Reklamy, wolny komputer, możliwy wirus

[ERROR22]

Witam. Od kilku dni, mam problem z komputerem. Pojawiają się reklamy, wyskakuje mi stronke ErrorSafe. Nie wiem o co chodzi.

Logfile of HijackThis v1.99.1 Scan saved at 20:39:36, on 2007-05-21 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\XP\System32\smss.exe C:\WINDOWS\XP\system32\winlogon.exe C:\WINDOWS\XP\system32\services.exe C:\WINDOWS\XP\system32\lsass.exe C:\WINDOWS\XP\system32\svchost.exe C:\WINDOWS\XP\system32\svchost.exe C:\WINDOWS\XP\System32\svchost.exe C:\WINDOWS\XP\Explorer.EXE C:\WINDOWS\XP\system32\LEXBCES.EXE C:\WINDOWS\XP\system32\spoolsv.exe C:\WINDOWS\XP\system32\LEXPPS.EXE C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\XP\System32\nvsvc32.exe C:\WINDOWS\XP\system32\PSIService.exe C:\WINDOWS\XP\System32\svchost.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\XP\TBPanel.exe C:\Program Files\Mouse Driver\MouseDrv.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\WINDOWS\XP\system32\LVCOMSX.EXE C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\XP\SOUNDMAN.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\XP\System32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Ares\Ares.exe C:\Program Files\WLAN\802.11 Wireless LAN\WlanMonitor.exe C:\WINDOWS\XP\System32\WgaTray.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Opera\Opera.exe C:\Download\PS\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {46BB5EAC-6383-4911-935A-72EC2A33C843} - C:\WINDOWS\XP\System32\vtsqn.dll O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\XP\System32\bsyjmxjh.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {9D7EF71F-92F4-4E1E-93DE-E21436E4C815} - C:\WINDOWS\XP\system32\tuvtrop.dll O2 - BHO: (no name) - {FE70EECF-E4AD-4356-B82F-27D4E4B77AFf} - C:\WINDOWS\XP\System32\tjijpcsq.dll O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\XP\System32\msdxm.ocx O4 - HKLM…\Run: [Gainward] C:\WINDOWS\XP\TBPanel.exe /A O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\XP\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\XP\System32\NeroCheck.exe O4 - HKLM…\Run: [CreativeMouse] C:\Program Files\Mouse Driver\MouseDrv.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe” O4 - HKLM…\Run: [LVCOMSX] C:\WINDOWS\XP\system32\LVCOMSX.EXE O4 - HKLM…\Run: [avgnt] “C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe” /min O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [setup] rundll32.exe “C:\WINDOWS\XP\System32\pirkmjcq.dll”,realset O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\XP\System32\ctfmon.exe O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” O4 - HKCU…\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU…\Run: [ares] “C:\Program Files\Ares\Ares.exe” -h O4 - Startup: Configuration & Monitor Utility.lnk = ? O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: Download with Star Downloader - C:\Program Files\Star Downloader\sdie.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\XP\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\XP\web\related.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d … o-eula.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.windowsvistatestdrive.com/Ac … lient1.cab O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab O16 - DPF: {594ECDD4-A991-4208-A7B7-00DDAD9BE328} (Photosynth Class) - http://media.labs.live.com/all/ps/_code_/Photosynth.cab O20 - Winlogon Notify: tuvtrop - C:\WINDOWS\XP\SYSTEM32\tuvtrop.dll O20 - Winlogon Notify: vtsqn - C:\WINDOWS\XP\System32\vtsqn.dll O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\XP\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\XP\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\XP\system32\LEXBCES.EXE O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\XP\System32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\XP\system32\PSIService.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)

Z góry dzienki za wszelką pomoc.

[Gutek]

Użyj VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone.

Daj log z Combofix

[ERROR22]

Witam,

dopiero teraz odpisuje ponieważ wcześniej nie mogłem.

A więc tak użyłem wszystkich trzech programów. Co do Combofix`a to mam mały problem.

Uruchamiam, po chwili pojawia się komunikat i nic więcej.

A może odpalić do w trybie awaryjnym??

[qrczak13]

Przejrzyj. Musisz być zalogowany jako administrator.

http://cybertrash.pl/images/tata/ComboFix.html

http://www.unicorn.ksiezyc.pl/WWW/instrukcje/combofix.html

[ERROR22]

Combofix

“Mateusz” - 2007-05-22 20:30:25 Dodatek Service Pack. 1 ComboFix 07-05.21.6.V - Running from: “” (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\XP\system32\awtqn.dll C:\WINDOWS\XP\system32\awtsp.dll C:\WINDOWS\XP\system32\awtsq.dll C:\WINDOWS\XP\system32\awtsr.dll C:\WINDOWS\XP\system32\awtst.dll C:\WINDOWS\XP\system32\awvtq.dll C:\WINDOWS\XP\system32\awvtu.dll C:\WINDOWS\XP\system32\bsyjmxjh.dll C:\WINDOWS\XP\system32\ddaba.dll C:\WINDOWS\XP\system32\ddabc.dll C:\WINDOWS\XP\system32\ddaby.dll C:\WINDOWS\XP\system32\ddayw.dll C:\WINDOWS\XP\system32\ddayx.dll C:\WINDOWS\XP\system32\ddcca.dll C:\WINDOWS\XP\system32\ddccb.dll C:\WINDOWS\XP\system32\ddccc.dll C:\WINDOWS\XP\system32\ddccd.dll C:\WINDOWS\XP\system32\ddccy.dll C:\WINDOWS\XP\system32\ddcya.dll C:\WINDOWS\XP\system32\ddcyv.dll C:\WINDOWS\XP\system32\ddcyx.dll C:\WINDOWS\XP\system32\dusfdatx.dll C:\WINDOWS\XP\system32\fjkedmmw.dll C:\WINDOWS\XP\system32\gebca.dll C:\WINDOWS\XP\system32\gebyv.dll C:\WINDOWS\XP\system32\gebyy.dll C:\WINDOWS\XP\system32\geeba.dll C:\WINDOWS\XP\system32\geedc.dll C:\WINDOWS\XP\system32\jkhfc.dll C:\WINDOWS\XP\system32\jkhfd.dll C:\WINDOWS\XP\system32\jkhfg.dll C:\WINDOWS\XP\system32\jkhhe.dll C:\WINDOWS\XP\system32\jkhhg.dll C:\WINDOWS\XP\system32\jkkjh.dll C:\WINDOWS\XP\system32\jkkjj.dll C:\WINDOWS\XP\system32\jkkjk.dll C:\WINDOWS\XP\system32\jkkli.dll C:\WINDOWS\XP\system32\jkklj.dll C:\WINDOWS\XP\system32\jkklk.dll C:\WINDOWS\XP\system32\jkkll.dll C:\WINDOWS\XP\system32\mljge.dll C:\WINDOWS\XP\system32\mljgf.dll C:\WINDOWS\XP\system32\mljgg.dll C:\WINDOWS\XP\system32\mljjh.dll C:\WINDOWS\XP\system32\mljjj.dll C:\WINDOWS\XP\system32\mlljj.dll C:\WINDOWS\XP\system32\mlljk.dll C:\WINDOWS\XP\system32\pirkmjcq.dll C:\WINDOWS\XP\system32\pmkhe.dll C:\WINDOWS\XP\system32\pmkhf.dll C:\WINDOWS\XP\system32\pmkhi.dll C:\WINDOWS\XP\system32\pmkji.dll C:\WINDOWS\XP\system32\pmkjk.dll C:\WINDOWS\XP\system32\pmnli.dll C:\WINDOWS\XP\system32\pmnlj.dll C:\WINDOWS\XP\system32\pmnlk.dll C:\WINDOWS\XP\system32\pmnll.dll C:\WINDOWS\XP\system32\pmnnk.dll C:\WINDOWS\XP\system32\pmnno.dll C:\WINDOWS\XP\system32\ssqpp.dll C:\WINDOWS\XP\system32\ssqpq.dll C:\WINDOWS\XP\system32\ssqro.dll C:\WINDOWS\XP\system32\ssqrq.dll C:\WINDOWS\XP\system32\sstqn.dll C:\WINDOWS\XP\system32\sstqp.dll C:\WINDOWS\XP\system32\sstqr.dll C:\WINDOWS\XP\system32\ssttu.dll C:\WINDOWS\XP\system32\tcnnmwso.dll C:\WINDOWS\XP\system32\tjijpcsq.dll C:\WINDOWS\XP\system32\tqfdlngx.dll C:\WINDOWS\XP\system32\tuvtrop.dll C:\WINDOWS\XP\system32\vtsqo.dll C:\WINDOWS\XP\system32\vtsqp.dll C:\WINDOWS\XP\system32\vtsqq.dll C:\WINDOWS\XP\system32\vtsqr.dll C:\WINDOWS\XP\system32\vtstq.dll C:\WINDOWS\XP\system32\vtsts.dll C:\WINDOWS\XP\system32\vtstu.dll C:\WINDOWS\XP\system32\vturo.dll C:\WINDOWS\XP\system32\vturp.dll C:\WINDOWS\XP\system32\vturs.dll C:\WINDOWS\XP\system32\vtutq.dll C:\WINDOWS\XP\system32\vtuts.dll C:\WINDOWS\XP\system32\qcjmkrip.ini * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\XP\Resources\Themes\VistaCG\VistaCG1.0\Shell_desktop.ini C:\WINDOWS\XP\Resources\Themes\VistaCG\VistaCG1.0\Shell\black_desktop.ini C:\WINDOWS\XP\Resources\Themes\VistaCG\Wallpaper_desktop.ini ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-22 )))))))))))))))))))))))))))))))))) No new files created in this timespan (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 16:39] {46BB5EAC-6383-4911-935A-72EC2A33C843}=C:\WINDOWS\XP\System32\vtsqn.dll [] {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}=C:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-01-06 12:52] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll [2006-11-09 16:21] {9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-04-17 13:32] {FE70EECF-E4AD-4356-B82F-27D4E4B77AFf}=C:\WINDOWS\XP\System32\tjijpcsq.dll [] {FFFFFEF0-5B30-21D4-945D-000000000000}=C:\PROGRA~1\STARDO~1\SDIEInt.dll [2006-02-26 14:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gainward”=“C:\WINDOWS\XP\TBPanel.exe” [2003-06-16 05:56] “NvCplDaemon”=“C:\WINDOWS\XP\System32\NvCpl.dll” [2002-10-25 12:18] “nwiz”=“nwiz.exe” [2002-10-25 12:18 C:\WINDOWS\XP\system32\nwiz.exe] “NeroCheck”=“C:\WINDOWS\XP\System32\NeroCheck.exe” [2001-07-09 12:50] “CreativeMouse “=“C:\Program Files\Mouse Driver\MouseDrv.exe” [2004-06-27 15:38] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe” [2006-11-09 16:07] “LVCOMSX”=“C:\WINDOWS\XP\system32\LVCOMSX.EXE” [2005-07-19 18:32] “avgnt”=“C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe” [2007-04-23 15:00] “NWEReboot”=”” [] “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [2006-01-12 16:40] “SoundMan”=“SOUNDMAN.EXE” [] “TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2007-01-27 00:29] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-02-13 20:29] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\XP\System32\ctfmon.exe” [2003-04-16 14:00] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [2006-06-19 17:40] “Komunikator”=“C:\Program Files\Tlen.pl\tlen.exe” [2007-02-12 12:01] “ares”=“C:\Program Files\Ares\Ares.exe” [2006-07-15 12:34] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “appinit_dlls”=wbsys.dll *Newly Created Service* -PROCEXP90 Contents of the ‘Scheduled Tasks’ folder 2007-04-27 15:15:00 C:\WINDOWS\XP\tasks\1-Click Maintenance.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-22 20:42:38 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … ******************************************************************** Completion time: 2007-05-22 20:57:53 C:\ComboFix-quarantined-files.txt … 2007-05-22 20:57 — E O F —

[Gutek]

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

Files to delete: C:\WINDOWS\XP\system32\awtqn.dll C:\WINDOWS\XP\system32\awtsp.dll C:\WINDOWS\XP\system32\awtsq.dll C:\WINDOWS\XP\system32\awtsr.dll C:\WINDOWS\XP\system32\awtst.dll C:\WINDOWS\XP\system32\awvtq.dll C:\WINDOWS\XP\system32\awvtu.dll C:\WINDOWS\XP\system32\bsyjmxjh.dll C:\WINDOWS\XP\system32\ddaba.dll C:\WINDOWS\XP\system32\ddabc.dll C:\WINDOWS\XP\system32\ddaby.dll C:\WINDOWS\XP\system32\ddayw.dll C:\WINDOWS\XP\system32\ddayx.dll C:\WINDOWS\XP\system32\ddcca.dll C:\WINDOWS\XP\system32\ddccb.dll C:\WINDOWS\XP\system32\ddccc.dll C:\WINDOWS\XP\system32\ddccd.dll C:\WINDOWS\XP\system32\ddccy.dll C:\WINDOWS\XP\system32\ddcya.dll C:\WINDOWS\XP\system32\ddcyv.dll C:\WINDOWS\XP\system32\ddcyx.dll C:\WINDOWS\XP\system32\dusfdatx.dll C:\WINDOWS\XP\system32\fjkedmmw.dll C:\WINDOWS\XP\system32\gebca.dll C:\WINDOWS\XP\system32\gebyv.dll C:\WINDOWS\XP\system32\gebyy.dll C:\WINDOWS\XP\system32\geeba.dll C:\WINDOWS\XP\system32\geedc.dll C:\WINDOWS\XP\system32\jkhfc.dll C:\WINDOWS\XP\system32\jkhfd.dll C:\WINDOWS\XP\system32\jkhfg.dll C:\WINDOWS\XP\system32\jkhhe.dll C:\WINDOWS\XP\system32\jkhhg.dll C:\WINDOWS\XP\system32\jkkjh.dll C:\WINDOWS\XP\system32\jkkjj.dll C:\WINDOWS\XP\system32\jkkjk.dll C:\WINDOWS\XP\system32\jkkli.dll C:\WINDOWS\XP\system32\jkklj.dll C:\WINDOWS\XP\system32\jkklk.dll C:\WINDOWS\XP\system32\jkkll.dll C:\WINDOWS\XP\system32\mljge.dll C:\WINDOWS\XP\system32\mljgf.dll C:\WINDOWS\XP\system32\mljgg.dll C:\WINDOWS\XP\system32\mljjh.dll C:\WINDOWS\XP\system32\mljjj.dll C:\WINDOWS\XP\system32\mlljj.dll C:\WINDOWS\XP\system32\mlljk.dll C:\WINDOWS\XP\system32\pirkmjcq.dll C:\WINDOWS\XP\system32\pmkhe.dll C:\WINDOWS\XP\system32\pmkhf.dll C:\WINDOWS\XP\system32\pmkhi.dll C:\WINDOWS\XP\system32\pmkji.dll C:\WINDOWS\XP\system32\pmkjk.dll C:\WINDOWS\XP\system32\pmnli.dll C:\WINDOWS\XP\system32\pmnlj.dll C:\WINDOWS\XP\system32\pmnlk.dll C:\WINDOWS\XP\system32\pmnll.dll C:\WINDOWS\XP\system32\pmnnk.dll C:\WINDOWS\XP\system32\pmnno.dll C:\WINDOWS\XP\system32\ssqpp.dll C:\WINDOWS\XP\system32\ssqpq.dll C:\WINDOWS\XP\system32\ssqro.dll C:\WINDOWS\XP\system32\ssqrq.dll C:\WINDOWS\XP\system32\sstqn.dll C:\WINDOWS\XP\system32\sstqp.dll C:\WINDOWS\XP\system32\sstqr.dll C:\WINDOWS\XP\system32\ssttu.dll C:\WINDOWS\XP\system32\tcnnmwso.dll C:\WINDOWS\XP\system32\tjijpcsq.dll C:\WINDOWS\XP\system32\tqfdlngx.dll C:\WINDOWS\XP\system32\tuvtrop.dll C:\WINDOWS\XP\system32\vtsqo.dll C:\WINDOWS\XP\system32\vtsqp.dll C:\WINDOWS\XP\system32\vtsqq.dll C:\WINDOWS\XP\system32\vtsqr.dll C:\WINDOWS\XP\system32\vtstq.dll C:\WINDOWS\XP\system32\vtsts.dll C:\WINDOWS\XP\system32\vtstu.dll C:\WINDOWS\XP\system32\vturo.dll C:\WINDOWS\XP\system32\vturp.dll C:\WINDOWS\XP\system32\vturs.dll C:\WINDOWS\XP\system32\vtutq.dll C:\WINDOWS\XP\system32\vtuts.dll C:\WINDOWS\XP\system32\qcjmkrip.ini C:\WINDOWS\XP\System32\vtsqn.dll C:\WINDOWS\XP\System32\tjijpcsq.dll

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).