zrobiłem to. ale Registry Search Tool nie moglem odpalic w trybie awarayjnym, uruchomilem normalnie... nic nie znalazł:–/
robak został:–/
chyba bede musial robic format:( moze wiecie jak po zainstalowaniu windowsa 2000 obrnic sie przed tym robakiem... ?
System w ktorym mam tego robala obecnie, zostal zainstalowany zaledwie tydzien temu(!) a wszystkie aplikacje ktore w nim są byly zainstalowane na innym moim kompie na ktorym nie bylo sladu robala..

pozdrawiam!

Masz chyba wersją A tego robaka: http://www.symantec.com/avcenter/venc/data/w32.rahack.html
W wersji B nie ma tej usługi, która u Ciebie była.
Proponuje uruchomic system w awaryjnym, otworzyc notatnik wklejić w nim:

cd C:\windows\system32
attrib –r –s –h mscolsrv.exe
attrib –r –s –h server.dll
attrib –r –s –h svchsot.exe
attrib –r –s –h syshid.exe
del mscolsrv.exe
del server.dll
del svchsot.exe
del syshid.exe

Zapisac z rozszerzeniem *.bat i uruchomić.
Wczesniej sciagnąć Registry Search Tool, i po kolei jako słowa szukane wpisac nazwy tych plików oraz: Rahack i RAdmin.
Jesli to nie pomoze przeskanuj system gruntownie antywirusem i skanerami on–line. Pozniej ewentualnie zapuscisz inne programy pokazujące miejsca gdzie regenerator moze siedziec.

P.S. Przenosze do działu bezpieczeństwo.

poprawilem BootExecute. komp byl włączony kilka godz. i monitor rejestru arcavir znowu informuje o wpisach do rejestru srvsvc.exe, syshid itd... :–(

cristians:

nie ma u mnie na kompie 'mscolsrv.exe'

Moze juz nie ma? :wink:

Popraw tylko ten wpis:

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

Tak jak napisał Wiewia tutaj: http://forum.centrumxp.pl/viewtopic.php?t=47135

nie ma u mnie na kompie 'mscolsrv.exe'
wiem co to servtcp.exe i musze go miec.

Logfile of HijackThis v1.99.1
Scan saved at 20:56:25, on 2006–01–24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Fmctrl.EXE
C:\Program Files\ArcaVir\Bin\ABmenu.exe
C:\Program Files\ArcaVir\Bin\ABregmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800–840\dslmon.exe
C:\Program Files\ArcaVir\Bin\NetMonSv.exe
C:\Program Files\ArcaVir\Bin\avmonsv.exe
C:\Program Files\No–IP\DUC20.exe
C:\WINDOWS\system32\r_server.exe
C:\WINDOWS\system32\servtcp.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\No–IP\DUC20.exe
C:\Documents and Settings\cristians\Pulpit\new\pasterz\pasterz.exe
C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7m\SBCL v0.7m.exe
C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7n\SBCL v0.7n.exe
C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7o\SBCL v0.7o.exe
C:\Documents and Settings\cristians\Pulpit\new\SatBazaar CardServer v0.7e\SBCS v0.7e.exe
C:\Documents and Settings\cristians\Pulpit\new\SatBazaar CardServer v0.7ee\SBCS v0.7ee.exe
C:\Documents and Settings\cristians\Pulpit\new\PKarta 0.5\PKarta 0.5.exe
C:\Documents and Settings\cristians\Pulpit\new\hijackthis\HijackThis.exe

R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 – HKLM\..\Run: [SystemTray] SysTray.Exe
O4 – HKLM\..\Run: [FmctrlTray] Fmctrl.EXE
O4 – HKLM\..\Run: [ABmenu] C:\Program Files\ArcaVir\Bin\ABmenu.exe
O4 – HKLM\..\Run: [ABREGMON] C:\Program Files\ArcaVir\Bin\ABregmon.exe
O4 – Startup: Internet ADSL.lnk = ?
O4 – Startup: No–IP DUC.lnk = C:\Program Files\No–IP\DUC20.exe
O4 – Startup: pasterz.lnk = C:\Documents and Settings\cristians\Pulpit\new\pasterz\pasterz.exe
O4 – Startup: SBCL v0.7m.lnk = C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7m\SBCL v0.7m.exe
O4 – Startup: SBCL v0.7n.lnk = C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7n\SBCL v0.7n.exe
O4 – Startup: SBCL v0.7o.lnk = C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7o\SBCL v0.7o.exe
O4 – Startup: SBCS v0.7e.lnk = C:\Documents and Settings\cristians\Pulpit\new\SatBazaar CardServer v0.7e\SBCS v0.7e.exe
O4 – Startup: SBCS v0.7ee.lnk = C:\Documents and Settings\cristians\Pulpit\new\SatBazaar CardServer v0.7ee\SBCS v0.7ee.exe
O4 – Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800–840\dslmon.exe
O17 – HKLM\System\CCS\Services\Tcpip\..\{8AA548FF–B181–4FE6–9D0D–A8C5BA487225}: NameServer = 194.204.152.34 217.98.63.164
O20 – Winlogon Notify: WRNotifier – C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 – Service: ArcaBit NetMonitor (ABNetMon) – ArcaBit sp. z o.o. – C:\Program Files\ArcaVir\Bin\NetMonSv.exe
O23 – Service: ArcaVir Monitor (ArcaMonSvc) – ArcaBit – C:\Program Files\ArcaVir\Bin\avmonsv.exe
O23 – Service: ArcaScan – ArcaBit – C:\Program Files\ArcaVir\Bin\arcascan.exe
O23 – Service: arcaserv – ArcaBit Sp. z o. o. – C:\Program Files\ArcaVir\bin\arcaserv.exe
O23 – Service: NoIPDUCService – Vitalwerks LLC – C:\Program Files\No–IP\DUC20.exe
O23 – Service: Remote Administrator Service (r_server) – Unknown owner – C:\WINDOWS\system32\r_server.exe" /service (file missing)
O23 – Service: SerwerTCP (SerwerTcp) – Unknown owner – C:\WINDOWS\system32\servtcp.exe
O23 – Service: Webroot Spy Sweeper Engine (svcWRSSSDK) – Webroot Software, Inc. – C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe



"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non–default values, except where indicated by "{++}"


Startup items buried in registry:
–––––––––––––––––––––––––––––––––

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SystemTray" = "SysTray.Exe" [MS]
"FmctrlTray" = "Fmctrl.EXE" ["ForteMedia, Inc."]
"ABmenu" = "C:\Program Files\ArcaVir\Bin\ABmenu.exe" ["ArcaBit"]
"ABREGMON" = "C:\Program Files\ArcaVir\Bin\ABregmon.exe" ["ArcaBit"]

HKLM\Software\Microsoft\Active Setup\Installed Components\
>{881dd1c5–3dcf–431b–b061–f3f88e8be88a}\(Default) = "Outlook Express"
\StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714–76d4–11d1–8b24–00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
–> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560–9AA2–1069–930E–00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
–> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{21569614–B795–46b1–85F4–E737A8DC09AD}" = "Shell Search Band"
–> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{7C9D5882–CB4A–4090–96C8–430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration"
–> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! WRNotifier\DLLName = "WRLogonNTF.dll" ["Webroot Software, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ArcaVir\(Default) = "{39D48A26–EB1E–494c–973B–DDF4B2BEFE3F}"
–> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ArcaVir\Bin\ArcaShl.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
ArcaVir\(Default) = "{39D48A26–EB1E–494c–973B–DDF4B2BEFE3F}"
–> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ArcaVir\Bin\ArcaShl.dll" [null data]
SpySweeper\(Default) = "{7C9D5882–CB4A–4090–96C8–430BFE8B795B}"
–> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]


Active Desktop and Wallpaper:
–––––––––––––––––––––––––––––

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\cristians\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Startup items in "cristians" & "All Users" startup folders:
–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

C:\Documents and Settings\cristians\Menu Start\Programy\Autostart
"Internet ADSL" –> shortcut to: "" [file not found]
"No–IP DUC" –> shortcut to: "C:\Program Files\No–IP\DUC20.exe" ["Vitalwerks LLC"]
"pasterz" –> shortcut to: "C:\Documents and Settings\cristians\Pulpit\new\pasterz\pasterz.exe" [empty string]
"SBCL v0.7m" –> shortcut to: "C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7m\SBCL v0.7m.exe" [null data]
"SBCL v0.7n" –> shortcut to: "C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7n\SBCL v0.7n.exe" [null data]
"SBCL v0.7o" –> shortcut to: "C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7o\SBCL v0.7o.exe" [null data]
"SBCS v0.7e" –> shortcut to: "C:\Documents and Settings\cristians\Pulpit\new\SatBazaar CardServer v0.7e\SBCS v0.7e.exe" [null data]
"SBCS v0.7ee" –> shortcut to: "C:\Documents and Settings\cristians\Pulpit\new\SatBazaar CardServer v0.7ee\SBCS v0.7ee.exe" [null data]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"DSLMON" –> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800–840\dslmon.exe" [empty string]


Winsock2 Service Provider DLLs:
–––––––––––––––––––––––––––––––

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 – 03, 06 – 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 – 05


Running Services (Display Name, Service Name, Path {Service DLL}):
––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

ArcaBit NetMonitor, ABNetMon, "C:\Program Files\ArcaVir\Bin\NetMonSv.exe" ["ArcaBit sp. z o.o."]
ArcaVir Monitor, ArcaMonSvc, "C:\Program Files\ArcaVir\Bin\avmonsv.exe" ["ArcaBit"]
NoIPDUCService, NoIPDUCService, "C:\Program Files\No–IP\DUC20.exe –service" ["Vitalwerks LLC"]
Remote Administrator Service, r_server, ""C:\WINDOWS\system32\r_server.exe" /service" [null data]
SerwerTCP, SerwerTcp, "C:\WINDOWS\system32\servtcp.exe" [null data]
Webroot Spy Sweeper Engine, svcWRSSSDK, "C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe" ["Webroot Software, Inc."]


––––––––––
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the –all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the –supp parameter or answer "No" at the first message box.
–––––––––– (total run time: 106 seconds, including 5 seconds for message boxes)



czy teraz komp jest czysty? narazie jest ok. ale nie wiem jak bedzie po restarcie...

cristians, to samo z servtcp.exe o ile nie wiesz coz to jest i czy Ty instalowales.

O23 – Service: MSCoolServ – Unknown owner – C:\WINDOWS\system32\mscolsrv.exe" –service (file missing)

Podobno Rahack, uruchom wiersz poleceń i wpisz:
sc stop MSCoolServ
sc delete MSCoolServ
cd C:\WINDOWS\system32
del mscolsrv.exe
Silent nie skonczył produkowac loga, trzeba troche poczekac po uruchomieniu. Da znać kiedy ukończy zadanie.

Logfile of HijackThis v1.99.1
Scan saved at 19:14:06, on 2006–01–24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Fmctrl.EXE
C:\Program Files\ArcaVir\Bin\ABmenu.exe
C:\Program Files\ArcaVir\Bin\ABregmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800–840\dslmon.exe
C:\Program Files\ArcaVir\Bin\NetMonSv.exe
C:\Program Files\ArcaVir\Bin\avmonsv.exe
C:\Program Files\No–IP\DUC20.exe
C:\WINDOWS\system32\r_server.exe
C:\WINDOWS\system32\servtcp.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\No–IP\DUC20.exe
C:\Documents and Settings\cristians\Pulpit\new\pasterz\pasterz.exe
C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7m\SBCL v0.7m.exe
C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7n\SBCL v0.7n.exe
C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7o\SBCL v0.7o.exe
C:\Documents and Settings\cristians\Pulpit\new\SatBazaar CardServer v0.7e\SBCS v0.7e.exe
C:\Documents and Settings\cristians\Pulpit\new\SatBazaar CardServer v0.7ee\SBCS v0.7ee.exe
C:\Documents and Settings\cristians\Pulpit\new\PKarta 0.5\PKarta 0.5.exe
C:\Documents and Settings\cristians\Pulpit\new\hijackthis\HijackThis.exe

R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 – HKLM\..\Run: [SystemTray] SysTray.Exe
O4 – HKLM\..\Run: [FmctrlTray] Fmctrl.EXE
O4 – HKLM\..\Run: [ABmenu] C:\Program Files\ArcaVir\Bin\ABmenu.exe
O4 – HKLM\..\Run: [ABREGMON] C:\Program Files\ArcaVir\Bin\ABregmon.exe
O4 – Startup: Internet ADSL.lnk = ?
O4 – Startup: No–IP DUC.lnk = C:\Program Files\No–IP\DUC20.exe
O4 – Startup: pasterz.lnk = C:\Documents and Settings\cristians\Pulpit\new\pasterz\pasterz.exe
O4 – Startup: SBCL v0.7m.lnk = C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7m\SBCL v0.7m.exe
O4 – Startup: SBCL v0.7n.lnk = C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7n\SBCL v0.7n.exe
O4 – Startup: SBCL v0.7o.lnk = C:\Documents and Settings\cristians\Pulpit\new\SatBazaar Client v0.7o\SBCL v0.7o.exe
O4 – Startup: SBCS v0.7e.lnk = C:\Documents and Settings\cristians\Pulpit\new\SatBazaar CardServer v0.7e\SBCS v0.7e.exe
O4 – Startup: SBCS v0.7ee.lnk = C:\Documents and Settings\cristians\Pulpit\new\SatBazaar CardServer v0.7ee\SBCS v0.7ee.exe
O4 – Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800–840\dslmon.exe
O17 – HKLM\System\CCS\Services\Tcpip\..\{8AA548FF–B181–4FE6–9D0D–A8C5BA487225}: NameServer = 194.204.152.34 217.98.63.164
O20 – Winlogon Notify: WRNotifier – C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 – Service: ArcaBit NetMonitor (ABNetMon) – ArcaBit sp. z o.o. – C:\Program Files\ArcaVir\Bin\NetMonSv.exe
O23 – Service: ArcaVir Monitor (ArcaMonSvc) – ArcaBit – C:\Program Files\ArcaVir\Bin\avmonsv.exe
O23 – Service: ArcaScan – ArcaBit – C:\Program Files\ArcaVir\Bin\arcascan.exe
O23 – Service: arcaserv – ArcaBit Sp. z o. o. – C:\Program Files\ArcaVir\bin\arcaserv.exe
O23 – Service: MSCoolServ – Unknown owner – C:\WINDOWS\system32\mscolsrv.exe" –service (file missing)
O23 – Service: NoIPDUCService – Vitalwerks LLC – C:\Program Files\No–IP\DUC20.exe
O23 – Service: Remote Administrator Service (r_server) – Unknown owner – C:\WINDOWS\system32\r_server.exe" /service (file missing)
O23 – Service: SerwerTCP (SerwerTcp) – Unknown owner – C:\WINDOWS\system32\servtcp.exe
O23 – Service: Webroot Spy Sweeper Engine (svcWRSSSDK) – Webroot Software, Inc. – C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe


"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non–default values, except where indicated by "{++}"


Startup items buried in registry:
–––––––––––––––––––––––––––––––––

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SystemTray" = "SysTray.Exe" [MS]
"FmctrlTray" = "Fmctrl.EXE" ["ForteMedia, Inc."]
"ABmenu" = "C:\Program Files\ArcaVir\Bin\ABmenu.exe" ["ArcaBit"]
"ABREGMON" = "C:\Program Files\ArcaVir\Bin\ABregmon.exe" ["ArcaBit"]

Daj więc dwa logi: Hijacka iu Silenta,

na poczatku zrobilem wszystko pomijając wersy czerwone...
teraz zrobiłem all
i przy starcie systemu monitor rejestru arcavir znowu informuje o wpisie do rejestru 'sysser' :–/

Ja tez nie znam.

Usuwasz pliki wymienione na stronie, czyli:
server.dll
syshid.exe
system.vbs
logX.txt
Jesli otrzymasz komunikat o tym ze usuniecie jest niemozliwe, bo cos_tam, cos_tam, wylacz odpowiednie procesy w Task manadzerze (CTRL+ALT+DEL). Jesli dalej nie bedzie to mozliwe, usuwaj w trybie awaryjnym, lub za pomoca programiku killbox.

Z rejestru usuwasz:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

sysser


HKCR\exefile\shell\open\command
(default)

syshid.exe "%1" %*"

HKCR\CLSID\{3040DD03–9C5A–4563–AC2E–0026188C25A9}\
(default)
"Colib for lazy guys"

HKCR\CLSID\{3040DD03–9C5A–4563–AC2E–0026188C25A9}\InprocServer32\
(default)
"\server.dll"

HKCR\CLSID\{3040DD03–9C5A–4563–AC2E–0026188C25A9}\ProgID\
(default)
"ComDll.1"

HKLM\SOFTWARE\RAdmin\v1.1\Server\Parameters\

HKLM\SYSTEM\RAdmin\v2.0\Server\Parameters\

Zastosuj pozniej fixa do plikow .exe – znajdziesz go w przyklejonym temacie w dziale XP.

no mam na kompie dokladnie te pliki ktore tam są wymienione...
ale nie wiem jak usunąc tego trojana, nie znam angielskiego az tak dobrze:/

cristians:

w autostarcie robi sie plik:
VBScript Script file
o nazwie 'system' z taką zawartoscią:

Set mack = CreateObject("ComDll.1")
mack.RuunResource(0)

Sprawdz czy to nie ten trojan –> http://www.sophos.com/virusinfo/analyses/trojrahackb.html
W zakladce Advanced miejsca i pliki.

tam jest tylko:
NoDriveTypeAutoRun o wartości: 91

Sprwadź jeszcze w rejestrze czy nie masz w kluczu HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer wartości NoSaveSettings
jeśli będzie to ją usuń