Ckvo jak sie pozbyc

**Posty:** 174 · przez **tekladg** 15 Gru 2008, 21:03

Już wyczytałem ze to od pen'a czy mp3 wiec wyczyscilem
Jednak pozostał na dysku.
logi
Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:46:10, on 2008-12-15 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe -- End of file - 3755 bytes

combofix

Kod: Zaznacz wszystko: ComboFix 08-12-15.01 - Tekla 2008-12-15 19:47:39.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1023.602 [GMT 1:00] Uruchomiony z: c:\documents and settings\Tekla\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\h3.bat c:\windows\system32\ckvo0.dll D:\Autorun.inf D:\h3.bat E:\33gmhso.bat E:\6.bat E:\Autorun.inf E:\ffojc.com E:\fi.cmd E:\h3.bat E:\ivcvknr.bat F:\Autorun.inf F:\h3.bat . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-15 do 2008-12-15 ))))))))))))))))))))))))))))))) . 2008-12-15 19:45 . 2008-12-15 19:45 <DIR> d-------- c:\program files\Trend Micro 2008-12-15 19:08 . 2008-12-15 19:48 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2008-12-15 19:08 . 2008-12-02 19:19 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2008-12-15 19:08 . 2008-12-02 18:31 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2008-12-15 19:08 . 2008-12-02 19:19 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2008-12-15 19:08 . 2008-12-02 19:19 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2008-12-15 19:08 . 2008-12-02 19:19 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2008-12-15 19:08 . 2008-12-02 19:19 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2008-12-15 19:08 . 2008-12-15 19:08 <DIR> d-------- c:\documents and settings\Administrator 2008-12-14 00:11 . 2008-12-14 00:11 <DIR> d-------- c:\windows\Sun 2008-12-14 00:07 . 2008-12-14 00:07 <DIR> d-------- c:\program files\Yahoo! 2008-12-14 00:07 . 2008-12-14 00:07 <DIR> d-------- c:\program files\CCleaner 2008-12-13 23:59 . 2008-12-14 00:01 <DIR> d-------- c:\documents and settings\Tekla\Dane aplikacji\Winamp 2008-12-13 23:41 . 2008-12-13 23:42 <DIR> d-------- c:\program files\VDJ5 2008-12-13 23:41 . 2005-11-30 21:20 2,314,332 --a------ c:\windows\system32\LIBMMD.DLL 2008-12-13 23:41 . 2000-05-21 22:00 647,872 --a------ c:\windows\system32\mscomct2.ocx 2008-12-13 23:41 . 1998-06-23 22:00 609,584 --a------ c:\windows\system32\comctl32.ocx 2008-12-13 23:41 . 1999-05-28 08:13 301,568 --a------ c:\windows\system32\l3codecp.acm 2008-12-13 23:41 . 2001-03-13 11:49 120,320 --a------ c:\windows\system32\comdlg32.ocx 2008-12-13 23:41 . 2000-05-22 15:58 115,920 --a------ c:\windows\system32\msinet.ocx 2008-12-13 18:45 . 2008-12-15 07:57 108,326 -r-hs---- c:\windows\system32\vamsoft.exe 2008-12-13 18:45 . 2008-12-15 15:26 85,504 -r-hs---- c:\windows\system32\vbsdfe0.dll 2008-12-13 18:44 . 2008-04-14 00:15 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys 2008-12-13 18:42 . 2008-12-13 18:42 <DIR> d-------- c:\documents and settings\Tekla\Dane aplikacji\AdobeUM 2008-12-13 18:38 . 2008-12-13 18:38 <DIR> d-------- c:\program files\Intel Desktop Board 2008-12-10 18:58 . 2008-12-10 18:58 <DIR> d-------- c:\program files\Teamspeak2_RC2 2008-12-10 18:58 . 2008-12-10 19:02 <DIR> d-------- c:\documents and settings\Tekla\Dane aplikacji\teamspeak2 2008-12-10 18:58 . 2008-12-10 18:58 34,064 --a------ c:\windows\system32\lhacm.acm 2008-12-05 17:53 . 1997-04-07 18:19 391,680 --a------ c:\windows\system32\I263_32.drv 2008-12-05 17:51 . 2008-12-05 17:53 <DIR> d-------- c:\program files\K-Lite Codec Pack 2008-12-05 17:48 . 2008-12-05 17:48 <DIR> d-------- c:\program files\Google 2008-12-05 17:46 . 2008-12-05 17:50 <DIR> d-------- c:\program files\DivX 2008-12-02 20:33 . 2006-10-26 19:58 30,512 --a------ c:\windows\system32\mdimon.dll 2008-12-02 20:32 . 2008-12-02 20:32 <DIR> d-------- c:\program files\Microsoft Works 2008-12-02 20:31 . 2008-12-02 20:31 <DIR> d-------- c:\program files\Microsoft.NET 2008-12-02 20:28 . 2008-12-02 20:29 <DIR> d-------- c:\windows\SHELLNEW 2008-12-02 20:28 . 2008-12-02 20:28 <DIR> dr-h----- C:\MSOCache 2008-12-02 20:28 . 2008-12-02 20:34 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-12-02 20:20 . 2008-12-02 20:20 <DIR> d-------- c:\program files\D-Tools 2008-12-02 20:20 . 2004-08-22 16:31 155,136 --a------ c:\windows\system32\drivers\d347bus.sys 2008-12-02 20:20 . 2004-08-22 16:31 5,248 --a------ c:\windows\system32\drivers\d347prt.sys 2008-12-02 20:19 . 2008-12-02 20:19 <DIR> d-------- c:\windows\Downloaded Installations 2008-12-02 20:19 . 2008-12-02 20:19 <DIR> d-------- c:\documents and settings\Tekla\Dane aplikacji\Nero 2008-12-02 20:17 . 2008-12-02 20:18 <DIR> d-------- c:\program files\Nero 2008-12-02 20:17 . 2008-12-02 20:18 <DIR> d-------- c:\program files\Common Files\Nero 2008-12-02 20:17 . 2008-12-02 20:17 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-02 20:17 . 2006-03-17 11:45 1,757,184 --a------ c:\windows\system32\imagX7.dll 2008-12-02 20:17 . 2006-03-17 11:45 802,816 --a------ c:\windows\system32\imagXRA7.dll 2008-12-02 20:17 . 2006-03-17 11:45 497,296 --a------ c:\windows\system32\imagXpr7.dll 2008-12-02 20:17 . 2006-03-17 14:49 368,640 --a------ c:\windows\system32\TwnLib4.dll 2008-12-02 20:17 . 2006-03-17 11:45 258,048 --a------ c:\windows\system32\imagXR7.dll 2008-12-02 20:02 . 2008-12-02 20:02 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\DFX 2008-12-02 20:01 . 2008-12-02 20:02 <DIR> d-------- c:\program files\DFX 2008-12-02 20:01 . 2008-12-02 20:01 <DIR> d-------- c:\program files\Common Files\DFX . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-13 22:59 --------- d-----w c:\program files\Winamp 2008-12-05 16:47 --------- d-----w c:\program files\Real Alternative 2008-12-04 17:20 --------- d-----w c:\program files\SubEdit-Player 2008-12-02 18:33 --------- d-----w c:\program files\GSpot 2008-12-02 18:32 --------- d-----w c:\program files\Gadu-Gadu 2008-12-02 18:32 --------- d-----w c:\documents and settings\Tekla\Dane aplikacji\Gadu-Gadu 2008-12-02 18:31 410,976 ----a-w c:\windows\system32\deploytk.dll 2008-12-02 18:31 --------- d-----w c:\program files\Java 2008-12-02 18:29 --------- d-----w c:\program files\Common Files\Adobe 2008-12-02 18:28 --------- d-----w c:\program files\MarBit 2008-12-02 18:17 --------- d-----w c:\documents and settings\Tekla\Dane aplikacji\ATI 2008-12-02 18:14 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-02 18:14 --------- d-----w c:\program files\ATI Technologies 2008-12-02 18:04 --------- d-----w c:\program files\C-Media 3D Audio 2008-12-02 17:36 --------- d-----w c:\program files\microsoft frontpage 2008-12-02 17:34 --------- d-----w c:\program files\Usługi online 2008-09-16 00:14 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-16 00:12 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-16 00:11 683,520 ----a-w c:\windows\system32\divx.dll 2001-11-23 04:08 712,704 ----a-w c:\windows\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 171520] "ATIModeChange"="Ati2mdxx.exe" [2006-05-03 c:\windows\system32\Ati2mdxx.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv "msacm.fraunhoferacm"= l3codecp.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2008-04-14 22:51 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 17:05 81920 c:\program files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-12-02 19:31 136600 c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vamsoft] -r-hs---- 2008-12-15 07:57 108326 c:\windows\system32\vamsoft.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-01-15 23:54 37376 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange] --a------ 2006-05-03 17:45 26112 c:\windows\system32\Ati2mdxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wscsvc"=2 (0x2) "MDM"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 viasraid;viasraid;c:\windows\system32\DRIVERS\viasraid.sys [2008-12-02 75904] S3 SetupNTGLM7X;SetupNTGLM7X;\??\G:\NTGLM7X.sys [] *Newly Created Service* - PROCEXP90 . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-kamsoft - c:\windows\system32\ckvo.exe MSConfigStartUp-Cmaudio - cmicnfg.cpl . ------- Skan uzupełniający ------- . IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Tekla\Dane aplikacji\Mozilla\Firefox\Profiles\l6wwai6t.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query= FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-15 19:48:43 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(560) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2008-12-15 19:49:30 ComboFix-quarantined-files.txt 2008-12-15 18:49:09 Przed: 3 885 764 608 bajtów wolnych Po: 3,907,043,328 bajtów wolnych 182

jak sie tego pozbyc?

**Posty:** 8001 · przez **Okocza** 15 Gru 2008, 21:15

tekladg, zastosuj SDFix

specjalne-narzedzia-czyszczace-vt96631.html

wstaw z niego log a potem z combofixa

**Posty:** 174 · przez **tekladg** 15 Gru 2008, 21:42

SDFix

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Administrator on 2008-12-15 at 20:25 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-15 20:29:49 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40] "khjeh"=hex:20,02,00,00,e5,ba,71,36,d9,c4,4d,d7,5d,dc,6f,0b,61,b2,c1,6a,b1,.. "hj34z0"=hex:45,2a,1e,50,e2,80,79,7f,18,ee,d6,1e,21,21,6c,88,f7,8a,25,1b,81,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Mon 15 Dec 2008 108,326 ..SHR --- "C:\WINDOWS\system32\vamsoft.exe" Mon 15 Dec 2008 85,504 ..SHR --- "C:\WINDOWS\system32\vbsdfe0.dll" [b]Finished![/b]

combofix

Kod: Zaznacz wszystko: ComboFix 08-12-15.01 - Tekla 2008-12-15 20:32:52.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1023.680 [GMT 1:00] Uruchomiony z: c:\documents and settings\Tekla\Pulpit\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-15 do 2008-12-15 ))))))))))))))))))))))))))))))) . 2008-12-15 20:25 . 2008-12-15 20:25 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-12-15 20:23 . 2008-12-15 20:24 <DIR> d-------- c:\windows\ERUNT 2008-12-15 20:20 . 2008-12-15 20:31 <DIR> d-------- C:\SDFix 2008-12-15 20:05 . 2008-12-15 20:36 584,224 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-12-15 20:05 . 2008-12-15 20:36 139,296 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2008-12-15 20:05 . 2008-12-15 20:05 96,976 --a------ c:\windows\system32\drivers\klin.dat 2008-12-15 20:05 . 2008-12-15 20:05 87,855 --a------ c:\windows\system32\drivers\klick.dat 2008-12-15 20:05 . 2008-12-15 20:36 8,788 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-12-15 20:05 . 2008-12-15 20:36 1,556 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2008-12-15 20:04 . 2008-12-15 20:04 <DIR> d-------- c:\program files\Kaspersky Lab 2008-12-15 20:04 . 2008-12-15 20:38 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2008-12-15 20:03 . 2008-12-15 20:03 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-12-15 19:45 . 2008-12-15 19:45 <DIR> d-------- c:\program files\Trend Micro 2008-12-15 19:08 . 2008-12-15 20:35 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2008-12-15 19:08 . 2008-12-02 19:19 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2008-12-15 19:08 . 2008-12-02 18:31 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2008-12-15 19:08 . 2008-12-15 20:25 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2008-12-15 19:08 . 2008-12-02 19:19 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2008-12-15 19:08 . 2008-12-02 19:19 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2008-12-15 19:08 . 2008-12-02 19:19 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2008-12-15 19:08 . 2008-12-15 19:08 <DIR> d-------- c:\documents and settings\Administrator 2008-12-14 00:11 . 2008-12-14 00:11 <DIR> d-------- c:\windows\Sun 2008-12-14 00:07 . 2008-12-14 00:07 <DIR> d-------- c:\program files\Yahoo! 2008-12-14 00:07 . 2008-12-14 00:07 <DIR> d-------- c:\program files\CCleaner 2008-12-13 23:59 . 2008-12-14 00:01 <DIR> d-------- c:\documents and settings\Tekla\Dane aplikacji\Winamp 2008-12-13 23:41 . 2008-12-13 23:42 <DIR> d-------- c:\program files\VDJ5 2008-12-13 23:41 . 2005-11-30 21:20 2,314,332 --a------ c:\windows\system32\LIBMMD.DLL 2008-12-13 23:41 . 2000-05-21 22:00 647,872 --a------ c:\windows\system32\mscomct2.ocx 2008-12-13 23:41 . 1998-06-23 22:00 609,584 --a------ c:\windows\system32\comctl32.ocx 2008-12-13 23:41 . 1999-05-28 08:13 301,568 --a------ c:\windows\system32\l3codecp.acm 2008-12-13 23:41 . 2001-03-13 11:49 120,320 --a------ c:\windows\system32\comdlg32.ocx 2008-12-13 23:41 . 2000-05-22 15:58 115,920 --a------ c:\windows\system32\msinet.ocx 2008-12-13 18:45 . 2008-12-15 07:57 108,326 -r-hs---- c:\windows\system32\vamsoft.exe 2008-12-13 18:45 . 2008-12-15 20:36 85,504 -r-hs---- c:\windows\system32\vbsdfe0.dll 2008-12-13 18:44 . 2008-04-14 00:15 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys 2008-12-13 18:42 . 2008-12-13 18:42 <DIR> d-------- c:\documents and settings\Tekla\Dane aplikacji\AdobeUM 2008-12-13 18:38 . 2008-12-13 18:38 <DIR> d-------- c:\program files\Intel Desktop Board 2008-12-10 18:58 . 2008-12-10 18:58 <DIR> d-------- c:\program files\Teamspeak2_RC2 2008-12-10 18:58 . 2008-12-10 19:02 <DIR> d-------- c:\documents and settings\Tekla\Dane aplikacji\teamspeak2 2008-12-10 18:58 . 2008-12-10 18:58 34,064 --a------ c:\windows\system32\lhacm.acm 2008-12-05 17:53 . 1997-04-07 18:19 391,680 --a------ c:\windows\system32\I263_32.drv 2008-12-05 17:51 . 2008-12-05 17:53 <DIR> d-------- c:\program files\K-Lite Codec Pack 2008-12-05 17:48 . 2008-12-05 17:48 <DIR> d-------- c:\program files\Google 2008-12-05 17:46 . 2008-12-05 17:50 <DIR> d-------- c:\program files\DivX 2008-12-02 20:33 . 2006-10-26 19:58 30,512 --a------ c:\windows\system32\mdimon.dll 2008-12-02 20:32 . 2008-12-02 20:32 <DIR> d-------- c:\program files\Microsoft Works 2008-12-02 20:31 . 2008-12-02 20:31 <DIR> d-------- c:\program files\Microsoft.NET 2008-12-02 20:28 . 2008-12-02 20:29 <DIR> d-------- c:\windows\SHELLNEW 2008-12-02 20:28 . 2008-12-02 20:28 <DIR> dr-h----- C:\MSOCache 2008-12-02 20:28 . 2008-12-02 20:34 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-12-02 20:20 . 2008-12-02 20:20 <DIR> d-------- c:\program files\D-Tools 2008-12-02 20:20 . 2004-08-22 16:31 155,136 --a------ c:\windows\system32\drivers\d347bus.sys 2008-12-02 20:20 . 2004-08-22 16:31 5,248 --a------ c:\windows\system32\drivers\d347prt.sys 2008-12-02 20:19 . 2008-12-02 20:19 <DIR> d-------- c:\windows\Downloaded Installations 2008-12-02 20:19 . 2008-12-02 20:19 <DIR> d-------- c:\documents and settings\Tekla\Dane aplikacji\Nero 2008-12-02 20:17 . 2008-12-02 20:18 <DIR> d-------- c:\program files\Nero 2008-12-02 20:17 . 2008-12-02 20:18 <DIR> d-------- c:\program files\Common Files\Nero 2008-12-02 20:17 . 2008-12-02 20:17 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-02 20:17 . 2006-03-17 11:45 1,757,184 --a------ c:\windows\system32\imagX7.dll 2008-12-02 20:17 . 2006-03-17 11:45 802,816 --a------ c:\windows\system32\imagXRA7.dll 2008-12-02 20:17 . 2006-03-17 11:45 497,296 --a------ c:\windows\system32\imagXpr7.dll 2008-12-02 20:17 . 2006-03-17 14:49 368,640 --a------ c:\windows\system32\TwnLib4.dll 2008-12-02 20:17 . 2006-03-17 11:45 258,048 --a------ c:\windows\system32\imagXR7.dll 2008-12-02 20:02 . 2008-12-02 20:02 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\DFX 2008-12-02 20:01 . 2008-12-02 20:02 <DIR> d-------- c:\program files\DFX 2008-12-02 20:01 . 2008-12-02 20:01 <DIR> d-------- c:\program files\Common Files\DFX . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-13 22:59 --------- d-----w c:\program files\Winamp 2008-12-05 16:47 --------- d-----w c:\program files\Real Alternative 2008-12-04 17:20 --------- d-----w c:\program files\SubEdit-Player 2008-12-02 18:33 --------- d-----w c:\program files\GSpot 2008-12-02 18:32 --------- d-----w c:\program files\Gadu-Gadu 2008-12-02 18:32 --------- d-----w c:\documents and settings\Tekla\Dane aplikacji\Gadu-Gadu 2008-12-02 18:31 410,976 ----a-w c:\windows\system32\deploytk.dll 2008-12-02 18:31 --------- d-----w c:\program files\Java 2008-12-02 18:29 --------- d-----w c:\program files\Common Files\Adobe 2008-12-02 18:28 --------- d-----w c:\program files\MarBit 2008-12-02 18:17 --------- d-----w c:\documents and settings\Tekla\Dane aplikacji\ATI 2008-12-02 18:14 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-02 18:14 --------- d-----w c:\program files\ATI Technologies 2008-12-02 18:04 --------- d-----w c:\program files\C-Media 3D Audio 2008-12-02 17:36 --------- d-----w c:\program files\microsoft frontpage 2008-12-02 17:34 --------- d-----w c:\program files\Usługi online 2008-11-11 19:00 218,376 ----a-w c:\windows\system32\klogon.dll 2008-11-11 18:58 25,601 ----a-w c:\windows\system32\drivers\klopp.dat 2008-09-16 00:14 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-16 00:12 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-16 00:11 683,520 ----a-w c:\windows\system32\divx.dll 2001-11-23 04:08 712,704 ----a-w c:\windows\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((( snapshot@2008-12-15_19.48.52,54 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-12-15 19:24:06 524,288 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-15 19:24:06 8,192 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-12-15 19:24:00 524,288 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-15 19:24:00 8,192 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-07-21 16:34:36 121,872 ----a-w c:\windows\system32\drivers\kl1.sys + 2008-01-29 16:29:38 32,784 ----a-w c:\windows\system32\drivers\klbg.sys + 2008-12-15 19:04:28 227,344 ----a-w c:\windows\system32\drivers\klif.sys + 2008-04-30 16:06:48 24,592 ----a-w c:\windows\system32\drivers\klim5.sys + 2008-12-15 19:38:03 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_4c0.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-11-11 206088] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv "msacm.fraunhoferacm"= l3codecp.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2008-04-14 22:51 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 17:05 81920 c:\program files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-12-02 19:31 136600 c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vamsoft] -r-hs---- 2008-12-15 07:57 108326 c:\windows\system32\vamsoft.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-01-15 23:54 37376 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange] --a------ 2006-05-03 17:45 26112 c:\windows\system32\Ati2mdxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wscsvc"=2 (0x2) "MDM"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R0 viasraid;viasraid;c:\windows\system32\DRIVERS\viasraid.sys [2008-12-02 75904] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592] S3 SetupNTGLM7X;SetupNTGLM7X;\??\G:\NTGLM7X.sys [] . . ------- Skan uzupełniający ------- . IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Tekla\Dane aplikacji\Mozilla\Firefox\Profiles\l6wwai6t.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query= FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-15 20:37:55 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(844) c:\windows\system32\Ati2evxx.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-12-15 20:40:57 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-15 19:40:16 Przed: 3 679 363 072 bajtów wolnych Po: 3,637,137,408 bajtów wolnych 202

**Posty:** 18165 · przez **wojtas** 15 Gru 2008, 21:54

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\vamsoft.exe
C:\WINDOWS\system32\vbsdfe0.dll

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

Ckvo jak sie pozbyc

Ckvo jak sie pozbyc

Ckvo jak sie pozbyc

Re: ckvo jak sie pozbyc

Ckvo jak sie pozbyc

Kto jest na forum