Blokowanie dostepu do sieci

[polacoloco (Antekwielki)]

witam,

mam zainfekowany system.

podam w skrocie co sie dzieje:

• wywala mnie czesto z MSN

• blokuje przychodzace i wychodzace teksty z MSN i skype (wyslam ale nie docieraja, ani ja nie widze przysylanych do mnie) musze dopiero wylaczyc i wlaczyc program na nowo

• linki przesylane w emailach nie uruchamiaja sie automatycznie (musze je wklejac recznie)

• czesto pojawia mi sie informacja o bledzie programu TODO (plik o nazwie: 82exhmunml35dl - czesto sie zmieniaja jego pierwsze cyfry)

• ten sam plik uruchamia sie w tle (widoczne to jest podczas zamykania systemu)

• czesto pojawia sie informacja o bledzie allplayera przy ogladaniu jakis filmow.

• pomimo dobrego sygnalu z netu, pokazuje mi sie w oknie explorera informacja o braku zasiegu (Thompson)

z gory dziekuje za pomoc

wklejam loga:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 07:46:19, on 2007-12-19

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\acs.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\WINDOWS\system32\DVDRAMSV.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Spyware Doctor\svcntaux.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Spyware Doctor\swdsvc.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

C:\Program Files\TOSHIBA\Tvs\TvsTray.exe

C:\WINDOWS\system32\TPSMain.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe

C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\TPSBattM.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\PROGRA~1\MyWebSearch\bar\1.bin\m3SrchMn.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Spyware Doctor\SDTrayApp.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\RAMASST.exe

C:\PROGRA~1\COMMON~1\Nokia\Services\SERVIC~1.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\TOSHIBA\ConfigFree\CFXFER.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Outlook Express\msimn.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\eMule\emule.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 189.145.128.86:8080

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMul0.dll

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL

O2 - BHO: MouseGest - {112AB43D-32C4-3B21-53BA-13A46743BC34} - C:\WINDOWS\system32\mousegex.dll

O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: Web Mon - {7428F943-BC4F-4A39-3B43-AB433C523B34} - C:\WINDOWS\system32\WebMons.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMul0.dll

O3 - Toolbar: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMul0.dll

O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL

O3 - Toolbar: Need2Find Bar - {4D1C4E89-A32A-416B-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)

O4 - HKLM…\Run: [ATIPTA] “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe”

O4 - HKLM…\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM…\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM…\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

O4 - HKLM…\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe

O4 - HKLM…\Run: [TPSMain] TPSMain.exe

O4 - HKLM…\Run: [NDSTray.exe] NDSTray.exe

O4 - HKLM…\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

O4 - HKLM…\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe

O4 - HKLM…\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM…\Run: [CFSServ.exe] CFSServ.exe -NoClient

O4 - HKLM…\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe

O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe”

O4 - HKLM…\Run: [My Web Search Bar Search Scope Monitor] “C:\PROGRA~1\MyWebSearch\bar\1.bin\m3SrchMn.exe” /m=0

O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime

O4 - HKLM…\Run: [soundlibs] C:\WINDOWS\soundlib.exe

O4 - HKLM…\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16

O4 - HKLM…\Run: [devenv] C:\WINDOWS\system\smvss.exe /w

O4 - HKLM…\Run: [sDTray] “C:\Program Files\Spyware Doctor\SDTrayApp.exe”

O4 - HKCU…\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWebSearch\bar\1.bin\mwsoemon.exe

O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi … p=ZNfox000

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

O18 - Filter hijack: text/html - (no CLSID) - (no file)

O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: lmab_device - Lexmark International, Inc. - C:\WINDOWS\system32\LMabcoms.exe

O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe

O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe (file missing)

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

–

End of file - 10231 bytes

[Ciuci]

Pobierz program SDFix

* Dwuklik na SDFix.exe następnie program wypakuje się na dysk systemowy (standardowo C:\SDFix)

* Zrestartuj komputer i wejdź do trybu awaryjnego (klawisz F8 przed bootem Windowsa)

* Wejdź do folderu z SDFix kliknij dwa razy na plik RunThis.bat

* Wciśnij Y nastąpi proces usuwania.

* Kiedy usuwanie się ukończy wciśnij dowolny klawisz (Any Key). Nastąpi restart komputera.

* Po restarcie SDFix uruchomi się ponownie, żeby dokończyć proces usuwania kiedy pojawi się w oknie programu Finished, wciśnij dowolny klawisz do zakończenia scryptu i załadowania ikon na pulpicie.

* Pokaż Report.txt znajdujący się w folderze SDFix.

[polacoloco (Antekwielki)]

zrobilem wedlug polecen.

report:

SDFix: Version 1.119 Run by Administrator on 2007-12-19 at 15:49 Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\system\smss.exe - Deleted Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-19 16:01:40 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes … scanning hidden services & system hive … scanning hidden registry entries … [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\24\xe1\21] “DisplayName”="\b\x224\b\x224\1" “DeviceDesc”="\b\x224\b\x224\1" “ProviderName”="\xfed4\21\xee18\x7c90\xff44\21\b" “MFG”="\x570" “ReinstallString”=“C:\WINDOWS\System32\ReinstallBackups\xe114\21\x80\xc010\DriverFiles.INF” “DeviceInstanceIds”=str(7):“c:\toolscd\display driver\sbdrv\smbus\smbusati.inf” scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] “%windir%\system32\sessmgr.exe”="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" “C:\Program Files\eMule\emule.exe”=“C:\Program Files\eMule\emule.exe:*:Enabled:eMule” “C:\Program Files\Gadu-Gadu\gg.exe”=“C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program glowny” “C:\Program Files\Kazaa\kazaa.exe”=“C:\Program Files\Kazaa\kazaa.exe:*:Enabled:Kazaa” “C:\Program Files\TOSHIBA\ConfigFree\CFXFER.exe”=“C:\Program Files\TOSHIBA\ConfigFree\CFXFER.exe:*:Disabled:ConfigFree SUMMIT Engine” “%windir%\Network Diagnostic\xpnetdiag.exe”="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" “C:\Program Files\MSN Messenger\msnmsgr.exe”=“C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1” “C:\Program Files\MSN Messenger\livecall.exe”=“C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)” “C:\Program Files\Bonjour\mDNSResponder.exe”=“C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\80exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\80exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\97exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\97exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\82exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\82exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\53exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\53exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\14exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\14exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\88exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\88exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\15exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\15exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\38exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\38exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\95exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\95exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\24exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\24exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\18exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\18exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\25exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\25exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\70exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\70exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\69exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\69exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\83exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\83exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\2exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\2exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\51exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\51exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\45exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\45exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\77exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\77exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\58exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\58exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\40exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\40exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\81exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\81exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\76exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\76exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\61exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\61exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\78exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\78exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\63exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\63exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\65exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\65exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\52exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\52exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\20exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\20exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\12exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\12exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\87exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\87exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\59exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\59exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\3exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\3exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\6exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\6exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\29exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\29exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\94exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\94exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\22exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\22exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\98exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\98exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\54exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\54exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\35exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\35exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\89exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\89exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\75exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\75exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\30exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\30exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\50exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\50exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\48exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\48exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\42exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\42exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\7exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\7exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\34exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\34exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\62exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\62exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\27exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\27exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\32exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\32exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\41exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\41exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\55exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\55exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\56exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\56exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\68exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\68exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\28exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\28exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\96exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\96exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\21exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\21exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\72exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\72exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\91exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\91exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\1exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\1exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\13exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\13exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\84exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\84exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\46exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\46exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\8exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\8exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\10exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\10exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\44exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\44exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\79exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\79exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\93exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\93exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\47exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\47exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\92exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\92exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\99exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\99exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\57exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\57exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\17exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\17exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\0exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\0exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\74exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\74exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\90exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\90exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\49exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\49exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\43exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\43exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\23exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\23exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\5exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\5exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\4exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\4exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\64exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\64exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\39exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\39exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\60exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\60exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\66exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\66exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\36exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\36exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\85exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\85exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\16exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\16exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\Documents and Settings\Antonio\Local Settings\Temp\8909.exe”=“C:\Documents and Settings\Antonio\Local Settings\Temp\8909.exe:*:Enabled:securesystd” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\73exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\73exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\11exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\11exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\19exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\19exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\9exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\9exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\67exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\67exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\31exinjs.a9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\31exinjs.a9.exe:*:Enabled:Microsoft Update” “C:\Program Files\uTorrent\utorrent.exe”=“C:\Program Files\uTorrent\utorrent.exe:*:Enabled:uTorrent” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\62exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\62exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\95exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\95exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\6exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\6exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\35exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\35exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\70exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\70exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\44exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\44exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\53exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\53exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\71exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\71exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\9exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\9exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\40exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\40exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\41exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\41exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\54exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\54exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\78exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\78exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\4exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\4exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\43exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\43exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\36exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\36exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\63exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\63exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\76exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\76exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\57exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\57exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\16exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\16exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\26exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\26exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\92exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\92exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\20exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\20exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\18exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\18exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\39exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\39exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\29exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\29exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\79exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\79exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\15exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\15exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\98exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\98exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\1exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\1exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\17exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\17exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\96exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\96exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\77exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\77exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\65exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\65exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\12exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\12exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\80exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\80exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\37exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\37exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\24exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\24exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\32exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\32exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\34exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\34exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\14exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\14exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\45exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\45exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\99exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\99exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\25exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\25exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\38exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\38exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\7exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\7exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\5exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\5exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\8exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\8exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\89exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\89exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\66exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\66exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\69exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\69exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\60exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\60exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\68exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\68exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\91exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\91exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\11exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\11exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\52exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\52exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\55exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\55exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\23exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\19exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\19exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\2exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\2exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\21exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\21exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\51exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\51exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\81exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\81exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\90exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\90exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\47exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\47exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\84exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\84exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\48exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\48exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\27exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\27exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\61exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\61exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\64exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\64exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\72exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\72exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\31exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\31exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\10exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\10exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\30exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\30exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\88exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\88exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\3exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\3exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\56exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\56exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\87exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\87exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\58exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\58exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\83exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\73exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\73exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\28exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\28exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\67exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\67exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\93exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\93exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\86exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\86exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\13exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\13exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\33exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\33exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\97exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\97exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\42exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\42exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\55exed32_2.d.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\55exed32_2.d.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\46exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\46exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\0exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\75exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\75exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\22exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\69exml32.9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\69exml32.9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\85exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\85exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\0exml32.9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\0exml32.9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\49exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\49exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\94exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\94exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\50exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\50exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\82exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\82exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\91exml32.9.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\91exml32.9.exe:*:Enabled:Microsoft Update” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\74exinjs.aa.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\74exinjs.aa.exe:*:Enabled:Microsoft Update” “C:\WINDOWS\system32\LMabcoms.exe”=“C:\WINDOWS\system32\LMabcoms.exe:*:Enabled:Lexmark Enhanced TCP/IP” “D:\STHIW\stInstall.exe”=“D:\STHIW\stInstall.exe:*:Enabled:SpeedTouch Home Install Wizard” “C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe”=“C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe” “C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe”=“C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe” “C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe”=“C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe” “C:\DOCUME~1\Antonio\LOCALS~1\Temp\7exmdnk16.exe”=“C:\DOCUME~1\Antonio\LOCALS~1\Temp\7exmdnk16.exe:*:Enabled:Microsoft Update” “C:\Program Files\Skype\Phone\Skype.exe”=“C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype” [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] “%windir%\system32\sessmgr.exe”="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" “%windir%\Network Diagnostic\xpnetdiag.exe”="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" “C:\Program Files\MSN Messenger\msnmsgr.exe”=“C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1” “C:\Program Files\MSN Messenger\livecall.exe”=“C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)” “C:\Documents and Settings\Antonio\Local Settings\Temp\8909.exe”=“C:\Documents and Settings\Antonio\Local Settings\Temp\8909.exe:*:Enabled:securesystd” “C:\WINDOWS\arc13.exe”=“C:\WINDOWS\arc13.exe:*:Enabled:securesystd” Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Mon 28 May 2007 0 A.SH. — “C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp” Finished!

[Gutek]

Daj log z ComboFix

Użyj ATF-Cleaner http://www.atribune.org/ccount/click.php?id=1 i oczyść TEMP

[polacoloco (Antekwielki)]

tyel ,ze ja wyczyscilem TEMP. hmm. wyczyscilem jeszcze raz to co sie dalo (kilka plikow zostalo) jak i TEMP INTERNET FILES.

po uzyciu programu Combo Fix mam taki report:

ComboFix 07-12-19.2 - Antonio 2007-12-19 21:51:41.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1033.18.396 [GMT 0:00] Running from: C:\Documents and Settings\Antonio\My Documents\install\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\FunWebProducts C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html C:\Program Files\internet explorer\msimg32.dll C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S C:\Program Files\MyWebSearch\bar\Cache\00055878 C:\Program Files\MyWebSearch\bar\Cache\003FF4DD.bin C:\Program Files\MyWebSearch\bar\Cache\003FFEEF.bin C:\Program Files\MyWebSearch\bar\Cache\004009AD.bin C:\Program Files\MyWebSearch\bar\Cache\00401248.bin C:\Program Files\MyWebSearch\bar\Cache\007443DA C:\Program Files\MyWebSearch\bar\Cache\060F21F7 C:\Program Files\MyWebSearch\bar\Cache\060F37A2 C:\Program Files\MyWebSearch\bar\Cache\060F40BA.bin C:\Program Files\MyWebSearch\bar\Cache\060F47FD.bin C:\Program Files\MyWebSearch\bar\Cache\060F5E15.bin C:\Program Files\MyWebSearch\bar\Cache\060F7B13.bin C:\Program Files\MyWebSearch\bar\Cache\08FF57F1.bin C:\Program Files\MyWebSearch\bar\Cache\08FF655F.bin C:\Program Files\MyWebSearch\bar\Cache\08FF69D4.bin C:\Program Files\MyWebSearch\bar\Cache\08FF7695.bin C:\Program Files\MyWebSearch\bar\Cache\files.ini C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S C:\Program Files\MyWebSearch\bar\History\search2 C:\Program Files\MyWebSearch\bar\icons\CM.ICO C:\Program Files\MyWebSearch\bar\icons\MFC.ICO C:\Program Files\MyWebSearch\bar\icons\PSS.ICO C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO C:\Program Files\MyWebSearch\bar\icons\WB.ICO C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL C:\WINDOWS\system32\f3PSSavr.scr . ((((((((((((((((((((((((( Files Created from 2007-11-19 to 2007-12-19 ))))))))))))))))))))))))))))))) . 2007-12-19 15:46 . 2007-12-19 15:47 2007-12-19 15:43 . 2006-06-11 03:11 2007-12-19 15:43 . 2006-06-11 03:11 2007-12-19 15:43 . 2005-12-08 17:25 2007-12-19 15:43 . 2006-06-11 03:11 2007-12-19 08:03 . 2007-12-19 08:03 2007-12-19 08:03 . 2007-12-19 08:03 2007-12-19 07:14 . 2007-12-19 07:14 2007-12-18 22:18 . 2007-12-18 22:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-12-18 22:18 . 2007-12-18 22:18 1,409 --a------ C:\WINDOWS\QTFont.for 2007-12-17 17:50 . 2007-12-18 19:14 2007-12-17 17:50 . 2007-12-17 17:50 2007-12-17 17:50 . 2007-12-17 17:51 74,240 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-17 17:50 . 2007-12-17 17:51 56,832 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-17 17:50 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-17 17:50 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-17 17:49 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-17 17:42 . 2007-12-17 17:42 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-19 16:00 --------- d—a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-19 15:17 --------- d-----w C:\Program Files\eMule 2007-12-19 09:01 --------- d-----w C:\Documents and Settings\Antonio\Application Data\Skype 2007-12-13 12:35 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-11 21:36 --------- d-----w C:\Program Files\Winamp 2007-12-11 20:44 --------- d-----w C:\Program Files\MSN Messenger 2007-12-04 05:39 --------- d-----w C:\Program Files\Lx_cats 2007-11-11 14:15 --------- d-----w C:\Program Files\Java 2007-11-08 12:31 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-08 12:31 --------- d-----w C:\Program Files\TomTom HOME 2007-11-05 13:53 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2007-11-05 13:52 --------- d-----w C:\Program Files\HP 2007-10-28 21:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-09-28 16:08 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-09-28 16:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2007-09-28 16:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-09-28 16:07 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-09-28 16:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-09-28 16:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2007-09-28 16:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2007-09-28 16:07 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll 2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2007-04-23 19:41 56,952 ----a-w C:\Documents and Settings\Antonio\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE~\Browser Helper Objects{112AB43D-32C4-3B21-53BA-13A46743BC34}] 2002-02-04 15:56 48128 --a------ C:\WINDOWS\system32\mousegex.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{7428F943-BC4F-4A39-3B43-AB433C523B34}] C:\WINDOWS\system32\WebMons.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “TOSCDSPD”=“C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe” [2005-04-11 11:26] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 13:00] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-08-05 20:05] “SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2004-10-14 22:28] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2004-10-14 22:26] “AGRSMMSG”=“AGRSMMSG.exe” [2005-10-15 13:29 C:\WINDOWS\agrsmmsg.exe] “THotkey”=“C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe” [2005-12-08 12:53] “Tvs”=“C:\Program Files\TOSHIBA\Tvs\TvsTray.exe” [2005-11-30 12:25] “TPSMain”=“TPSMain.exe” [2005-08-03 14:26 C:\WINDOWS\system32\TPSMain.exe] “NDSTray.exe”=“NDSTray.exe” [] “SmoothView”=“C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe” [2005-05-12 10:31] “PadTouch”=“C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe” [2005-08-30 11:53] “DLA”=“C:\WINDOWS\System32\DLA\DLACTRLW.EXE” [2005-08-01 05:10] “CFSServ.exe”=“CFSServ.exe” [] “Nokia Tray Application”=“C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe” [2002-04-29 15:22] “NWEReboot”="" [] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “RTHDCPL”=“RTHDCPL.EXE” [2005-11-10 18:14 C:\WINDOWS\RTHDCPL.EXE] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11] “QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2007-07-09 03:28] “Soundlibs”=“C:\WINDOWS\soundlib.exe” [] “LXCFCATS”=“C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll” [2005-07-20 17:47] “devenv”=“C:\WINDOWS\system\smvss.exe” [2007-11-15 19:56] “SDTray”=“C:\Program Files\Spyware Doctor\SDTrayApp.exe” [2007-11-02 17:24] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 13:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-05-21 20:32:04] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:00] Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:00] RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2006-06-17 16:40:25] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R3 axsaki;axsaki;C:\WINDOWS\system32\DRIVERS\axsaki.sys [2003-03-31 02:38] R3 axskbus;axskbus;C:\WINDOWS\system32\DRIVERS\axskbus.sys [2003-03-28 16:58] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 15:05] S3 KS-959;Kingsun KS-959 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-07-05 02:42] S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2007-02-15 17:14] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{6d078037-4d9b-11dc-92c1-0011f5f06172}] \Shell\AutoRun\command - E:\InstallTomTomHOME.exe *Newly Created Service* - PROCEXP90 . Contents of the ‘Scheduled Tasks’ folder “2007-12-19 21:56:00 C:\WINDOWS\Tasks\Symantec NetDetect.job” - C:\Program Files\Symantec\LiveUpdate\NDetect.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-19 21:55:30 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes … scanning hidden autostart entries … HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCFCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16??? scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-19 21:56:29 . 2007-11-01 21:59:26 — E O F —

[Gutek]

Wklej do Notatnika:

File:: C:\WINDOWS\system32\mousegex.dll C:\WINDOWS\system32\WebMons.dll Registry:: [-HKEY_LOCAL_MACHINE~\Browser Helper Objects{112AB43D-32C4-3B21-53BA-13A46743BC34}] [-HKEY_LOCAL_MACHINE~\Browser Helper Objects{7428F943-BC4F-4A39-3B43-AB433C523B34}]

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo

[polacoloco (Antekwielki)]

zrobione wedlug zalecen.

nowy log z combo wyglada tak:

ComboFix 07-12-19.2 - Antonio 2007-12-19 23:28:27.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1033.18.383 [GMT 0:00] Running from: C:\Documents and Settings\Antonio\My Documents\install\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-19 to 2007-12-19 ))))))))))))))))))))))))))))))) . 2007-12-19 15:46 . 2007-12-19 15:47 2007-12-19 15:43 . 2006-06-11 03:11 2007-12-19 15:43 . 2006-06-11 03:11 2007-12-19 15:43 . 2005-12-08 17:25 2007-12-19 15:43 . 2006-06-11 03:11 2007-12-19 08:03 . 2007-12-19 08:03 2007-12-19 08:03 . 2007-12-19 08:03 2007-12-19 07:14 . 2007-12-19 07:14 2007-12-18 22:18 . 2007-12-18 22:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-12-18 22:18 . 2007-12-18 22:18 1,409 --a------ C:\WINDOWS\QTFont.for 2007-12-17 17:50 . 2007-12-18 19:14 2007-12-17 17:50 . 2007-12-17 17:50 2007-12-17 17:50 . 2007-12-17 17:51 74,240 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-17 17:50 . 2007-12-17 17:51 56,832 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-17 17:50 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-17 17:50 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-17 17:49 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-17 17:42 . 2007-12-17 17:42 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-19 23:19 --------- d-----w C:\Program Files\eMule 2007-12-19 21:54 --------- d-----w C:\Program Files\MSN Messenger 2007-12-19 16:00 --------- d—a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-19 09:01 --------- d-----w C:\Documents and Settings\Antonio\Application Data\Skype 2007-12-13 12:35 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-11 21:36 --------- d-----w C:\Program Files\Winamp 2007-12-04 05:39 --------- d-----w C:\Program Files\Lx_cats 2007-11-11 14:15 --------- d-----w C:\Program Files\Java 2007-11-08 12:31 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-08 12:31 --------- d-----w C:\Program Files\TomTom HOME 2007-11-05 13:53 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2007-11-05 13:52 --------- d-----w C:\Program Files\HP 2007-10-28 21:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-09-28 16:08 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-09-28 16:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2007-09-28 16:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-09-28 16:07 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-09-28 16:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-09-28 16:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2007-09-28 16:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2007-09-28 16:07 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll 2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2007-04-23 19:41 56,952 ----a-w C:\Documents and Settings\Antonio\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “TOSCDSPD”=“C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe” [2005-04-11 11:26] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 13:00] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-08-05 20:05] “SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2004-10-14 22:28] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2004-10-14 22:26] “AGRSMMSG”=“AGRSMMSG.exe” [2005-10-15 13:29 C:\WINDOWS\agrsmmsg.exe] “THotkey”=“C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe” [2005-12-08 12:53] “Tvs”=“C:\Program Files\TOSHIBA\Tvs\TvsTray.exe” [2005-11-30 12:25] “TPSMain”=“TPSMain.exe” [2005-08-03 14:26 C:\WINDOWS\system32\TPSMain.exe] “NDSTray.exe”=“NDSTray.exe” [] “SmoothView”=“C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe” [2005-05-12 10:31] “PadTouch”=“C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe” [2005-08-30 11:53] “DLA”=“C:\WINDOWS\System32\DLA\DLACTRLW.EXE” [2005-08-01 05:10] “CFSServ.exe”=“CFSServ.exe” [] “Nokia Tray Application”=“C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe” [2002-04-29 15:22] “NWEReboot”="" [] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “RTHDCPL”=“RTHDCPL.EXE” [2005-11-10 18:14 C:\WINDOWS\RTHDCPL.EXE] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11] “QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2007-07-09 03:28] “Soundlibs”=“C:\WINDOWS\soundlib.exe” [] “LXCFCATS”=“C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll” [2005-07-20 17:47] “devenv”=“C:\WINDOWS\system\smvss.exe” [2007-11-15 19:56] “SDTray”=“C:\Program Files\Spyware Doctor\SDTrayApp.exe” [2007-11-02 17:24] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 13:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-05-21 20:32:04] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:00] Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:00] RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2006-06-17 16:40:25] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R3 axsaki;axsaki;C:\WINDOWS\system32\DRIVERS\axsaki.sys [2003-03-31 02:38] R3 axskbus;axskbus;C:\WINDOWS\system32\DRIVERS\axskbus.sys [2003-03-28 16:58] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 15:05] S3 KS-959;Kingsun KS-959 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-07-05 02:42] S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2007-02-15 17:14] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{6d078037-4d9b-11dc-92c1-0011f5f06172}] \Shell\AutoRun\command - E:\InstallTomTomHOME.exe *Newly Created Service* - PROCEXP90 . Contents of the ‘Scheduled Tasks’ folder “2007-12-19 23:31:00 C:\WINDOWS\Tasks\Symantec NetDetect.job” - C:\Program Files\Symantec\LiveUpdate\NDetect.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-19 23:30:35 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes … scanning hidden autostart entries … HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCFCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16??? scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-19 23:31:38 C:\ComboFix2.txt … 2007-12-19 23:25 C:\ComboFix3.txt … 2007-12-19 21:56 . 2007-11-01 21:59:26 — E O F —

[Gutek]

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=509

[polacoloco (Antekwielki)]

sprawa dosyc skomplikowana jak dla mnie.

uruchomilem tego cleanera jak i sprawdzilem regedit.

jest taki plik w TEMP, ktory nazywa sie “30exhmunml35dl” on tworzy (dodaje) kolejne pliki o tej samej nazwie ale z innym numerem, np “96exhmunml35dl”.

wydaje mi sie, ze one sa odpowiedzialne za problemy.

w MSN i skypie ciagle nie dochodza wiadomosci mimo, iz wszystko wyglada ok.

poszukalem w regedit, gdzie jest ten plik “30exhmunml35dl” i pokazalo mi 3 pliki:

type: dwa razy REG_SZ oraz REG_DWORD

data: (value not set), 0x475d2387f (1197286287), 94exhmunml35dl.exe

znajduje sie to w HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\directdraw\MostRecentAplication

dziekuje za pomoc, Antek

[Gutek]

Pobierz Gmer

1. Rootkit=>szukaj=>bez zaznaczania pokaż wszystko=> Ctrl + V do posta wklej

2. Rootkit => zaznaczone tylko Pokazuj wszystko + Usługi => Szukaj => Kopiuj => Ctrl + V do posta wklej

[polacoloco (Antekwielki)]

1. bez zaznaczania “pokaz wszystko”

czy ma to dzielic i tu wrzucic? - Wiadomość ma 669889 znaków. Maksymalna dopuszczalna liczba znaków to 60000.

2. zaznaczone tylko “pokaz wszystko”

“gmer nie odnalazl zadnych modyfikacji systemu”

spowalnia mi juz system

[Gutek]

Optymalizacja XP: viewtopic.php?t=76580

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=509

Opis RegCleaner - http://www.agavk.p9.pl/strony/progra_regcleaner.php

Zobacz - Obsługa jv16 PowerTools