Infekcja komputera (vundo?)

**Posty:** 112 · przez **Fever** 25 Wrz 2010, 19:46

otóz na komputerze mojej dziewczyny pojawił się program pod tytulem my security sheild, oczywiscie wyskakuja alerty w trayu, komputer się wiesza, wprawdzie internet działa, ale gmera nie udało się uruchomic, pomimo iż dostosowałem się do tematow przyklejonych odnosnie emulatorów itp. mam natomiast loga z otla i jego zamieszczam:
http://wklej.org/id/393362/

**Posty:** 584 · przez **Andziorka** 25 Wrz 2010, 22:40

DRV - [2010-09-25 19:08:38 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

ciągle jest aktywny. spróbuj użyć SPTDinst http://www.duplexsecure.com/download/SPTDinst-v162-x86.exe i po restarcie wykonać nowe logi z OTL + Gmer-a.

**Posty:** 112 · przez **Fever** 26 Wrz 2010, 08:57

http://wklej.org/hash/14c2185ab2a/

**Posty:** 584 · przez **Andziorka** 26 Wrz 2010, 09:50

Skopiuj skrypt z tego linka: http://wklej.org/id/393538/txt/ i wklej w okienko OTL i klik na Wykonaj skrypt.
+ wykonaj pełny skan:http://www.programosy.pl/program,malwarebytes-anti-malware.html usuń co znajdzie i daj wynik. I wróć z nowym logiem z OTL.

**Posty:** 112 · przez **Fever** 26 Wrz 2010, 11:57

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.46 http://www.malwarebytes.org Wersja bazy: 4052 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 2010-09-26 11:52:05 mbam-log-2010-09-26 (11-52-05).txt Typ skanowania: Pełne skanowanie (C:\|E:\|) Przeskanowano obiektów: 284713 Upłynęło: 1 godzin(y), 24 minut(y), 56 sekund(y) [url]http://wklej.org/hash/fc91aaca214/[/url] Zainfekowanych procesów w pamięci: 0 Zainfekowanych modułów w pamięci: 0 Zainfekowanych kluczy rejestru: 15 Zainfekowanych wartości rejestru: 0 Zainfekowane informacje rejestru systemowego: 5 Zainfekowanych folderów: 4 Zainfekowanych plików: 1 Zainfekowanych procesów w pamięci: (Nie znaleziono zagrożeń) Zainfekowanych modułów w pamięci: (Nie znaleziono zagrożeń) Zainfekowanych kluczy rejestru: HKEY_CLASSES_ROOT\hostie.bho (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostie.bho.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a21-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a2b-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbmain.commband (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbmain.commband.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbr.hbmain (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbr.hbmain.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\toolbar.htmlmenuui (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\toolbar.htmlmenuui.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\toolbar.toolbarctl (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\toolbar.toolbarctl.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MyGlobalSearch (Adware.BookedSpace) -> Quarantined and deleted successfully. Zainfekowanych wartości rejestru: (Nie znaleziono zagrożeń) Zainfekowane informacje rejestru systemowego: HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (http://findgala.com/?&uid=2129&q={searchTerms}) Good: (http://www.Google.com/) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (http://findgala.com/?&uid=2129&q={searchTerms}) Good: (http://www.Google.com/) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (http://findgala.com/?&uid=2129&q={searchTerms}) Good: (http://www.Google.com/) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (http://findgala.com/?&uid=2129&q={searchTerms}) Good: (http://www.Google.com/) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (http://findgala.com/?&uid=2129&q={searchTerms}) Good: (http://www.Google.com/) -> Quarantined and deleted successfully. Zainfekowanych folderów: C:\Program Files\MyGlobalSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyGlobalSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyGlobalSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyGlobalSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully. Zainfekowanych plików: C:\Program Files\MyGlobalSearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.

**Posty:** 584 · przez **Andziorka** 26 Wrz 2010, 12:14

Rozumiem, że wszystko osunięte?
Daj nowego loga z OTL.

**Posty:** 112 · przez **Fever** 26 Wrz 2010, 12:17

http://wklej.org/hash/2427596c494/

**Posty:** 584 · przez **Andziorka** 26 Wrz 2010, 13:02

Pobierz: http://www.programosy.pl/program,combofix.html
Wklej do notatnika:

File::
C:\Windows\System32\rpcnetp.exe
C:\Windows\System32\agremove.exe
C:\Windows\System32\rpcnetp.dll

Zapisz plik jako CFScript.txt przeciągnij i upuść plik na ikonkę ComboFix.exe rozpocznie się usuwanie, daj powstałego loga.

**Posty:** 112 · przez **Fever** 26 Wrz 2010, 16:05

Kod: Zaznacz wszystko: ComboFix 10-09-25.07 - Magda 2010-09-26 15:37:56.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.48.1045.18.2046.1238 [GMT 2:00] Uruchomiony z: c:\users\Magda\Desktop\ComboFix.exe Użyto następujących komend :: c:\users\Magda\Desktop\CFScript.txt SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\programdata\11879c c:\programdata\11879c\BackUp\Bluetooth Manager.lnk c:\programdata\11879c\MS118_2129.exe c:\programdata\11879c\MSS.ico c:\programdata\11879c\MSSSys\vd952342.bd c:\users\Magda\AppData\Roaming\.# c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.exe c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\cb.exe c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\CLSV.drv c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\delfile.tmp c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\dudl.exe c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\eb.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\exec.drv c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\FS.sys c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\FW.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\hymt.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\hymt.sys c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\kernel32.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\kernel32.drv c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\kernel32.tmp c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\PE.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\PE.drv c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\PE.exe c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\PE.sys c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\ppal.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\ppal.sys c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\ppal.tmp c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\sld.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\sld.drv c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\std.tmp c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\tjd.exe c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\tjd.sys c:\users\Magda\AppData\Roaming\Microsoft\Windows\Start Menu\My Security Shield.lnk c:\users\Magda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My Security Shield.lnk Zainfekowana kopia c:\windows\System32\autochk.exe została znaleziona. Problem naprawiono Plik odzyskano z - c:\windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6001.18000_none_e1f3ed49c1c122ef\autochk.exe . ((((((((((((((((((((((((( Pliki utworzone od 2010-08-26 do 2010-09-26 ))))))))))))))))))))))))))))))) . 2010-09-26 13:49 . 2010-09-26 13:49 17408 ----a-w- c:\windows\system32\rpcnetp.dll 2010-09-26 13:49 . 2010-09-26 13:49 17408 ----a-w- c:\windows\system32\rpcnetp.exe 2010-09-26 13:47 . 2010-09-26 13:52 -------- d-----w- c:\users\Magda\AppData\Local\temp 2010-09-26 13:47 . 2010-09-26 13:47 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-09-26 10:46 . 2010-09-26 10:46 -------- d-----w- c:\users\Magda\AppData\Local\Adobe 2010-09-26 08:11 . 2010-09-26 10:06 44544 ----a-w- c:\windows\system32\agremove.exe 2010-09-26 08:08 . 2010-09-26 08:08 -------- d-----w- c:\users\Magda\AppData\Roaming\Malwarebytes 2010-09-26 08:08 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-09-26 08:08 . 2010-09-26 08:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-09-26 08:08 . 2010-09-26 08:08 -------- d-----w- c:\programdata\Malwarebytes 2010-09-26 08:08 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-09-26 07:59 . 2010-09-26 07:59 -------- d-----w- C:\_OTL 2010-09-25 17:08 . 2010-09-25 17:08 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2010-09-25 17:08 . 2010-09-25 17:15 -------- d-----w- c:\program files\DAEMON Tools Lite 2010-09-22 06:26 . 2010-09-22 06:26 -------- d-----w- c:\users\Magda\AppData\Local\ATI 2010-09-21 20:56 . 2010-09-21 20:56 -------- d-sh--w- c:\programdata\MSJPOQPXS 2010-09-21 17:14 . 2010-09-21 17:15 -------- d-----w- c:\program files\Gadu-Gadu 10 2010-09-20 15:58 . 2010-04-16 16:46 502272 ----a-w- c:\windows\system32\usp10.dll 2010-09-20 15:58 . 2010-05-27 20:08 81920 ----a-w- c:\windows\system32\iccvid.dll 2010-09-20 15:58 . 2010-06-29 15:47 834048 ----a-w- c:\windows\system32\wininet.dll 2010-09-20 15:58 . 2010-06-28 16:13 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-09-20 15:58 . 2010-06-11 16:16 274944 ----a-w- c:\windows\system32\schannel.dll 2010-09-20 15:58 . 2010-08-17 14:11 128000 ----a-w- c:\windows\system32\spoolsv.exe 2010-09-20 15:57 . 2010-04-05 17:02 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL 2010-09-20 15:57 . 2010-06-21 13:37 2037760 ----a-w- c:\windows\system32\win32k.sys 2010-09-20 15:57 . 2010-06-18 17:31 36864 ----a-w- c:\windows\system32\rtutils.dll 2010-09-20 15:57 . 2010-06-08 17:35 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-09-20 15:57 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-09-20 15:57 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll 2010-09-20 15:57 . 2010-06-18 15:04 302080 ----a-w- c:\windows\system32\drivers\srv.sys 2010-09-20 15:57 . 2010-06-18 15:04 144896 ----a-w- c:\windows\system32\drivers\srv2.sys 2010-09-20 15:57 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys 2010-09-20 15:56 . 2010-05-27 20:08 739328 ----a-w- c:\windows\system32\inetcomm.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-26 10:02 . 2006-12-05 05:22 8903840 ----a-w- c:\windows\system32\perfh015.dat 2010-09-26 10:02 . 2006-12-05 05:22 3098118 ----a-w- c:\windows\system32\perfc015.dat 2010-09-25 17:16 . 2008-12-14 14:33 -------- d-----w- c:\users\Magda\AppData\Roaming\DAEMON Tools Lite 2010-09-25 17:08 . 2008-12-14 14:41 -------- d-----w- c:\programdata\DAEMON Tools Lite 2010-09-22 07:19 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-09-22 06:52 . 2008-03-05 10:18 -------- d-----w- c:\program files\Common Files\Java 2010-09-20 15:30 . 2008-03-05 10:18 -------- d-----w- c:\program files\Java 2010-09-12 23:09 . 2010-09-12 23:09 406112 ----a-w- c:\programdata\Gadu-Gadu 10\_userdata\ggbho.4.dll 2010-08-30 10:51 . 2009-10-17 17:45 -------- d-----w- c:\users\Magda\AppData\Roaming\Skype 2010-08-30 10:42 . 2009-10-19 18:57 -------- d-----w- c:\users\Magda\AppData\Roaming\skypePM 2010-08-04 19:51 . 2008-11-24 19:17 -------- d-----w- c:\users\Magda\AppData\Roaming\gtk-2.0 2010-07-17 03:00 . 2010-06-06 14:23 423656 ----a-w- c:\windows\system32\deployJava1.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "Google Update"="c:\users\Magda\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-11-27 135664] "AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-08-03 102400] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184] "ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136] "topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-29 1029416] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456] "HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-01-22 712704] "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 571024] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000] "iPlusManager"="c:\program files\iPlus\iPlusChecker.exe" [2009-12-21 446464] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-1-25 2938184] c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2007-7-27 389120] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 2 (0x2) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NkvMon.exe.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\NkvMon.exe.lnk backup=c:\windows\pss\NkvMon.exe.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software] 2007-10-25 15:41 413696 ----a-w- c:\program files\Camera Assistant Software for Toshiba\traybar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Desktop SMS] 2007-06-18 09:51 1507328 ----a-w- c:\program files\IDM\Desktop SMS\DesktopSMS.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] 2008-03-05 11:54 1836544 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2006-01-12 14:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4151532698-542710578-3078324491-1000] "EnableNotificationsRef"=dword:00000002 R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [x] S0 rpcnetp;rpcnetp; [x] S1 aswSP;avast! Self Protection; [x] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560] S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-11-24 53328] S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2007-12-25 40960] S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-08-03 233472] S3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDART.sys [2008-02-01 187904] S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-01-15 48472] S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [2007-04-09 8192] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . . ------- Skan uzupełniający ------- . uStart Page = hxxp://onet.pl/ IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm TCP: {69BAD41E-7489-456A-BE6D-CD911CC6D183} = 212.2.96.52 212.2.96.51 . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe ************************************************************************** skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\O2Micro Flash Memory Card Driver\o2flash.exe c:\windows\System32\rpcnetp.exe c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe c:\windows\system32\TODDSrv.exe c:\program files\Toshiba\Power Saver\TosCoSrv.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe c:\windows\system32\DRIVERS\xaudio.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\windows\system32\conime.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE c:\program files\Alwil Software\Avast4\ashDisp.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe c:\program files\Synaptics\SynTP\SynTPHelper.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Czas ukończenia: 2010-09-26 16:00:27 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2010-09-26 14:00 Przed: 17 528 565 760 bajtów wolnych Po: 17 443 672 064 bajtów wolnych - - End Of File - - C56CE6F3958A75733E7538B009F34B35

**Posty:** 584 · przez **Andziorka** 26 Wrz 2010, 16:16

Nie wykonało się usuwanie plików, o których usunięcie prosiłam. W ogóle jakbyś tego nie wykonał.
Pobierz: http://www.sendspace.com/file/alfmtg i przeciągnij ten plik na ikonkę Combofixa, jak na poniższym gifie.

rozpocznie się usuwanie i pokażesz powstałego loga.

**Posty:** 112 · przez **Fever** 26 Wrz 2010, 16:39

robiłem to nie raz, wiec bez przesadyzmu, może jakaś literowka czy cos, log za sekund 5

**Posty:** 584 · przez **Andziorka** 26 Wrz 2010, 17:00

Nie wiem czy robiłeś czy nie. Staram się robić tak, aby było dobrze, oferując pomoc. Jest ten log z Combo?

Jeśli nie usunie pobierz: http://swandog46.geekstogo.com/avenger.exe wklej w okienko poniższy skrypt i klik na Execute

Files to delete:
C:\Windows\System32\rpcnetp.exe
C:\Windows\System32\agremove.exe
C:\Windows\System32\rpcnetp.dll

**Posty:** 112 · przez **Fever** 26 Wrz 2010, 18:02

Kod: Zaznacz wszystko: ComboFix 10-09-25.07 - Magda 2010-09-26 15:37:56.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.48.1045.18.2046.1238 [GMT 2:00] Uruchomiony z: c:\users\Magda\Desktop\ComboFix.exe Użyto następujących komend :: c:\users\Magda\Desktop\CFScript.txt SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\programdata\11879c c:\programdata\11879c\BackUp\Bluetooth Manager.lnk c:\programdata\11879c\MS118_2129.exe c:\programdata\11879c\MSS.ico c:\programdata\11879c\MSSSys\vd952342.bd c:\users\Magda\AppData\Roaming\.# c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.exe c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\cb.exe c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\CLSV.drv c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\delfile.tmp c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\dudl.exe c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\eb.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\exec.drv c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\FS.sys c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\FW.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\hymt.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\hymt.sys c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\kernel32.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\kernel32.drv c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\kernel32.tmp c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\PE.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\PE.drv c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\PE.exe c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\PE.sys c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\ppal.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\ppal.sys c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\ppal.tmp c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\sld.dll c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\sld.drv c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\std.tmp c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\tjd.exe c:\users\Magda\AppData\Roaming\Microsoft\Windows\Recent\tjd.sys c:\users\Magda\AppData\Roaming\Microsoft\Windows\Start Menu\My Security Shield.lnk c:\users\Magda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My Security Shield.lnk Zainfekowana kopia c:\windows\System32\autochk.exe została znaleziona. Problem naprawiono Plik odzyskano z - c:\windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6001.18000_none_e1f3ed49c1c122ef\autochk.exe . ((((((((((((((((((((((((( Pliki utworzone od 2010-08-26 do 2010-09-26 ))))))))))))))))))))))))))))))) . 2010-09-26 13:49 . 2010-09-26 13:49 17408 ----a-w- c:\windows\system32\rpcnetp.dll 2010-09-26 13:49 . 2010-09-26 13:49 17408 ----a-w- c:\windows\system32\rpcnetp.exe 2010-09-26 13:47 . 2010-09-26 13:52 -------- d-----w- c:\users\Magda\AppData\Local\temp 2010-09-26 13:47 . 2010-09-26 13:47 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-09-26 10:46 . 2010-09-26 10:46 -------- d-----w- c:\users\Magda\AppData\Local\Adobe 2010-09-26 08:11 . 2010-09-26 10:06 44544 ----a-w- c:\windows\system32\agremove.exe 2010-09-26 08:08 . 2010-09-26 08:08 -------- d-----w- c:\users\Magda\AppData\Roaming\Malwarebytes 2010-09-26 08:08 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-09-26 08:08 . 2010-09-26 08:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-09-26 08:08 . 2010-09-26 08:08 -------- d-----w- c:\programdata\Malwarebytes 2010-09-26 08:08 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-09-26 07:59 . 2010-09-26 07:59 -------- d-----w- C:\_OTL 2010-09-25 17:08 . 2010-09-25 17:08 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2010-09-25 17:08 . 2010-09-25 17:15 -------- d-----w- c:\program files\DAEMON Tools Lite 2010-09-22 06:26 . 2010-09-22 06:26 -------- d-----w- c:\users\Magda\AppData\Local\ATI 2010-09-21 20:56 . 2010-09-21 20:56 -------- d-sh--w- c:\programdata\MSJPOQPXS 2010-09-21 17:14 . 2010-09-21 17:15 -------- d-----w- c:\program files\Gadu-Gadu 10 2010-09-20 15:58 . 2010-04-16 16:46 502272 ----a-w- c:\windows\system32\usp10.dll 2010-09-20 15:58 . 2010-05-27 20:08 81920 ----a-w- c:\windows\system32\iccvid.dll 2010-09-20 15:58 . 2010-06-29 15:47 834048 ----a-w- c:\windows\system32\wininet.dll 2010-09-20 15:58 . 2010-06-28 16:13 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-09-20 15:58 . 2010-06-11 16:16 274944 ----a-w- c:\windows\system32\schannel.dll 2010-09-20 15:58 . 2010-08-17 14:11 128000 ----a-w- c:\windows\system32\spoolsv.exe 2010-09-20 15:57 . 2010-04-05 17:02 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL 2010-09-20 15:57 . 2010-06-21 13:37 2037760 ----a-w- c:\windows\system32\win32k.sys 2010-09-20 15:57 . 2010-06-18 17:31 36864 ----a-w- c:\windows\system32\rtutils.dll 2010-09-20 15:57 . 2010-06-08 17:35 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-09-20 15:57 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-09-20 15:57 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll 2010-09-20 15:57 . 2010-06-18 15:04 302080 ----a-w- c:\windows\system32\drivers\srv.sys 2010-09-20 15:57 . 2010-06-18 15:04 144896 ----a-w- c:\windows\system32\drivers\srv2.sys 2010-09-20 15:57 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys 2010-09-20 15:56 . 2010-05-27 20:08 739328 ----a-w- c:\windows\system32\inetcomm.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-26 10:02 . 2006-12-05 05:22 8903840 ----a-w- c:\windows\system32\perfh015.dat 2010-09-26 10:02 . 2006-12-05 05:22 3098118 ----a-w- c:\windows\system32\perfc015.dat 2010-09-25 17:16 . 2008-12-14 14:33 -------- d-----w- c:\users\Magda\AppData\Roaming\DAEMON Tools Lite 2010-09-25 17:08 . 2008-12-14 14:41 -------- d-----w- c:\programdata\DAEMON Tools Lite 2010-09-22 07:19 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-09-22 06:52 . 2008-03-05 10:18 -------- d-----w- c:\program files\Common Files\Java 2010-09-20 15:30 . 2008-03-05 10:18 -------- d-----w- c:\program files\Java 2010-09-12 23:09 . 2010-09-12 23:09 406112 ----a-w- c:\programdata\Gadu-Gadu 10\_userdata\ggbho.4.dll 2010-08-30 10:51 . 2009-10-17 17:45 -------- d-----w- c:\users\Magda\AppData\Roaming\Skype 2010-08-30 10:42 . 2009-10-19 18:57 -------- d-----w- c:\users\Magda\AppData\Roaming\skypePM 2010-08-04 19:51 . 2008-11-24 19:17 -------- d-----w- c:\users\Magda\AppData\Roaming\gtk-2.0 2010-07-17 03:00 . 2010-06-06 14:23 423656 ----a-w- c:\windows\system32\deployJava1.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "Google Update"="c:\users\Magda\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-11-27 135664] "AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-08-03 102400] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184] "ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136] "topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-29 1029416] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456] "HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-01-22 712704] "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 571024] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000] "iPlusManager"="c:\program files\iPlus\iPlusChecker.exe" [2009-12-21 446464] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-1-25 2938184] c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2007-7-27 389120] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 2 (0x2) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NkvMon.exe.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\NkvMon.exe.lnk backup=c:\windows\pss\NkvMon.exe.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software] 2007-10-25 15:41 413696 ----a-w- c:\program files\Camera Assistant Software for Toshiba\traybar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Desktop SMS] 2007-06-18 09:51 1507328 ----a-w- c:\program files\IDM\Desktop SMS\DesktopSMS.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] 2008-03-05 11:54 1836544 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2006-01-12 14:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4151532698-542710578-3078324491-1000] "EnableNotificationsRef"=dword:00000002 R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [x] S0 rpcnetp;rpcnetp; [x] S1 aswSP;avast! Self Protection; [x] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560] S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-11-24 53328] S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2007-12-25 40960] S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-08-03 233472] S3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDART.sys [2008-02-01 187904] S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-01-15 48472] S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [2007-04-09 8192] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . . ------- Skan uzupełniający ------- . uStart Page = hxxp://onet.pl/ IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm TCP: {69BAD41E-7489-456A-BE6D-CD911CC6D183} = 212.2.96.52 212.2.96.51 . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe ************************************************************************** skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\O2Micro Flash Memory Card Driver\o2flash.exe c:\windows\System32\rpcnetp.exe c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe c:\windows\system32\TODDSrv.exe c:\program files\Toshiba\Power Saver\TosCoSrv.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe c:\windows\system32\DRIVERS\xaudio.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\windows\system32\conime.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE c:\program files\Alwil Software\Avast4\ashDisp.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe c:\program files\Synaptics\SynTP\SynTPHelper.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Czas ukończenia: 2010-09-26 16:00:27 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2010-09-26 14:00 Przed: 17 528 565 760 bajtów wolnych Po: 17 443 672 064 bajtów wolnych - - End Of File - - C56CE6F3958A75733E7538B009F34B35

Dodano 26.09.2010 18:05:14:
mi chodzi o to, li i jedynie, że z góry założyłaś że to moja wina. pomoc oczywiscie doceniam, bo jakżeby inaczej. widzę że nie usunął, więc zabieram sie za avengera

**Posty:** 584 · przez **Andziorka** 26 Wrz 2010, 18:10

Nie wykonało się usuwanie plików, o których usunięcie prosiłam. W ogóle jakbyś tego nie wykonał.

chodziło o to, że się nie usunęło jakby nie było wykonywane, a nie jakbyś źle to zrobił. nie miałam tu na myśli Ciebie. To Avengerem teraz wykonaj.

**Posty:** 112 · przez **Fever** 26 Wrz 2010, 18:30

Kod: Zaznacz wszystko: Platform: Windows Vista ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Error: file "C:\Windows\System32\rpcnetp.exe" not found! Deletion of file "C:\Windows\System32\rpcnetp.exe" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: file "C:\Windows\System32\agremove.exe" not found! Deletion of file "C:\Windows\System32\agremove.exe" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: file "C:\Windows\System32\rpcnetp.dll" not found! Deletion of file "C:\Windows\System32\rpcnetp.dll" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Completed script processing. ******************* Finished! Terminate.

Kto jest na forum