trojan.DownLoad.33838 oraz trojan.botnetlog.3

anti11 · 21 Kwiecień 2009 19:16

jak w temacie. dr. web wykrył mi o to takie śmieci :

domyślam się, iż te wirusy sknociły coś w działaniu sterowników do karty muzycznej jak i do nod32.

otwierając winamp’a wyskakuje komunikat “BadDirectSound driver. Please install popper drivers or select another device in configuration.”

natomiast uruchamiając nod32 komunikat brzmi następująco “Wystąpił błąd podczas komunikacji z usługą jądra NOD32”

To co wykrył dr.web usunęło bez problemu. No ale napewno to nie wszystko, gdyż problem dalej występuje. Tak więc załączam logi z combo fix, oraz silent runners. Nie wiem dlaczego, ale nie chce mi działać hijack this - zapewne z powodu infekcji :?

combo fix : http://wklejto.pl/31812

silent runners : http://wklejto.pl/31814

Leon1 · 21 Kwiecień 2009 19:56

Otwórz notatnik i wklej

File:: C:\sqmdata15.sqm C:\sqmnoopt15.sqm C:\sqmdata14.sqm C:\sqmnoopt14.sqm C:\sqmdata13.sqm C:\sqmnoopt13.sqm C:\sqmdata12.sqm C:\sqmnoopt12.sqm C:\sqmdata11.sqm C:\sqmnoopt11.sqm C:\sqmdata10.sqm C:\sqmnoopt10.sqm C:\sqmdata09.sqm C:\sqmnoopt09.sqm C:\sqmdata08.sqm C:\sqmnoopt08.sqm C:\sqmdata07.sqm C:\sqmnoopt07.sqm C:\sqmdata06.sqm C:\sqmnoopt06.sqm C:\sqmdata05.sqm C:\sqmnoopt05.sqm C:\sqmdata04.sqm C:\sqmnoopt04.sqm C:\sqmdata03.sqm C:\sqmnoopt03.sqm C:\sqmdata02.sqm C:\sqmnoopt02.sqm C:\sqmdata01.sqm C:\sqmnoopt01.sqm C:\sqmdata00.sqm C:\sqmnoopt00.sqm C:\sqmdata19.sqm C:\sqmnoopt19.sqm C:\sqmdata18.sqm C:\sqmnoopt18.sqm C:\sqmdata17.sqm C:\sqmnoopt17.sqm C:\sqmdata16.sqm C:\sqmnoopt16.sqm Driver:: faofcthqsukz Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\a2service.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ArcaCheck.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\arcavir.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ashDisp.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ashEnhcd.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ashServ.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ashUpd.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\aswUpdSv.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avcls.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avz.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avz4.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avz_se.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\bdinit.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\caav.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\caavguiscan.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\casecuritycenter.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ccupdate.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\cfp.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\cfpupdat.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\cmdagent.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DRWEB32.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FAMEH32.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FPAVServer.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\fpscan.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FPWin.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\fsav32.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\fsgk32st.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\FSMA32.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\guardxservice.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\guardxup.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\navigator.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NAVSTUB.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Nvcc.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\outpost.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\preupd.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\pskdr.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SfFnUp.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Vba32arkit.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\vba32ldr.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Zanda.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\zapro.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Zlh.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\zoneband.dll] [HKEY_LOCAL_MACHINE\software\microsoft\security center] “AntiVirusDisableNotify”=dword:00000000 “UpdatesDisableNotify”=dword:00000000 “AntiVirusOverride”=dword:00000000 [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] “RunNarrator”=-

zapisz jako CFScript.txt (zapisz by ikonka CFScript.txt była obok ikonki ComboFix.exe) >> Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

Powinno rozpocząć się usuwanie

Potem log z usuwania Combofix

anti11 · 22 Kwiecień 2009 16:27

http://wklejto.pl/31884

Leon1 · 22 Kwiecień 2009 17:45

Log wygląda na czysty

Pobierz CCleaner http://www.filehippo.com/download_ccleaner/

przeskanuj nim i wyczyść rejestr.

zrób optymalizacje uruchamiania

http://cybertrash.netarteria.pl/cyber/i … 378.0.html

usuń ręcznie folder C: \Qoobox usuń instalkę Combofix z dysku.

Wyłącz I włącz przywracanie systemu na wszystkich dyskach.http://support.microsoft.com/kb/310405/pl

przeskanuj obszar Mój komputer http://www.kaspersky.pl/virusscanner.html gdy będą wirusy pokaż raport