Wirus Variant of the Trojan.Win32.Obfuscated.gx porn adware

kurde niedawno moj kochany komputerek załapał takiego wirusa "Variant of the Trojan.Win32.Obfuscated.gx (porn adware)" jakim programem mam go usunac? probowałem juz 5 antywirusów i nic..... wie ktos cos moze na ten temat??? bede wdzieczny...

Podaj logi z combofix i Hijackthis

kurde a mozna jasniej? jesli chodzi o komputery to ja geniuszem w tej dziedzinie nie jestem...

http://instalki.pl/forum/viewtopic.php?t=7444
http://instalki.pl/forum/viewtopic.php?t=10681

Kod:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:47:58, on 2008-04-13
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\SYSTEM32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\Programy\avas\aswUpdSv.exe
J:\Programy\avas\ashServ.exe
J:\WINDOWS\Explorer.EXE
J:\Program Files\Intel Audio Studio\IntelAudioStudio.exe
J:\WINDOWS\System32\RunDLL32.exe
J:\Programy\winamp\winampa.exe
J:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
J:\Programy\bear\BearShare.exe
J:\Programy\avas\ashDisp.exe
J:\Program Files\Messenger\msmsgs.exe
J:\Programy\Gadu-Gadu\gg.exe
J:\Program Files\RALINK\Common\RaUI.exe
J:\WINDOWS\system32\spoolsv.exe
J:\WINDOWS\System32\nvsvc32.exe
J:\Programy\avas\ashMaiSv.exe
J:\Programy\avas\ashWebSv.exe
J:\Programy\winamp\winamp.exe
J:\WINDOWS\System32\wuauclt.exe
J:\WINDOWS\System32\dwwin.exe
J:\Program Files\Internet Explorer\iexplore.exe
J:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: FLW Viewer - {1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E} - J:\WINDOWS\cndr32a.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - J:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - J:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - J:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "J:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" TRAY
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE J:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] J:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] J:\Programy\winamp\winampa.exe
O4 - HKLM\..\Run: [HP Software Update] J:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] J:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [BearShare] "J:\Programy\bear\BearShare.exe" /pause
O4 - HKLM\..\Run: [avast!] J:\Programy\avas\ashDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "J:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "J:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] J:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] J:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] J:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] J:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Ralink Wireless Utility.lnk = J:\Program Files\RALINK\Common\RaUI.exe
O8 - Extra context menu item: &Winamp Toolbar Search - J:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://J:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - J:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - J:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - J:\WINDOWS\web\related.htm
O12 - Plugin for .spop: J:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0EFCB27-F385-448E-92F5-5EF5CB722944}: NameServer = 192.168.81.1,194.204.152.34
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - J:\Programy\avas\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - J:\Programy\avas\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - J:\Programy\avas\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - J:\Programy\avas\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - J:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\System32\nvsvc32.exe

--
End of file - 4814 bytes

fix w hijackthis

O2 - BHO: FLW Viewer - {1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E} - J:\WINDOWS\cndr32a.dll

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod:

File::
 J:\WINDOWS\cndr32a.dll


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox

Kod:

ComboFix 08-04-12.7 - Michał 2008-04-13 12:03:21.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.1.1250.1.1045.18.579 [GMT 2:00]
Running from: J:\Documents and Settings\Michał\Pulpit\ComboFix.exe
Command switches used :: J:\Documents and Settings\Michaˆ\Pulpit\CFScript.txt
 * Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-03-13 to 2008-04-13  )))))))))))))))))))))))))))))))
.

2008-04-13 11:47 . 2008-04-13 11:47   <DIR>   d--------   J:\Program Files\Trend Micro
2008-04-09 19:59 . 2008-03-29 19:45   1,146,232   --a------   J:\WINDOWS\system32\aswBoot.exe
2008-04-09 19:59 . 2004-01-09 10:13   380,928   --a------   J:\WINDOWS\system32\actskin4.ocx
2008-04-09 19:59 . 2008-03-29 19:23   95,608   --a------   J:\WINDOWS\system32\AvastSS.scr
2008-04-09 19:59 . 2008-03-29 19:35   94,544   --a------   J:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-09 19:59 . 2008-01-17 17:34   93,264   --a------   J:\WINDOWS\system32\drivers\aswmon.sys
2008-04-09 19:59 . 2008-03-29 19:31   75,856   --a------   J:\WINDOWS\system32\drivers\aswSP.sys
2008-04-09 19:59 . 2008-03-29 19:27   42,912   --a------   J:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-09 19:59 . 2008-03-29 19:26   26,944   --a------   J:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-09 19:59 . 2008-03-29 19:29   23,152   --a------   J:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-08 23:47 . 2008-04-09 19:56   <DIR>   d--------   J:\WINDOWS\LastGood
2008-04-08 23:46 . 2008-04-09 19:58   <DIR>   d--------   J:\Program Files\Common Files\Panda Software
2008-04-08 22:37 . 2008-04-08 23:44   <DIR>   d--------   J:\Documents and Settings\All Users\Dane aplikacji\Avira
2008-04-07 20:34 . 2008-04-07 20:34   211,456   --a------   J:\WINDOWS\cndr32a.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-09 17:58   ---------   d--h--w   J:\Program Files\InstallShield Installation Information
2008-04-09 17:57   ---------   d-----w   J:\Program Files\Common Files\InstallShield
2008-04-08 17:34   ---------   d-----w   J:\Documents and Settings\Michał\Dane aplikacji\winamp
2008-03-05 17:28   ---------   d-----w   J:\Program Files\Microsoft.NET
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-12-13 18:49   1185120   --a------   J:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "J:\Program Files\Winamp Toolbar\winamptb.dll" [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= J:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="J:\Program Files\Messenger\msmsgs.exe" [2002-08-20 16:08 1511453]
"Gadu-Gadu"="J:\Programy\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="sttray.exe" []
"IntelAudioStudio"="J:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" [2006-08-02 18:17 9134080]
"NvCplDaemon"="J:\WINDOWS\System32\NvCpl.dll" [2006-06-01 11:22 7618560]
"nwiz"="nwiz.exe" [2006-06-01 11:22 1519616 J:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 86016 J:\WINDOWS\system32\nvmctray.dll]
"NWEReboot"="" []
"NeroFilterCheck"="J:\WINDOWS\System32\NeroCheck.exe" [2001-07-09 12:50 155648]
"WinampAgent"="J:\Programy\winamp\winampa.exe" [2007-12-20 17:16 37376]
"HP Software Update"="J:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 12:40 49152]
"HPDJ Taskbar Utility"="J:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 12:08 172032]
"BearShare"="J:\Programy\bear\BearShare.exe" [2006-08-01 18:04 3313664]
"avast!"="J:\Programy\avas\ashDisp.exe" [2008-03-29 19:37 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="J:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 18:05 13312]

J:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Ralink Wireless Utility.lnk - J:\Program Files\RALINK\Common\RaUI.exe [2007-12-24 14:53:41 614400]

R1 aswSP;avast! Self Protection;J:\WINDOWS\System32\drivers\aswSP.sys [2008-03-29 19:31]
S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};J:\WINDOWS\TEMP\12.tmp []
S3 AvFlt;Antivirus Filter Driver;J:\WINDOWS\System32\drivers\av5flt.sys []
S3 RT2400;RT2400 Wireless Driver;J:\WINDOWS\System32\DRIVERS\RT2400.sys [2003-10-08 14:14]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-13 12:03:52
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-13 12:04:11
ComboFix-quarantined-files.txt  2008-04-13 10:04:07
ComboFix2.txt  2008-04-13 09:56:20
Pre-Run: 34,073,927,680 bajtów wolnych
Post-Run: 33,992,052,736 bajtów wolnych

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod:

File::
J:\WINDOWS\cndr32a.dll
J:\WINDOWS\TEMP\12.tmp

Driver::
{DEF85C80-216A-43ab-AF70-1665EDBE2780}


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu
[obrazek nie jest już dostępny]
Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox

Kod:

ComboFix 08-04-12.7 - Michał 2008-04-13 12:11:49.3 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.1.1250.1.1045.18.636 [GMT 2:00]
Running from: J:\Documents and Settings\Michał\Pulpit\ComboFix.exe
Command switches used :: J:\Documents and Settings\Michaˆ\Pulpit\CFScript.txt
 * Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-03-13 to 2008-04-13  )))))))))))))))))))))))))))))))
.

2008-04-13 11:47 . 2008-04-13 11:47   <DIR>   d--------   J:\Program Files\Trend Micro
2008-04-09 19:59 . 2008-03-29 19:45   1,146,232   --a------   J:\WINDOWS\system32\aswBoot.exe
2008-04-09 19:59 . 2004-01-09 10:13   380,928   --a------   J:\WINDOWS\system32\actskin4.ocx
2008-04-09 19:59 . 2008-03-29 19:23   95,608   --a------   J:\WINDOWS\system32\AvastSS.scr
2008-04-09 19:59 . 2008-03-29 19:35   94,544   --a------   J:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-09 19:59 . 2008-01-17 17:34   93,264   --a------   J:\WINDOWS\system32\drivers\aswmon.sys
2008-04-09 19:59 . 2008-03-29 19:31   75,856   --a------   J:\WINDOWS\system32\drivers\aswSP.sys
2008-04-09 19:59 . 2008-03-29 19:27   42,912   --a------   J:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-09 19:59 . 2008-03-29 19:26   26,944   --a------   J:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-09 19:59 . 2008-03-29 19:29   23,152   --a------   J:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-08 23:47 . 2008-04-09 19:56   <DIR>   d--------   J:\WINDOWS\LastGood
2008-04-08 23:46 . 2008-04-09 19:58   <DIR>   d--------   J:\Program Files\Common Files\Panda Software
2008-04-08 22:37 . 2008-04-08 23:44   <DIR>   d--------   J:\Documents and Settings\All Users\Dane aplikacji\Avira
2008-04-07 20:34 . 2008-04-07 20:34   211,456   --a------   J:\WINDOWS\cndr32a.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-09 17:58   ---------   d--h--w   J:\Program Files\InstallShield Installation Information
2008-04-09 17:57   ---------   d-----w   J:\Program Files\Common Files\InstallShield
2008-04-08 17:34   ---------   d-----w   J:\Documents and Settings\Michał\Dane aplikacji\winamp
2008-03-05 17:28   ---------   d-----w   J:\Program Files\Microsoft.NET
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-12-13 18:49   1185120   --a------   J:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "J:\Program Files\Winamp Toolbar\winamptb.dll" [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= J:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="J:\Program Files\Messenger\msmsgs.exe" [2002-08-20 16:08 1511453]
"Gadu-Gadu"="J:\Programy\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="sttray.exe" []
"IntelAudioStudio"="J:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" [2006-08-02 18:17 9134080]
"NvCplDaemon"="J:\WINDOWS\System32\NvCpl.dll" [2006-06-01 11:22 7618560]
"nwiz"="nwiz.exe" [2006-06-01 11:22 1519616 J:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 86016 J:\WINDOWS\system32\nvmctray.dll]
"NWEReboot"="" []
"NeroFilterCheck"="J:\WINDOWS\System32\NeroCheck.exe" [2001-07-09 12:50 155648]
"WinampAgent"="J:\Programy\winamp\winampa.exe" [2007-12-20 17:16 37376]
"HP Software Update"="J:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 12:40 49152]
"HPDJ Taskbar Utility"="J:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 12:08 172032]
"BearShare"="J:\Programy\bear\BearShare.exe" [2006-08-01 18:04 3313664]
"avast!"="J:\Programy\avas\ashDisp.exe" [2008-03-29 19:37 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="J:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 18:05 13312]

J:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Ralink Wireless Utility.lnk - J:\Program Files\RALINK\Common\RaUI.exe [2007-12-24 14:53:41 614400]

R1 aswSP;avast! Self Protection;J:\WINDOWS\System32\drivers\aswSP.sys [2008-03-29 19:31]
S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};J:\WINDOWS\TEMP\12.tmp []
S3 AvFlt;Antivirus Filter Driver;J:\WINDOWS\System32\drivers\av5flt.sys []
S3 RT2400;RT2400 Wireless Driver;J:\WINDOWS\System32\DRIVERS\RT2400.sys [2003-10-08 14:14]

*Newly Created Service* - ALG
*Newly Created Service* - IPNAT
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-13 12:12:30
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}]
"ImagePath"="\??\J:\WINDOWS\TEMP\12.tmp"
.
Completion time: 2008-04-13 12:12:47
ComboFix-quarantined-files.txt  2008-04-13 10:12:43
ComboFix2.txt  2008-04-13 10:04:12
Pre-Run: 34,322,747,392 bajtów wolnych
Post-Run: 34,312,323,072 bajtów wolnych

Pobierz Avenger
Zaznacz Input Script Manualy => naciskasz Lupkę => wklej:

Kod:

Files to delete:
J:\WINDOWS\cndr32a.dll
J:\WINDOWS\TEMP\12.tmp
Drivers to delete:
 {DEF85C80-216A-43ab-AF70-1665EDBE2780}


naciskasz Done => i zielone światełko => potem pojawi się pewna informacja => dajesz Tak
Pokaz z niego raport na C:\avenger.txt

ale tam nie ma czegos takiego..... "Input Script Manualy"??? "Lupka"???

W uruchomionym programie masz takie przyciski

na uruchomionym programie mam FILE EDIT LOAD SCRIPT HELP
LOAD SCRIPT FROM FILE... LOAD SCRIPT FROM INTERNET URL... PASTE SCRIPT FROM CLIPBOARD EXECUTE
wiec???????????????????????/

jak uruchomisz program to masz tam okienko takie do wpisywania treści to jest właśnie Input Script here

i rozumie ze ten kod mam wklei w to okienko? i co dalej....???