Proszę o sprawdzenie loga (trojany kilka razy dziennie)

**Posty:** 29 · przez **KAMILOSSS** 09 Kwi 2009, 17:59

Witam, mój problem jest pewnie bardzo typowy, lecz dla mnie to czarna magia więc zwracam się do Was z prośbą o pomoc.
Od około 2 tygodni prawie codziennie Avast wykrywał mi trojany, zwykle 2 dziennie. Używam Avasta a ponadto Comodo. Dziś przeskanowałem całego kompa przy pomocy Comodo i nic nie wykrył, za to Avast przy każdym uruchomieniu znajduje po 2 lub 3 trojany.

Dołączam logi z Hijackthis i ComboFixa

Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:43:21, on 2009-04-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\PROGRAMY\avast\aswUpdSv.exe D:\PROGRAMY\avast\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe D:\PROGRAMY\avast\ashDisp.exe D:\PROGRAMY\iTunes\iTunesHelper.exe D:\PROGRAMY\Comodo\COMODO Internet Security\cfp.exe D:\PROGRAMY\Power DVD\PDVDServ.exe C:\WINDOWS\system32\ctfmon.exe D:\PROGRAMY\3D\Common\IconMgr.exe C:\WINDOWS\system32\spoolsv.exe d:\programy\3D\E-Color Indicator\TICIcon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\AshEvtSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe D:\PROGRAMY\Comodo\COMODO Internet Security\cmdagent.exe D:\PROGRAMY\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\system32\wscntfy.exe D:\PROGRAMY\avast\ashMaiSv.exe D:\PROGRAMY\avast\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\LocalService\Dane aplikacji\940247539.exe D:\PROGRAMY\Mozilla Firefox\firefox.exe D:\PROGRAMY\Hijackthis\hijackthis.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAMY\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [pbmini] "C:\Program Files\pcast\PodcastbarMini\PodcastBarMiniStater.exe" -hide O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRAMY\avast\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "D:\PROGRAMY\QuickTime Alternative\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "D:\PROGRAMY\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [COMODO Internet Security] "D:\PROGRAMY\Comodo\COMODO Internet Security\cfp.exe" -h O4 - HKLM\..\Run: [RemoteControl] "D:\PROGRAMY\Power DVD\PDVDServ.exe" O4 - HKLM\..\RunOnce: [NSSInstallation] C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe /RunOnce O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AlcoholAutomount] "D:\PROGRAMY\Alcohol 120\axcmd.exe" /automount O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: E-Color.lnk = D:\PROGRAMY\3D\Common\IconMgr.exe O4 - Global Startup: Microsoft Office.lnk = D:\PROGRAMY\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: crypt - crypts.dll (file missing) O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AshEvtSvc - Unknown owner - C:\WINDOWS\System32\AshEvtSvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\PROGRAMY\avast\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\PROGRAMY\avast\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\PROGRAMY\avast\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\PROGRAMY\avast\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - D:\PROGRAMY\Comodo\COMODO Internet Security\cmdagent.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\PROGRAMY\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing) O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe -- End of file - 6207 bytes

ComboFix

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:58:19, on 2009-04-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\PROGRAMY\avast\aswUpdSv.exe D:\PROGRAMY\avast\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe D:\PROGRAMY\avast\ashDisp.exe D:\PROGRAMY\iTunes\iTunesHelper.exe D:\PROGRAMY\Power DVD\PDVDServ.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe D:\PROGRAMY\3D\Common\IconMgr.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\AshEvtSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe D:\PROGRAMY\Alcohol 120\StarWind\StarWindServiceAE.exe d:\programy\3D\E-Color Indicator\TICIcon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iPod\bin\iPodService.exe D:\PROGRAMY\avast\ashMaiSv.exe D:\PROGRAMY\avast\ashWebSv.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe D:\PROGRAMY\Mozilla Firefox\firefox.exe D:\PROGRAMY\Hijackthis\hijackthis.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAMY\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRAMY\avast\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "D:\PROGRAMY\QuickTime Alternative\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "D:\PROGRAMY\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [RemoteControl] "D:\PROGRAMY\Power DVD\PDVDServ.exe" O4 - HKLM\..\RunOnce: [NSSInstallation] C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe /RunOnce O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AlcoholAutomount] "D:\PROGRAMY\Alcohol 120\axcmd.exe" /automount O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: E-Color.lnk = D:\PROGRAMY\3D\Common\IconMgr.exe O4 - Global Startup: Microsoft Office.lnk = D:\PROGRAMY\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AshEvtSvc - Unknown owner - C:\WINDOWS\System32\AshEvtSvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\PROGRAMY\avast\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\PROGRAMY\avast\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\PROGRAMY\avast\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\PROGRAMY\avast\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\PROGRAMY\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing) O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe -- End of file - 5813 bytes

**Posty:** 18165 · przez **wojtas** 09 Kwi 2009, 18:27

dales dwa logi z hijacka.. daj z combofixa.

**Posty:** 29 · przez **KAMILOSSS** 09 Kwi 2009, 18:38

Racja, już daje ComboFixa

Kod: Zaznacz wszystko: ComboFix 09-04-04.01 - Użytkownik 2009-04-09 18:33:22.7 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.635 [GMT 2:00] Uruchomiony z: c:\documents and settings\Użytkownik\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1229 [VPS 081130-0] *On-access scanning disabled* (Outdated) AV: COMODO Antivirus *On-access scanning enabled* (Updated) FW: COMODO Firewall *enabled* UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((( Pliki utworzone od 2009-03-09 do 2009-04-09 ))))))))))))))))))))))))))))))) . 2009-04-09 17:33 . 2009-04-09 17:37 <DIR> d-------- C:\32788R22FWJFW.1.tmp 2009-04-09 17:30 . 2009-04-09 17:33 <DIR> d-------- C:\32788R22FWJFW.0.tmp 2009-04-09 16:54 . 2009-04-09 17:28 <DIR> d-------- C:\327882R2FWJFW 2009-04-09 15:19 . 2009-04-09 15:19 0 --a------ c:\windows\system32\31.tmp 2009-04-09 15:08 . 2009-04-09 15:08 0 --a------ c:\windows\system32\30.tmp 2009-04-09 15:07 . 2009-04-09 15:07 0 --a------ c:\windows\system32\2F.tmp 2009-04-09 15:07 . 2009-04-09 15:07 0 --a------ c:\windows\system32\2E.tmp 2009-04-09 15:05 . 2009-04-09 15:05 0 --a------ c:\windows\system32\2D.tmp 2009-04-09 11:33 . 2009-04-09 11:33 0 --a------ c:\windows\system32\7D.tmp 2009-04-09 11:33 . 2009-04-09 11:33 0 --a------ c:\windows\system32\7C.tmp 2009-04-03 14:30 . 2009-04-03 14:30 0 --a------ c:\windows\system32\2.tmp 2009-04-01 13:31 . 2009-04-01 13:31 0 --a------ c:\windows\system32\A.tmp 2009-04-01 13:31 . 2009-04-01 13:31 0 --a------ c:\windows\system32\6.tmp 2009-03-30 14:30 . 2009-03-30 14:30 0 --a------ c:\windows\system32\5.tmp 2009-03-29 22:15 . 2008-11-06 18:37 3,596,288 --a------ c:\windows\system32\qt-dx331.dll 2009-03-29 22:15 . 2008-09-24 20:41 839,680 --a------ c:\windows\system32\lameACM.acm 2009-03-29 22:15 . 2008-12-07 20:08 795,648 --a------ c:\windows\system32\xvidcore.dll 2009-03-29 22:15 . 2008-11-06 18:33 684,032 --a------ c:\windows\system32\divx.dll 2009-03-29 22:15 . 2004-01-25 18:18 217,088 --a------ c:\windows\system32\yv12vfw.dll 2009-03-29 22:15 . 2008-09-16 21:23 168,448 --a------ c:\windows\system32\unrar.dll 2009-03-29 22:15 . 2008-12-07 20:08 130,048 --a------ c:\windows\system32\xvidvfw.dll 2009-03-29 22:15 . 2007-09-21 02:52 118,784 --a------ c:\windows\system32\ac3acm.acm 2009-03-29 22:15 . 2008-12-11 02:33 86,016 --a------ c:\windows\system32\dpl100.dll 2009-03-29 22:15 . 2009-03-02 20:10 67,584 --a------ c:\windows\system32\ff_vfw.dll 2009-03-29 22:15 . 2007-07-10 18:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest 2009-03-29 22:15 . 2008-10-03 14:30 414 --a------ c:\windows\system32\lame_acm.xml 2009-03-26 19:22 . 2009-03-26 19:22 0 --a------ c:\windows\system32\4.tmp 2009-03-26 13:50 . 2009-03-26 13:50 32,768 --a------ c:\windows\system32\AshEvtSvc.exe 2009-03-25 12:45 . 2009-04-09 11:27 <DIR> d--h----- C:\LG3G 2009-03-25 12:45 . 2009-03-25 12:45 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\LG Electronics 2009-03-25 12:42 . 2009-03-25 12:42 <DIR> d-------- c:\program files\LG Electronics 2009-03-25 12:42 . 2007-07-11 11:45 21,632 --a------ c:\windows\system32\drivers\lgusbmodem.sys 2009-03-25 12:42 . 2007-07-11 16:51 19,840 --a------ c:\windows\system32\drivers\lgusbdiag.sys 2009-03-25 12:42 . 2007-07-11 11:40 12,416 --a------ c:\windows\system32\drivers\lgusbbus.sys 2009-03-25 12:39 . 2009-03-25 12:39 <DIR> d-------- c:\program files\LG PC Suite 2 2009-03-25 12:39 . 2009-03-25 12:39 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\InstallShield 2009-03-13 23:08 . 2009-03-13 23:08 <DIR> d-------- c:\program files\WIBU-SYSTEMS 2009-03-13 23:08 . 2006-11-23 06:20 1,253,376 --a------ c:\windows\system32\WibuKe32.cpl 2009-03-13 23:08 . 2006-11-17 07:00 516,096 --a------ c:\windows\system32\WibuXpm4J32.dll 2009-03-13 23:08 . 2006-11-02 06:20 479,232 --a------ c:\windows\system32\wibuKJni.dll 2009-03-13 23:08 . 2006-11-22 06:20 348,160 --a------ c:\windows\system32\WkExt32.dll 2009-03-13 23:08 . 2006-11-22 06:20 159,744 --a------ c:\windows\system32\WkWin32.dll 2009-03-13 23:08 . 2006-11-22 06:20 72,704 --a------ c:\windows\system32\drivers\WibuKey.sys 2009-03-13 23:08 . 2000-10-18 03:00 57,552 --a------ c:\windows\system32\WkDos.exe 2009-03-13 23:08 . 2006-03-06 06:10 54,336 --a------ c:\windows\system\WkWin.dll 2009-03-13 23:08 . 2006-11-09 06:20 16,384 --a------ c:\windows\system32\drivers\Wibukey2.sys 2009-03-13 23:07 . 2009-03-13 23:07 <DIR> d-------- c:\program files\Common Files\ChaosGroup . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-09 15:35 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\comodo 2009-04-08 18:59 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\Nowe Gadu-Gadu 2009-03-29 11:51 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\Skype 2009-03-28 09:43 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\ipla 2009-03-26 17:22 --------- d-----w c:\program files\Opera 2009-03-25 10:42 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-19 13:51 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WinZip 2009-02-17 17:48 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\SpeedSim 2009-01-29 10:23 1,700,352 ----a-w c:\windows\system32\gdiplus.dll 2008-07-04 07:37 94,208 -c--a-w c:\documents and settings\Użytkownik\Dane aplikacji\ezplay.sys 2008-07-04 07:37 47,360 -c--a-w c:\documents and settings\Użytkownik\Dane aplikacji\pcouffin.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "AlcoholAutomount"="d:\programy\Alcohol 120\axcmd.exe" [2007-07-02 219520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496] "avast!"="d:\programy\avast\ashDisp.exe" [2008-07-19 78008] "QuickTime Task"="d:\programy\QuickTime Alternative\qttask.exe" [2008-09-06 413696] "iTunesHelper"="d:\programy\iTunes\iTunesHelper.exe" [2008-10-01 289576] "RemoteControl"="d:\programy\Power DVD\PDVDServ.exe" [2004-11-02 32768] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-06-28 c:\windows\RTHDCPL.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "NSSInstallation"="c:\windows\system32\Adobe\Shockwave 11\nssstub.exe" [2008-12-19 181624] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ E-Color.lnk - d:\programy\3D\Common\IconMgr.exe [2007-01-06 61440] Microsoft Office.lnk - d:\programy\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"= ctwdm32.dll "aux1"= ctwdm32.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digiwet.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\PROGRAMY\\Gadu-Gadu\\gg.exe"= "f:\\gry\\STARCRAFT\\STARCRAFT.EXE"= "f:\\gry\\MotoGP Demo\\MotoGP URT 3 Demo\\motogp_demo.exe"= "d:\\PROGRAMY\\hamachi\\hamachi.exe"= "f:\\gry\\Warcraft III\\Warcraft III.exe"= "f:\\gry\\Counter-Strike 1.6\\hl.exe"= "d:\\PROGRAMY\\Mozilla Firefox\\firefox.exe"= "d:\\PROGRAMY\\Tlen.pl\\tlen.exe"= "f:\\gry\\Serious Sam - The First Encounter\\Bin\\SeriousSam.exe"= "f:\\gry\\F1\\F1 2006\\F1 2006.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "f:\\gry\\Counter-Strike 1.6\\hlds.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "d:\\PROGRAMY\\iTunes\\iTunes.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "d:\\PROGRAMY\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-12 78416] R2 AshEvtSvc;AshEvtSvc;c:\windows\System32\AshEvtSvc.exe -k netsvcs --> c:\windows\System32\AshEvtSvc.exe -k netsvcs [?] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-12 20560] R3 SNCT511;PC Camera (6005 CIF);c:\windows\system32\drivers\snct511.sys [2007-10-07 219264] S3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a080eea8-9d8f-11db-83d0-00138fe33e52}] \Shell\AutoRun\command - H:\Autorun.exe . Zawartość folderu 'Zaplanowane zadania' 2009-04-09 c:\windows\Tasks\NSSstub.job - c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2008-12-19 12:37] . . ------- Skan uzupełniający ------- . uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local FF - ProfilePath - c:\documents and settings\Użytkownik\Dane aplikacji\Mozilla\Firefox\Profiles\bfg53xfe.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.wp.pl/ FF - component: c:\documents and settings\All Users\Dane aplikacji\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll FF - component: c:\documents and settings\All Users\Dane aplikacji\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: d:\programy\iTunes\Mozilla Plugins\npitunes.dll FF - plugin: d:\programy\Mozilla Firefox\plugins\NPBILLARD8.dll FF - plugin: d:\programy\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: d:\programy\Mozilla Firefox\plugins\NPSNOOKER.dll FF - plugin: d:\programy\Mozilla Firefox\plugins\npzylomgamesplayer.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin2.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin3.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin4.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin5.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin6.dll FF - plugin: d:\programy\Reader\browser\nppdf32.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-09 18:34:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ASFWHide] "ImagePath"="\??\c:\docume~1\UYTKOW~1\USTAWI~1\Temp\ASFWHide" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(812) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2009-04-09 18:35:40 ComboFix-quarantined-files.txt 2009-04-09 16:35:25 ComboFix2.txt 2009-04-09 15:48:24 Przed: 5 587 574 784 bajtów wolnych Po: 5,570,048,000 bajtów wolnych 179 --- E O F --- 2008-12-03 08:43:05

**Posty:** 18165 · przez **wojtas** 09 Kwi 2009, 19:02

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 29 · przez **KAMILOSSS** 09 Kwi 2009, 19:06

Zapomniałem dodaj, wyskoczył mi kilka razy malware, nie wiem czy to da sie odczytac z logów...
Edit: Właśnie przed momentem dowiedzialem sie ze "Menedzer zadan zostal wylaczony przez administratora"

**Posty:** 18165 · przez **wojtas** 09 Kwi 2009, 19:34

zrob co kazalem i wroc z logami..

**Posty:** 29 · przez **KAMILOSSS** 09 Kwi 2009, 19:40

Po wszystkich czynnosciach i restarcie znow widze malware

Report.txt

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Użytkownik on 2009-04-09 at 19:21 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\system32\2.tmp - Deleted C:\WINDOWS\system32\4.tmp - Deleted C:\WINDOWS\system32\5.tmp - Deleted C:\WINDOWS\system32\6.tmp - Deleted C:\WINDOWS\system32\A.tmp - Deleted C:\WINDOWS\system32\2.tmp - Deleted C:\WINDOWS\system32\2D.tmp - Deleted C:\WINDOWS\system32\2E.tmp - Deleted C:\WINDOWS\system32\2F.tmp - Deleted C:\Program Files\Internet Explorer\setupapi.dll - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-09 19:28:08 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf41] "khjeh"=hex:20,02,00,00,ef,d1,e6,4e,fb,c1,0f,ad,72,7b,7b,6b,fd,05,b3,c6,1c,.. "hj34z0"=hex:44,71,14,1f,f3,00,10,f8,7b,da,2f,67,48,15,ba,12,90,87,e0,95,0b,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf42] "khjeh"=hex:20,02,00,00,d4,d0,e6,4e,7a,cb,e3,d4,45,e1,e3,be,c4,bd,a7,b0,d7,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf43] "khjeh"=hex:20,02,00,00,68,d0,e6,4e,66,ad,ed,1a,91,24,38,d1,60,69,56,16,03,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="D:\PROGRAMY\Alcohol 120\" "h0"=dword:00000000 "ujdew"=hex:36,8a,7d,bc,5b,c1,67,64,cc,68,46,a8,86,10,8f,86,4b,9c,13,41,87,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="D:\PROGRAMY\Alcohol 120\" "h0"=dword:00000000 "ujdew"=hex:fa,9b,a7,f9,ce,40,4f,4e,ce,5f,9d,15,4e,8d,77,5d,15,c4,e5,70,e9,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\PROGRAMY\\Gadu-Gadu\\gg.exe"="D:\\PROGRAMY\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny" "F:\\gry\\STARCRAFT\\STARCRAFT.EXE"="F:\\gry\\STARCRAFT\\STARCRAFT.EXE:*:Enabled:Starcraft" "F:\\gry\\MotoGP Demo\\MotoGP URT 3 Demo\\motogp_demo.exe"="F:\\gry\\MotoGP Demo\\MotoGP URT 3 Demo\\motogp_demo.exe:*:Enabled:motogp_demo" "D:\\PROGRAMY\\hamachi\\hamachi.exe"="D:\\PROGRAMY\\hamachi\\hamachi.exe:*:Enabled:Hamachi Client" "F:\\gry\\Warcraft III\\Warcraft III.exe"="F:\\gry\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III" "F:\\gry\\Counter-Strike 1.6\\hl.exe"="F:\\gry\\Counter-Strike 1.6\\hl.exe:*:Enabled:Half-Life Launcher" "D:\\PROGRAMY\\Mozilla Firefox\\firefox.exe"="D:\\PROGRAMY\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "D:\\PROGRAMY\\Tlen.pl\\tlen.exe"="D:\\PROGRAMY\\Tlen.pl\\tlen.exe:*:Enabled:Komunikator Tlen.pl" "F:\\gry\\Serious Sam - The First Encounter\\Bin\\SeriousSam.exe"="F:\\gry\\Serious Sam - The First Encounter\\Bin\\SeriousSam.exe:*:Enabled:SeriousSam" "F:\\gry\\F1\\F1 2006\\F1 2006.exe"="F:\\gry\\F1\\F1 2006\\F1 2006.exe:*:Enabled:F1 Challenge 99-02" "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"="C:\\Program Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver" "C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "F:\\gry\\Counter-Strike 1.6\\hlds.exe"="F:\\gry\\Counter-Strike 1.6\\hlds.exe:*:Enabled:HLDS Launcher" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" "D:\\PROGRAMY\\iTunes\\iTunes.exe"="D:\\PROGRAMY\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows" "D:\\PROGRAMY\\Nowe Gadu-Gadu\\gg.exe"="D:\\PROGRAMY\\Nowe Gadu-Gadu\\gg.exe:*:Enabled:Nowe Gadu-Gadu" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe" Wed 4 Aug 2004 60,928 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" Sat 3 Feb 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" [b]Finished![/b]

ComboFix

Kod: Zaznacz wszystko: ComboFix 09-04-04.01 - Użytkownik 2009-04-09 19:35:27.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.584 [GMT 2:00] Uruchomiony z: c:\documents and settings\Użytkownik\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1229 [VPS 081130-0] *On-access scanning disabled* (Outdated) AV: COMODO Antivirus *On-access scanning enabled* (Updated) FW: COMODO Firewall *enabled* UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\LocalService\Dane aplikacji\940247539.exe c:\documents and settings\LocalService\Dane aplikacji\951323796.exe . ((((((((((((((((((((((((( Pliki utworzone od 2009-03-09 do 2009-04-09 ))))))))))))))))))))))))))))))) . 2009-04-09 19:15 . 2009-04-09 19:30 <DIR> d-------- C:\SDFix 2009-04-09 17:33 . 2009-04-09 17:37 <DIR> d-------- C:\32788R22FWJFW.1.tmp 2009-04-09 17:30 . 2009-04-09 17:33 <DIR> d-------- C:\32788R22FWJFW.0.tmp 2009-04-09 16:54 . 2009-04-09 17:28 <DIR> d-------- C:\327882R2FWJFW 2009-04-09 15:19 . 2009-04-09 15:19 0 --a------ c:\windows\system32\31.tmp 2009-04-09 15:08 . 2009-04-09 15:08 0 --a------ c:\windows\system32\30.tmp 2009-04-09 11:33 . 2009-04-09 11:33 0 --a------ c:\windows\system32\7D.tmp 2009-04-09 11:33 . 2009-04-09 11:33 0 --a------ c:\windows\system32\7C.tmp 2009-03-29 22:15 . 2008-11-06 18:37 3,596,288 --a------ c:\windows\system32\qt-dx331.dll 2009-03-29 22:15 . 2008-09-24 20:41 839,680 --a------ c:\windows\system32\lameACM.acm 2009-03-29 22:15 . 2008-12-07 20:08 795,648 --a------ c:\windows\system32\xvidcore.dll 2009-03-29 22:15 . 2008-11-06 18:33 684,032 --a------ c:\windows\system32\divx.dll 2009-03-29 22:15 . 2004-01-25 18:18 217,088 --a------ c:\windows\system32\yv12vfw.dll 2009-03-29 22:15 . 2008-09-16 21:23 168,448 --a------ c:\windows\system32\unrar.dll 2009-03-29 22:15 . 2008-12-07 20:08 130,048 --a------ c:\windows\system32\xvidvfw.dll 2009-03-29 22:15 . 2007-09-21 02:52 118,784 --a------ c:\windows\system32\ac3acm.acm 2009-03-29 22:15 . 2008-12-11 02:33 86,016 --a------ c:\windows\system32\dpl100.dll 2009-03-29 22:15 . 2009-03-02 20:10 67,584 --a------ c:\windows\system32\ff_vfw.dll 2009-03-29 22:15 . 2007-07-10 18:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest 2009-03-29 22:15 . 2008-10-03 14:30 414 --a------ c:\windows\system32\lame_acm.xml 2009-03-26 13:50 . 2009-03-26 13:50 32,768 --a------ c:\windows\system32\AshEvtSvc.exe 2009-03-25 12:45 . 2009-04-09 11:27 <DIR> d--h----- C:\LG3G 2009-03-25 12:45 . 2009-03-25 12:45 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\LG Electronics 2009-03-25 12:42 . 2009-03-25 12:42 <DIR> d-------- c:\program files\LG Electronics 2009-03-25 12:42 . 2007-07-11 11:45 21,632 --a------ c:\windows\system32\drivers\lgusbmodem.sys 2009-03-25 12:42 . 2007-07-11 16:51 19,840 --a------ c:\windows\system32\drivers\lgusbdiag.sys 2009-03-25 12:42 . 2007-07-11 11:40 12,416 --a------ c:\windows\system32\drivers\lgusbbus.sys 2009-03-25 12:39 . 2009-03-25 12:39 <DIR> d-------- c:\program files\LG PC Suite 2 2009-03-25 12:39 . 2009-03-25 12:39 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\InstallShield 2009-03-13 23:08 . 2009-03-13 23:08 <DIR> d-------- c:\program files\WIBU-SYSTEMS 2009-03-13 23:08 . 2006-11-23 06:20 1,253,376 --a------ c:\windows\system32\WibuKe32.cpl 2009-03-13 23:08 . 2006-11-17 07:00 516,096 --a------ c:\windows\system32\WibuXpm4J32.dll 2009-03-13 23:08 . 2006-11-02 06:20 479,232 --a------ c:\windows\system32\wibuKJni.dll 2009-03-13 23:08 . 2006-11-22 06:20 348,160 --a------ c:\windows\system32\WkExt32.dll 2009-03-13 23:08 . 2006-11-22 06:20 159,744 --a------ c:\windows\system32\WkWin32.dll 2009-03-13 23:08 . 2006-11-22 06:20 72,704 --a------ c:\windows\system32\drivers\WibuKey.sys 2009-03-13 23:08 . 2000-10-18 03:00 57,552 --a------ c:\windows\system32\WkDos.exe 2009-03-13 23:08 . 2006-03-06 06:10 54,336 --a------ c:\windows\system\WkWin.dll 2009-03-13 23:08 . 2006-11-09 06:20 16,384 --a------ c:\windows\system32\drivers\Wibukey2.sys 2009-03-13 23:07 . 2009-03-13 23:07 <DIR> d-------- c:\program files\Common Files\ChaosGroup . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-09 15:35 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\comodo 2009-04-08 18:59 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\Nowe Gadu-Gadu 2009-03-29 11:51 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\Skype 2009-03-28 09:43 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\ipla 2009-03-26 17:22 --------- d-----w c:\program files\Opera 2009-03-25 10:42 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-19 13:51 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WinZip 2009-02-17 17:48 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\SpeedSim 2009-01-29 10:23 1,700,352 ----a-w c:\windows\system32\gdiplus.dll 2008-07-04 07:37 94,208 -c--a-w c:\documents and settings\Użytkownik\Dane aplikacji\ezplay.sys 2008-07-04 07:37 47,360 -c--a-w c:\documents and settings\Użytkownik\Dane aplikacji\pcouffin.sys . ((((((((((((((((((((((((((((( SnapShot@2009-04-09_17.47.17,12 ))))))))))))))))))))))))))))))))))))))))) . - 2008-02-23 22:01:53 163,328 -c--a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-08-07 13:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE - 2008-02-26 16:43:55 6,549,504 -c--a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2009-04-09 17:19:12 8,740,864 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-02-26 16:43:55 249,856 -c--a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2009-04-09 17:19:12 319,488 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2009-04-09 17:26:42 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_708.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "AlcoholAutomount"="d:\programy\Alcohol 120\axcmd.exe" [2007-07-02 219520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496] "avast!"="d:\programy\avast\ashDisp.exe" [2008-07-19 78008] "QuickTime Task"="d:\programy\QuickTime Alternative\qttask.exe" [2008-09-06 413696] "iTunesHelper"="d:\programy\iTunes\iTunesHelper.exe" [2008-10-01 289576] "RemoteControl"="d:\programy\Power DVD\PDVDServ.exe" [2004-11-02 32768] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-06-28 c:\windows\RTHDCPL.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "NSSInstallation"="c:\windows\system32\Adobe\Shockwave 11\nssstub.exe" [2008-12-19 181624] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ E-Color.lnk - d:\programy\3D\Common\IconMgr.exe [2007-01-06 61440] Microsoft Office.lnk - d:\programy\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"= ctwdm32.dll "aux1"= ctwdm32.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digiwet.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\PROGRAMY\\Gadu-Gadu\\gg.exe"= "f:\\gry\\STARCRAFT\\STARCRAFT.EXE"= "f:\\gry\\MotoGP Demo\\MotoGP URT 3 Demo\\motogp_demo.exe"= "d:\\PROGRAMY\\hamachi\\hamachi.exe"= "f:\\gry\\Warcraft III\\Warcraft III.exe"= "f:\\gry\\Counter-Strike 1.6\\hl.exe"= "d:\\PROGRAMY\\Mozilla Firefox\\firefox.exe"= "d:\\PROGRAMY\\Tlen.pl\\tlen.exe"= "f:\\gry\\Serious Sam - The First Encounter\\Bin\\SeriousSam.exe"= "f:\\gry\\F1\\F1 2006\\F1 2006.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "f:\\gry\\Counter-Strike 1.6\\hlds.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "d:\\PROGRAMY\\iTunes\\iTunes.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "d:\\PROGRAMY\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-12 78416] R2 AshEvtSvc;AshEvtSvc;c:\windows\System32\AshEvtSvc.exe -k netsvcs --> c:\windows\System32\AshEvtSvc.exe -k netsvcs [?] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-12 20560] R3 SNCT511;PC Camera (6005 CIF);c:\windows\system32\drivers\snct511.sys [2007-10-07 219264] S3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a080eea8-9d8f-11db-83d0-00138fe33e52}] \Shell\AutoRun\command - H:\Autorun.exe . Zawartość folderu 'Zaplanowane zadania' 2009-04-09 c:\windows\Tasks\NSSstub.job - c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2008-12-19 12:37] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-Malware Doctor - c:\documents and settings\LocalService\Dane aplikacji\940247539.exe HKLM-Run-Malware Doctor - c:\documents and settings\LocalService\Dane aplikacji\940247539.exe . ------- Skan uzupełniający ------- . uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local FF - ProfilePath - c:\documents and settings\Użytkownik\Dane aplikacji\Mozilla\Firefox\Profiles\bfg53xfe.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.wp.pl/ FF - component: c:\documents and settings\All Users\Dane aplikacji\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll FF - component: c:\documents and settings\All Users\Dane aplikacji\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: d:\programy\iTunes\Mozilla Plugins\npitunes.dll FF - plugin: d:\programy\Mozilla Firefox\plugins\NPBILLARD8.dll FF - plugin: d:\programy\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: d:\programy\Mozilla Firefox\plugins\NPSNOOKER.dll FF - plugin: d:\programy\Mozilla Firefox\plugins\npzylomgamesplayer.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin2.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin3.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin4.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin5.dll FF - plugin: d:\programy\QuickTime Alternative\Plugins\npqtplugin6.dll FF - plugin: d:\programy\Reader\browser\nppdf32.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-09 19:36:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ASFWHide] "ImagePath"="\??\c:\docume~1\UYTKOW~1\USTAWI~1\Temp\ASFWHide" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(812) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2009-04-09 19:38:16 ComboFix-quarantined-files.txt 2009-04-09 17:37:42 ComboFix2.txt 2009-04-09 16:35:41 ComboFix3.txt 2009-04-09 15:48:24 Przed: 5 591 322 624 bajtów wolnych Po: 5,544,591,360 bajtów wolnych 191 --- E O F --- 2008-12-03 08:43:05

Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:40:23, on 2009-04-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\PROGRAMY\avast\aswUpdSv.exe D:\PROGRAMY\avast\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\AshEvtSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe D:\PROGRAMY\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe D:\PROGRAMY\avast\ashDisp.exe D:\PROGRAMY\iTunes\iTunesHelper.exe D:\PROGRAMY\Power DVD\PDVDServ.exe C:\WINDOWS\system32\ctfmon.exe D:\PROGRAMY\3D\Common\IconMgr.exe d:\programy\3D\E-Color Indicator\TICIcon.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\msiexec.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe D:\PROGRAMY\Mozilla Firefox\firefox.exe D:\PROGRAMY\Hijackthis\hijackthis.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAMY\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRAMY\avast\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "D:\PROGRAMY\QuickTime Alternative\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "D:\PROGRAMY\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [RemoteControl] "D:\PROGRAMY\Power DVD\PDVDServ.exe" O4 - HKLM\..\RunOnce: [NSSInstallation] C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe /RunOnce O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AlcoholAutomount] "D:\PROGRAMY\Alcohol 120\axcmd.exe" /automount O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: E-Color.lnk = D:\PROGRAMY\3D\Common\IconMgr.exe O4 - Global Startup: Microsoft Office.lnk = D:\PROGRAMY\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AshEvtSvc - Unknown owner - C:\WINDOWS\System32\AshEvtSvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\PROGRAMY\avast\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\PROGRAMY\avast\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\PROGRAMY\avast\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\PROGRAMY\avast\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\PROGRAMY\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing) O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe -- End of file - 5782 bytes

**Posty:** 18165 · przez **wojtas** 09 Kwi 2009, 19:54

skasuj:

2009-04-09 15:19 . 2009-04-09 15:19 0 --a------ c:\windows\system32\31.tmp
2009-04-09 15:08 . 2009-04-09 15:08 0 --a------ c:\windows\system32\30.tmp
2009-04-09 11:33 . 2009-04-09 11:33 0 --a------ c:\windows\system32\7D.tmp
2009-04-09 11:33 . 2009-04-09 11:33 0 --a------ c:\windows\system32\7C.tmp

te plik/i :

c:\windows\system32\AshEvtSvc.exe

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow oraz powiedz w jakich plikach wykrywa Ci wirusa?

**Posty:** 29 · przez **KAMILOSSS** 09 Kwi 2009, 20:07

Fuck, nie jest dobrze

Zle to zrozumialem, usunalem plik c:\windows\system32\AshEvtSvc.exe

Edit:
Bawic sie w przywracanie systemu do daty sprzed calej tej procedury i zaczac od poczatku?
(Czy jest to bardzo wazny plik dla systemu?)
Czy moze jest jakis latwiejszy sposob na odzyskanie tego pliku?

**Posty:** 18165 · przez **wojtas** 10 Kwi 2009, 16:02

sadze ze mogłbyc to wirus..

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 29 · przez **KAMILOSSS** 11 Kwi 2009, 22:42

Oto raport z kasperskiego (najwazniejsze rzeczy):

Statystyki skanowania
Przeskanowanych plików 99368
Nazwa zagrożenia 1
Zainfekowanych obiektów 1
Podejrzanych obiektów 0
Czas skanowania 01:33:00

Nazwa pliku
D:\PROGRAMY\Comodo\COMODO Internet Security\Quarantine\Intell.DLL

Nazwa zagrożenia
Zainfekowany: Backdoor.Win32.Hupigon.arlg

Liczba zagrożeń
1

oraz log z FixIEDefa

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7514 * * * ******************************************************************************** Created at 22:18:13 on Saturday, April 11, 2009 Time Zone : Logged On User : Użytkownik Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 Intel(R) Pentium(R) D CPU 2.80GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 20 GB System Drive Free : 7.64 GB Total Physical Memory: 1023 MB Free Physical Memory : 587 MB Total Page File : 1023 MB Free Page File : 2129 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1968 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\WINDOWS\system32\actskn45.ocx C:\WINDOWS\system32\tmp.txt -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\DateTime HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager "SystemID" ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 18165 · przez **wojtas** 12 Kwi 2009, 01:57

oproznij kwarantanne i bedzie ok

Kto jest na forum