Wyskakująca witryna explorer.exe i gsearching

[system]

Witam forumowiczów Mam taki mały :o problem:d otóż podczas włączania komputera pojawia się okienko o treści: PRZEPRASZAMY WYSTąPIł PROBLEM Z APLIKACJA EXPLORER.EXE i jak daje na nie wysyłaj (raportu o błędach) znikają wszystkie ikonki na pulpicie i muszę resetować kompa!! Jakby tego było mało wciąż wpieprza mi sie GSEARCHING!

[Gutek]

Daj log z ComboFix

Skan AVG Anti-Spyware 7.5 po update

[system]

sorki ale nie całkiem znam się na tym . mam pytanko : co to takiego combofix? jestem tu nowy na forum więc sie nie znam!! proszę pomóz mi i wytłumacz mi i co chodzi krok po kroku bo nie robić kolejnego już formata na kompie :o

[Gutek]

Zobacz na temat ostatni post - http://forum.dobreprogramy.pl/viewtopic.php?t=36654

[system]

a więc oto mój log z COMBOFIX’A :

ComboFix 07-08-14.4 - “Rafaˆ” 2007-08-16 23:59:33.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.170 [GMT 2:00] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\lsass.exe C:\WINDOWS\smss.exe C:\WINDOWS\system32.exe C:\WINDOWS\system32\a.exe C:\WINDOWS\system32\crypts.dll C:\WINDOWS\system32\helper.sys ((((((((((((((((((((((((( Files Created from 2007-07-16 to 2007-08-16 ))))))))))))))))))))))))))))))) 2007-08-17 00:01 163,840 —hs---- C:\WINDOWS\smss.exe 2007-08-17 00:01 0 --a------ C:\WINDOWS\lsass.exe 2007-08-16 23:47 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-16 22:10 105,607 --a------ C:\edjko.exe 2007-08-15 22:53 68,608 --a------ C:\mlk.exe 2007-08-15 12:49 69,208 --a------ C:\WINDOWS\system32\dload.exe 2007-08-15 12:40 2,560 —hs---- C:\WINDOWS\system32\helpermdmdd.exe 2007-08-15 10:43 401,408 -r-hs---- C:\WINDOWS\system32\keysys.exe 2007-08-14 23:07 185,464 -r-hs---- C:\WINDOWS\system32\wscvs.exe 2007-08-14 10:51 52,985 —hs---- C:\WINDOWS\system32\mdm.exe 2007-08-13 22:50 20,992 --a------ C:\asdje.exe 2007-08-13 21:39 68,608 --a------ C:\asd.exe 2007-08-13 20:22 12,812 --a------ C:\mj8.exe 2007-08-13 19:46 68,608 --a------ C:\hip.exe 2007-08-13 11:39 38,912 -r-hsc— C:\WINDOWS\system32\dllcache\ivchost.exe 2007-08-12 21:06 398,848 -r-hs---- C:\WINDOWS\system32\upds.exe 2007-08-12 18:23 2007-08-12 18:22 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe 2007-08-12 18:22 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll 2007-08-05 15:05 71,869 —hs---- C:\WINDOWS\system32\sysems.exe 2007-08-05 15:05 70,465 —hs---- C:\WINDOWS\system32\helpsyss.exe 2007-08-05 12:09 48,640 --------- C:\WINDOWS\system32\drivers\ser2pl.sys 2007-08-05 10:49 2007-07-27 10:00 2,560 —hs---- C:\WINDOWS\system32\helpersscc.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-17 00:02 --------- d-------- C:\Program Files\neostrada tp 2007-08-15 16:15 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-08-15 16:15 103736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-08-12 17:55 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-08-12 11:26 --------- d-------- C:\Program Files\Gadu-Gadu 2007-08-05 12:09 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-07-27 19:55 --------- d—s---- C:\Program Files\Xfire 2007-07-27 17:08 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Xfire 2007-07-26 20:38 66872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-07-19 19:04 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\teamspeak2 2007-07-16 17:53 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Azureus 2007-07-12 15:48 --------- d-------- C:\Program Files\BellesBeautyBoutique_at 2007-07-09 21:43 --------- d-------- C:\Program Files\PhotoFiltre 2007-07-08 19:16 90112 --a------ C:\favo.exe 2007-07-08 18:20 --------- d-------- C:\Program Files\NiemPol 2007-07-07 17:03 --------- d-------- C:\Program Files\MultiRes 2007-07-07 17:02 737280 --a------ C:\WINDOWS\iun6002.exe 2007-07-06 23:44 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Tibia 2007-07-05 17:31 --------- d-------- C:\Program Files\Alcohol Soft 2007-07-05 17:27 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-07-04 19:01 223128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys 2007-07-02 11:58 163840 —hs---- C:\sg.exe 2007-07-02 11:58 163840 —hs---- C:\Program Files\smss.exe 2007-07-02 11:58 163840 —hs---- C:\lsass.exe 2007-07-01 00:53 --------- d-------- C:\Program Files\Azureus 2007-07-01 00:40 --------- d-------- C:\Program Files\BitTorrent 2007-07-01 00:40 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\BitTorrent 2007-06-25 15:00 --------- d-------- C:\Program Files\BearShare 2007-06-25 13:47 2560 --a------ C:\WINDOWS_MSRSTRT.EXE 2007-06-22 19:19 163840 —hs---- C:\WINDOWS\sass.exe 2007-06-22 19:19 163840 —hs---- C:\Program Files\sass.exe 2007-06-22 19:19 163840 —hs---- C:\ntldx.exe 2007-06-22 19:19 163840 —hs---- C:\gs.exe 2007-06-21 19:02 111104 --a------ C:\WINDOWS\system32\mswsgs.exe 2007-06-21 18:12 --------- d-------- C:\Program Files\Repair Registry Pro 2007-06-17 22:19 75542 —hs---- C:\WINDOWS\system32\mfceee.exe 2007-05-26 11:45 24576 --a------ C:\WINDOWS\system32\kazsuqdu.exe 2007-05-21 16:07 24576 --a------ C:\WINDOWS\system32\acsqxorq.exe 2007-05-18 16:58 231302 --a------ C:\WINDOWS\Peer2Mail_Toolbar_Uninstaller_7047.exe 2007-05-17 16:40 22016 --a------ C:\WINDOWS\system32\sodplqi.exe 2001-11-23 06:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL 2007-05-07 16:59:44 69,492 --sh–w C:\WINDOWS\system32\mdmdd.exe 2002-09-28 22:00:00 69,208 --sh–r C:\WINDOWS\system32\mmdmm.exe 2007-05-07 15:29:39 304 --sh–w C:\WINDOWS\system32\srvc.exe 2007-05-13 20:02:48 69,445 --sh–w C:\WINDOWS\system32\sscc.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{5142FE17-20E6-4121-A925-A4C6385CDDAA}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SiSUSBRG”=“C:\WINDOWS\SiSUSBrg.exe” [2002-07-12 12:15] “Cmaudio”=“cmicnfg.cpl” [] “AdslTaskBar”=“stmctrl.dll” [2006-06-02 11:01 C:\WINDOWS\system32\stmctrl.dll] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50] “johnj315”=“C:\WINDOWS\system32\srvc.exe” [2007-05-07 17:29] “melg3445”=“C:\Documents and Settings\Monika\4.exe” [] “Windows Security Centers”=“C:\WINDOWS\System32\wimnini.exe” [] “staeck122”=“C:\WINDOWS\system32\mfceee.exe” [2007-06-17 22:19] “Windows Service Update”=“C:\WINDOWS\System32\mswsgs.exe” [2007-06-21 19:02] “NvCp1Do”=“C:\Program Files\smss.exe” [2007-07-02 11:58] “NvCp1De”=“c:\windows\sass.exe” [2007-06-22 19:19] “NvCp1Da”=“d:\windows\sass.exe” [] “Rund”=“c:\Program Files\sass.exe” [2007-06-22 19:19] “Msnsgrst.exe”=“c:\ntldx.exe” [2007-06-22 19:19] “Msnsgry.exe”=“d:\sass.exe” [2007-06-22 19:19] “Virscanner”=“c:\windows\smss.exe” [2007-08-17 00:01] “AntiVir”=“c:\Program Files\smss.exe” [2007-07-02 11:58] “Msnmsgr.exe”=“c:\lsass.exe” [2007-07-02 11:58] “NvCplDaemon”=“C:\WINDOWS\System32\NvCpl.dll” [2004-07-15 17:42] “nwiz”=“nwiz.exe” [2004-07-15 17:42 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“C:\WINDOWS\System32\NvMcTray.dll” [2004-07-15 17:42] “sysmss”=“C:\Documents and Settings\Monika\dfsf.exe” [] “sck121”=“C:\Documents and Settings\Monika\das4.exe” [] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55] “mmsass”=“mmdmm.exe” [2002-09-29 00:00 C:\WINDOWS\system32\mmdmm.exe] “Windows Update Tool”=“C:\WINDOWS\System32\upds.exe” [2007-08-12 21:08] “Microsoft Office”=“C:\WINDOWS\System32\mdm.exe” [2007-08-14 10:51] “Windows Server Client Verification Service”=“C:\WINDOWS\system32\wscvs.exe” [2007-08-14 23:07] “Microsoft Svchost local services”=“C:\WINDOWS\System32\keysys.exe” [2007-08-15 10:44] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-04-17 13:12] “johnj315”=“C:\WINDOWS\system32\srvc.exe” [2007-05-07 17:29] “eMuleAutoStart”=“C:\Program Files\eMule\emule.exe” [] “Windows Security Centers”=“C:\WINDOWS\System32\wimnini.exe” [] “staeck122”=“C:\WINDOWS\system32\mfceee.exe” [2007-06-17 22:19] “Network Security”=“C:\WINDOWS\System32\NSecurity.exe” [] “Office Monitor Word Exel R”=“C:\WINDOWS\System32\u.exe” [] “Windows Service Update”=“C:\WINDOWS\System32\mswsgs.exe” [2007-06-21 19:02] “NvCp1Do”=“C:\Program Files\smss.exe” [2007-07-02 11:58] “NvCp1Da”=“d:\windows\sass.exe” [] “AlcoholAutomount”=“C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” [2007-07-02 12:27] “Microsoft Office”=“C:\WINDOWS\System32\mdm.exe” [2007-08-14 10:51] “Virscanner”=“c:\windows\smss.exe” [2007-08-17 00:01] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] “NvCp1Do”=C:\Program Files\smss.exe “NvCp1De”=c:\windows\sass.exe “NvCp1Da”=d:\windows\sass.exe “Rund”=c:\Program Files\sass.exe “Msnsgrst.exe”=c:\ntldx.exe “Msnsgry.exe”=d:\sass.exe “Virscanner”=c:\windows\smss.exe “AntiVir”=c:\Program Files\smss.exe “Msnmsgr.exe”=c:\lsass.exe “mmsass”=mmdmm.exe “Windows Update Tool”=C:\WINDOWS\System32\upds.exe “Microsoft Svchost local services”=C:\WINDOWS\System32\keysys.exe [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “Windows Security Centers”=C:\WINDOWS\System32\wimnini.exe “Windows Service Update”=C:\WINDOWS\System32\mswsgs.exe “Microsoft Office”=C:\WINDOWS\System32\mdm.exe “Windows Server Client Verification Service”=“C:\WINDOWS\system32\wscvs.exe” * C:\Documents and Settings\Rafaˆ\Menu Start\Programy\Autostart\ Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2007-07-11 03:07:46] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] “NvCp1Do”= C:\Program Files\smss.exe “NvCp1De”= c:\windows\sass.exe “NvCp1Da”= d:\windows\sass.exe “Rund”= c:\Program Files\sass.exe “Msnsgrst.exe”= c:\ntldx.exe “Msnsgry.exe”= d:\sass.exe “Virscanner”= c:\windows\smss.exe “AntiVir”= c:\Program Files\smss.exe “Msnmsgr.exe”= c:\lsass.exe

czekam na instrukcje co mam robić dalej?

:mrgreen:

[Gutek]

Pobierz program SDFix

[system]

A więc oto mój raport z SDFix’a :

SDFix: Version 1.98

Run by Rafa on 2007-08-17 at 12:23

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:

Checking Services:

Name:

mshexdefx

ImagePath:

“C:\WINDOWS\system32\dllcache\ivchost.exe”

mshexdefx - Deleted

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Dodam jeszcze że od razu po zrestartowaniu kompa w C/SDFix zalęgły się trojany!

Co mam robić

[Gutek]

Daj log z Combofix-a + raport ze skanu AVG Anti-Spyware 7.5

[system]

jedno małe pytanko

o co chodzi z tym skanem AVG Anti-Spyware?? bo nie bardzo kapuje 8)

[Gutek]

Skan AVG Anti-Spyware 7.5 po update

masz pobrać program zainstalować, ściągnąć aktualizację i przeskanować

[system]

a więc oto raport ze skanowania:

AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 14:00 2007-08-17 + Scan result: HKU.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignored. HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignored. HKU\S-1-5-21-507921405-839522115-1060284298-1003\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignored. C:\Program Files\BearShare Applications\BearShare MediaBar\MediaBar.dll -> Adware.Softomate : Ignored. C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\4H2JS16R\lam[2].exe -> Backdoor.IRCBot.acm : Ignored. C:\QooBox\Quarantine\C\WINDOWS\system32\a.exe.vir -> Backdoor.IRCBot.acp : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0313711.exe -> Backdoor.IRCBot.acp : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0315975.exe -> Backdoor.IRCBot.acp : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0319129.exe -> Backdoor.IRCBot.acp : Ignored. C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\BJ8Y67PQ\mmdmm[1].exe -> Backdoor.IRCBot.acp : Ignored. C:\WINDOWS\system32\mdm.exe -> Backdoor.IRCBot.acp : Ignored. C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\4H2JS16R\aaa[2].exe -> Backdoor.Rbot.cpe : Ignored. C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\GNAR854D\ho[1].exe -> Backdoor.Rizo.b : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0319301.exe -> Downloader.Delf.blb : Ignored. C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\4H2JS16R\aaa[1].exe -> Downloader.Delf.blb : Ignored. C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\W9IRODQV\a[1].exe -> Downloader.Delf.blb : Ignored. C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\W9IRODQV\a[2].exe -> Downloader.Delf.blb : Ignored. C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\W9IRODQV\a[3].exe -> Downloader.Delf.blb : Ignored. C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\W9IRODQV\a[4].exe -> Downloader.Delf.blb : Ignored. C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\W9IRODQV\a[5].exe -> Downloader.Delf.blb : Ignored. C:\11.tmp -> Hijacker.Agent.jn : Ignored. C:\13.tmp -> Hijacker.Agent.jn : Ignored. C:\158.tmp -> Hijacker.Agent.jn : Ignored. C:\16.tmp -> Hijacker.Agent.jn : Ignored. C:\18.tmp -> Hijacker.Agent.jn : Ignored. C:\6.tmp -> Hijacker.Agent.jn : Ignored. C:\7.tmp -> Hijacker.Agent.jn : Ignored. C:\A.tmp -> Hijacker.Agent.jn : Ignored. C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1681781Z\viss[1].exe -> Hijacker.Agent.jn : Ignored. C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\2YTWE4OT\viss[1].exe -> Hijacker.Agent.jn : Ignored. C:\F.tmp -> Hijacker.Agent.jn : Ignored. C:\asd.exe -> Hijacker.Agent.jn : Ignored. C:\asdkjoe.exe -> Hijacker.Agent.jn : Ignored. C:\hip.exe -> Hijacker.Agent.jn : Ignored. C:\mlk.exe -> Hijacker.Agent.jn : Ignored. C:\favo.exe -> Hijacker.StartPage.aoy : Ignored. C:\Documents and Settings\Rafał\Ustawienia lokalne\Temporary Internet Files\Content.IE5\IP8FG5UJ\s3.0[1].exe -> Proxy.Agent.ls : Ignored. C:\WINDOWS\system32\acsqxorq.exe -> Proxy.Agent.mf : Ignored. C:\WINDOWS\system32\fzge.exe -> Proxy.Agent.mf : Ignored. C:\WINDOWS\system32\kazsuqdu.exe -> Proxy.Agent.mf : Ignored. C:\WINDOWS\system32\kgenr.exe -> Proxy.Agent.mf : Ignored. C:\WINDOWS\system32\sodplqi.exe -> Proxy.Agent.mf : Ignored. C:\WINDOWS\system32\dhxab.exe -> Proxy.Ranky.gn : Ignored. C:\WINDOWS\system32\emkm.exe -> Proxy.Ranky.gn : Ignored. C:\WINDOWS\system32\gbsylu.exe -> Proxy.Ranky.gn : Ignored. C:\WINDOWS\system32\uhjdw.exe -> Proxy.Ranky.gn : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0304303.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0304316.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0304318.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0304319.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0305315.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0308343.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0308344.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0308345.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0310458.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0311458.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0311459.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0311460.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0311469.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0311579.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0311644.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0311651.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0312683.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0318032.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0318033.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0319033.exe -> Proxy.Slaper.e : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0319034.exe -> Proxy.Slaper.e : Ignored. C:\SDFix\backups\mdmdd.exe -> Proxy.Slaper.n : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0305318.exe -> Proxy.Slaper.n : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0318035.exe -> Proxy.Slaper.n : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0318039.exe -> Proxy.Slaper.n : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0319032.exe -> Proxy.Slaper.n : Ignored. C:\SDFix\backups\helpsyss.exe -> Proxy.Slaper.p : Ignored. C:\SDFix\backups\mfceee.exe -> Proxy.Slaper.p : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0305319.exe -> Proxy.Slaper.p : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0305320.exe -> Proxy.Slaper.p : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0318034.exe -> Proxy.Slaper.p : Ignored. C:\System Volume Information_restore{E71CE5EA-14C1-41DE-A9B0-F460C921C157}\RP76\A0318036.exe -> Proxy.Slaper.p : Ignored. C:\WINDOWS\system32\sysems.exe -> Proxy.Slaper.p : Ignored. :mozilla.703:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.85:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.86:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.95:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.2o7 : Ignored. C:\Documents and Settings\Rafał\Cookies\rafał@2o7[2].txt -> TrackingCookie.2o7 : Ignored. :mozilla.706:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Adtech : Ignored. :mozilla.707:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Adtech : Ignored. :mozilla.114:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Advertising : Ignored. :mozilla.115:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Advertising : Ignored. :mozilla.67:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Advertising : Ignored. :mozilla.68:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Advertising : Ignored. :mozilla.120:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Atdmt : Ignored. C:\Documents and Settings\Rafał\Cookies\rafał@atdmt[2].txt -> TrackingCookie.Atdmt : Ignored. :mozilla.512:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Bbmedia : Ignored. :mozilla.92:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Bbmedia : Ignored. :mozilla.142:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored. :mozilla.143:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored. :mozilla.144:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored. C:\Documents and Settings\Rafał\Cookies\rafał@castup[1].txt -> TrackingCookie.Castup : Ignored. :mozilla.452:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Clickbank : Ignored. :mozilla.59:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Com : Ignored. :mozilla.521:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Connextra : Ignored. :mozilla.522:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Connextra : Ignored. :mozilla.523:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Connextra : Ignored. :mozilla.525:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Connextra : Ignored. :mozilla.39:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Doubleclick : Ignored. C:\Documents and Settings\Rafał\Cookies\rafał@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignored. :mozilla.116:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Fastclick : Ignored. :mozilla.108:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.109:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.110:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.111:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.112:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.113:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.200:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.273:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.681:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.285:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Hotlog : Ignored. :mozilla.49:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Imrworldwide : Ignored. :mozilla.50:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Imrworldwide : Ignored. :mozilla.593:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Information : Ignored. :mozilla.702:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Netflame : Ignored. :mozilla.464:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Overture : Ignored. :mozilla.101:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Paypal : Ignored. :mozilla.268:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Realmedia : Ignored. :mozilla.138:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Revsci : Ignored. :mozilla.110:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Ru4 : Ignored. :mozilla.111:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Ru4 : Ignored. C:\Documents and Settings\Rafał\Cookies\rafał@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Ignored. C:\Documents and Settings\Rafał\Cookies\rafał@serving-sys[1].txt -> TrackingCookie.Serving-sys : Ignored. :mozilla.447:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Sitestat : Ignored. :mozilla.448:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Sitestat : Ignored. :mozilla.100:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Specificclick : Ignored. :mozilla.101:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Specificclick : Ignored. :mozilla.102:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Specificclick : Ignored. :mozilla.103:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Specificclick : Ignored. :mozilla.645:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Spylog : Ignored. :mozilla.122:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Statcounter : Ignored. :mozilla.123:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Statcounter : Ignored. :mozilla.124:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Statcounter : Ignored. :mozilla.488:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Tacoda : Ignored. :mozilla.489:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Tacoda : Ignored. :mozilla.490:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Tacoda : Ignored. :mozilla.529:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Targetnet : Ignored. C:\Documents and Settings\Rafał\Cookies\rafał@targetnet[1].txt -> TrackingCookie.Targetnet : Ignored. :mozilla.51:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.52:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.58:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.60:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.61:C:\Program Files\neostrada tp\Config\a@neostrada.pl\Firefox\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. C:\Documents and Settings\Rafał\Cookies\rafał@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.688:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Trafic : Ignored. :mozilla.532:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Tribalfusion : Ignored. :mozilla.337:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Webtrendslive : Ignored. :mozilla.338:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Webtrendslive : Ignored. :mozilla.646:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Yadro : Ignored. :mozilla.647:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Yadro : Ignored. C:\Documents and Settings\Rafał\Cookies\rafał@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Ignored. :mozilla.382:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Zedo : Ignored. :mozilla.383:C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\2zz7u619.default\cookies.txt -> TrackingCookie.Zedo : Ignored. ::Report end i nowy log z combo fix’a: ComboFix 07-08-14.4 - “Rafaˆ” 2007-08-17 13:03:36.7 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.178 [GMT 2:00] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\lsass.exe C:\WINDOWS\smss.exe ((((((((((((((((((((((((( Files Created from 2007-07-17 to 2007-08-17 ))))))))))))))))))))))))))))))) 2007-08-17 12:42 2007-08-17 12:31 163,840 —hs---- C:\lsass.exe 2007-08-17 12:23 2007-08-17 12:03 68,608 --a------ C:\asdkjoe.exe 2007-08-17 11:48 104 --a------ C:\WINDOWS\system32\appmr.dll 2007-08-16 23:47 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-16 22:10 105,607 --a------ C:\edjko.exe 2007-08-15 22:53 68,608 --a------ C:\mlk.exe 2007-08-15 12:49 69,208 --a------ C:\WINDOWS\system32\dload.exe 2007-08-15 10:43 401,408 -r-hs---- C:\WINDOWS\system32\keysys.exe 2007-08-14 23:07 185,464 -r-hs---- C:\WINDOWS\system32\wscvs.exe 2007-08-14 10:51 52,985 —hs---- C:\WINDOWS\system32\mdm.exe 2007-08-13 21:39 68,608 --a------ C:\asd.exe 2007-08-13 20:22 12,812 --a------ C:\mj8.exe 2007-08-13 19:46 68,608 --a------ C:\hip.exe 2007-08-12 18:23 2007-08-12 18:22 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe 2007-08-12 18:22 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll 2007-08-05 15:05 71,869 —hs---- C:\WINDOWS\system32\sysems.exe 2007-08-05 12:09 48,640 --------- C:\WINDOWS\system32\drivers\ser2pl.sys 2007-08-05 10:49 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-17 13:01 --------- d-------- C:\Program Files\neostrada tp 2007-08-15 16:15 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-08-15 16:15 103736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-08-12 17:55 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-08-12 11:26 --------- d-------- C:\Program Files\Gadu-Gadu 2007-08-05 12:09 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-07-27 19:55 --------- d—s---- C:\Program Files\Xfire 2007-07-27 17:08 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Xfire 2007-07-26 20:38 66872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-07-19 19:04 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\teamspeak2 2007-07-16 17:53 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Azureus 2007-07-12 15:48 --------- d-------- C:\Program Files\BellesBeautyBoutique_at 2007-07-09 21:43 --------- d-------- C:\Program Files\PhotoFiltre 2007-07-08 19:16 90112 --a------ C:\favo.exe 2007-07-08 18:20 --------- d-------- C:\Program Files\NiemPol 2007-07-07 17:03 --------- d-------- C:\Program Files\MultiRes 2007-07-07 17:02 737280 --a------ C:\WINDOWS\iun6002.exe 2007-07-06 23:44 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Tibia 2007-07-05 17:31 --------- d-------- C:\Program Files\Alcohol Soft 2007-07-05 17:27 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-07-04 19:01 223128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys 2007-07-02 11:58 163840 —hs---- C:\sg.exe 2007-07-02 11:58 163840 —hs---- C:\Program Files\smss.exe 2007-07-01 00:53 --------- d-------- C:\Program Files\Azureus 2007-07-01 00:40 --------- d-------- C:\Program Files\BitTorrent 2007-07-01 00:40 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\BitTorrent 2007-06-25 15:00 --------- d-------- C:\Program Files\BearShare 2007-06-25 13:47 2560 --a------ C:\WINDOWS_MSRSTRT.EXE 2007-06-22 19:19 163840 —hs---- C:\WINDOWS\sass.exe 2007-06-22 19:19 163840 —hs---- C:\Program Files\sass.exe 2007-06-22 19:19 163840 —hs---- C:\ntldx.exe 2007-06-22 19:19 163840 —hs---- C:\gs.exe 2007-06-21 19:02 111104 --a------ C:\WINDOWS\system32\mswsgs.exe 2007-06-21 18:12 --------- d-------- C:\Program Files\Repair Registry Pro 2007-05-26 11:45 24576 --a------ C:\WINDOWS\system32\kazsuqdu.exe 2007-05-21 16:07 24576 --a------ C:\WINDOWS\system32\acsqxorq.exe 2007-05-18 16:58 231302 --a------ C:\WINDOWS\Peer2Mail_Toolbar_Uninstaller_7047.exe 2007-05-17 16:40 22016 --a------ C:\WINDOWS\system32\sodplqi.exe 2001-11-23 06:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{5142FE17-20E6-4121-A925-A4C6385CDDAA}]

[Gutek]

Zastosuj w trybie awaryjnym Perlovga Removal Tool

Wyłącz przywracanie systemu

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

Files to delete: C:\lsass.exe C:\asdkjoe.exe C:\WINDOWS\system32\appmr.dll C:\edjko.exe C:\mlk.exe C:\WINDOWS\system32\dload.exe C:\WINDOWS\system32\keysys.exe C:\asd.exe C:\mj8.exe C:\hip.exe C:\WINDOWS\system32\sysems.exe C:\favo.exe C:\sg.exe C:\WINDOWS_MSRSTRT.EXE C:\WINDOWS\sass.exe C:\Program Files\sass.exe C:\ntldx.exe C:\gs.exe C:\WINDOWS\system32\mswsgs.exe C:\WINDOWS\system32\kazsuqdu.exe C:\WINDOWS\system32\acsqxorq.exe C:\WINDOWS\system32\sodplqi.exe C:\WINDOWS\system32\fzge.exe C:\WINDOWS\system32\kgenr.exe C:\WINDOWS\system32\dhxab.exe C:\WINDOWS\system32\emkm.exe C:\WINDOWS\system32\gbsylu.exe C:\WINDOWS\system32\uhjdw.exe

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po wszystkim nowy log z Combofix-a

[system]

ok zrobiłem wszystko jak kazałeś jednakze miamlem problem z combofix’em jak chciałem utworzyć nowy log to pojawiło sie żebym spróbował póżniej , no ale jakoś się udało i mam ten nowy log

A oto i on:

ComboFix 07-08-14.4 - “Rafa” 2007-08-17 19:57:59.12 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.120 [GMT 2:00]

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\lsass.exe

C:\WINDOWS\smss.exe

((((((((((((((((((((((((( Files Created from 2007-07-17 to 2007-08-17 )))))))))))))))))))))))))))))))

2007-08-17 19:51 0 --a------ C:\backup.reg

2007-08-17 19:35 163,840 —hs---- C:\WINDOWS\sass.exe

2007-08-17 19:35 163,840 —hs---- C:\Program Files\sass.exe

2007-08-17 19:35 163,840 —hs---- C:\ntldx.exe

2007-08-17 19:35 163,840 —hs---- C:\lsass.exe

2007-08-17 13:11 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-08-17 12:42

2007-08-17 12:23

2007-08-16 23:47 51,200 --a------ C:\WINDOWS\nircmd.exe

2007-08-14 23:07 185,464 -r-hs---- C:\WINDOWS\system32\wscvs.exe

2007-08-12 18:23

2007-08-12 18:22 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe

2007-08-12 18:22 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll

2007-08-05 12:09 48,640 --------- C:\WINDOWS\system32\drivers\ser2pl.sys

2007-08-05 10:49

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-17 19:56 --------- d-------- C:\Program Files\neostrada tp

2007-08-15 16:15 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys

2007-08-15 16:15 103736 --a------ C:\WINDOWS\system32\PnkBstrB.exe

2007-08-12 17:55 --------- d-------- C:\Program Files\K-Lite Codec Pack

2007-08-12 11:26 --------- d-------- C:\Program Files\Gadu-Gadu

2007-08-05 12:09 --------- d–h----- C:\Program Files\InstallShield Installation Information

2007-07-27 19:55 --------- d—s---- C:\Program Files\Xfire

2007-07-27 17:08 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Xfire

2007-07-26 20:38 66872 --a------ C:\WINDOWS\system32\PnkBstrA.exe

2007-07-19 19:04 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\teamspeak2

2007-07-16 17:53 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Azureus

2007-07-12 15:48 --------- d-------- C:\Program Files\BellesBeautyBoutique_at

2007-07-09 21:43 --------- d-------- C:\Program Files\PhotoFiltre

2007-07-08 18:20 --------- d-------- C:\Program Files\NiemPol

2007-07-07 17:03 --------- d-------- C:\Program Files\MultiRes

2007-07-07 17:02 737280 --a------ C:\WINDOWS\iun6002.exe

2007-07-06 23:44 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Tibia

2007-07-05 17:31 --------- d-------- C:\Program Files\Alcohol Soft

2007-07-05 17:27 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2007-07-04 19:01 223128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys

2007-07-02 11:58 163840 —hs---- C:\Program Files\smss.exe

2007-07-01 00:53 --------- d-------- C:\Program Files\Azureus

2007-07-01 00:40 --------- d-------- C:\Program Files\BitTorrent

2007-07-01 00:40 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\BitTorrent

2007-06-25 15:00 --------- d-------- C:\Program Files\BearShare

2007-06-21 18:12 --------- d-------- C:\Program Files\Repair Registry Pro

2007-05-18 16:58 231302 --a------ C:\WINDOWS\Peer2Mail_Toolbar_Uninstaller_7047.exe

2001-11-23 06:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{5142FE17-20E6-4121-A925-A4C6385CDDAA}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“SiSUSBRG”=“C:\WINDOWS\SiSUSBrg.exe” [2002-07-12 12:15]

“Cmaudio”=“cmicnfg.cpl” []

“AdslTaskBar”=“stmctrl.dll” [2006-06-02 11:01 C:\WINDOWS\system32\stmctrl.dll]

“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42]

“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50]

“johnj315”=“C:\WINDOWS\system32\srvc.exe” []

“melg3445”=“C:\Documents and Settings\Monika\4.exe” []

“Windows Security Centers”=“C:\WINDOWS\System32\wimnini.exe” []

“staeck122”=“C:\WINDOWS\system32\mfceee.exe” []

“NvCp1Do”=“C:\windows\smss.exe” []

“NvCp1De”=“c:\windows\sass.exe” [2007-08-17 19:35]

“NvCp1Da”=“d:\windows\sass.exe” []

“Rund”=“c:\Program Files\sass.exe” [2007-08-17 19:35]

“Msnsgrst.exe”=“c:\ntldx.exe” [2007-08-17 19:35]

“Msnsgry.exe”=“d:\sass.exe” [2007-06-22 19:19]

“Virscanner”=“c:\windows\smss.exe” []

“AntiVir”=“c:\Program Files\smss.exe” [2007-07-02 11:58]

“Msnmsgr.exe”=“c:\lsass.exe” [2007-08-17 19:35]

“NvCplDaemon”=“C:\WINDOWS\System32\NvCpl.dll” [2004-07-15 17:42]

“nwiz”=“nwiz.exe” [2004-07-15 17:42 C:\WINDOWS\system32\nwiz.exe]

“NvMediaCenter”=“C:\WINDOWS\System32\NvMcTray.dll” [2004-07-15 17:42]

“sysmss”=“C:\Documents and Settings\Monika\dfsf.exe” []

“sck121”=“C:\Documents and Settings\Monika\das4.exe” []

“WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49]

“WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55]

“mmsass”=“mmdmm.exe” []

“Windows Update Tool”=“C:\WINDOWS\System32\upds.exe” []

“Windows Server Client Verification Service”=“C:\WINDOWS\system32\wscvs.exe” [2007-08-14 23:07]

“!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2007-06-11 11:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-04-17 13:12]

“johnj315”=“C:\WINDOWS\system32\srvc.exe” []

“eMuleAutoStart”=“C:\Program Files\eMule\emule.exe” []

“Windows Security Centers”=“C:\WINDOWS\System32\wimnini.exe” []

“staeck122”=“C:\WINDOWS\system32\mfceee.exe” []

“Network Security”=“C:\WINDOWS\System32\NSecurity.exe” []

“Office Monitor Word Exel R”=“C:\WINDOWS\System32\u.exe” []

“Windows Service Update”=“C:\WINDOWS\System32\mswsgs.exe” []

“NvCp1Do”=“C:\windows\smss.exe” []

“NvCp1Da”=“d:\windows\sass.exe” []

“AlcoholAutomount”=“C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” [2007-07-02 12:27]

“Microsoft Office”=“C:\WINDOWS\System32\mdm.exe” []

“Virscanner”=“c:\windows\smss.exe” []

“Msnmsgr.exe”=“c:\lsass.exe” [2007-08-17 19:35]

“NvCp1De”=“c:\windows\sass.exe” [2007-08-17 19:35]

“Rund”=“c:\Program Files\sass.exe” [2007-08-17 19:35]

“Msnsgrst.exe”=“c:\ntldx.exe” [2007-08-17 19:35]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]

“NvCp1Do”=C:\windows\smss.exe

“NvCp1De”=c:\windows\sass.exe

“NvCp1Da”=d:\windows\sass.exe

“Rund”=c:\Program Files\sass.exe

“Msnsgrst.exe”=c:\ntldx.exe

“Msnsgry.exe”=d:\sass.exe

“Virscanner”=c:\windows\smss.exe

“AntiVir”=c:\Program Files\smss.exe

“Msnmsgr.exe”=c:\lsass.exe

“mmsass”=mmdmm.exe

“Windows Update Tool”=C:\WINDOWS\System32\upds.exe

[HKEY_USERS.default\software\microsoft\windows\currentversion\run]

“Windows Security Centers”=C:\WINDOWS\System32\wimnini.exe

“Windows Server Client Verification Service”=“C:\WINDOWS\system32\wscvs.exe” *

C:\Documents and Settings\Rafa\Menu Start\Programy\Autostart\

Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2007-07-11 03:07:46]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

“NvCp1Do”= C:\windows\smss.exe

“NvCp1De”= c:\windows\sass.exe

“NvCp1Da”= d:\windows\sass.exe

“Rund”= c:\Program Files\sass.exe

“Msnsgrst.exe”= c:\ntldx.exe

“Msnsgry.exe”= d:\sass.exe

“Virscanner”= c:\windows\smss.exe

“AntiVir”= c:\Program Files\smss.exe

“Msnmsgr.exe”= c:\lsass.exe

R2 wscvs;Windows Server Client Verification Service;C:\WINDOWS\system32\wscvs.exe

R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\System32\DRIVERS\stmatm.sys

R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\System32\DRIVERS\torususb.sys

S2 mshexdefx;ms hexidecimal defx;“C:\WINDOWS\system32\dllcache\ivchost.exe”

S3 SER120;OTI Serial port driver;C:\WINDOWS\System32\DRIVERS\SER120.sys

S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-08-17 19:59:43

Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

**************************************************************************

Completion time: 2007-08-17 20:00:46

C:\ComboFix-quarantined-files.txt … 2007-08-17 20:00

— E O F —

co mam dalej robić???

[qrczak13]

Pobierz Windows Worms Doors Cleaner, ustaw znaczki na zielono, Netbios może być na żółto.

Po użyciu narzędzia wymagany jest restart.

The Avenger > uruchom > Input script manually > klikasz w lupkę > w nowo otwartym oknie wklejasz:

Drivers to unload: ms hexidecimal defx Windows Server Client Verification Service Files to delete: C:\WINDOWS\sass.exe C:\Program Files\sass.exe C:\ntldx.exe C:\lsass.exe C:\WINDOWS\system32\wscvs.exe C:\Program Files\smss.exe C:\WINDOWS\system32\dllcache\ivchost.exe

Po wklejeniu > Done > klik na zielone światło > ok i będzie restart.

Po restarcie wchodzisz gdzie masz The Avenger wklejasz raport avenger.txt.

Czyszczenie rejestru - jv16 PowerTools 1.3.0.195 + opis.

Po czyszczeniu nowy log z combo.

[system]

A więc tak: wyczyściłem rejestr . a oto nowy log z combo’sa:

ComboFix 07-08-14.4 - “Rafa” 2007-08-18 22:10:23.14 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.201 [GMT 2:00]

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\lsass.exe

C:\WINDOWS\smss.exe

((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 )))))))))))))))))))))))))))))))

2007-08-18 21:49

2007-08-18 21:35

2007-08-17 20:31

2007-08-17 19:35 163,840 —hs---- C:\WINDOWS\sass.exe

2007-08-17 19:35 163,840 —hs---- C:\Program Files\sass.exe

2007-08-17 19:35 163,840 —hs---- C:\ntldx.exe

2007-08-17 19:35 163,840 —hs---- C:\lsass.exe

2007-08-17 13:11 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-08-17 12:42

2007-08-17 12:23

2007-08-16 23:47 51,200 --a------ C:\WINDOWS\nircmd.exe

2007-08-14 23:07 185,464 -r-hs---- C:\WINDOWS\system32\wscvs.exe

2007-08-12 18:23

2007-08-12 18:22 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe

2007-08-12 18:22 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll

2007-08-05 12:09 48,640 --------- C:\WINDOWS\system32\drivers\ser2pl.sys

2007-08-05 10:49

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-18 22:06 --------- d-------- C:\Program Files\neostrada tp

2007-08-15 16:15 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys

2007-08-15 16:15 103736 --a------ C:\WINDOWS\system32\PnkBstrB.exe

2007-08-12 17:55 --------- d-------- C:\Program Files\K-Lite Codec Pack

2007-08-12 11:26 --------- d-------- C:\Program Files\Gadu-Gadu

2007-08-05 12:09 --------- d–h----- C:\Program Files\InstallShield Installation Information

2007-07-27 19:55 --------- d—s---- C:\Program Files\Xfire

2007-07-27 17:08 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Xfire

2007-07-26 20:38 66872 --a------ C:\WINDOWS\system32\PnkBstrA.exe

2007-07-19 19:04 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\teamspeak2

2007-07-16 17:53 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Azureus

2007-07-12 15:48 --------- d-------- C:\Program Files\BellesBeautyBoutique_at

2007-07-09 21:43 --------- d-------- C:\Program Files\PhotoFiltre

2007-07-08 18:20 --------- d-------- C:\Program Files\NiemPol

2007-07-07 17:03 --------- d-------- C:\Program Files\MultiRes

2007-07-07 17:02 737280 --a------ C:\WINDOWS\iun6002.exe

2007-07-06 23:44 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Tibia

2007-07-05 17:31 --------- d-------- C:\Program Files\Alcohol Soft

2007-07-05 17:27 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2007-07-04 19:01 223128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys

2007-07-02 11:58 163840 —hs---- C:\Program Files\smss.exe

2007-07-01 00:53 --------- d-------- C:\Program Files\Azureus

2007-07-01 00:40 --------- d-------- C:\Program Files\BitTorrent

2007-07-01 00:40 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\BitTorrent

2007-06-25 15:00 --------- d-------- C:\Program Files\BearShare

2007-06-21 18:12 --------- d-------- C:\Program Files\Repair Registry Pro

2007-05-18 16:58 231302 --a------ C:\WINDOWS\Peer2Mail_Toolbar_Uninstaller_7047.exe

2001-11-23 06:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{5142FE17-20E6-4121-A925-A4C6385CDDAA}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“SiSUSBRG”=“C:\WINDOWS\SiSUSBrg.exe” [2002-07-12 12:15]

“Cmaudio”=“cmicnfg.cpl” []

“AdslTaskBar”=“stmctrl.dll” [2006-06-02 11:01 C:\WINDOWS\system32\stmctrl.dll]

“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42]

“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50]

“Windows Security Centers”=“C:\WINDOWS\System32\wimnini.exe” []

“NvCp1Do”=“C:\windows\smss.exe” []

“NvCp1De”=“c:\windows\sass.exe” [2007-08-17 19:35]

“Rund”=“c:\Program Files\sass.exe” [2007-08-17 19:35]

“Msnsgrst.exe”=“c:\ntldx.exe” [2007-08-17 19:35]

“Msnsgry.exe”=“d:\sass.exe” [2007-06-22 19:19]

“Virscanner”=“c:\windows\smss.exe” []

“AntiVir”=“c:\Program Files\smss.exe” [2007-07-02 11:58]

“Msnmsgr.exe”=“c:\lsass.exe” [2007-08-17 19:35]

“NvCplDaemon”=“C:\WINDOWS\System32\NvCpl.dll” [2004-07-15 17:42]

“nwiz”=“nwiz.exe” [2004-07-15 17:42 C:\WINDOWS\system32\nwiz.exe]

“NvMediaCenter”=“C:\WINDOWS\System32\NvMcTray.dll” [2004-07-15 17:42]

“WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49]

“WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55]

“mmsass”=“mmdmm.exe” []

“Windows Update Tool”=“C:\WINDOWS\System32\upds.exe” []

“Windows Server Client Verification Service”=“C:\WINDOWS\system32\wscvs.exe” [2007-08-14 23:07]

“!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2007-06-11 11:25]

będę wdzięczy jak powiecie co mam dalej robić ??

pozdrawiam:d

[jessica]

Wklej do Notatnika :

File::

C:\WINDOWS\sass.exe

C:\Program Files\sass.exe

C:\ntldx.exe

C:\lsass.exe

C:\WINDOWS\system32\wscvs.exe

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie,

jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe

(czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku -->http://i12.tinypic.com/4l761r5.gif

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie.

Po restarcie usuń ręcznie folder C: ** Qoobox**.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file) F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscvs.exe O2 - BHO: (no name) - {5142FE17-20E6-4121-A925-A4C6385CDDAA} - (no file) O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O4 - HKLM…\Run: [johnj315] C:\WINDOWS\system32\srvc.exe O4 - HKLM…\Run: [melg3445] C:\Documents and Settings\Monika\4.exe O4 - HKLM…\Run: [Windows Security Centers] C:\WINDOWS\System32\wimnini.exe O4 - HKLM…\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe O4 - HKLM…\Run: [Windows Service Update] C:\WINDOWS\System32\mswsgs.exe O4 - HKLM…\Run: [NvCp1Do] C:\windows\sass.exe O4 - HKLM…\Run: [NvCp1De] c:\windows\sass.exe O4 - HKLM…\Run: [NvCp1Da] d:\windows\sass.exe O4 - HKLM…\Run: [Rund] c:\Program Files\sass.exe O4 - HKLM…\Run: [Msnsgrst.exe] c:\ntldx.exe O4 - HKLM…\Run: [Msnsgry.exe] d:\sass.exe O4 - HKLM…\Run: [Virscanner] c:\windows\smss.exe O4 - HKLM…\Run: [AntiVir] c:\Program Files\smss.exe O4 - HKLM…\Run: [Msnmsgr.exe] c:\lsass.exe O4 - HKLM…\Run: [sysmss] C:\Documents and Settings\Monika\dfsf.exe O4 - HKLM…\Run: [sck121] C:\Documents and Settings\Monika\das4.exe O4 - HKLM…\Run: [mmsass] mmdmm.exe O4 - HKLM…\Run: [Windows Update Tool] C:\WINDOWS\System32\upds.exe O4 - HKLM…\Run: [Microsoft Office] C:\WINDOWS\System32\mdm.exe O4 - HKLM…\Run: [Windows Server Client Verification Service] “C:\WINDOWS\system32\wscvs.exe” * O4 - HKLM…\Run: [Microsoft Svchost local services] C:\WINDOWS\System32\keysys.exe O4 - HKLM…\RunServices: [NvCp1Do] C:\windows\sass.exe O4 - HKLM…\RunServices: [NvCp1De] c:\windows\sass.exe O4 - HKLM…\RunServices: [NvCp1Da] d:\windows\sass.exe O4 - HKLM…\RunServices: [Rund] c:\Program Files\sass.exe O4 - HKLM…\RunServices: [Msnsgrst.exe] c:\ntldx.exe O4 - HKLM…\RunServices: [Msnsgry.exe] d:\sass.exe O4 - HKLM…\RunServices: [Virscanner] c:\windows\smss.exe O4 - HKLM…\RunServices: [AntiVir] c:\Program Files\smss.exe O4 - HKLM…\RunServices: [Msnmsgr.exe] c:\lsass.exe O4 - HKLM…\RunServices: [mmsass] mmdmm.exe O4 - HKLM…\RunServices: [Windows Update Tool] C:\WINDOWS\System32\upds.exe O4 - HKLM…\RunServices: [Microsoft Svchost local services] C:\WINDOWS\System32\keysys.exe O4 - HKCU…\Run: [johnj315] C:\WINDOWS\system32\srvc.exe O4 - HKCU…\Run: [Windows Security Centers] C:\WINDOWS\System32\wimnini.exe O4 - HKCU…\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe O4 - HKCU…\Run: [Network Security] C:\WINDOWS\System32\NSecurity.exe O4 - HKCU…\Run: [Office Monitor Word Exel R] C:\WINDOWS\System32\u.exe O4 - HKCU…\Run: [Windows Service Update] C:\WINDOWS\System32\mswsgs.exe O4 - HKCU…\Run: [NvCp1Do] C:\windows\sass.exe O4 - HKCU…\Run: [NvCp1Da] d:\windows\sass.exe O4 - HKCU…\Run: [Microsoft Office] C:\WINDOWS\System32\mdm.exe

Te w/w wpisy sfiksuj w Hijacku:

>>Hijack>>scan(Do a system scan only)>>zaznacz je >> Fix checked.

Od tego należało zacząć. Teraz te wpisy mogą wyglądać troszeczkę inaczej, bo bezplikowo.

Potem daj nowy log z Hijacka i log z ComboFixa.

jessica

[system]

Zrobiłem tak jak kazałas!! I oto nowy log z hijacka::

Logfile of HijackThis v1.99.1 Scan saved at 21:40, on 2007-08-19 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\RunDll32.exe C:\WINDOWS\System32\rundll32.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\wscvs.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\WINDOWS\System32\dwwin.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe D:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Peer2Mail Toolbar Helper - {4FB971C4-99FB-480d-BA3F-55B8263010FB} - C:\Program Files\Peer2Mail Toolbar\v2.0.0.0\Peer2Mail_Toolbar.dll O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Peer2Mail Toolbar - {43F2A7F9-06F6-48a5-B0DC-8530BF29CE66} - C:\Program Files\Peer2Mail Toolbar\v2.0.0.0\Peer2Mail_Toolbar.dll O4 - HKLM…\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM…\Run: [Windows Server Client Verification Service] “C:\WINDOWS\system32\wscvs.exe” * O4 - HKLM…\Run: [!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized O4 - HKLM…\Run: [NvCp1Da] d:\windows\sass.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [AlcoholAutomount] “C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” /automount O4 - HKCU…\Run: [Microsoft Office] C:\WINDOWS\System32\mdm.exe O4 - HKCU…\Run: [Virscanner] c:\windows\smss.exe O4 - HKCU…\Run: [Msnmsgr.exe] c:\lsass.exe O4 - HKCU…\Run: [Rund] c:\Program Files\sass.exe O4 - HKCU…\Run: [Msnsgrst.exe] c:\ntldx.exe O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/sho … wflash.cab O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Windows Server Client Verification Service (wscvs) - Unknown owner - C:\WINDOWS\system32\wscvs.exe

niestety mam problem z utworzeniem nowego loga z combofix’a

:-x co mam robić ??? dalej==

[Gutek]

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\System32\mdm.exe

C:\WINDOWS\System32\wscvs.exe

d:\windows\sass.exe

c:\windows\smss.exe

c:\lsass.exe

c:\Program Files\sass.exe

c:\ntldx.exe

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

Pobierz program SDFix

[system]

A więc tak : chciałbym wszystkim bardzo podziękować za pomoc bo już nie wyskakuja mi samoczynnie strony GSearching A L E nadal po włączaniu kompa wpieprza się explorer.exe wię byłbym znów wdzięczny jakbyście coś z tym fantem zrobili :mrgreen: :mrgreen: a raport z sdfix już podawałem , acha i oto nowy log z combofix’a :

ComboFix 07-08-17.2 - “Rafaˆ” 2007-08-22 19:36:44.23 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.496 [GMT 2:00] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\lsass.exe C:\WINDOWS\sisport.sys ((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 ))))))))))))))))))))))))))))))) 2007-08-22 19:01 2007-08-21 17:12 2007-08-21 16:49 971,776 --a------ C:\WINDOWS\system32\msgina.dll 2007-08-21 16:49 945,664 --a------ C:\WINDOWS\system32\syssetup.dll 2007-08-21 16:49 88,576 --a------ C:\WINDOWS\system32\mydocs.dll 2007-08-21 16:49 8,192 --a------ C:\WINDOWS\system32\winhlp32.exe 2007-08-21 16:49 765,440 --a------ C:\WINDOWS\system32\winntbbu.dll 2007-08-21 16:49 67,072 --a------ C:\WINDOWS\notepad.exe 2007-08-21 16:49 649,216 --a------ C:\WINDOWS\system32\rasdlg.dll 2007-08-21 16:49 571,904 --a------ C:\WINDOWS\system32\wiashext.dll 2007-08-21 16:49 562,688 --a------ C:\WINDOWS\system32\shdoclc.dll 2007-08-21 16:49 530,432 --a------ C:\WINDOWS\system32\printui.dll 2007-08-21 16:49 52,736 --a------ C:\WINDOWS\system32\narrator.exe 2007-08-21 16:49 504,832 --a------ C:\WINDOWS\system32\logonui.exe 2007-08-21 16:49 421,888 --a------ C:\WINDOWS\system32\shimgvw.dll 2007-08-21 16:49 416,768 --a------ C:\WINDOWS\system32\wiaacmgr.exe 2007-08-21 16:49 387,072 --a------ C:\WINDOWS\system32\themeui.dll 2007-08-21 16:49 342,016 --a------ C:\WINDOWS\system32\mspaint.exe 2007-08-21 16:49 317,440 --a------ C:\WINDOWS\system32\zipfldr.dll 2007-08-21 16:49 276,992 --a------ C:\WINDOWS\system32\winsrv.dll 2007-08-21 16:49 253,952 --a------ C:\WINDOWS\system32\mstask.dll 2007-08-21 16:49 240,128 --a------ C:\WINDOWS\system32\newdev.dll 2007-08-21 16:49 231,424 --a------ C:\WINDOWS\system32\upnpui.dll 2007-08-21 16:49 219,648 --a------ C:\WINDOWS\system32\logon.scr 2007-08-21 16:49 210,944 --a------ C:\WINDOWS\system32\moricons.dll 2007-08-21 16:49 142,336 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-08-21 16:49 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe 2007-08-21 16:49 138,752 --a------ C:\WINDOWS\system32\ntshrui.dll 2007-08-21 16:49 136,704 --a------ C:\WINDOWS\system32\netid.dll 2007-08-21 16:49 132,608 --a------ C:\WINDOWS\system32\taskmgr.exe 2007-08-21 16:49 125,440 --a------ C:\WINDOWS\system32\sndrec32.exe 2007-08-21 16:49 118,272 --a------ C:\WINDOWS\system32\stobject.dll 2007-08-21 16:49 104,448 --a------ C:\WINDOWS\system32\sysocmgr.exe 2007-08-21 16:49 1,629,184 --a------ C:\WINDOWS\system32\netshell.dll 2007-08-21 16:48 91,648 --a------ C:\WINDOWS\system32\ahui.exe 2007-08-21 16:48 77,312 --a------ C:\WINDOWS\system32\gcdef.dll 2007-08-21 16:48 67,584 --a------ C:\WINDOWS\system32\acctres.dll 2007-08-21 16:48 66,560 --a------ C:\WINDOWS\system32\console.dll 2007-08-21 16:48 62,464 --a------ C:\WINDOWS\system32\cleanmgr.exe 2007-08-21 16:48 6,656 --a------ C:\WINDOWS\system32\batt.dll 2007-08-21 16:48 382,976 --a------ C:\WINDOWS\system32\cmd.exe 2007-08-21 16:48 329,216 --a------ C:\WINDOWS\system32\cmdial32.dll 2007-08-21 16:48 27,136 --a------ C:\WINDOWS\system32\batmeter.dll 2007-08-21 16:48 16,896 --a------ C:\WINDOWS\system32\deskmon.dll 2007-08-21 16:48 159,744 --a------ C:\WINDOWS\system32\credui.dll 2007-08-21 16:48 147,968 --a------ C:\WINDOWS\system32\keymgr.dll 2007-08-21 16:48 138,240 --a------ C:\WINDOWS\system32\hotplug.dll 2007-08-21 16:48 117,760 --a------ C:\WINDOWS\system32\inetcplc.dll 2007-08-21 16:48 115,200 --a------ C:\WINDOWS\system32\calc.exe 2007-08-21 16:48 1,005,568 --a------ C:\WINDOWS\explorer.exe 2007-08-21 16:13 44,055 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-08-21 16:13 204,288 --a------ C:\WINDOWS\system32\uxtheme.dll 2007-08-21 16:05 3,645 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-08-21 16:05 2007-08-18 21:49 2007-08-18 21:35 2007-08-17 20:31 2007-08-17 13:11 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-08-17 12:42 2007-08-17 12:23 2007-08-16 23:47 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-14 23:07 185,464 -r-hs---- C:\WINDOWS\system32\wscvs.exe 2007-08-12 18:23 2007-08-12 18:22 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe 2007-08-12 18:22 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll 2007-08-05 12:09 48,640 --------- C:\WINDOWS\system32\drivers\ser2pl.sys 2007-08-05 10:49 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-22 19:37 --------- d-------- C:\Program Files\neostrada tp 2007-08-22 18:41 --------- d-------- C:\Program Files\Gadu-Gadu 2007-08-21 16:58 --------- d-------- C:\Program Files\Movie Maker 2007-08-19 22:22 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-08-19 22:22 103736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-08-12 17:55 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-08-05 12:09 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-07-27 19:55 --------- d—s---- C:\Program Files\Xfire 2007-07-27 17:08 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Xfire 2007-07-26 20:38 66872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-07-19 19:04 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\teamspeak2 2007-07-16 17:53 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Azureus 2007-07-09 21:43 --------- d-------- C:\Program Files\PhotoFiltre 2007-07-08 18:20 --------- d-------- C:\Program Files\NiemPol 2007-07-07 17:03 --------- d-------- C:\Program Files\MultiRes 2007-07-07 17:02 737280 --a------ C:\WINDOWS\iun6002.exe 2007-07-06 23:44 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\Tibia 2007-07-05 17:27 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-07-04 19:01 223128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys 2007-07-01 00:53 --------- d-------- C:\Program Files\Azureus 2007-07-01 00:40 --------- d-------- C:\Program Files\BitTorrent 2007-07-01 00:40 --------- d-------- C:\DOCUME~1\RAFA~1\DANEAP~1\BitTorrent 2001-11-23 06:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SiSUSBRG”=“C:\WINDOWS\SiSUSBrg.exe” [2002-07-12 12:15] “Cmaudio”=“cmicnfg.cpl” [] “AdslTaskBar”=“stmctrl.dll” [2006-06-02 11:01 C:\WINDOWS\system32\stmctrl.dll] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50] “NvCplDaemon”=“C:\WINDOWS\System32\NvCpl.dll” [2004-07-15 17:42] “nwiz”=“nwiz.exe” [2004-07-15 17:42 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“C:\WINDOWS\System32\NvMcTray.dll” [2004-07-15 17:42] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55] “Windows Server Client Verification Service”=“C:\WINDOWS\system32\wscvs.exe” [2007-08-14 23:07] “!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2007-06-11 11:25] “NvCp1Da”=“d:\windows\sass.exe” [] “Google Desktop Search”=“C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” [2007-08-21 17:12] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-04-17 13:12] “AlcoholAutomount”=“C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” [] “Microsoft Office”=“C:\WINDOWS\System32\mdm.exe” [] “Virscanner”=“c:\windows\smss.exe” [] “Msnmsgr.exe”=“c:\lsass.exe” [] “Rund”=“c:\Program Files\sass.exe” [] “Msnsgrst.exe”=“c:\ntldx.exe” [] “NvCp1Do”=“C:\lsass.exe” [] “NvCp1Da”=“d:\windows\sass.exe” [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] “NvCp1Da”=d:\windows\sass.exe [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “Windows Security Centers”=C:\WINDOWS\System32\wimnini.exe “Windows Server Client Verification Service”=“C:\WINDOWS\system32\wscvs.exe” * [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “appinit_dlls”=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] “NvCp1Do”= C:\lsass.exe “NvCp1De”= c:\windows\sass.exe “Rund”= c:\Program Files\sass.exe “Msnsgrst.exe”= c:\ntldx.exe “Msnsgry.exe”= d:\sass.exe “Virscanner”= c:\windows\smss.exe “AntiVir”= c:\Program Files\smss.exe “Msnmsgr.exe”= c:\lsass.exe “NvCp1Da”= d:\windows\sass.exe R2 wscvs;Windows Server Client Verification Service;C:\WINDOWS\system32\wscvs.exe R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\System32\DRIVERS\stmatm.sys R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\System32\DRIVERS\torususb.sys S3 SER120;OTI Serial port driver;C:\WINDOWS\System32\DRIVERS\SER120.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-22 19:38:53 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-22 19:40:03 C:\ComboFix-quarantined-files.txt … 2007-08-22 19:39 — E O F —

Bardzo proszę o dalsze wskazówki

[Gutek]

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot i w polu Full Path of File to Delete wklejasz ścieżkę

C:\WINDOWS\system32\wscvs.exe

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

Otwórz Notatnik i wklej w nim to:

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCp1Da”=- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Microsoft Office”=- “Virscanner”=- “Msnmsgr.exe”=- “Rund”=- “Msnsgrst.exe”=- “NvCp1Do”=- “NvCp1Da”=- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] “NvCp1Da”=- [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “Windows Security Centers”=- “Windows Server Client Verification Service”=- [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] “NvCp1Do”=- “NvCp1De”=- “Rund”=- “Msnsgrst.exe”=- “Msnsgry.exe”=- “Virscanner”=- “AntiVir”=- “Msnmsgr.exe”=- “NvCp1Da”=-

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Nowy log z Combofix-a i SDFix