Problem z pozbyciem się Trojan horse Agent.IJM

joahun · 9 Październik 2007 09:54

AVG znajduje tego wirusa ( C:\WINDOWS\system32\mmf32.exe ) usuwa go, ale bestia wraca. Szukałam na necie informacji, ale uwierzcie nic nie znalazłam na temat tego trojana. Proszę o informacje i pomoc.

Logfile of HijackThis v1.99.1

Scan saved at 11:52:12, on 2007-10-09

Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\WINDOWS\System32\ctfmon.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

D:\programy\winrar\WinRAR.exe

C:\DOCUME~1\xxx\USTAWI~1\Temp\Rar$EX00.282\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O1 - Hosts: 212.150.54.250 dv-networks.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab

O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) - http://67.15.101.3/g_bin/pl/breakout_2_0_0_28.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{1F5A6232-76B1-448E-BEBF-AF658386D277}: NameServer = 85.255.116.173,85.255.112.72

O17 - HKLM\System\CCS\Services\Tcpip\..\{385879AF-9FF4-4B0A-B839-44BA7D53F936}: NameServer = 85.255.116.173 85.255.112.72

O17 - HKLM\System\CCS\Services\Tcpip\..\{F07BA66A-4979-4D16-A69D-4BB36DC1B507}: NameServer = 85.255.116.173,85.255.112.72

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.173 85.255.112.72

O17 - HKLM\System\CS1\Services\Tcpip\..\{1F5A6232-76B1-448E-BEBF-AF658386D277}: NameServer = 85.255.116.173,85.255.112.72

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.173 85.255.112.72

O17 - HKLM\System\CS2\Services\Tcpip\..\{1F5A6232-76B1-448E-BEBF-AF658386D277}: NameServer = 85.255.116.173,85.255.112.72

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.173 85.255.112.72

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

Złączono Posta : 09.10.2007 (Wto) 12:53

Proszę o pomoc.

Złączono Posta : 09.10.2007 (Wto) 12:55

Proszę o pomoc.

Gutek · 9 Październik 2007 22:05

O1 - Hosts: 212.150.54.250 dv-networks.com O17 - HKLM\System\CCS\Services\Tcpip…{1F5A6232-76B1-448E-BEBF-AF658386D277}: NameServer = 85.255.116.173,85.255.112.72 O17 - HKLM\System\CCS\Services\Tcpip…{385879AF-9FF4-4B0A-B839-44BA7D53F936}: NameServer = 85.255.116.173 85.255.112.72 O17 - HKLM\System\CCS\Services\Tcpip…{F07BA66A-4979-4D16-A69D-4BB36DC1B507}: NameServer = 85.255.116.173,85.255.112.72 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.173 85.255.112.72 O17 - HKLM\System\CS1\Services\Tcpip…{1F5A6232-76B1-448E-BEBF-AF658386D277}: NameServer = 85.255.116.173,85.255.112.72 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.173 85.255.112.72 O17 - HKLM\System\CS2\Services\Tcpip…{1F5A6232-76B1-448E-BEBF-AF658386D277}: NameServer = 85.255.116.173,85.255.112.72 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.173 85.255.112.72

Użyj FixWareOut - http://downloads.subratam.org/Fixwareout.exe

Daj log z ComboFix

joahun · 10 Październik 2007 11:52

Username “xxx” - 2007-10-10 13:26:16 [Fixwareout edited 2007/07/05] »»»»»Prerun check HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters “nameserver”=“85.255.116.173 85.255.112.72” HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{1F5A6232-76B1-448E-BEBF-AF658386D277} “nameserver”=“85.255.116.173,85.255.112.72” HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{385879AF-9FF4-4B0A-B839-44BA7D53F936} “nameserver”=“85.255.116.173” HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{F07BA66A-4979-4D16-A69D-4BB36DC1B507} “nameserver”=“85.255.116.173,85.255.112.72” Pomyślnie opróżniono pamięć podręczną programu rozpoznawania nazw DNS. System was rebooted successfully. »»»»» Postrun check HKLM\SOFTWARE~\Winlogon\ “System”="" … HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion_r “}7137185D52EE-0B9B-5C44-997E-58BA20CF{” Deleted HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion_r “}E42E10275430-35B9-EA74-7503-1A898990{” Deleted HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion_r “}CBCDD7E29237-C5D9-B284-F186-BE2C9C91{” Deleted HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion_r “}9E523E90162F-D3E8-80D4-9F94-75E74327{” Deleted HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion_r “}977B43870CB0-0E7A-B044-6DDD-9CF862A3{” Deleted HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion_r “}B8AACD3B151B-3D18-7A94-CC80-F9A294FD{” Deleted HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion_r “}A220DEFAE794-7FDA-5294-8194-EC063DE8{” Deleted HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion_r “}7940AA6E38FA-0418-6A94-9684-74195FD6{” Deleted HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion_r “}332DA3C58FE6-D068-D974-6730-FA42F5C9{” Deleted HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion_r “}8314AD359E84-033A-02E4-0211-A9E395A5{” Deleted C:\WINDOWS\System32\qjdsx.exe Deleted … »»»»» Misc files. C:\WINDOWS\System32\kernel32.exe Deleted … »»»»» Checking for older varients. … Search five digit cs, dm, kd, jb, other, files. The following files NEED TO BE SUBMITTED to one of the following URL’S for further inspection. C:\WINDOWS\system32\dmfjo.exe 63004 2002-09-29 Click browse, find the file then click submit. http://www.virustotal.com/flash/index_en.html Or http://virusscan.jotti.org/ »»»»» Current runs (hklm hkcu “run” Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “WatchDog”=“C:\Program Files\InterVideo\DVD Check\DVDCheck.exe” “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe” “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” “AVG7_CC”=“C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP” “Microsoft Network Services Controller”=“C:\WINDOWS\System32\mmsvc32.exe” “Spools Service Controller”=“C:\WINDOWS\System32\spools.exe” [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\ctfmon.exe” “SpybotSD TeaTimer”=“C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe” … Hosts file was reset, If you use a custom hosts file please replace it »»»»» End report »»»»»

ComboFix 07-08-14.4 - “xxx” 2007-10-10 13:37:59.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.30 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-09-10 to 2007-10-10 ))))))))))))))))))))))))))))))) 2007-10-10 10:02 70,144 --a------ C:\WINDOWS\system32\gate.exe 2007-10-09 21:58 8,192 --a------ C:\WINDOWS\system32\psvc.exe 2007-10-09 21:58 263,680 --a------ C:\WINDOWS\system32\spools.exe 2007-10-09 21:56 263,680 --a------ C:\WINDOWS\system32\bbot.exe 2007-10-09 21:55 79,872 --a------ C:\WINDOWS\system32\mmsvc32.exe 2007-10-09 21:54 79,872 --a------ C:\WINDOWS\system32\mmf32.exe 2007-10-09 11:36 2007-09-23 22:59 67,788 --a------ C:\WINDOWS\exrk.exe 2007-09-23 08:35 25,992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe 2007-09-23 07:05 2007-09-23 07:05 2007-09-21 16:50 2007-09-21 04:54 2007-09-21 01:50 2007-09-21 01:48 2007-09-19 16:45 2007-09-19 16:45 2007-09-11 14:09 2007-09-11 14:08 434,252 --a------ C:\WINDOWS\system32\Msvcrtd.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-19 02:13 2560 --a------ C:\WINDOWS_MSRSTRT.EXE 2007-09-16 21:35 --------- d-------- C:\Program Files\PopCap Games 2007-09-16 21:35 --------- d-------- C:\Program Files\Messenger 2007-09-16 21:35 --------- d-------- C:\Program Files\GameHouse 2007-09-16 21:35 --------- d-------- C:\Program Files\Codec Pack - All In 1 2007-08-18 01:23 7458 --a------ C:\dnsbak.reg ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “WatchDog”=“C:\Program Files\InterVideo\DVD Check\DVDCheck.exe” [2004-12-08 19:44] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe” [2005-03-04 04:36] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-04-11 11:00] “AVG7_CC”=“C:\PROGRA~1\Grisoft\AVG7\avgcc.exe” [2007-09-15 23:09] “Microsoft Network Services Controller”=“C:\WINDOWS\System32\mmsvc32.exe” [2007-10-09 21:55] “Spools Service Controller”=“C:\WINDOWS\System32\spools.exe” [2007-10-09 21:58] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\ctfmon.exe” [2002-09-29 00:00] “SpybotSD TeaTimer”=“C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe” [2005-05-31 01:04] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2007-02-07 05:46:32] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\odk_mcd] R3 HSFHWATI;HSFHWATI;C:\WINDOWS\System32\DRIVERS\HSFHWATI.sys R3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\System32\DRIVERS\k510bus.sys R3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\System32\DRIVERS\k510mdfl.sys R3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\System32\DRIVERS\k510mdm.sys R3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\System32\DRIVERS\k510mgmt.sys R3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\System32\DRIVERS\k510obex.sys S1 eusk2par;EUTRON SmartKey Parallel Driver;??\C:\WINDOWS\System32\Drivers\eusk2par.sys S3 GTF32BUS;GT F32 BUS;C:\WINDOWS\System32\DRIVERS\gtf32bus.sys S3 GTPTSER;GT PT SER;C:\WINDOWS\System32\DRIVERS\gtptser.sys S3 GTSCSER;GT SC SER;C:\WINDOWS\System32\DRIVERS\gtscser.sys ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-10 13:39:05 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes … scanning hidden autostart entries …

dawidek11 · 10 Październik 2007 13:30

Masz wirusa o nazwie Win32.Worm.Nanspy.I przeskanuj kompa skanerem online kaspersky .

Zamknij robaczywe porty przy pomocy tego—> Windows Worms Doors Cleaner http://www.firewallleaktester.com/tools/wwdc.exe

Ustaw znaczki na zielono, Netbios może być na żółto.

Po użyciu narzędzia wymagany jest restart.

Gutek · 10 Październik 2007 22:31

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po tym nowy log z Combo i:

Pobierz program SDFix

joahun · 11 Październik 2007 08:20

Oto logi:

ComboFix 07-08-14.4 - “xxx” 2007-10-11 9:53:22.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.26 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-09-11 to 2007-10-11 ))))))))))))))))))))))))))))))) 2007-10-09 11:36 2007-09-23 22:59 67,788 --a------ C:\WINDOWS\exrk.exe 2007-09-23 08:35 25,992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe 2007-09-23 07:05 2007-09-23 07:05 2007-09-21 16:50 2007-09-21 04:54 2007-09-21 01:50 2007-09-21 01:48 2007-09-19 16:45 2007-09-19 16:45 2007-09-11 14:09 2007-09-11 14:08 434,252 --a------ C:\WINDOWS\system32\Msvcrtd.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-19 02:13 2560 --a------ C:\WINDOWS_MSRSTRT.EXE 2007-09-16 21:35 --------- d-------- C:\Program Files\PopCap Games 2007-09-16 21:35 --------- d-------- C:\Program Files\Messenger 2007-09-16 21:35 --------- d-------- C:\Program Files\GameHouse 2007-09-16 21:35 --------- d-------- C:\Program Files\Codec Pack - All In 1 2007-08-18 01:23 7458 --a------ C:\dnsbak.reg ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “WatchDog”=“C:\Program Files\InterVideo\DVD Check\DVDCheck.exe” [2004-12-08 19:44] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe” [2005-03-04 04:36] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-04-11 11:00] “AVG7_CC”=“C:\PROGRA~1\Grisoft\AVG7\avgcc.exe” [2007-09-15 23:09] “Microsoft Network Services Controller”=“C:\WINDOWS\System32\mmsvc32.exe” [] “Spools Service Controller”=“C:\WINDOWS\System32\spools.exe” [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\ctfmon.exe” [2002-09-29 00:00] “SpybotSD TeaTimer”=“C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe” [2005-05-31 01:04] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2007-02-07 05:46:32] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\odk_mcd] R3 HSFHWATI;HSFHWATI;C:\WINDOWS\System32\DRIVERS\HSFHWATI.sys S1 eusk2par;EUTRON SmartKey Parallel Driver;??\C:\WINDOWS\System32\Drivers\eusk2par.sys S3 GTF32BUS;GT F32 BUS;C:\WINDOWS\System32\DRIVERS\gtf32bus.sys S3 GTPTSER;GT PT SER;C:\WINDOWS\System32\DRIVERS\gtptser.sys S3 GTSCSER;GT SC SER;C:\WINDOWS\System32\DRIVERS\gtscser.sys S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\System32\DRIVERS\k510bus.sys S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\System32\DRIVERS\k510mdfl.sys S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\System32\DRIVERS\k510mdm.sys S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\System32\DRIVERS\k510mgmt.sys S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\System32\DRIVERS\k510obex.sys ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-11 09:55:03 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-10-11 9:55:54 C:\ComboFix2.txt … 2007-10-10 13:39 C:\ComboFix3.txt … 2007-08-18 01:34 — E O F — SDFix: Version 1.108 Run by xxx on 2007-10-11 at 10:10 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\system32\TFTP188 - Deleted Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------

Złączono Posta : 11.10.2007 (Czw) 13:17

Zaszły zmiany po “sprzątaniu”, oczywiście na plus, ale czy to wszystko?

Gutek · 11 Październik 2007 21:51

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.