Logi - Trojan w pliku "svcnost.exe"

Problem polega na 100% użycie procesora oraz rozmnażaniem procesów "svchost" po godzinie wlaczonego kompa jest ich okolo 20. Podejrzany plik svnost.

Podaje log z OTL

http://wklej.to/za5bt

Drugi Log

http://wklej.to/m7pt5


PRoszę o szybka pomoc!

Skanowanie Spybotem czy alwabare trwa okolo 14 godzin!

[2011-01-25 15:57:31 | 000,000,000 | ---D | C] -- C:\Program Files\tmp
[2011-01-24 20:58:54 | 000,000,000 | ---D | C] -- C:\Program Files\windows

Znasz te powyższe programy (nie są Systemowe) ?
Co w nich jest? Powstały razem z infekcją.

Uruchom OTL i w oknie Własne opcje skanowania/Script wklej to:

:OTL
FF - prefs.js..browser.search.defaultthis.engineName: "Softonic-Polska Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2530240&SearchSource=3&q={searchTerms}"
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..keyword.URL: "http://vshare.toolbarhome.com/search.aspx?srch=ku&q="
[2010-10-10 09:37:05 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Documents and Settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\97c1ckyp.default\extensions\vshare@toolbar
[2010-12-08 15:49:56 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\97c1ckyp.default\searchplugins\conduit.xml
[2010-10-10 09:37:17 | 000,001,583 | ---- | M] () -- C:\Documents and Settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\97c1ckyp.default\searchplugins\web-search.xml
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3 - HKU\S-1-5-21-861567501-1788223648-1801674531-1004\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKU\S-1-5-21-861567501-1788223648-1801674531-1004..\Run: [mssend] C:\Documents and Settings\Klaudia\Dane aplikacji\xssend2\svcnost.exe ()
O4 - Startup: C:\Documents and Settings\Klaudia\Menu Start\Programy\Autostart\aodgdpbb.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Program Files\iWuioHal\aodgdpbb.exe) - C:\Program Files\iWuioHal\aodgdpbb.exe ()
[2011-01-27 22:27:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssend2scftpnsoirofkximbpkmnxw3aise3d
[2011-01-27 22:11:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssend1urvxsftyeuegkxtsnueblro3ppgppr
[2011-01-27 21:53:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendtlm3xxmpevwkracbuy2zhaga11mhrzx
[2011-01-27 21:36:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendfl2e3agt2ri2ocllwbhqbpzsmfjnymz
[2011-01-27 21:19:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendfzjoiyddbszchieutrnwldpwhqjjnee
[2011-01-27 21:02:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendoylizefpe2zcfly2tqdxl1z2skmlkb3
[2011-01-27 20:45:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendnvpzzbabgbdetrbehujvz1ppfa2j3jc
[2011-01-27 20:28:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendb3eyc3csi132iw23vauvncixi1anozk
[2011-01-27 20:11:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendyavgleikkjfmmyf1xhusmy3plnwfe3a
[2011-01-27 19:53:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendqa1cdvacr1uuumu2erwdnsadszqcqqg
[2011-01-27 19:36:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendvpwyowmxsewlvkpmflvgbultovfasps
[2011-01-27 19:19:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendsm1hwhi2hi23zyl2ldj1ptsbnmcrkjt
[2011-01-27 19:02:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssende3hrzofvp2bdxq21ehv3mvfjhwh3xnr
[2011-01-27 18:45:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendldrashh3b1cuohfcrblz33yor1dt1yf
[2011-01-27 18:29:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssenduebstbrrcblhmqortoil3vsdrgzor2y
[2011-01-27 18:11:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendqomvgnz2fpg3a3xrrpk3221rmcvilhc
[2011-01-27 17:54:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssenduurirbgfgjfis32diomaesfwmgm1hht
[2011-01-27 17:37:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendndzhvqtswsfwmsbo2zyfia3vsmlkjiv
[2011-01-27 17:20:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendj3lubijgblruo3pwwizwwfesi1pwiku
[2011-01-27 17:04:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendkheomkumurntvxhoxjfacyyo2dtzlqb
[2011-01-27 16:46:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendilnhnzmkbmgniyeoqt3yuzvgksqmxeu
[2011-01-27 16:29:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssend3sfglfdghufl22y1xvvoshpigkftiui
[2011-01-27 16:11:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendripnginfyryid3bhmlphakcfportzli
[2011-01-27 15:55:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendoh1lrz2wysiwimsjhntbszdsnlpedwg
[2011-01-27 15:53:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssend3bkyvclaihk131duspimupkrujlgevu
[2011-01-27 15:44:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Ustawienia lokalne\Dane aplikacji\Softonic-Polska
[2011-01-27 15:37:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendieviopqah3zkonacw33ducnxsgcwy1u
[2011-01-26 20:07:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendtkokcz3fvvmoupfjefgmsdpchkr2dq1
[2011-01-26 15:03:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendpyrnn1yfpwyxml1sxbbbmcboahtk2ml
[2011-01-26 09:59:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssend3h33yzolxryxg1vjgb2zhkrpjok3duq
[2011-01-25 21:01:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendbttjrcfwck3cva2qjjlxl1uyugggphc
[2011-01-25 15:57:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendqhofmny1eitdk1fe2pxg2vbmumyenxx
[2011-01-25 14:41:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendsmuxafux2rbtg2coqbs11ssumdqbwuw
[2011-01-24 20:58:39 | 000,000,000 | ---D | C] -- C:\Program Files\iWuioHal
[2011-01-24 08:32:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssend2cznp1thefzkyr1b3ibwp1c3amzaz1h
[2011-01-23 23:39:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendv2rsimny33hfgdypjmozvxkdcdd2cgc
[2011-01-23 18:35:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendcnzohspt3kssarwdtwyjykuerkrfk1s
[2011-01-20 18:48:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendp3abey2a3rba12dgr3hjzejdugkcvly
[2011-01-20 13:45:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssenddh2v33lxg3v3yygfkpgpgbfgk2unpgs
[2011-01-20 08:41:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssenddtpqjetqfptjqgm1bbwobfzlpbskifg
[2011-01-20 03:34:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssenddk1hxouo3m22nk3t1dd3irnxdkqjgcq
[2011-01-19 22:31:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendk3bqnvaum2whye1hkqs3x1ilpa1asjr
[2011-01-19 22:30:49 | 000,000,000 | ---D | C] -- C:\Program Files\XpxGXrTIö# ¸Ëaodgdpbb.exe
[2010-01-09 22:23:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Ustawienia lokalne\Dane aplikacji\Web Search Operator
[2010-01-09 22:23:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Ustawienia lokalne\Dane aplikacji\GameRaving Toolbar
[2010-01-09 22:23:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer
[2010-01-09 22:23:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer
[2010-01-09 22:23:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Ustawienia lokalne\Dane aplikacji\Internet Today
[2010-01-09 11:01:29 | 000,000,000 | ---D | C] -- C:\Program Files\GameRaving Toolbar
[2006-01-01 20:36:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssend2
[2006-01-01 20:09:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendtwxasrgfjpwhcsjjiwahooyvrisv1p2
[2006-01-01 19:53:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssend3abjbd2ndrdnkywjkza1bcrlfbgnrrm
[2006-01-01 19:14:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendktcz2xkufdkqpc3mfcpbwehj21piswh
[2006-01-01 18:57:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendf2vm1bdmemgvbbx3r3uwvqprjxypgi1
[2006-01-01 18:40:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssend1jitww1mxf3vygoeqdnzjqgvvba3zho
[2006-01-01 17:46:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendhqfbllbrqa3enzychksa33kgjpxuyay
[2006-01-01 03:16:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendrwch2mecku3uspayfasdglm2eh3f3we
[2006-01-01 02:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendnvdfkatixkziiygtghskjnnnzwdfmc2
[2006-01-01 02:22:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendwcyr2hshlyxd2zgqyucd1cgiqnyjgjv
[2006-01-01 02:05:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendj23adt1yzkuewxjzzgczmlmnwlnvz3x
[2006-01-01 01:48:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendwsgrfi2uhuqwmwxqdeys1sj1vsyfmhp
[2006-01-01 01:01:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssend3ewoiyacdeqwbnuxfopgvavbea1dxdp
[2006-01-01 00:44:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendwrkumwqbkjrcqgnmiewp1eump2h2hgm
[2006-01-01 00:27:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Klaudia\Dane aplikacji\xssendxomodllhqph1hoknuii2xclkrvempgn
[2011-01-19 22:30:47 | 000,075,636 | --S- | M] () -- C:\Documents and Settings\Klaudia\Menu Start\Programy\Autostart\aodgdpbb.exe

:Files
C:\Program Files\DAEMON Tools Toolbar
RECYCLER /alldrives

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\Klaudia\Dane aplikacji\xssend2\svcnost.exe"=-

:Commands
[emptytemp]
[resethosts]

Kliknij w Wykonaj Script. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.
Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania.
.

http://www.forumkomputerowe.pl/topic/6448-log-z-otl-do-sprawdzenia/page__gopid__35015&#entry35015

Aha, problem rozwiązany na innym forum.
.