~1\Temp\privacy_danger - Removed

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-09 16:55:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions]
"Miniport dell'UtilitU di pianificazione pacchetti"=str(7):"1\0002\0003\0"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions]
"Miniport dell'UtilitU di pianificazione pacchetti"=str(7):"1\0002\0003\0"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
"khjeh"=hex:20,02,00,00,d7,5a,a3,63,9a,db,5e,fe,1b,f2,dc,1d,5a,c8,62,fe,a7,..
"hj34z0"=hex:4a,f8,71,92,a4,ae,ca,69,32,94,75,8a,33,5c,e6,1a,a1,61,60,23,57,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions]
"Miniport dell'UtilitU di pianificazione pacchetti"=str(7):"1\0002\0003\0"

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Accessori\UtilitU di sistema]
"Order"=hex:08,00,00,00,02,00,00,00,ba,05,00,00,01,00,00,00,08,00,00,00,b8,..
[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\Ajt Soft\SBownik\unins000.exe"="Inno Setup Uninstaller"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programmi\\Internet Explorer\\IEXPLORE.EXE"="C:\\Programmi\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\Programmi\\Gadu-Gadu\\gg.exe"="C:\\Programmi\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny"
"C:\\Programmi\\Mozilla Firefox 2 Beta 2\\firefox.exe"="C:\\Programmi\\Mozilla Firefox 2 Beta 2\\firefox.exe:*:Enabled:Mozilla Firefox"
"C:\\Programmi\\Winamp Remote\\bin\\Orb.exe"="C:\\Programmi\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Programmi\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Programmi\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Programmi\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Programmi\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\\Programmi\\Warcraft III\\Warcraft III.exe"="C:\\Programmi\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\\Programmi\\Soulseek-Test\\slsk.exe"="C:\\Programmi\\Soulseek-Test\\slsk.exe:*:Enabled:SoulSeek"
"C:\\Programmi\\eMule\\emule.exe"="C:\\Programmi\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Programmi\\BitLord\\BitLord.exe"="C:\\Programmi\\BitLord\\BitLord.exe:*:Enabled:BitLord"
"C:\\Programmi\\Bonjour\\mDNSResponder.exe"="C:\\Programmi\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Programmi\\iTunes\\iTunes.exe"="C:\\Programmi\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Documents and Settings\\Adrian Solka\\Desktop\\ArcaMicroScanUpdater.exe"="C:\\Documents and Settings\\Adrian Solka\\Desktop\\ArcaMicroScanUpdater.exe:*:Enabled:ArcaMicroScanUpdater"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

File Backups: - C:\DOCUME~1\ADRIAN~1\Desktop\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 25 Nov 2006 211 A.SHR --- "C:\BOOT.BAK"

Finished!

**Posty:** 7956 · przez **Magik** 09 Lip 2008, 17:17

HJT czysty

sdfix wiadomo, swoej zrobil :arrow:

dla pewnosci
http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html

by Mario
1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 18165 · przez **wojtas** 09 Lip 2008, 18:16

daj koniecznie log z combofixa lub dss'a !!

**Posty:** 13 · przez **adriansolka** 09 Lip 2008, 18:55

log zcombofixa

ComboFix 08-07-08.9 - Adrian Solka 2008-07-09 18:43:18.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1040.18.575 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Adrian Solka\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Adrian Solka\Dati applicazioni\rhc1mbj0e3c5
C:\Documents and Settings\Adrian Solka\Dati applicazioni\shc3mbj0e3c5
C:\Documents and Settings\Adrian Solka\Impostazioni locali\Dati applicazioni\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Programmi\rhc1mbj0e3c5
C:\Programmi\shc3mbj0e3c5
C:\WINDOWS\ebaq.exe
C:\WINDOWS\system32\blphc5mbj0e3c5.scr
C:\WINDOWS\system32\jkkKedbY.dll
C:\WINDOWS\system32\oeminfo.ini
C:\WINDOWS\system32\phc5mbj0e3c5.bmp
C:\WINDOWS\system32\qoMdBUKE.dll
C:\WINDOWS\system32\setqpjys.ini
C:\WINDOWS\system32\syjpqtes.dll
C:\WINDOWS\system32\wlgeqevb.dll
C:\WINDOWS\system32\YbdeKkkj.ini
C:\WINDOWS\system32\YbdeKkkj.ini2

.
((((((((((((((((((((((((( Files Creati Da 2008-06-09 al 2008-07-09 )))))))))))))))))))))))))))))))))))
.

2008-07-09 16:47 . 2008-07-09 16:47 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-09 16:12 . 2008-07-09 18:47 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-09 16:12 . 2008-07-09 16:12 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-09 14:09 . 2008-07-09 14:09 <DIR> d-------- C:\Programmi\Trend Micro
2008-07-08 14:38 . 2008-07-08 14:38 <DIR> d-------- C:\Documents and Settings\Adrian Solka\Dati applicazioni\ArcaBit
2008-07-08 03:24 . 2008-07-09 17:35 <DIR> d-------- C:\Programmi\Spybot - Search & Destroy
2008-07-08 03:24 . 2008-07-09 17:34 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-07-07 23:21 . 2008-07-08 00:51 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-07 23:18 . 2008-07-07 23:18 318,720 --a------ C:\WINDOWS\system32\ssqpmLbB.dll.vir
2008-06-13 13:58 . 2008-06-14 19:59 272,768 --a------ C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 13:58 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-09 16:39 --------- d-----w C:\Programmi\Mozilla Firefox 2 Beta 2
2008-07-09 14:03 --------- d---a-w C:\Documents and Settings\All Users\Dati applicazioni\TEMP
2008-07-08 01:35 --------- d-----w C:\Programmi\ICQToolbar
2008-07-02 10:22 --------- d-----w C:\Programmi\Warcraft III
2008-06-23 03:17 1,584 ----a-w C:\Documents and Settings\Adrian Solka\Dati applicazioni\wklnhst.dat
2008-06-13 11:32 --------- d-----w C:\Programmi\File comuni\InstallShield
2008-05-31 21:42 --------- d-----w C:\Documents and Settings\Adrian Solka\Dati applicazioni\AdobeUM
2008-05-09 23:33 --------- d-----w C:\Programmi\Apple Software Update
2007-05-13 23:24 44,216 ----a-w C:\Documents and Settings\Adrian Solka\Dati applicazioni\GDIPFONTCACHEV1.DAT
2007-03-07 17:05 7,706,216 ----a-w C:\Programmi\winzip110.exe
2007-03-07 16:52 1,273,572 ----a-w C:\Programmi\wrar370b3pl.exe
2006-11-20 09:05 1,049,719 ----a-w C:\Programmi\wrar361pl.exe
2006-11-16 12:16 3,657,784 ----a-w C:\Programmi\gg76.exe
2006-09-16 22:23 5,061,763 ----a-w C:\Programmi\SetupCloneDVD2901Slysoft.exe
2006-08-28 22:13 18,575,366 ----a-w C:\Programmi\klcodec276fbeta1.[www.UnderPL.org].exe
2006-08-28 21:59 6,509,863 ----a-w C:\Programmi\firefox-2.0b2.pl.win32.installer.exe
2006-08-28 21:52 6,206,440 ----a-w C:\Programmi\winamp524_full_emusic-7plus.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 10:00 15360]
"RemoteCenter"="C:\Programmi\Creative\MediaSource\RemoteControl\RcMan.exe" [2004-06-25 11:21 147456]
"swg"="C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-05 03:37 68856]
"Gadu-Gadu"="C:\Programmi\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-11-03 17:25 98304]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-03 17:22 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-03 17:26 118784]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"HP Software Update"="C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"SynTPEnh"="C:\Programmi\Synaptics\SynTP\SynTPEnh.exe" [2005-11-11 10:04 761945]
"QPService"="C:\Programmi\HP\QuickPlay\QPService.exe" [2005-12-12 11:39 94208]
"eabconfg.cpl"="C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 08:57 405504]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 10:23 1187840]
"Reminder"="C:\Windows\CREATOR\Remind_XP.exe" [2006-02-09 09:52 643072]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112]
"CTSysVol"="C:\Programmi\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe" [2003-09-17 11:43 57344]
"Symantec PIF AlertEng"="C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 11:22 517768]
"Sony Ericsson PC Suite"="C:\Programmi\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17 159744]
"QuickTime Task"="C:\Programmi\QuickTime\QTTask.exe" [2008-01-10 16:27 385024]
"iTunesHelper"="C:\Programmi\iTunes\iTunesHelper.exe" [2008-01-15 04:22 267048]
"TkBellExe"="C:\Programmi\File comuni\Real\Update_OB\realsched.exe" [2008-03-25 20:41 185896]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-02-16 15:16 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"SbUsb AudCtrl"="sbusbdll.dll" [2004-07-09 04:27 119296 C:\WINDOWS\system32\sbusbdll.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 10:00 15360]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Avvio rapido HP Photosmart Premier.lnk - C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 01:39:30 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiscSpaceChecks"= 000000000000f03f

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Programmi\\Gadu-Gadu\\gg.exe"=
"C:\\Programmi\\Mozilla Firefox 2 Beta 2\\firefox.exe"=
"C:\\Programmi\\Warcraft III\\Warcraft III.exe"=
"C:\\Programmi\\BitLord\\BitLord.exe"=
"C:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"C:\\Programmi\\iTunes\\iTunes.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 sbusb;Sound Blaster USB Audio Driver;C:\WINDOWS\system32\DRIVERS\sbusb.sys [2004-07-27 11:31]
S3 USBSTOR;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8bb74b9-84ac-11db-bd02-00130245e39a}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

.
Contenuto della cartella 'Scheduled Tasks'
"2008-06-19 07:51:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-RemoteControl - (no file)
HKLM-Run-RemoteCenter - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-09 18:47:58
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\snmp.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\File comuni\Teleca Shared\CapabilityManager.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Creative\MediaSource\RemoteControl\OSDMenu.exe
C:\WINDOWS\SoftwareDistribution\Download\9859834e89172702ef462fbc3265334a\update\update.exe
.
**************************************************************************
.
Ora fine scansione: 2008-07-09 18:50:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-09 16:50:40

12 Directory 8,179,757,056 byte disponibili
16 Directory 8,187,322,368 byte disponibili

158 --- E O F --- 2008-06-20 01:01:15

**Posty:** 18165 · przez **wojtas** 09 Lip 2008, 19:29

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\ssqpmLbB.dll.vir

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu )

potem:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 13 · przez **adriansolka** 09 Lip 2008, 19:58

Po tym jak przeciągnąłem ten plik na combofixa, program znowu się urucomil, zrobił swoje. Przesylam loga.

ComboFix 08-07-08.9 - Adrian Solka 2008-07-09 19:53:50.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1040.18.576 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Adrian Solka\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Adrian Solka\Desktop\CFScript.txt
* Creato nuovo punto di ripristino

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\ssqpmLbB.dll.vir
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ssqpmLbB.dll.vir

.
((((((((((((((((((((((((( Files Creati Da 2008-06-09 al 2008-07-09 )))))))))))))))))))))))))))))))))))
.

2008-07-09 16:47 . 2008-07-09 16:47 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-09 16:12 . 2008-07-09 19:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-09 16:12 . 2008-07-09 16:12 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-09 14:09 . 2008-07-09 14:09 <DIR> d-------- C:\Programmi\Trend Micro
2008-07-08 14:38 . 2008-07-08 14:38 <DIR> d-------- C:\Documents and Settings\Adrian Solka\Dati applicazioni\ArcaBit
2008-07-08 03:24 . 2008-07-09 17:35 <DIR> d-------- C:\Programmi\Spybot - Search & Destroy
2008-07-08 03:24 . 2008-07-09 17:34 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-07-07 23:21 . 2008-07-08 00:51 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-06-20 19:39 . 2008-06-20 19:39 247,296 --------- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 12:44 . 2008-06-20 12:44 138,368 --------- C:\WINDOWS\system32\dllcache\afd.sys
2008-06-13 13:58 . 2008-06-14 19:59 272,768 --a------ C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 13:58 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-09 17:50 --------- d-----w C:\Programmi\Mozilla Firefox 2 Beta 2
2008-07-09 14:03 --------- d---a-w C:\Documents and Settings\All Users\Dati applicazioni\TEMP
2008-07-08 01:35 --------- d-----w C:\Programmi\ICQToolbar
2008-07-02 10:22 --------- d-----w C:\Programmi\Warcraft III
2008-06-23 03:17 1,584 ----a-w C:\Documents and Settings\Adrian Solka\Dati applicazioni\wklnhst.dat
2008-06-20 17:39 247,296 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:39 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-13 11:32 --------- d-----w C:\Programmi\File comuni\InstallShield
2008-05-31 21:42 --------- d-----w C:\Documents and Settings\Adrian Solka\Dati applicazioni\AdobeUM
2008-05-09 23:33 --------- d-----w C:\Programmi\Apple Software Update
2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:14 1,292,800 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:14 1,292,800 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-17 10:52 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2007-05-13 23:24 44,216 ----a-w C:\Documents and Settings\Adrian Solka\Dati applicazioni\GDIPFONTCACHEV1.DAT
2007-03-07 17:05 7,706,216 ----a-w C:\Programmi\winzip110.exe
2007-03-07 16:52 1,273,572 ----a-w C:\Programmi\wrar370b3pl.exe
2006-11-20 09:05 1,049,719 ----a-w C:\Programmi\wrar361pl.exe
2006-11-16 12:16 3,657,784 ----a-w C:\Programmi\gg76.exe
2006-09-16 22:23 5,061,763 ----a-w C:\Programmi\SetupCloneDVD2901Slysoft.exe
2006-08-28 22:13 18,575,366 ----a-w C:\Programmi\klcodec276fbeta1.[www.UnderPL.org].exe
2006-08-28 21:59 6,509,863 ----a-w C:\Programmi\firefox-2.0b2.pl.win32.installer.exe
2006-08-28 21:52 6,206,440 ----a-w C:\Programmi\winamp524_full_emusic-7plus.exe
.

((((((((((((((((((((((((((((( snapshot@2008-07-09_18.50.30.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-09 16:47:30 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-09 17:17:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-02-20 05:33:54 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-06-20 17:39:47 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-06-25 16:15:46 17,972,344 ----a-w C:\WINDOWS\system32\MRT.exe
- 2007-11-30 11:19:29 18,808 ----a-w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 12:39:40 18,808 ------w C:\WINDOWS\system32\spmsg.dll
+ 2008-07-09 17:17:44 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_66c.dat
+ 2008-07-09 17:17:37 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6ec.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 10:00 15360]
"RemoteCenter"="C:\Programmi\Creative\MediaSource\RemoteControl\RcMan.exe" [2004-06-25 11:21 147456]
"swg"="C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-05 03:37 68856]
"Gadu-Gadu"="C:\Programmi\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-11-03 17:25 98304]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-03 17:22 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-03 17:26 118784]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"HP Software Update"="C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"SynTPEnh"="C:\Programmi\Synaptics\SynTP\SynTPEnh.exe" [2005-11-11 10:04 761945]
"QPService"="C:\Programmi\HP\QuickPlay\QPService.exe" [2005-12-12 11:39 94208]
"eabconfg.cpl"="C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 08:57 405504]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 10:23 1187840]
"Reminder"="C:\Windows\CREATOR\Remind_XP.exe" [2006-02-09 09:52 643072]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112]
"CTSysVol"="C:\Programmi\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe" [2003-09-17 11:43 57344]
"Symantec PIF AlertEng"="C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 11:22 517768]
"Sony Ericsson PC Suite"="C:\Programmi\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17 159744]
"QuickTime Task"="C:\Programmi\QuickTime\QTTask.exe" [2008-01-10 16:27 385024]
"iTunesHelper"="C:\Programmi\iTunes\iTunesHelper.exe" [2008-01-15 04:22 267048]
"TkBellExe"="C:\Programmi\File comuni\Real\Update_OB\realsched.exe" [2008-03-25 20:41 185896]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-02-16 15:16 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"SbUsb AudCtrl"="sbusbdll.dll" [2004-07-09 04:27 119296 C:\WINDOWS\system32\sbusbdll.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 10:00 15360]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Avvio rapido HP Photosmart Premier.lnk - C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 01:39:30 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiscSpaceChecks"= 000000000000f03f

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Programmi\\Gadu-Gadu\\gg.exe"=
"C:\\Programmi\\Mozilla Firefox 2 Beta 2\\firefox.exe"=
"C:\\Programmi\\Warcraft III\\Warcraft III.exe"=
"C:\\Programmi\\BitLord\\BitLord.exe"=
"C:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"C:\\Programmi\\iTunes\\iTunes.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 sbusb;Sound Blaster USB Audio Driver;C:\WINDOWS\system32\DRIVERS\sbusb.sys [2004-07-27 11:31]
S3 USBSTOR;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8bb74b9-84ac-11db-bd02-00130245e39a}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
.
Contenuto della cartella 'Scheduled Tasks'
"2008-06-19 07:51:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-09 19:55:50
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-07-09 19:56:24
ComboFix-quarantined-files.txt 2008-07-09 17:56:21
ComboFix2.txt 2008-07-09 16:50:47

12 Directory 8,215,703,552 byte disponibili
16 Directory 8,211,685,376 byte disponibili

149 --- E O F --- 2008-07-09 16:54:25

**Posty:** 18165 · przez **wojtas** 09 Lip 2008, 20:08

czysto

**Posty:** 13 · przez **adriansolka** 09 Lip 2008, 20:14

Tylko teraz jak robiłem scan avastem, to mi dalej tego trojana pokazuje:)

**Posty:** 7956 · przez **Magik** 09 Lip 2008, 20:27

adriansolka napisał(a):Tylko teraz jak robiłem scan avastem

ten program dla mnie nie istnieje :arrow:

zablokuj w firewall'u port 6667

Kod: Zaznacz wszystko: How to remove Win32:Trojan-gen detected by Avast

Kod: Zaznacz wszystko: Avast may not remove it (just warn) or removed it but actually didn"t. Don"t worry too much. It is actually just a false alarm. You cannot remove it permanently because most of this false alarm appear with System Restore"s files of Win XP

i jest po temacie :arrow:

Avast i jego falszywe alarmy :arrow:

**Posty:** 13 · przez **adriansolka** 09 Lip 2008, 20:33

Jak sie blokuje port? :lol:

**Posty:** 7956 · przez **Magik** 09 Lip 2008, 20:37

adriansolka napisał(a):Jak sie blokuje port?

wrozka nie ejstem//nie wiem jakiego uzywasz firewall'a :arrow:

kerio, comodo itd itd......podaj nazwe

**Posty:** 13 · przez **adriansolka** 09 Lip 2008, 20:45

Windows Firewall xP

**Posty:** 7956 · przez **Magik** 09 Lip 2008, 20:53

adriansolka napisał(a):Windows Firewall xP

wybacz ale...........

Avast + zapora systemowa :arrow:

to jest sitooooO :arrow:

odpalasz zapore :arrow:

zakladka wyjatki :arrow:

dodaj port

W zakladce ogolne zaznacz ptaka przy "nie zezwalaj wyjatkom " lub cos podobnego-->mam ang XP

a tak na amrginesie zainstaluj Kerio lub Comodo

znów trojan win32:trojan-gen {other}

znów trojan win32:trojan-gen {other}

Kto jest na forum