alert o wirusach

[sxe]

witam , jestem peirwszy raz , choc troche juz prezczytalem , mam problem , bo wraca jak bumerang w tray'u windows security alert i nie bardzo daje rade z innego teamtu posciogalem programy i od razu wrzuce logi z hijac oraz combo fux , bardzo prosze o pomoc ,, jak sie da , to prosze o tlumaczenie krok po kroku , z gory dzieki wszystkim za pomoc

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:12, on 2007-12-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\spoolsv.exe
C:\windows\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\windows\Explorer.EXE
C:\Program Files\Konnekt\konnekt.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O21 - SSODL: bvtqfvx - {E94F49D0-8EDF-4CBB-9F69-7ADD2769AE2E} - C:\windows\bvtqfvx.dll
O21 - SSODL: alxvdvm - {84547CC0-8964-4462-9A91-4FDD366F97E0} - C:\windows\alxvdvm.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\windows\system32\pr2ah4nc.exe

--
End of file - 1477 bytes










ComboFix 07-12-21.4 - sxe 2007-12-26 0:18:28.5 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.717 [GMT 1:00]
Running from: C:\Documents and Settings\sxe\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-25 to 2007-12-25 )))))))))))))))))))))))))))))))
.

2007-12-25 19:34 . 2007-12-25 19:34 <DIR> d-------- C:\Documents and Settings\sxe\Dane aplikacji\ZoomBrowser EX
2007-12-25 19:28 . 2007-12-25 19:28 <DIR> d-------- C:\Documents and Settings\sxe\Dane aplikacji\CANON INC
2007-12-25 19:28 . 2007-12-25 19:28 <DIR> d-------- C:\Documents and Settings\sxe\Dane aplikacji\CameraWindowDC
2007-12-25 19:28 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-12-25 19:28 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-12-25 19:28 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-12-25 19:17 . 2007-12-25 19:17 <DIR> d-------- C:\Program Files\Canon
2007-12-25 19:17 . 2007-12-25 19:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ZoomBrowser
2007-12-25 19:15 . 2007-12-25 19:15 <DIR> d-------- C:\Program Files\Common Files\Canon
2007-12-25 10:19 . 2004-08-04 00:44 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-12-25 10:19 . 2004-08-04 00:38 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2007-12-25 10:19 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-12-25 10:19 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-12-25 10:18 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-12-23 15:44 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-12-23 15:44 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-12-23 15:44 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2007-12-23 15:44 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-12-23 15:44 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-12-23 15:44 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-12-23 15:44 . 2007-12-23 15:45 1,092 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-23 15:31 . 2007-12-23 15:31 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-23 09:46 . 2007-12-23 09:46 1 --a------ C:\WINDOWS\system32\rc.dat
2007-12-23 09:46 . 2007-12-23 09:46 1 --a------ C:\WINDOWS\system32\ps1.dat
2007-12-23 09:46 . 2007-12-23 09:46 1 --a------ C:\WINDOWS\system32\cs.dat
2007-12-23 09:44 . 2007-12-23 09:44 53,248 --a------ C:\WINDOWS\system32\tardm2.dll
2007-12-23 09:44 . 2007-12-23 09:44 53,248 --a------ C:\WINDOWS\system32\tardeme2.dll
2007-12-23 00:37 . 2007-12-22 18:56 217,088 --a------ C:\WINDOWS\alxvdvm.dll
2007-12-23 00:37 . 2007-12-22 18:56 208,896 --a------ C:\WINDOWS\bvtqfvx.dll
2007-12-23 00:37 . 2007-12-22 18:57 167,936 --a------ C:\WINDOWS\emlkdvo.dll
2007-12-23 00:37 . 2007-12-22 18:57 77,824 --a------ C:\WINDOWS\fvkwdrt.exe
2007-12-23 00:24 . 2007-12-23 00:24 24,576 --a------ C:\WINDOWS\WindowsUpdates.exe
2007-12-11 21:45 . 2007-12-25 15:38 128 --a------ C:\WINDOWS\ChssBase.ini
2007-12-11 21:44 . 2007-12-11 21:44 <DIR> d-------- C:\Documents and Settings\sxe\Dane aplikacji\ChessBase
2007-12-11 21:43 . 2007-12-11 21:44 <DIR> d-------- C:\Program Files\Common Files\ChessBase

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-18 20:20 22,328 ----a-w C:\windows\system32\drivers\PnkBstrK.sys
2007-11-18 20:20 103,736 ----a-w C:\windows\system32\PnkBstrB.exe
2007-11-18 13:38 66,872 ----a-w C:\windows\system32\PnkBstrA.exe
2007-11-18 07:42 22,328 ----a-w C:\Documents and Settings\sxe\Dane aplikacji\PnkBstrK.sys
2007-11-04 19:26 21 ---ha-w C:\qpmd8378.bin
2007-11-04 19:25 49,152 ----a-w C:\windows\system32\cfperfmon_mx.dll
2007-11-04 19:12 --------- d-----w C:\Program Files\Common Files\Macromedia
2007-10-28 14:46 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-10-27 21:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-10-14 20:06 77,824 ----a-w C:\windows\system32\qttask.exe
.

((((((((((((((((((((((((((((( snapshot_2007-12-25_19.24.22,53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-25 18:47:48 26,624 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\3bc21a2cc9b6434c9f6604935ffce671\Accessibility.ni.dll
+ 2007-12-25 18:47:50 860,160 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\7acd21e77b731241bde5331bdfc6968f\AspNetMMCExt.ni.dll
+ 2007-12-25 18:47:50 237,568 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\3dc68b316761a6468190dec469f55a63\CustomMarshalers.ni.dll
+ 2007-12-25 18:47:50 15,360 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\a41816809705fd4e98572a7dba729aee\dfsvc.ni.exe
+ 2007-12-25 18:47:52 880,640 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\fb7dbb3c981b774284e25e874f411a3b\Microsoft.Build.Engine.ni.dll
+ 2007-12-25 18:47:54 81,920 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\eb6d9fc274cb5f48aceef575122d52ae\Microsoft.Build.Framework.ni.dll
+ 2007-12-25 18:47:58 1,691,648 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\1ef6570c40b915478a77b38c77b410c2\Microsoft.Build.Tasks.ni.dll
+ 2007-12-25 18:47:58 163,840 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\92c181c69ec6ff48b71080755f33a38a\Microsoft.Build.Utilities.ni.dll
+ 2007-12-25 18:48:02 1,724,416 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\c4973d72fd3177479a0122606100bc78\Microsoft.VisualBasic.ni.dll
+ 2007-12-25 18:48:04 962,560 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\a32a33ff69e1464dac36abee0f6fc4ab\System.Configuration.ni.dll
+ 2007-12-25 18:48:06 1,712,128 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\b8afe993db34ec42a20bcf80fd0a7d6c\System.Deployment.ni.dll
+ 2007-12-25 18:24:30 10,723,328 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\5d0d4bececd6054988886e5067ee0f2b\System.Design.ni.dll
+ 2007-12-25 18:48:10 512,000 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\bf3f8431650fd14ca6f4c71c0d8d6326\System.DirectoryServices.Protocols.ni.dll
+ 2007-12-25 18:48:08 1,220,608 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c9e8f22e4feabf43bd50710e2d275377\System.DirectoryServices.ni.dll
+ 2007-12-25 18:48:12 659,456 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\4ebd88af96f5d646b3ba125e43f51e3b\System.EnterpriseServices.ni.dll
+ 2007-12-25 18:48:12 294,912 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\4ebd88af96f5d646b3ba125e43f51e3b\System.EnterpriseServices.Wrapper.dll
+ 2007-12-25 18:48:14 729,088 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\68190ac5cb017b47a749b536890254c4\System.Security.ni.dll
+ 2007-12-25 18:48:14 684,032 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\10554ebafc3fbc4db7735d645cdce1c4\System.Transactions.ni.dll
+ 2007-12-25 18:48:54 2,310,144 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\06c159b5a96bf74b990568ad1f8feffc\System.Web.Mobile.ni.dll
+ 2007-12-25 18:48:54 237,568 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\76c5dba77052744fb26177a5aa20911e\System.Web.RegularExpressions.ni.dll
+ 2007-12-25 18:48:58 1,945,600 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\d308ad1993d45447829dcb70bd97c26c\System.Web.Services.ni.dll
+ 2007-12-25 18:48:46 11,808,768 ----a-w C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\cd144feba611914f93baf14b7d5e8022\System.Web.ni.dll
- 2007-12-25 18:20:22 52,608 ----a-w C:\windows\system32\perfc009.dat
+ 2007-12-25 18:24:44 59,100 ----a-w C:\windows\system32\perfc009.dat
- 2007-12-25 18:20:22 66,002 ----a-w C:\windows\system32\perfc015.dat
+ 2007-12-25 18:24:44 74,494 ----a-w C:\windows\system32\perfc015.dat
- 2007-12-25 18:20:22 341,896 ----a-w C:\windows\system32\perfh009.dat
+ 2007-12-25 18:24:44 394,900 ----a-w C:\windows\system32\perfh009.dat
- 2007-12-25 18:20:22 388,120 ----a-w C:\windows\system32\perfh015.dat
+ 2007-12-25 18:24:44 450,528 ----a-w C:\windows\system32\perfh015.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bvtqfvx"= {E94F49D0-8EDF-4CBB-9F69-7ADD2769AE2E} - C:\windows\bvtqfvx.dll [2007-12-22 18:56 208896]
"alxvdvm"= {84547CC0-8964-4462-9A91-4FDD366F97E0} - C:\windows\alxvdvm.dll [2007-12-22 18:56 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-04 00:44 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Delete less]
C:\DOCUME~1\sxe\DANEAP~1\USERLO~1\Soft Else Way.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dupe vga cdrom htm]
C:\Documents and Settings\All Users\Dane aplikacji\DUMB ARMY DUPE VGA\JugsOnline.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt]
C:\Program Files\Konnekt\konnekt.exe /autostart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\windows\system32\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Secure]
2007-12-23 00:24 24576 --a------ C:\windows\WindowsUpdates.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-10-18 11:42 32881 --a------ C:\Program Files\Java\j2re1.4.2_13\bin\jusched.exe

R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\windows\system32\drivers\ps6ah4nc.sys [2007-05-18 21:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\windows\system32\pr2ah4nc.exe svc []
S4 ColdFusion MX 7 Application Server;ColdFusion MX 7 Application Server;"D:\instalki\macro\runtime\bin\jrunsvc.exe" [2005-01-24 18:59]
S4 ColdFusion MX 7 Search Server;ColdFusion MX 7 Search Server;"D:\instalki\macro\verity\k2\_nti40\bin\k2admin.exe" -cfg "D:\instalki\macro\verity\k2\common\verity.cfg" -ntstart 1 []

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 00:19:31
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\windows\explorer.exe [6.00.2900.2180]
-> C:\windows\bvtqfvx.dll
.
Completion time: 2007-12-26 0:19:56
C:\ComboFix2.txt ... 2007-12-25 19:24
C:\ComboFix3.txt ... 2007-12-25 14:35

[kepa416]

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html



i nie combo fux tylko fix

[wojtas]

umiesc logi w tagach wg. opisu:

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

[sxe]

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01, on 2007-12-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\Program Files\Konnekt\konnekt.exe
C:\windows\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Winamp\winamp.exe
C:\windows\system32\cmd.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\windows\system32\cmd.exe
C:\windows\system32\cmd.exe
C:\ComboFix\vfind.cfexe
C:\ComboFix\vfind.cfexe
C:\windows\system32\cmd.exe

O21 - SSODL: bvtqfvx - {E94F49D0-8EDF-4CBB-9F69-7ADD2769AE2E} - C:\windows\bvtqfvx.dll
O21 - SSODL: alxvdvm - {84547CC0-8964-4462-9A91-4FDD366F97E0} - C:\windows\alxvdvm.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\windows\system32\pr2ah4nc.exe

--
End of file - 1643 bytes











combo

ComboFix 07-12-21.4 - sxe 2007-12-26 11:01:34.6 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.694 [GMT 1:00]
Running from: C:\Documents and Settings\sxe\Pulpit\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2007-11-26 to 2007-12-26  )))))))))))))))))))))))))))))))
.

2007-12-25 19:34 . 2007-12-25 19:34   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\ZoomBrowser EX
2007-12-25 19:28 . 2007-12-25 19:28   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\CANON INC
2007-12-25 19:28 . 2007-12-25 19:28   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\CameraWindowDC
2007-12-25 19:28 . 2004-08-04 00:44   159,232   --a------   C:\WINDOWS\system32\ptpusd.dll
2007-12-25 19:28 . 2004-08-03 22:58   15,104   --a------   C:\WINDOWS\system32\drivers\usbscan.sys
2007-12-25 19:28 . 2001-10-26 17:29   5,632   --a------   C:\WINDOWS\system32\ptpusb.dll
2007-12-25 19:17 . 2007-12-25 19:17   <DIR>   d--------   C:\Program Files\Canon
2007-12-25 19:17 . 2007-12-25 19:17   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\ZoomBrowser
2007-12-25 19:15 . 2007-12-25 19:15   <DIR>   d--------   C:\Program Files\Common Files\Canon
2007-12-25 10:19 . 2004-08-04 00:44   21,504   --a------   C:\WINDOWS\system32\hidserv.dll
2007-12-25 10:19 . 2004-08-04 00:38   14,848   --a------   C:\WINDOWS\system32\drivers\kbdhid.sys
2007-12-25 10:19 . 2001-10-26 16:57   12,160   --a------   C:\WINDOWS\system32\drivers\mouhid.sys
2007-12-25 10:19 . 2001-08-17 22:02   9,600   --a------   C:\WINDOWS\system32\drivers\hidusb.sys
2007-12-25 10:18 . 2004-08-03 23:08   31,616   --a------   C:\WINDOWS\system32\drivers\usbccgp.sys
2007-12-23 15:44 . 2007-09-05 23:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2007-12-23 15:44 . 2006-04-27 16:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-12-23 15:44 . 2007-12-20 23:11   81,920   --a------   C:\WINDOWS\system32\IEDFix.exe
2007-12-23 15:44 . 2003-06-05 20:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-12-23 15:44 . 2004-07-31 17:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-12-23 15:44 . 2007-10-03 23:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2007-12-23 15:44 . 2007-12-23 15:45   1,092   --a------   C:\WINDOWS\system32\tmp.reg
2007-12-23 15:31 . 2007-12-23 15:31   <DIR>   d--------   C:\Program Files\Trend Micro
2007-12-23 09:46 . 2007-12-23 09:46   1   --a------   C:\WINDOWS\system32\rc.dat
2007-12-23 09:46 . 2007-12-23 09:46   1   --a------   C:\WINDOWS\system32\ps1.dat
2007-12-23 09:46 . 2007-12-23 09:46   1   --a------   C:\WINDOWS\system32\cs.dat
2007-12-23 09:44 . 2007-12-23 09:44   53,248   --a------   C:\WINDOWS\system32\tardm2.dll
2007-12-23 09:44 . 2007-12-23 09:44   53,248   --a------   C:\WINDOWS\system32\tardeme2.dll
2007-12-23 00:37 . 2007-12-22 18:56   217,088   --a------   C:\WINDOWS\alxvdvm.dll
2007-12-23 00:37 . 2007-12-22 18:56   208,896   --a------   C:\WINDOWS\bvtqfvx.dll
2007-12-23 00:37 . 2007-12-22 18:57   167,936   --a------   C:\WINDOWS\emlkdvo.dll
2007-12-23 00:37 . 2007-12-22 18:57   77,824   --a------   C:\WINDOWS\fvkwdrt.exe
2007-12-23 00:24 . 2007-12-23 00:24   24,576   --a------   C:\WINDOWS\WindowsUpdates.exe
2007-12-11 21:45 . 2007-12-25 15:38   128   --a------   C:\WINDOWS\ChssBase.ini
2007-12-11 21:44 . 2007-12-11 21:44   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\ChessBase
2007-12-11 21:43 . 2007-12-11 21:44   <DIR>   d--------   C:\Program Files\Common Files\ChessBase

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-18 20:20   22,328   ----a-w   C:\windows\system32\drivers\PnkBstrK.sys
2007-11-18 20:20   103,736   ----a-w   C:\windows\system32\PnkBstrB.exe
2007-11-18 13:38   66,872   ----a-w   C:\windows\system32\PnkBstrA.exe
2007-11-18 07:42   22,328   ----a-w   C:\Documents and Settings\sxe\Dane aplikacji\PnkBstrK.sys
2007-11-04 19:26   21   ---ha-w   C:\qpmd8378.bin
2007-11-04 19:25   49,152   ----a-w   C:\windows\system32\cfperfmon_mx.dll
2007-11-04 19:12   ---------   d-----w   C:\Program Files\Common Files\Macromedia
2007-10-28 14:46   ---------   d-----w   C:\Program Files\K-Lite Codec Pack
2007-10-27 21:42   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-10-14 20:06   77,824   ----a-w   C:\windows\system32\qttask.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bvtqfvx"= {E94F49D0-8EDF-4CBB-9F69-7ADD2769AE2E} - C:\windows\bvtqfvx.dll [2007-12-22 18:56 208896]
"alxvdvm"= {84547CC0-8964-4462-9A91-4FDD366F97E0} - C:\windows\alxvdvm.dll [2007-12-22 18:56 217088]
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
         atiptaxx.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-04 00:44   15360   --a------   C:\WINDOWS\system32\ctfmon.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Delete less]
         C:\DOCUME~1\sxe\DANEAP~1\USERLO~1\Soft Else Way.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dupe vga cdrom htm]
         C:\Documents and Settings\All Users\Dane aplikacji\DUMB ARMY DUPE VGA\JugsOnline.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt]
         C:\Program Files\Konnekt\konnekt.exe /autostart
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50   155648   --a------   C:\WINDOWS\system32\NeroCheck.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
         C:\windows\system32\qttask.exe -atboottime
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Secure]
2007-12-23 00:24   24576   --a------   C:\windows\WindowsUpdates.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-10-18 11:42   32881   --a------   C:\Program Files\Java\j2re1.4.2_13\bin\jusched.exe

R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\windows\system32\drivers\ps6ah4nc.sys [2007-05-18 21:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\windows\system32\pr2ah4nc.exe svc []
S4 ColdFusion MX 7 Application Server;ColdFusion MX 7 Application Server;"D:\instalki\macro\runtime\bin\jrunsvc.exe" [2005-01-24 18:59]
S4 ColdFusion MX 7 Search Server;ColdFusion MX 7 Search Server;"D:\instalki\macro\verity\k2\_nti40\bin\k2admin.exe" -cfg "D:\instalki\macro\verity\k2\common\verity.cfg" -ntstart 1 []

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 11:02:45
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\windows\explorer.exe [6.00.2900.2180]
-> C:\windows\bvtqfvx.dll
.
Completion time: 2007-12-26 11:03:10


[wojtas]

Wykonaj to co jest podane w tym temacie


zastosuj:

smitfraudfix z opcji 2

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[sxe]

mam problem z wejsciem w tryb awaryjny , nie dziala f8 , ani f5 i f4 i nie ma tez po msconfig zakladki z boot , wiec smit... jest robiony w normalnym trybie oto logi

Kod: Zaznacz wszystko

SmitFraudFix v2.274

Scan done at 12:31:10,10, 2007-12-26
Run from C:\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Karta Realtek RTL8139 Family PCI Fast Ethernet NIC #2 - Sterownik miniport Harmonogramu pakietów
DNS Server Search Order: 195.82.184.6
DNS Server Search Order: 83.142.12.3

Description: Karta Realtek RTL8139 Family PCI Fast Ethernet NIC #2 - Sterownik miniport Harmonogramu pakietów
DNS Server Search Order: 195.82.184.6
DNS Server Search Order: 83.142.12.3

HKLM\SYSTEM\CCS\Services\Tcpip\..\{44E3CE03-67B6-4CF7-AFE1-3877571B93D8}: DhcpNameServer=195.82.184.6 83.142.12.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{82440739-4E05-4332-AC38-961A2B3CC76E}: DhcpNameServer=85.255.115.42,85.255.112.170
HKLM\SYSTEM\CCS\Services\Tcpip\..\{D53C39CD-C246-46E9-90F6-69B662219C8D}: DhcpNameServer=195.82.184.6 83.142.12.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{44E3CE03-67B6-4CF7-AFE1-3877571B93D8}: DhcpNameServer=195.82.184.6 83.142.12.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{82440739-4E05-4332-AC38-961A2B3CC76E}: DhcpNameServer=85.255.115.42,85.255.112.170
HKLM\SYSTEM\CS1\Services\Tcpip\..\{D53C39CD-C246-46E9-90F6-69B662219C8D}: DhcpNameServer=195.82.184.6 83.142.12.3
HKLM\SYSTEM\CS2\Services\Tcpip\..\{44E3CE03-67B6-4CF7-AFE1-3877571B93D8}: DhcpNameServer=195.82.184.6 83.142.12.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{44E3CE03-67B6-4CF7-AFE1-3877571B93D8}: DhcpNameServer=195.82.184.6 83.142.12.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{82440739-4E05-4332-AC38-961A2B3CC76E}: DhcpNameServer=85.255.115.42,85.255.112.170
HKLM\SYSTEM\CS3\Services\Tcpip\..\{D53C39CD-C246-46E9-90F6-69B662219C8D}: DhcpNameServer=195.82.184.6 83.142.12.3
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=195.82.184.6 83.142.12.3
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=195.82.184.6 83.142.12.3
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=195.82.184.6 83.142.12.3
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=195.82.184.6 83.142.12.3


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End


ComboFix 07-12-21.4 - sxe 2007-12-26 17:55:31.7 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.764 [GMT 1:00]
Running from: C:\Documents and Settings\sxe\Pulpit\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\sxe\Pulpit\Error Cleaner.url
C:\Documents and Settings\sxe\Pulpit\Privacy Protector.url
C:\Documents and Settings\sxe\Pulpit\Spyware&Malware Protection.url
C:\Documents and Settings\sxe\Ulubione\Error Cleaner.url
C:\Documents and Settings\sxe\Ulubione\Privacy Protector.url
C:\Documents and Settings\sxe\Ulubione\Spyware&Malware Protection.url

.
(((((((((((((((((((((((((   Files Created from 2007-11-26 to 2007-12-26  )))))))))))))))))))))))))))))))
.

2007-12-26 12:02 . 2007-12-13 23:35   <DIR>   d--------   C:\SmitfraudFix
2007-12-25 19:34 . 2007-12-25 19:34   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\ZoomBrowser EX
2007-12-25 19:28 . 2007-12-25 19:28   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\CANON INC
2007-12-25 19:28 . 2007-12-25 19:28   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\CameraWindowDC
2007-12-25 19:28 . 2004-08-04 00:44   159,232   --a------   C:\WINDOWS\system32\ptpusd.dll
2007-12-25 19:28 . 2004-08-03 22:58   15,104   --a------   C:\WINDOWS\system32\drivers\usbscan.sys
2007-12-25 19:28 . 2001-10-26 17:29   5,632   --a------   C:\WINDOWS\system32\ptpusb.dll
2007-12-25 19:17 . 2007-12-25 19:17   <DIR>   d--------   C:\Program Files\Canon
2007-12-25 19:17 . 2007-12-25 19:17   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\ZoomBrowser
2007-12-25 19:15 . 2007-12-25 19:15   <DIR>   d--------   C:\Program Files\Common Files\Canon
2007-12-25 10:19 . 2004-08-04 00:44   21,504   --a------   C:\WINDOWS\system32\hidserv.dll
2007-12-25 10:19 . 2004-08-04 00:38   14,848   --a------   C:\WINDOWS\system32\drivers\kbdhid.sys
2007-12-25 10:19 . 2001-10-26 16:57   12,160   --a------   C:\WINDOWS\system32\drivers\mouhid.sys
2007-12-25 10:19 . 2001-08-17 22:02   9,600   --a------   C:\WINDOWS\system32\drivers\hidusb.sys
2007-12-25 10:18 . 2004-08-03 23:08   31,616   --a------   C:\WINDOWS\system32\drivers\usbccgp.sys
2007-12-23 15:44 . 2007-12-26 12:31   1,242   --a------   C:\WINDOWS\system32\tmp.reg
2007-12-23 15:31 . 2007-12-23 15:31   <DIR>   d--------   C:\Program Files\Trend Micro
2007-12-23 09:46 . 2007-12-23 09:46   1   --a------   C:\WINDOWS\system32\rc.dat
2007-12-23 09:46 . 2007-12-23 09:46   1   --a------   C:\WINDOWS\system32\ps1.dat
2007-12-23 09:46 . 2007-12-23 09:46   1   --a------   C:\WINDOWS\system32\cs.dat
2007-12-23 09:44 . 2007-12-23 09:44   53,248   --a------   C:\WINDOWS\system32\tardm2.dll
2007-12-23 09:44 . 2007-12-23 09:44   53,248   --a------   C:\WINDOWS\system32\tardeme2.dll
2007-12-23 00:37 . 2007-12-22 18:56   217,088   --a------   C:\WINDOWS\alxvdvm.dll
2007-12-23 00:37 . 2007-12-22 18:56   208,896   --a------   C:\WINDOWS\bvtqfvx.dll
2007-12-23 00:37 . 2007-12-22 18:57   167,936   --a------   C:\WINDOWS\emlkdvo.dll
2007-12-23 00:37 . 2007-12-22 18:57   77,824   --a------   C:\WINDOWS\fvkwdrt.exe
2007-12-23 00:24 . 2007-12-23 00:24   24,576   --a------   C:\WINDOWS\WindowsUpdates.exe
2007-12-11 21:45 . 2007-12-25 15:38   128   --a------   C:\WINDOWS\ChssBase.ini
2007-12-11 21:44 . 2007-12-11 21:44   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\ChessBase
2007-12-11 21:43 . 2007-12-11 21:44   <DIR>   d--------   C:\Program Files\Common Files\ChessBase

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-18 20:20   22,328   ----a-w   C:\windows\system32\drivers\PnkBstrK.sys
2007-11-18 20:20   103,736   ----a-w   C:\windows\system32\PnkBstrB.exe
2007-11-18 13:38   66,872   ----a-w   C:\windows\system32\PnkBstrA.exe
2007-11-18 07:42   22,328   ----a-w   C:\Documents and Settings\sxe\Dane aplikacji\PnkBstrK.sys
2007-11-04 19:26   21   ---ha-w   C:\qpmd8378.bin
2007-11-04 19:25   49,152   ----a-w   C:\windows\system32\cfperfmon_mx.dll
2007-11-04 19:12   ---------   d-----w   C:\Program Files\Common Files\Macromedia
2007-10-28 14:46   ---------   d-----w   C:\Program Files\K-Lite Codec Pack
2007-10-27 21:42   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-10-14 20:06   77,824   ----a-w   C:\windows\system32\qttask.exe
.

(((((((((((((((((((((((((((((   snapshot_2007-12-26_ 0.19.34.56   )))))))))))))))))))))))))))))))))))))))))
.
- 2006-01-09 08:36:06   40,960   ----a-w   C:\windows\system32\swsc.exe
+ 2007-12-04 00:00:44   136,704   ----a-w   C:\windows\system32\swsc.exe
- 2006-12-01 04:20:34   79,360   ----a-w   C:\windows\system32\swxcacls.exe
+ 2006-12-01 04:20:32   212,480   ----a-w   C:\windows\system32\swxcacls.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:44]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bvtqfvx"= {E94F49D0-8EDF-4CBB-9F69-7ADD2769AE2E} - C:\windows\bvtqfvx.dll [2007-12-22 18:56 208896]
"alxvdvm"= {84547CC0-8964-4462-9A91-4FDD366F97E0} - C:\windows\alxvdvm.dll [2007-12-22 18:56 217088]
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
         atiptaxx.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-04 00:44   15360   --a------   C:\WINDOWS\system32\ctfmon.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Delete less]
         C:\DOCUME~1\sxe\DANEAP~1\USERLO~1\Soft Else Way.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dupe vga cdrom htm]
         C:\Documents and Settings\All Users\Dane aplikacji\DUMB ARMY DUPE VGA\JugsOnline.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt]
         C:\Program Files\Konnekt\konnekt.exe /autostart
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50   155648   --a------   C:\WINDOWS\system32\NeroCheck.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
         C:\windows\system32\qttask.exe -atboottime
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Secure]
2007-12-23 00:24   24576   --a------   C:\windows\WindowsUpdates.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-10-18 11:42   32881   --a------   C:\Program Files\Java\j2re1.4.2_13\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"xmlprov"=3 (0x3)
"WZCSVC"=2 (0x2)
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"WmiApSrv"=3 (0x3)
"Wmi"=3 (0x3)
"WmdmPmSN"=3 (0x3)
"winmgmt"=2 (0x2)
"WebClient"=2 (0x2)
"W32Time"=2 (0x2)
"VSS"=3 (0x3)
"UPS"=3 (0x3)
"upnphost"=3 (0x3)
"TrkWks"=2 (0x2)
"TlntSvr"=3 (0x3)
"Themes"=2 (0x2)
"TermService"=3 (0x3)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"SwPrv"=3 (0x3)
"stisvc"=2 (0x2)
"srservice"=2 (0x2)
"Spooler"=2 (0x2)
"ShellHWDetection"=2 (0x2)
"SharedAccess"=2 (0x2)
"SENS"=2 (0x2)
"seclogon"=2 (0x2)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"SamSs"=2 (0x2)
"RSVP"=3 (0x3)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"ProtectedStorage"=2 (0x2)
"pr2ah4nc"=2 (0x2)
"PolicyAgent"=3 (0x3)
"PlugPlay"=2 (0x2)
"ose"=3 (0x3)
"NtmsSvc"=3 (0x3)
"NtLmSsp"=3 (0x3)
"Nla"=3 (0x3)
"Netman"=3 (0x3)
"Netlogon"=3 (0x3)
"MSIServer"=3 (0x3)
"MSDTC"=3 (0x3)
"mnmsrvc"=3 (0x3)
"LmHosts"=2 (0x2)
"lanmanworkstation"=2 (0x2)
"lanmanserver"=2 (0x2)
"ImapiService"=3 (0x3)
"IDriverT"=3 (0x3)
"HTTPFilter"=3 (0x3)
"HidServ"=2 (0x2)
"helpsvc"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"EventSystem"=3 (0x3)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"Dnscache"=2 (0x2)
"dmserver"=2 (0x2)
"dmadmin"=3 (0x3)
"Dhcp"=2 (0x2)
"CryptSvc"=2 (0x2)
"COMSysApp"=3 (0x3)
"clr_optimization_v2.0.50727_32"=3 (0x3)
"cisvc"=3 (0x3)
"CCALib8"=2 (0x2)
"Browser"=2 (0x2)
"BITS"=2 (0x2)
"AudioSrv"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"aspnet_state"=3 (0x3)
"AppMgmt"=3 (0x3)
"ALG"=3 (0x3)

R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\windows\system32\drivers\ps6ah4nc.sys [2007-05-18 21:52]
S4 ColdFusion MX 7 Application Server;ColdFusion MX 7 Application Server;"D:\instalki\macro\runtime\bin\jrunsvc.exe" [2005-01-24 18:59]
S4 ColdFusion MX 7 Search Server;ColdFusion MX 7 Search Server;"D:\instalki\macro\verity\k2\_nti40\bin\k2admin.exe" -cfg "D:\instalki\macro\verity\k2\common\verity.cfg" -ntstart 1 []
S4 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\windows\system32\pr2ah4nc.exe svc []

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 17:56:57
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00"
.
Completion time: 2007-12-26 17:57:18
C:\ComboFix2.txt ... 2007-12-26 11:03





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:02:46, on 2007-12-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\spoolsv.exe
C:\windows\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Konnekt\konnekt.exe
C:\windows\explorer.exe
C:\windows\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O21 - SSODL: bvtqfvx - {E94F49D0-8EDF-4CBB-9F69-7ADD2769AE2E} - C:\windows\bvtqfvx.dll
O21 - SSODL: alxvdvm - {84547CC0-8964-4462-9A91-4FDD366F97E0} - C:\windows\alxvdvm.dll

--
End of file - 1220 bytes



[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\rc.dat
C:\WINDOWS\system32\ps1.dat
C:\WINDOWS\system32\cs.dat
C:\WINDOWS\system32\tardm2.dll
C:\WINDOWS\system32\tardeme2.dll
C:\WINDOWS\alxvdvm.dll
C:\WINDOWS\bvtqfvx.dll
C:\WINDOWS\emlkdvo.dll
C:\WINDOWS\fvkwdrt.exe
C:\WINDOWS\WindowsUpdates.exe
C:\qpmd8378.bin

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bvtqfvx"=-
"alxvdvm"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Delete less]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dupe vga cdrom htm]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Secure]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

[sxe]

poszlo bez restartu , bo combo nie restartowalo , wiec log bezposrednio po instrukcji z posta , z gory dzieki za pomoc

Kod: Zaznacz wszystko

ComboFix 07-12-21.4 - sxe 2007-12-26 23:26:12.8 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.722 [GMT 1:00]
Running from: C:\Documents and Settings\sxe\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\sxe\Pulpit\CFScript.txt
* Created a new restore point

FILE
C:\qpmd8378.bin
C:\WINDOWS\alxvdvm.dll
C:\WINDOWS\bvtqfvx.dll
C:\WINDOWS\emlkdvo.dll
C:\WINDOWS\fvkwdrt.exe
C:\WINDOWS\system32\cs.dat
C:\WINDOWS\system32\ps1.dat
C:\WINDOWS\system32\rc.dat
C:\WINDOWS\system32\tardeme2.dll
C:\WINDOWS\system32\tardm2.dll
C:\WINDOWS\WindowsUpdates.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\qpmd8378.bin
C:\WINDOWS\alxvdvm.dll
C:\WINDOWS\bvtqfvx.dll
C:\WINDOWS\emlkdvo.dll
C:\WINDOWS\fvkwdrt.exe
C:\WINDOWS\system32\cs.dat
C:\WINDOWS\system32\ps1.dat
C:\WINDOWS\system32\rc.dat
C:\WINDOWS\system32\tardeme2.dll
C:\WINDOWS\system32\tardm2.dll
C:\WINDOWS\WindowsUpdates.exe

.
(((((((((((((((((((((((((   Files Created from 2007-11-26 to 2007-12-26  )))))))))))))))))))))))))))))))
.

2007-12-26 12:02 . 2007-12-13 23:35   <DIR>   d--------   C:\SmitfraudFix
2007-12-25 19:34 . 2007-12-25 19:34   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\ZoomBrowser EX
2007-12-25 19:28 . 2007-12-25 19:28   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\CANON INC
2007-12-25 19:28 . 2007-12-25 19:28   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\CameraWindowDC
2007-12-25 19:28 . 2004-08-04 00:44   159,232   --a------   C:\WINDOWS\system32\ptpusd.dll
2007-12-25 19:28 . 2004-08-03 22:58   15,104   --a------   C:\WINDOWS\system32\drivers\usbscan.sys
2007-12-25 19:28 . 2001-10-26 17:29   5,632   --a------   C:\WINDOWS\system32\ptpusb.dll
2007-12-25 19:17 . 2007-12-25 19:17   <DIR>   d--------   C:\Program Files\Canon
2007-12-25 19:17 . 2007-12-25 19:17   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\ZoomBrowser
2007-12-25 19:15 . 2007-12-25 19:15   <DIR>   d--------   C:\Program Files\Common Files\Canon
2007-12-25 10:19 . 2004-08-04 00:44   21,504   --a------   C:\WINDOWS\system32\hidserv.dll
2007-12-25 10:19 . 2004-08-04 00:38   14,848   --a------   C:\WINDOWS\system32\drivers\kbdhid.sys
2007-12-25 10:19 . 2001-10-26 16:57   12,160   --a------   C:\WINDOWS\system32\drivers\mouhid.sys
2007-12-25 10:19 . 2001-08-17 22:02   9,600   --a------   C:\WINDOWS\system32\drivers\hidusb.sys
2007-12-25 10:18 . 2004-08-03 23:08   31,616   --a------   C:\WINDOWS\system32\drivers\usbccgp.sys
2007-12-23 15:44 . 2007-12-26 12:31   1,242   --a------   C:\WINDOWS\system32\tmp.reg
2007-12-23 15:31 . 2007-12-23 15:31   <DIR>   d--------   C:\Program Files\Trend Micro
2007-12-11 21:45 . 2007-12-25 15:38   128   --a------   C:\WINDOWS\ChssBase.ini
2007-12-11 21:44 . 2007-12-11 21:44   <DIR>   d--------   C:\Documents and Settings\sxe\Dane aplikacji\ChessBase
2007-12-11 21:43 . 2007-12-11 21:44   <DIR>   d--------   C:\Program Files\Common Files\ChessBase

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-18 20:20   22,328   ----a-w   C:\windows\system32\drivers\PnkBstrK.sys
2007-11-18 20:20   103,736   ----a-w   C:\windows\system32\PnkBstrB.exe
2007-11-18 13:38   66,872   ----a-w   C:\windows\system32\PnkBstrA.exe
2007-11-18 07:42   22,328   ----a-w   C:\Documents and Settings\sxe\Dane aplikacji\PnkBstrK.sys
2007-11-04 19:25   49,152   ----a-w   C:\windows\system32\cfperfmon_mx.dll
2007-11-04 19:12   ---------   d-----w   C:\Program Files\Common Files\Macromedia
2007-10-28 14:46   ---------   d-----w   C:\Program Files\K-Lite Codec Pack
2007-10-27 21:42   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-10-14 20:06   77,824   ----a-w   C:\windows\system32\qttask.exe
.

(((((((((((((((((((((((((((((   snapshot_2007-12-26_ 0.19.34.56   )))))))))))))))))))))))))))))))))))))))))
.
- 2006-01-09 08:36:06   40,960   ----a-w   C:\windows\system32\swsc.exe
+ 2007-12-04 00:00:44   136,704   ----a-w   C:\windows\system32\swsc.exe
- 2006-12-01 04:20:34   79,360   ----a-w   C:\windows\system32\swxcacls.exe
+ 2006-12-01 04:20:32   212,480   ----a-w   C:\windows\system32\swxcacls.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:44]
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
         atiptaxx.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-04 00:44   15360   --a------   C:\WINDOWS\system32\ctfmon.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt]
         C:\Program Files\Konnekt\konnekt.exe /autostart
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50   155648   --a------   C:\WINDOWS\system32\NeroCheck.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
         C:\windows\system32\qttask.exe -atboottime
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-10-18 11:42   32881   --a------   C:\Program Files\Java\j2re1.4.2_13\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"xmlprov"=3 (0x3)
"WZCSVC"=2 (0x2)
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"WmiApSrv"=3 (0x3)
"Wmi"=3 (0x3)
"WmdmPmSN"=3 (0x3)
"winmgmt"=2 (0x2)
"WebClient"=2 (0x2)
"W32Time"=2 (0x2)
"VSS"=3 (0x3)
"UPS"=3 (0x3)
"upnphost"=3 (0x3)
"TrkWks"=2 (0x2)
"TlntSvr"=3 (0x3)
"Themes"=2 (0x2)
"TermService"=3 (0x3)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"SwPrv"=3 (0x3)
"stisvc"=2 (0x2)
"srservice"=2 (0x2)
"Spooler"=2 (0x2)
"ShellHWDetection"=2 (0x2)
"SharedAccess"=2 (0x2)
"SENS"=2 (0x2)
"seclogon"=2 (0x2)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"SamSs"=2 (0x2)
"RSVP"=3 (0x3)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"ProtectedStorage"=2 (0x2)
"pr2ah4nc"=2 (0x2)
"PolicyAgent"=3 (0x3)
"PlugPlay"=2 (0x2)
"ose"=3 (0x3)
"NtmsSvc"=3 (0x3)
"NtLmSsp"=3 (0x3)
"Nla"=3 (0x3)
"Netman"=3 (0x3)
"Netlogon"=3 (0x3)
"MSIServer"=3 (0x3)
"MSDTC"=3 (0x3)
"mnmsrvc"=3 (0x3)
"LmHosts"=2 (0x2)
"lanmanworkstation"=2 (0x2)
"lanmanserver"=2 (0x2)
"ImapiService"=3 (0x3)
"IDriverT"=3 (0x3)
"HTTPFilter"=3 (0x3)
"HidServ"=2 (0x2)
"helpsvc"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"EventSystem"=3 (0x3)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"Dnscache"=2 (0x2)
"dmserver"=2 (0x2)
"dmadmin"=3 (0x3)
"Dhcp"=2 (0x2)
"CryptSvc"=2 (0x2)
"COMSysApp"=3 (0x3)
"clr_optimization_v2.0.50727_32"=3 (0x3)
"cisvc"=3 (0x3)
"CCALib8"=2 (0x2)
"Browser"=2 (0x2)
"BITS"=2 (0x2)
"AudioSrv"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"aspnet_state"=3 (0x3)
"AppMgmt"=3 (0x3)
"ALG"=3 (0x3)

R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\windows\system32\drivers\ps6ah4nc.sys [2007-05-18 21:52]
S4 ColdFusion MX 7 Application Server;ColdFusion MX 7 Application Server;"D:\instalki\macro\runtime\bin\jrunsvc.exe" [2005-01-24 18:59]
S4 ColdFusion MX 7 Search Server;ColdFusion MX 7 Search Server;"D:\instalki\macro\verity\k2\_nti40\bin\k2admin.exe" -cfg "D:\instalki\macro\verity\k2\common\verity.cfg" -ntstart 1 []
S4 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\windows\system32\pr2ah4nc.exe svc []

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 23:27:24
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00"
.
Completion time: 2007-12-26 23:27:45
C:\ComboFix3.txt ... 2007-12-26 11:03
C:\ComboFix2.txt ... 2007-12-26 17:57









Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:29:26, on 2007-12-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\spoolsv.exe
C:\windows\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Konnekt\konnekt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

--
End of file - 1011 byt

[wojtas]

czysto skasuj tylko"

Kod: Zaznacz wszystko

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2