Infekcja spyware

system · 12 Kwiecień 2008 08:34

Ostatnio w moim kompie Avast coraz częściej pokazuje komunikaty o infekcji spyware. Oto mój Log:

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:31:34, on 2008-04-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Documents and Settings\All Users\Dane aplikacji\vkjghkxe\bidcrqpg.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Lexmark 4300 Series\lxcemon.exe C:\Program Files\Lexmark 4300 Series\ezprint.exe E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe E:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\zsvynepo.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\System32\nvsvc32.exe E:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\System32\svchost.exe E:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\System32\lxcecoms.exe E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe E:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe e:\program files\a-squared free\a2service.exe E:\Program Files\Mozilla Firefox\firefox.exe E:\Program Files\Winamp\winamp.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {02715E47-5A8E-495B-8F63-0D30470B8E72} - C:\WINDOWS\system32\geBTjKdd.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {9B505BDE-87A9-465C-99AB-8E73CA624401} - C:\WINDOWS\system32\byXRLdBR.dll O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - E:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - E:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll O3 - Toolbar: vnbptxlf - {D212F823-17B0-470A-832F-86D3B30EE0D1} - C:\WINDOWS\vnbptxlf.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [LXCECATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16 O4 - HKLM…\Run: [lxcemon.exe] “C:\Program Files\Lexmark 4300 Series\lxcemon.exe” O4 - HKLM…\Run: [EzPrint] “C:\Program Files\Lexmark 4300 Series\ezprint.exe” O4 - HKLM…\Run: [FaxCenterServer] “C:\Program Files\Lexmark Fax Solutions\fm3032.exe” /s O4 - HKLM…\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [EasyTuneV] E:\Program Files\Gigabyte\ET5\GUI.exe O4 - HKLM…\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe O4 - HKLM…\Run: [248b0ac4] rundll32.exe “C:\WINDOWS\system32\cwnslgjv.dll”,b O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “E:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [ophmsupr] C:\WINDOWS\system32\zsvynepo.exe O4 - HKLM…\Policies\Explorer\Run: [wwRAIHJhes] C:\Documents and Settings\All Users\Dane aplikacji\vkjghkxe\bidcrqpg.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’) O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: geBTjKdd - C:\WINDOWS\SYSTEM32\geBTjKdd.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - e:\program files\a-squared free\a2service.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcecoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - E:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - E:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe – End of file - 6157 bytes

huber2t · 12 Kwiecień 2008 08:38

fix w hijackthis

Pobierz ComboFix, ale nie uruchamiaj

Wklej do notatnika:

File::

C:\WINDOWS\system32\zsvynepo.exe

C:\WINDOWS\SYSTEM32\geBTjKdd.dll

C:\Documents and Settings\All Users\Dane aplikacji\vkjghkxe\bidcrqpg.exe

C:\WINDOWS\system32\geBTjKdd.dll

C:\WINDOWS\system32\byXRLdBR.dll

C:\WINDOWS\system32\cwnslgjv.dll

C:\WINDOWS\vnbptxlf.dll


Folder::

C:\Documents and Settings\All Users\Dane aplikacji\vkjghkxe

Plik -> zapisz jako -> CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)

Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu ->

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.

Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox

system · 12 Kwiecień 2008 14:20

Zrobiłem. tu jest log :

ComboFix 08-04-11.8 - Marffik 2008-04-12 16:08:23.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.468 [GMT 2:00] Running from: F:\ComboFix.exe Command switches used :: F:\CFScript.txt WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED FILE :: C:\Documents and Settings\All Users\Dane aplikacji\vkjghkxe\bidcrqpg.exe C:\WINDOWS\system32\byXRLdBR.dll C:\WINDOWS\system32\cwnslgjv.dll C:\WINDOWS\system32\geBTjKdd.dll C:\WINDOWS\SYSTEM32\geBTjKdd.dll C:\WINDOWS\system32\zsvynepo.exe C:\WINDOWS\vnbptxlf.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Dane aplikacji\vkjghkxe C:\Documents and Settings\All Users\Dane aplikacji\vkjghkxe\bidcrqpg.exe C:\WINDOWS\system32\byXNhffD.dll C:\WINDOWS\system32\byXRLdBR.dll C:\WINDOWS\system32\Cfx32.lic C:\WINDOWS\system32\cfx32.ocx C:\WINDOWS\system32\cwnslgjv.dll C:\WINDOWS\SYSTEM32\geBTjKdd.dll C:\WINDOWS\system32\hgGWPGwV.dll C:\WINDOWS\system32\RBdLRXyb.ini C:\WINDOWS\system32\RBdLRXyb.ini2 C:\WINDOWS\system32\vjglsnwc.ini C:\WINDOWS\system32\zsvynepo.exe C:\WINDOWS\vnbptxlf.dll E:\Program Files\PC-Cleaner . ((((((((((((((((((((((((( Files Created from 2008-03-12 to 2008-04-12 ))))))))))))))))))))))))))))))) . 2008-04-12 10:08 . 2008-04-12 10:12 2008-04-12 09:26 . 2008-04-12 09:26 3,648 --a------ C:\WINDOWS\system32\qyvmevsi.dll 2008-04-04 17:13 . 2008-04-04 17:17 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll 2008-04-04 17:13 . 2008-04-04 17:17 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll 2008-04-04 17:13 . 2008-04-04 17:17 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll 2008-04-04 17:09 . 2008-04-04 17:09 2008-04-03 21:06 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys 2008-04-03 21:06 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys 2008-03-30 17:30 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-12 08:12 --------- d-----w E:\Program Files\a-squared Free 2008-04-04 17:02 --------- d–h--w E:\Program Files\InstallShield Installation Information 2008-04-04 15:18 --------- d-----w E:\Program Files\Common Files\InstallShield 2008-03-29 17:45 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe 2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2008-03-29 17:23 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr 2008-03-05 20:13 --------- d-----w E:\Program Files\Google 2008-02-28 15:13 --------- d-----w E:\Program Files\Elfin 2008-02-25 20:44 --------- d-----w E:\Program Files\PITy . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] “{D212F823-17B0-470A-832F-86D3B30EE0D1}”= “C:\WINDOWS\vnbptxlf.dll” [] [HKEY_CLASSES_ROOT\clsid{d212f823-17b0-470a-832f-86d3b30ee0d1}] [HKEY_CLASSES_ROOT\vnbptxlf.1] [HKEY_CLASSES_ROOT\TypeLib{E209E7D8-8D9C-4C25-9EF2-BF7B2CC48A03}] [HKEY_CLASSES_ROOT\vnbptxlf] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 01:44 15360] “Gadu-Gadu”=“E:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 16:36 2111176] “ophmsupr”=“C:\WINDOWS\system32\zsvynepo.exe” [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“C:\WINDOWS\System32\NvCpl.dll” [2004-07-13 02:50 4112384] “nwiz”=“nwiz.exe” [2004-07-13 02:50 843776 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“C:\WINDOWS\System32\NvMcTray.dll” [2004-07-13 02:50 81920] “LXCECATS”=“C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll” [2005-07-20 15:46 73728] “lxcemon.exe”=“C:\Program Files\Lexmark 4300 Series\lxcemon.exe” [2005-08-02 19:47 192512] “EzPrint”=“C:\Program Files\Lexmark 4300 Series\ezprint.exe” [2005-07-26 14:17 94208] “FaxCenterServer”=“C:\Program Files\Lexmark Fax Solutions\fm3032.exe” [2005-07-12 11:36 299008] “EasyTuneV”=“E:\Program Files\Gigabyte\ET5\GUI.exe” [2004-06-14 12:54 200704] “PinnacleDriverCheck”=“C:\WINDOWS\System32\PSDrvCheck.exe” [2003-11-10 17:06 406016] “248b0ac4”=“C:\WINDOWS\system32\cwnslgjv.dll” [] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 01:44 15360] “Nokia.PCSync”=“E:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe” [2007-03-27 16:58 1744896] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “SynchronousMachineGroupPolicy”= 0 (0x0) “SynchronousUserGroupPolicy”= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] “wwRAIHJhes”= C:\Documents and Settings\All Users\Dane aplikacji\vkjghkxe\bidcrqpg.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geBTjKdd] geBTjKdd.dll [HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-10-10 20:51 39792 E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 01:47 31016 E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantTray] --a------ 2004-05-06 16:14 772096 C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IW_Drop_Icon] --a------ 2004-07-30 16:10 1123840 C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-03-23 14:20 227328 E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] E:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 18:17 159744 E:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 02:11 132496 E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] E:\Program Files\Winamp\winampa.exe [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile] “EnableFirewall”= 0 (0x0) [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “E:\Program Files\WapSter\AQQ\AQQ.exe”= R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys [2003-08-01 15:47] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 11:21] R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 11:21] R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys [2004-07-06 18:06] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35] R2 SPF4;Sunbelt Personal Firewall 4;“E:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe” [2007-04-26 11:21] R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys [2004-08-03 12:10] R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] . Contents of the ‘Scheduled Tasks’ folder “2008-04-08 19:49:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job” - E:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-12 16:16:57 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe E:\Program Files\a-squared Free\a2service.exe C:\WINDOWS\system32\nvsvc32.exe E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe E:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\lxcecoms.exe E:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Completion time: 2008-04-12 16:18:55 - machine was rebooted ComboFix-quarantined-files.txt 2008-04-12 14:18:43 ComboFix2.txt 2007-11-08 14:48:09 Pre-Run: 1,785,958,400 bajtów wolnych Post-Run: 1,702,051,840 bajt˘w wolnych

Leon1 · 12 Kwiecień 2008 14:38

Wyłącz przywracanie systemu na wszystkich dyskach.http://support.microsoft.com/kb/310405/pl

Otwórz notatnik i wklej

File:: C:\WINDOWS\system32\qyvmevsi.dll Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] “{D212F823-17B0-470A-832F-86D3B30EE0D1}”=- [-HKEY_CLASSES_ROOT\clsid{d212f823-17b0-470a-832f-86d3b30ee0d1}] [-HKEY_CLASSES_ROOT\vnbptxlf.1] [-HKEY_CLASSES_ROOT\TypeLib{E209E7D8-8D9C-4C25-9EF2-BF7B2CC48A03}] [-HKEY_CLASSES_ROOT\vnbptxlf] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ophmsupr”=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “248b0ac4”=- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] “wwRAIHJhes”=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geBTjKdd] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

zapisz jako CFScript.txt (zapisz by ikonka CFScript.txt była obok ikonki ComboFix.exe) >> Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

http://img.wklej.org/images/88953CFScri … iemoes.gif

Powinno rozpocząć się usuwanie

Potem log z usuwania Combofix