TrojanDownloader.xs

Paul12 [ Buja ]

Wszystkie skanery spywarowe też nie dają rady.

Paul12 [ Buja ]

Log z Combo-fix:

ComboFix 08-05-29.1 - Paweł 2008-05-31 11:24:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.506 [GMT 2:00]
Running from: C:\Documents and Settings\Paweł\Pulpit\ComboFix.exe
* Created a new restore point

[color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\PC-Cleaner
C:\WINDOWS\rs.txt
C:\WINDOWS\vnbptxlf.dll

.
((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-31 )))))))))))))))))))))))))))))))
.

2008-05-18 11:54 . 2008-05-18 11:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-05-18 11:42 . 2008-05-18 11:42 <DIR> d-------- C:\Program Files\Bonjour
2008-05-18 11:27 . 2008-05-18 11:27 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-05-09 08:02 . 2008-05-09 08:02 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Apple Computer
2008-04-26 21:58 . 2008-04-26 21:58 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Gadu-Gadu
2008-04-26 20:28 . 2008-05-02 23:27 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-04-26 20:28 . 2008-04-26 20:29 <DIR> d-------- C:\Documents and Settings\Paweł\Gadu-Gadu
2008-04-26 20:28 . 2008-04-26 20:29 <DIR> d-------- C:\Documents and Settings\Paweł\Gadu-Gadu
2008-04-25 22:34 . 2008-04-25 22:34 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-04-25 15:24 . 2008-04-25 15:34 <DIR> d-------- C:\Program Files\MagicDisc
2008-04-25 15:24 . 2005-04-03 23:08 52,992 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys
2008-04-17 20:13 . 2008-04-17 20:14 <DIR> d-------- C:\Program Files\CCleaner
2008-04-17 19:52 . 2008-04-17 20:01 <DIR> d-------- C:\Program Files\SpyZooka
2008-04-17 19:52 . 2008-04-17 19:52 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-04-14 23:42 . 2008-04-14 23:42 <DIR> d-------- C:\Program Files\Damian Pasternak
2008-04-13 09:53 . 2008-04-13 09:53 <DIR> d-------- C:\Program Files\Optimus Nexus
2008-04-12 12:22 . 2008-05-23 09:32 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-12 12:22 . 2008-04-12 12:22 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-09 16:29 . 2008-04-09 16:30 <DIR> d-------- C:\Lost.S04E03.HDTV.XviD-XOR
2008-04-09 16:28 . 2008-04-09 16:29 <DIR> d-------- C:\Lost.S04E02.HDTV.XviD-2HD
2008-04-09 16:26 . 2008-04-09 16:28 <DIR> d-------- C:\Lost.S04E01.HDTV.XviD-XOR
2008-04-08 23:40 . 2008-04-08 23:40 <DIR> d-------- C:\Documents and Settings\All Users\SonicStage
2008-04-08 22:28 . 2008-04-08 22:28 <DIR> d-------- C:\WINDOWS\Sun
2008-04-08 22:27 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-08 22:26 . 2008-04-08 22:27 <DIR> d-------- C:\Program Files\Java
2008-04-08 22:25 . 2008-04-08 22:25 <DIR> d-------- C:\Program Files\Common Files\Java
2008-04-08 21:35 . 2008-04-08 21:35 <DIR> d-------- C:\SmartSound Software
2008-04-07 00:25 . 2008-04-07 00:25 <DIR> d-------- C:\Temp\FrankProtocol
2008-04-07 00:25 . 2008-04-07 00:25 <DIR> d-------- C:\Temp\FrankPacManager
2008-04-07 00:25 . 2008-04-07 00:25 <DIR> d-------- C:\Temp\FrankMedium
2008-04-07 00:25 . 2008-04-07 00:25 <DIR> d-------- C:\Temp\FrankHandler
2008-04-07 00:25 . 2008-04-07 00:25 <DIR> d-------- C:\Temp\FrankFormat
2008-04-07 00:25 . 2008-04-07 00:25 <DIR> d-------- C:\Temp\FrankDevice
2008-04-07 00:25 . 2008-04-07 00:25 <DIR> d-------- C:\Temp\FrankContents
2008-04-07 00:25 . 2008-04-07 00:25 <DIR> d-------- C:\Temp\Frank
2008-04-07 00:09 . 2001-09-13 02:15 90,112 --------- C:\WINDOWS\snymsico.dll
2008-04-07 00:09 . 2002-08-08 15:51 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
2008-04-07 00:09 . 2005-10-31 10:46 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
2008-04-07 00:09 . 2003-11-10 12:31 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
2008-04-07 00:09 . 2003-04-01 18:55 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
2008-04-07 00:08 . 2008-04-07 00:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony Corporation
2008-04-07 00:08 . 2007-01-13 08:24 770,048 --a------ C:\WINDOWS\system32\CDDBUISony.dll
2008-04-07 00:08 . 2007-01-13 08:22 655,360 --a------ C:\WINDOWS\system32\CDDBControlSony.dll
2008-04-07 00:08 . 2007-01-13 08:22 589,824 --a------ C:\WINDOWS\system32\CddbMusicIDSony.dll
2008-04-07 00:08 . 2007-01-13 08:25 532,480 --a------ C:\WINDOWS\system32\CddbPlaylist2Sony.dll
2008-04-07 00:08 . 2007-01-13 08:24 73,728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll
2008-04-07 00:07 . 2008-04-07 00:09 <DIR> d-------- C:\Program Files\Sony
2008-04-07 00:06 . 2008-04-07 00:07 <DIR> d-------- C:\Program Files\Common Files\Sony Shared
2008-04-07 00:06 . 2008-04-08 23:41 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Sony Corporation
2008-04-06 16:15 . 2008-04-12 13:17 560 --a------ C:\Documents and Settings\Paweł\Dane aplikacji\ViewerApp.dat
2008-04-06 16:14 . 2008-04-06 18:40 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Ulead Systems
2008-04-06 16:10 . 2004-11-15 13:55 619,390 --a------ C:\WINDOWS\system32\drivers\sonypvf3.sys
2008-04-06 16:10 . 2004-12-06 14:26 423,454 --a------ C:\WINDOWS\system32\drivers\sonypvt3.sys
2008-04-06 16:10 . 2004-11-29 15:12 65,536 --a------ C:\WINDOWS\system32\sonypvi3.dll
2008-04-06 16:10 . 2004-12-07 15:00 64,964 --a------ C:\WINDOWS\system32\drivers\sonypvd3.sys
2008-04-06 16:10 . 2004-09-22 11:55 18,110 --a------ C:\WINDOWS\system32\drivers\sonypvl3.sys
2008-04-06 16:10 . 2004-09-13 15:42 4,464 --a------ C:\WINDOWS\system32\SonyPVC3.dll
2008-04-06 16:09 . 2008-04-06 16:09 <DIR> d-------- C:\Program Files\Sony Corporation
2008-04-06 16:09 . 2008-04-06 16:09 <DIR> d-------- C:\Program Files\Common Files\muvee Technologies
2008-04-06 16:05 . 2008-04-06 16:05 <DIR> d-------- C:\Program Files\SmartSound Software
2008-04-06 16:05 . 2008-04-08 21:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\SmartSound Software Inc
2008-04-06 16:04 . 2008-04-06 16:05 <DIR> d-------- C:\Program Files\QuickTime
2008-04-06 16:04 . 2008-04-06 16:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-04-06 16:03 . 2008-04-06 16:03 <DIR> d-------- C:\Program Files\Common Files\InterVideo
2008-04-06 16:03 . 2008-04-06 16:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InterVideo
2008-04-06 16:03 . 2007-03-06 11:58 210,456 --a------ C:\WINDOWS\system32\IVIresizeW7.dll
2008-04-06 16:03 . 2007-03-06 11:58 206,360 --a------ C:\WINDOWS\system32\IVIresizeA6.dll
2008-04-06 16:03 . 2007-03-06 11:58 198,168 --a------ C:\WINDOWS\system32\IVIresizeP6.dll
2008-04-06 16:03 . 2007-03-06 11:58 198,168 --a------ C:\WINDOWS\system32\IVIresizeM6.dll
2008-04-06 16:03 . 2007-03-06 11:58 194,072 --a------ C:\WINDOWS\system32\IVIresizePX.dll
2008-04-06 16:03 . 2007-03-06 11:58 26,136 --a------ C:\WINDOWS\system32\IVIresize.dll
2008-04-06 16:02 . 2008-04-06 16:02 <DIR> d-------- C:\Program Files\Windows Media Components
2008-04-06 16:01 . 2008-04-06 16:01 <DIR> d-------- C:\Program Files\Ulead Systems
2008-04-06 16:01 . 2008-04-06 16:02 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems
2008-04-06 16:01 . 2008-04-06 16:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
2008-04-06 15:21 . 2008-04-06 15:21 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-06 15:21 . 2008-04-06 15:21 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Lavasoft
2008-04-06 12:15 . 2008-04-06 12:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\gdsxojif
2008-04-06 12:15 . 2008-04-06 10:47 249,856 --a------ C:\WINDOWS\temlxopqwsp.dll
2008-04-06 12:15 . 2008-04-06 12:15 98,304 --a------ C:\WINDOWS\system32\mrqlirqp.exe
2008-04-06 12:14 . 2007-12-03 09:12 143,215 --a------ C:\Cyberlink_PowerDVD_Ultra_Deluxe_7.3.3319f.zip
2008-04-06 12:10 . 2008-04-06 12:11 <DIR> d-------- C:\Program Files\CyberLink
2008-04-06 11:29 . 2008-04-06 11:29 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\CyberLink
2008-04-06 11:29 . 2008-04-06 11:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-04-06 11:19 . 2008-04-06 11:19 29,480 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-04-06 11:08 . 2008-04-06 11:08 49,511 ---h----- C:\treeinfo.wc
2008-04-06 11:05 . 2008-04-06 11:06 <DIR> d-------- C:\Program Files\totalcmd
2008-04-06 11:05 . 2008-04-06 11:29 786 --a------ C:\WINDOWS\wincmd.ini
2008-04-06 11:05 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\UC.PIF
2008-04-06 11:05 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\RAR.PIF
2008-04-06 11:05 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-04-06 11:05 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-04-06 11:05 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-04-06 11:05 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\LHA.PIF
2008-04-06 11:05 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\ARJ.PIF
2008-04-03 20:18 . 2007-07-09 15:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-04-03 18:08 . 2008-05-14 14:29 <DIR> d--h----- C:\WINDOWS\$hf_mig$

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-30 15:01 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\uTorrent
2008-05-29 13:44 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-24 20:43 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\AdobeUM
2008-05-21 13:32 --------- d-----w C:\Program Files\IrfanView
2008-05-18 09:42 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-15 05:47 --------- d-----w C:\Program Files\Last.fm
2008-04-06 22:09 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-03 05:35 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\Winamp
2008-03-30 13:07 --------- d-----w C:\Program Files\Tunatic
2008-03-28 15:22 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys
2008-03-28 15:22 --------- d-----w C:\Program Files\DAEMON Tools
2008-03-28 15:17 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd2429.sys
2008-03-28 15:17 642,560 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-28 09:40 --------- d-----w C:\Program Files\LClock
2008-03-28 08:44 65,305 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-03-28 08:44 6,116 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-03-28 07:13 --------- d-----w C:\Program Files\Konnekt
2008-03-27 19:46 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-23 19:15 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll
2008-03-23 19:15 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll
2008-03-22 22:46 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 09:05 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\‹952A0FBE-E225-450F-A518-E55805DAF6AC›]
2008-04-06 10:47 249856 --a------ C:\WINDOWS\temlxopqwsp.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"‹9620B51A-BAB2-4FF5-8BB7-45C2C5510777›"= "C:\WINDOWS\vnbptxlf.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\‹9620b51a-bab2-4ff5-8bb7-45c2c5510777›]
[HKEY_CLASSES_ROOT\vnbptxlf.1]
[HKEY_CLASSES_ROOT\TypeLib\‹76E66FF8-22BA-4ECD-BB6B-95F6B33A4B46›]
[HKEY_CLASSES_ROOT\vnbptxlf]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Konnekt"="C:\Program Files\Konnekt\konnekt.exe" [2005-05-24 23:41 503808]
"LClock"="C:\Program Files\LClock\lclock.exe" [2004-09-19 20:27 65536]
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-19 00:05 630784]
"noylgkay"="C:\WINDOWS\system32\mrqlirqp.exe" [2008-04-06 12:15 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-12-10 04:06 7311360]
"nwiz"="nwiz.exe" [2005-12-10 04:06 1519616 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-11-03 14:58 28160 C:\WINDOWS\KHALMNPR.Exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40 155648]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 12:20 77824 C:\WINDOWS\SOUNDMAN.EXE]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 16:57 133016]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 21:01 71216]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-03-14 21:01 54832]
"UVS11 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 14:12 341488]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57 282624]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-12-10 04:06 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360]

C:\Documents and Settings\Pawe&#136;\Menu Start\Programy\Autostart\
MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2008-04-25 15:24:13 432128]
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 00:05:02 630784]
Skr˘t do rasphone.exe.lnk - C:\WINDOWS\system32\rasphone.exe [2001-10-26 19:30:00 56832]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 09:43:08 180224]
Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 09:43:14 155648]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-03-22 21:51:38 532480]
Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2008-04-06 16:09:54 151552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"rSoaRYGUSl"= C:\Documents and Settings\All Users\Dane aplikacji\gdsxojif\spsbujwn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Konnekt\\konnekt.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Adobe\\Adobe Dreamweaver CS3\\Dreamweaver.exe"=

R0 sonypvl3;sonypvl3;C:\WINDOWS\system32\drivers\sonypvl3.sys [2004-09-22 11:55]
R1 sonypvf3;sonypvf3;C:\WINDOWS\system32\drivers\sonypvf3.sys [2004-11-15 13:55]
R1 sonypvt3;sonypvt3;C:\WINDOWS\system32\drivers\sonypvt3.sys [2004-12-06 14:26]
R2 ‹95808DC4-FA4A-4C74-92FE-5B863F82066B›;‹95808DC4-FA4A-4C74-92FE-5B863F82066B›;C:\Program Files\CyberLink\PowerDVD\000.fcl [2007-09-19 21:37]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-05-31 11:25:53
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\‹95808DC4-FA4A-4C74-92FE-5B863F82066B›]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-05-31 11:28:28
ComboFix-quarantined-files.txt 2008-05-31 09:27:40

Pre-Run: 6,944,894,976 bajtów wolnych
Post-Run: 7,267,885,056 bajtów wolnych

223 --- E O F --- 2008-05-14 21:49:55

QrKo_ [ ]

Sprawdz co to:
"noylgkay"="C:\WINDOWS\system32\mrqlirqp.exe" [2008-04-06 12:15 98304]

A to od razu wywal:
"rSoaRYGUSl"= C:\Documents and Settings\All Users\Dane aplikacji\gdsxojif\spsbujwn.exe

Paul12 [ Buja ]

Nie pomogło.

Slasher11 [ Generaďż˝ ]

Jeśli masz dysk podzielony na partycje to sformatuj po prostu systemówkę i za 1-2h będziesz miał świeżutkiego kompa wraz z wsyztskimi programami co miales wczesniej. Szkoda czasu na walczenie z robactwem

Paul12 [ Buja ]

Slasher - wolę stracić trochę czasu na robactwo, niż przez kilka dni dochodzić do stanu sprzed formatowania.

jagged_alliahdnbedffds [ Rock'n'Roll ]

Też tak myślałem kilka tygodni temu, ale po półtora dnia się poddałem i wieczorem sformatowałem cały dysk C - z Windowsem, a kolejnego dnia zainstalowałem wszystko i w kilka godzin komp działa jeszcze szybciej i piękniej :)
Polecam Norton GHOSTa - robisz sobie obraz dysku i w takiej sytuacji wgrywasz ten obraz na dysk i masz to, co zapisałeś na obrazie, a robaczki idą spać :P

Paul12 [ Buja ]

Up? Ktoś wie jak sobie z tym poradzić? Nie chcę formatować dysku.

The HardStyler [ Centurion ]

Zainstaluj HiJackThis np. 1.99.1 czy tam inną wersje i zrób 'scan and save'.
Potem wrzuć ten log na tą stronke
jak będziesz miał jakieś krzyżyki to usuniesz, może to pomoże :)