Win32:cutwail nie można usunąć

**Posty:** 4 · przez **pajka83** 29 Kwi 2009, 20:30

Witam.
Jestem laikiem jesśli chodzi o komputery. Awast wykrył mi win 32: cutwail koń trojański, nie daje sie standardowo usunąć przez awasta. oto log z comobofixa:

Kod: Zaznacz wszystko: ComboFix 09-04-29.01 - User1 2009-04-29 20:20.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.511.120 [GMT 2:00] Uruchomiony z: c:\documents and settings\User1\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090428-0] *On-access scanning disabled* (Updated) . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Poprzednie uruchomienie ------- . c:\documents and settings\User1\User1.exe c:\windows\IE4 Error Log.txt c:\windows\system32\drivers\amd64si.sys . ((((((((((((((((((((((((( Pliki utworzone od 2009-05-28 do 2009-4-29 ))))))))))))))))))))))))))))))) . 2009-04-29 18:08 . 2009-04-29 18:08 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2009-04-17 06:56 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-17 06:56 . 2009-03-06 14:22 285696 -c----w c:\windows\system32\dllcache\pdh.dll 2009-04-17 06:56 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe 2009-04-17 06:56 . 2009-02-09 10:53 401408 -c----w c:\windows\system32\dllcache\rpcss.dll 2009-04-17 06:56 . 2009-02-09 10:53 473600 -c----w c:\windows\system32\dllcache\fastprox.dll 2009-04-17 06:56 . 2009-02-09 10:53 686592 -c----w c:\windows\system32\dllcache\advapi32.dll 2009-04-17 06:56 . 2009-02-09 10:53 731136 -c----w c:\windows\system32\dllcache\lsasrv.dll 2009-04-17 06:56 . 2009-02-09 10:53 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-17 06:56 . 2009-02-09 10:53 722944 -c----w c:\windows\system32\dllcache\ntdll.dll 2009-04-17 06:56 . 2008-04-21 21:16 218112 -c----w c:\windows\system32\dllcache\wordpad.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-17 09:23 . 2006-03-02 12:00 50968 ----a-w c:\windows\system32\perfc015.dat 2009-04-17 09:23 . 2006-03-02 12:00 359046 ----a-w c:\windows\system32\perfh015.dat 2009-03-06 14:22 . 2006-03-02 12:00 285696 ----a-w c:\windows\system32\pdh.dll 2009-03-01 15:00 . 2006-09-21 15:27 -------- d--h--w c:\program files\InstallShield Installation Information 2009-02-20 08:12 . 2006-03-02 12:00 668672 ----a-w c:\windows\system32\wininet.dll 2009-02-20 08:11 . 2006-03-02 12:00 81920 ----a-w c:\windows\system32\ieencode.dll 2009-02-17 13:03 . 2007-05-14 19:15 304182 ----a-w C:\StiImg.dat 2009-02-10 17:09 . 2004-08-04 00:38 2067328 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-09 14:07 . 2006-03-02 12:00 1847040 ----a-w c:\windows\system32\win32k.sys 2009-02-09 11:26 . 2006-03-02 12:00 2190336 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-09 11:25 . 2006-03-02 12:00 111104 ----a-w c:\windows\system32\services.exe 2009-02-09 10:53 . 2006-03-02 12:00 731136 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:53 . 2006-03-02 12:00 686592 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:53 . 2006-03-02 12:00 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:53 . 2006-03-02 12:00 722944 ----a-w c:\windows\system32\ntdll.dll 2009-02-06 10:39 . 2006-03-02 12:00 35328 ----a-w c:\windows\system32\sc.exe 2009-02-03 19:58 . 2006-03-02 12:00 56832 ----a-w c:\windows\system32\secur32.dll 2004-10-01 13:00 . 2006-09-23 11:17 40960 ----a-w c:\program files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((( SnapShot@2009-04-29_18.14.48 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-29 18:17 . 2009-04-29 18:17 16384 c:\windows\Temp\Perflib_Perfdata_984.dat + 2009-04-29 18:17 . 2009-04-29 18:17 16384 c:\windows\Temp\Perflib_Perfdata_574.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [BU] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-01-12 25448488] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-01-16 1716224] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704] "IPLA!"="c:\program files\ipla\ipla.exe" [2008-12-23 2794232] "User1"="c:\documents and settings\User1\User1.exe" [BU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-19 7700480] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 83608] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920] "CafeNews"="c:\program files\Press-Service\CafeNews\CN.exe" [BU] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-19 86016] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-19 185896] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-04-19 1626112] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-08-14 16050176] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-3-27 113664] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\userinit.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 amd64si;amd64si; [x] R2 i386si;i386si; [x] R2 netsik;netsik; [x] R2 port135sik;port135sik; [x] S1 aswSP;avast! Self Protection; [x] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74f8d514-4bec-11dd-bf5e-001d7d52a389}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8065c9e3-4ddc-11dd-bf68-001d7d52a389}] \Shell\AutoRun\command - H:\cl.bat \Shell\explore\Command - H:\cl.bat \Shell\open\Command - H:\cl.bat . Zawartość folderu 'Zaplanowane zadania' . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.wp.pl/ uDefault_Search_URL = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {EFC92B39-B8FC-4FB9-91ED-DF38B53286AF} = 82.139.8.7,88.156.63.9,192.168.1.249 DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} - hxxp://slimak.onet.pl/_m/wirusy/ArcaOnline.cab DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\User1\Dane aplikacji\Mozilla\Firefox\Profiles\v2jzs00g.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.gazeta.pl/ . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-29 20:21 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(3680) c:\program files\Gadu-Gadu\ggwhook.dll c:\program files\Microsoft Office\OFFICE11\msohev.dll c:\windows\system32\mmfinfo.dll c:\windows\system32\mkunicode.dll c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll . Czas ukończenia: 2009-04-29 20:23 ComboFix-quarantined-files.txt 2009-04-29 18:22 Przed: 2 229 985 280 bajtów wolnych Po: 2 228 240 384 bajtów wolnych 160 --- E O F --- 2009-04-17 09:15

Dodano Dzisiaj, 20:31:
proszę o pomoc :cry:

Dodano Dzisiaj, 20:37:
wstawiam jeszcze log hijack this

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:35:20, on 2009-04-29 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\D-Tools\daemon.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\ipla\ipla.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = OO-OF-EA-61-C4-O5 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [CafeNews] C:\Program Files\Press-Service\CafeNews\CN.exe /autostart O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe /autorun O4 - HKCU\..\Run: [User1] C:\Documents and Settings\User1\User1.exe /i O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{EFC92B39-B8FC-4FB9-91ED-DF38B53286AF}: NameServer = 82.139.8.7,88.156.63.9,192.168.1.249 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = tulipan,alcanet,bmnet,rivnet,mikrus,pineska O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = tulipan,alcanet,bmnet,rivnet,mikrus,pineska O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 7262 bytes

**Posty:** 18165 · przez **wojtas** 29 Kwi 2009, 23:00

Otworz notatnik i wklej w nim to:

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74f8d514-4bec-11dd-bf5e-001d7d52a389}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8065c9e3-4ddc-11dd-bf68-001d7d52a389}]

Driver::
amd64si
i386si
netsik
port135sik

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 4 · przez **pajka83** 30 Kwi 2009, 16:21

Zrobiłam wszystko zgodnie ze wskazówkami. Watawiam log

Kod: Zaznacz wszystko: ComboFix 09-04-29.01 - User1 2009-04-30 15:59:12.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.511.92 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\User1\Pulpit\ComboFix.exe Użyto następujących komend :: C:\Documents and Settings\User1\Pulpit\CFScript.txt AV: avast! antivirus 4.8.1335 [VPS 090429-0] *On-access scanning enabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_AMD64SI -------\Service_amd64si -------\Service_i386si -------\Service_netsik -------\Service_port135sik ((((((((((((((((((((((((( Pliki utworzone od 2009-05-28 do 2009-4-30 ))))))))))))))))))))))))))))))) . 2009-04-29 18:34:48 . 2009-04-29 18:34:48 0 d-----w C:\Program Files\Trend Micro 2009-04-29 18:08:21 . 2009-04-29 18:08:21 0 d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2009-04-17 06:56:34 . 2009-02-06 10:10:02 227840 -c----w C:\WINDOWS\system32\dllcache\wmiprvse.exe 2009-04-17 06:56:33 . 2009-03-06 14:22:12 285696 -c----w C:\WINDOWS\system32\dllcache\pdh.dll 2009-04-17 06:56:33 . 2009-02-09 11:25:57 111104 -c----w C:\WINDOWS\system32\dllcache\services.exe 2009-04-17 06:56:33 . 2009-02-09 10:53:44 401408 -c----w C:\WINDOWS\system32\dllcache\rpcss.dll 2009-04-17 06:56:32 . 2009-02-09 10:53:44 473600 -c----w C:\WINDOWS\system32\dllcache\fastprox.dll 2009-04-17 06:56:32 . 2009-02-09 10:53:44 686592 -c----w C:\WINDOWS\system32\dllcache\advapi32.dll 2009-04-17 06:56:32 . 2009-02-09 10:53:44 731136 -c----w C:\WINDOWS\system32\dllcache\lsasrv.dll 2009-04-17 06:56:32 . 2009-02-09 10:53:43 453120 -c----w C:\WINDOWS\system32\dllcache\wmiprvsd.dll 2009-04-17 06:56:32 . 2009-02-09 10:53:43 722944 -c----w C:\WINDOWS\system32\dllcache\ntdll.dll 2009-04-17 06:56:01 . 2008-04-21 21:16:16 218112 -c----w C:\WINDOWS\system32\dllcache\wordpad.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-17 09:23:17 . 2006-03-02 12:00:00 50968 ----a-w C:\WINDOWS\system32\perfc015.dat 2009-04-17 09:23:17 . 2006-03-02 12:00:00 359046 ----a-w C:\WINDOWS\system32\perfh015.dat 2009-03-06 14:22:12 . 2006-03-02 12:00:00 285696 ----a-w C:\WINDOWS\system32\pdh.dll 2009-03-01 15:00:54 . 2006-09-21 15:27:26 0 d--h--w C:\Program Files\InstallShield Installation Information 2009-02-20 08:12:00 . 2006-03-02 12:00:00 668672 ----a-w C:\WINDOWS\system32\wininet.dll 2009-02-20 08:11:59 . 2006-03-02 12:00:00 81920 ----a-w C:\WINDOWS\system32\ieencode.dll 2009-02-17 13:03:10 . 2007-05-14 19:15:32 304182 ----a-w C:\StiImg.dat 2009-02-10 17:09:18 . 2004-08-04 00:38:58 2067328 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2009-02-09 14:07:49 . 2006-03-02 12:00:00 1847040 ----a-w C:\WINDOWS\system32\win32k.sys 2009-02-09 11:26:12 . 2006-03-02 12:00:00 2190336 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2009-02-09 11:25:57 . 2006-03-02 12:00:00 111104 ----a-w C:\WINDOWS\system32\services.exe 2009-02-09 10:53:44 . 2006-03-02 12:00:00 731136 ----a-w C:\WINDOWS\system32\lsasrv.dll 2009-02-09 10:53:44 . 2006-03-02 12:00:00 686592 ----a-w C:\WINDOWS\system32\advapi32.dll 2009-02-09 10:53:44 . 2006-03-02 12:00:00 401408 ----a-w C:\WINDOWS\system32\rpcss.dll 2009-02-09 10:53:43 . 2006-03-02 12:00:00 722944 ----a-w C:\WINDOWS\system32\ntdll.dll 2009-02-06 10:39:08 . 2006-03-02 12:00:00 35328 ----a-w C:\WINDOWS\system32\sc.exe 2009-02-03 19:58:45 . 2006-03-02 12:00:00 56832 ----a-w C:\WINDOWS\system32\secur32.dll 2004-10-01 13:00:16 . 2006-09-23 11:17:30 40960 ----a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((( SnapShot@2009-04-29_18.14.48 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-30 14:03:19 . 2009-04-30 14:03:19 16384 C:\WINDOWS\Temp\Perflib_Perfdata_cf4.dat + 2009-04-30 13:52:46 . 2009-04-30 13:52:46 16384 C:\WINDOWS\Temp\Perflib_Perfdata_570.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 17:21:10 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 17:21:30 1695232] "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [BU] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-01-12 12:11:30 25448488] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-01-16 08:41:24 1716224] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 01:23:34 443968] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2008-08-16 14:01:10 264704] "IPLA!"="C:\Program Files\ipla\ipla.exe" [2008-12-23 10:33:44 2794232] "User1"="C:\Documents and Settings\User1\User1.exe" [BU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 11:26:00 7700480] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 01:43:44 83608] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 15:24:20 54840] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 16:05:02 81920] "CafeNews"="C:\Program Files\Press-Service\CafeNews\CN.exe" [BU] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 11:26:00 86016] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 08:50:42 155648] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-08-19 09:25:36 185896] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 21:08:45 81000] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 01:38:00 34672] "SkyTel"="SkyTel.EXE" - C:\WINDOWS\SkyTel.exe [2006-05-16 16:04:26 2879488] "nwiz"="nwiz.exe" - C:\WINDOWS\system32\nwiz.exe [2007-04-19 11:26:00 1626112] "RTHDCPL"="RTHDCPL.EXE" - C:\WINDOWS\RTHDCPL.exe [2006-08-14 12:00:04 16050176] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 17:21:10 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-3-27 113664] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]

**Posty:** 18165 · przez **wojtas** 30 Kwi 2009, 16:41

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 4 · przez **pajka83** 30 Kwi 2009, 18:21

przy skanowaniu dr.web pojawił się wirus niewyleczlny. Obiekt: psexesvc.exe, ścieżka: c:/Windows, Status: Program PsExec.170. Co z tym zrobić??

**Posty:** 18165 · przez **wojtas** 30 Kwi 2009, 19:53

zostaw ten plik jest dobry... rob dalej i pokaz raporty

**Posty:** 4 · przez **pajka83** 01 Maj 2009, 11:28

Oto raprt z dr. web:
A0144871.EXE C:\System Volume Information\_restore{0D3C618D-73C9-4784-998B-234BD64EF5E0}\RP331 Program.PsExec.170
a po skanowaniu http://www.kaspersky.pl/virusscanner.html nie znaleziono groźnych plików, w raporcie pusto

To chyba znaczy,że już wszystko o.ki??
Dziękuje bardzo za pomoc