Problem-niebieski ekran a potem... / log z hijack i combofix

[biigos]

witam, mojemu szefowi cos sie stalo z laptopem, gdy go wlacza pokazuje sie pulpit a za chwile wyskakuje niebieski ekran z ogromna iloscia hm tekstu, pokazuje sie zbyt szybko zebym mogl cokolwiek przeczytac, i komputer sie wylacza...jakims cude mwszedlem w niego zrobilem loga hijackiem...prosze o pomoc!!

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:27: VIRUS ALERT!, on 02.09.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: {4f29a4c2-3e36-792b-48f4-364ab39d2894} - {4982d93b-a463-4f84-b297-63e32c4a92f4} - C:\WINDOWS\system32\raborc.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: QXK Olive - {91FDC789-7732-4505-AB0F-88DCBC03F037} - C:\WINDOWS\rodqgpvlevn.dll (file missing)
O2 - BHO: (no name) - {AEC96647-C722-4332-94A2-B6F24C2E32B0} - C:\WINDOWS\system32\nnnkLeby.dll (file missing)
O2 - BHO: D - {FDDB29B3-A4F5-32D8-9D10-302705B1649C} - C:\WINDOWS\system32\mmx31403.dll (file missing)
O2 - BHO: (no name) - {FEEAD861-8455-42F3-8A7E-B7756084BB36} - C:\WINDOWS\system32\khfGwTkH.dll (file missing)
O3 - Toolbar: qalkfxor - {BD8713A4-DDDD-4A46-8363-6D1CF0D27364} - C:\WINDOWS\qalkfxor.dll
O3 - Toolbar: qalkfxor - {BEB6B37A-BC8B-46B6-B59D-BF83429C7FC7} - C:\WINDOWS\qalkfxor.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [2629165f] rundll32.exe "C:\WINDOWS\system32\elechulm.dll",b
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Run] "C:\Documents and Settings\XoXo\Application Data\Adobe\Manager.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1214935666117
O20 - AppInit_DLLs: pyjztm.dll raborc.dll
O20 - Winlogon Notify: khfGwTkH - khfGwTkH.dll (file missing)
O21 - SSODL: pdoskegl - {6C91520A-2E16-49A0-A7D3-9F28F5D03B45} - C:\WINDOWS\pdoskegl.dll (file missing)
O21 - SSODL: rqbmvpso - {26C4AE34-12F8-4494-AF4C-D2801E35D7D7} - C:\WINDOWS\rqbmvpso.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe

--
End of file - 8696 bytes

Kod: Zaznacz wszystko

ComboFix 08-09-01.01 - XoXo 2008-09-02  9:49:03.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.33.1036.18.878 [GMT 2:00]
Endroit: C:\Documents and Settings\XoXo\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active


[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\XoXo\Application Data\Adobe\crc.dat
C:\Documents and Settings\XoXo\Application Data\Adobe\Manager.exe
C:\Documents and Settings\XoXo\Cookies\xoxo@clicktorrent[1].txt
C:\WINDOWS\ebtg.exe
C:\WINDOWS\ekrb.exe
C:\WINDOWS\system32\cenzura!.dll
C:\WINDOWS\system32\geBRIXPi.dll
C:\WINDOWS\system32\hgGawWNf.dll
C:\WINDOWS\system32\mluhcele.ini
C:\WINDOWS\system32\nqwortnr.dll
C:\WINDOWS\system32\opnmKAqn.dll
C:\WINDOWS\system32\svnmkeqp.ini
C:\WINDOWS\system32\tdssadw.dll
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\tdssl.dll
C:\WINDOWS\system32\tdsslog.dll
C:\WINDOWS\system32\tdssmain.dll
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\system32\tuvUNhHA.dll
C:\WINDOWS\system32\wvUMCvww.dll
C:\WINDOWS\system32\ybeLknnn.ini
C:\WINDOWS\system32\ybeLknnn.ini2

----- BITS: Possible sites infect‚s -----

http://pornotube8.net
http://hqsextube08.com
.
(((((((((((((((((((((((((((((   Fichiers cr‚‚s 2008-08-02 to 2008-09-02  ))))))))))))))))))))))))))))))))))))
.

2008-09-02 09:27 . 2008-09-02 09:27   <REP>   d--------   C:\Program Files\Trend Micro
2008-08-30 21:41 . 2008-08-30 01:22   270,336   --a------   C:\WINDOWS\rqbmvpso.dll
2008-08-30 02:44 . 2008-08-30 02:44   12,288   --a------   C:\WINDOWS\system32\tdssserf.dll
2008-08-29 13:39 . 2004-08-20 01:09   159,232   --a------   C:\WINDOWS\system32\ptpusd.dll
2008-08-29 13:39 . 2004-08-04 07:58   15,104   --a------   C:\WINDOWS\system32\drivers\usbscan.sys
2008-08-29 13:39 . 2004-08-04 07:58   15,104   --a------   C:\WINDOWS\system32\dllcache\usbscan.sys
2008-08-29 13:39 . 2001-08-23 17:47   5,632   --a------   C:\WINDOWS\system32\ptpusb.dll
2008-08-28 21:09 . 2008-08-28 18:40   380,928   --a------   C:\WINDOWS\rodqgpvlsrd.dll
2008-08-28 20:58 .    290,816      C:\WINDOWS\pdoskegl.dll
2008-08-28 20:57 . 2008-08-28 20:57   325,120   --a------   C:\WINDOWS\system32\rqRlMCRH.dll
2008-08-28 13:33 . 2008-08-28 13:34   314,112   --a------   C:\WINDOWS\system32\pmnkHXrR.dll
2008-08-28 12:33 . 2008-08-28 12:40   323,968   --a------   C:\WINDOWS\system32\ddcBUkjH.dll
2008-08-28 10:38 . 2008-08-28 10:38   34,688   --a------   C:\WINDOWS\system32\mlJYqPjI.dll
2008-08-28 10:25 . 2008-08-28 10:25   159,744   --a------   C:\WINDOWS\system32\mx31403.dll
2008-08-27 12:17 . 2008-08-27 12:17   159,744   --a------   C:\WINDOWS\system32\mbk81444.dll
2008-08-27 12:17 . 2008-08-27 12:17   159,744   --a------   C:\WINDOWS\system32\bk81444.dll
2008-08-27 11:15 . 2008-08-27 11:15   159,744   --a------   C:\WINDOWS\system32\wx63805.dll
2008-08-27 10:14 . 2008-08-27 10:14   126,976   --a------   C:\WINDOWS\system32\wx65634.dll
2008-08-26 13:31 . 2008-08-26 13:31   <REP>   d--------   C:\Program Files\Alwil Software
2008-08-26 13:16 . 2008-08-30 01:22   192,512   --a------   C:\WINDOWS\qalkfxor.dll
2008-08-26 13:16 . 2008-08-30 01:22   94,208   --a------   C:\WINDOWS\rvoelbxt.exe
2008-08-14 18:37 . 2008-05-01 16:31   331,776   ---------   C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 19:08 . 2008-08-11 19:08   <REP>   d--------   C:\Program Files\iPod

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-02 07:10   90,112   ----a-w   C:\WINDOWS\DUMP39b3.tmp
2008-08-31 09:54   90,112   ----a-w   C:\WINDOWS\DUMP39bd.tmp
2008-08-31 09:52   90,112   ----a-w   C:\WINDOWS\DUMP5605.tmp
2008-08-31 09:50   90,112   ----a-w   C:\WINDOWS\DUMP55f1.tmp
2008-08-31 09:46   90,112   ----a-w   C:\WINDOWS\DUMP564b.tmp
2008-07-20 15:06   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\vlc
2008-07-20 14:50   ---------   d-----w   C:\Program Files\VideoLAN
2008-07-13 18:28   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\Azureus
2008-07-13 18:28   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Azureus
2008-07-13 18:27   ---------   d-----w   C:\Program Files\Azureus
2008-07-13 09:19   ---------   d-----w   C:\Program Files\MSXML 4.0
2008-07-11 17:35   ---------   d-----w   C:\Program Files\Fichiers communs\FotoWire
2008-07-11 17:35   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\FotoWire
2008-07-11 17:31   81,920   ------r   C:\WINDOWS\bwUnin-6.1.4.36-8876480L.exe
2008-07-11 17:31   ---------   d-----w   C:\Program Files\Logitech
2008-07-11 16:25   ---------   d-----w   C:\Program Files\directx
2008-07-11 16:22   ---------   d-----w   C:\Program Files\Fichiers communs\Logitech
2008-07-10 16:21   ---------   d-----w   C:\Program Files\iTunes
2008-07-10 16:21   ---------   d-----w   C:\Program Files\Bonjour
2008-07-10 16:21   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\Apple Computer
2008-07-10 16:20   ---------   d-----w   C:\Program Files\QuickTime
2008-07-10 16:20   ---------   d-----w   C:\Program Files\Fichiers communs\Apple
2008-07-10 16:20   ---------   d-----w   C:\Program Files\Apple Software Update
2008-07-10 16:20   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-10 16:20   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Apple
2008-07-07 20:31   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2008-07-07 20:31   253,952   ------w   C:\WINDOWS\system32\dllcache\es.dll
2008-07-07 18:25   ---------   d-----w   C:\Program Files\Windows Media Connect 2
2008-07-07 18:11   2,560   ----a-w   C:\WINDOWS\system32\bitcometres.dll
2008-07-07 18:09   ---------   d-----w   C:\Program Files\BitComet
2008-07-07 05:07   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-07-06 16:46   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\LimeWire
2008-07-06 16:45   ---------   d-----w   C:\Program Files\Java
2008-07-06 16:44   ---------   d-----w   C:\Program Files\Fichiers communs\Java
2008-07-06 16:43   ---------   d-----w   C:\Program Files\LimeWire
2008-07-06 10:44   ---------   d-----w   C:\Program Files\Messenger Plus! Live
2008-07-03 11:10   ---------   d-sh--w   C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-07-03 11:10   ---------   d-----w   C:\Program Files\Windows Live
2008-07-03 11:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-03 11:04   512,096   ----a-w   C:\WINDOWS\system32\drivers\amon.sys
2008-07-03 11:04   298,104   ----a-w   C:\WINDOWS\system32\imon.dll
2008-07-03 11:04   15,424   ----a-w   C:\WINDOWS\system32\drivers\nod32drv.sys
2008-07-03 11:04   ---------   d-----w   C:\Program Files\ESET
2008-06-24 16:23   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23   74,240   ------w   C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 08:28   3,592,192   ----a-w   C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:21   70,656   ------w   C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:21   625,664   ------w   C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20   13,824   ------w   C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-21 05:23   161,792   ----a-w   C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:41   247,808   ----a-w   C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41   247,808   ------w   C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41   148,992   ----a-w   C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45   360,320   ----a-w   C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44   138,368   ------w   C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52   225,920   ----a-w   C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-14 17:59   272,768   ------w   C:\WINDOWS\system32\dllcache\bthport.sys
.

(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{BD8713A4-DDDD-4A46-8363-6D1CF0D27364}"= "C:\WINDOWS\qalkfxor.dll" [2008-08-30 01:22 192512]
"{BEB6B37A-BC8B-46B6-B59D-BF83429C7FC7}"= "C:\WINDOWS\qalkfxor.dll" [2008-08-30 01:22 192512]

[HKEY_CLASSES_ROOT\clsid\{bd8713a4-dddd-4a46-8363-6d1cf0d27364}]
[HKEY_CLASSES_ROOT\qalkfxor.1]
[HKEY_CLASSES_ROOT\TypeLib\{123AE155-D37C-4D9D-9816-92A55AAC88F8}]
[HKEY_CLASSES_ROOT\qalkfxor]

[HKEY_CLASSES_ROOT\clsid\{beb6b37a-bc8b-46b6-b59d-bf83429c7fc7}]
[HKEY_CLASSES_ROOT\qalkfxor.1]
[HKEY_CLASSES_ROOT\TypeLib\{543C6090-CD1E-48F3-8814-AA3A42404E47}]
[HKEY_CLASSES_ROOT\qalkfxor]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-07-11 19:31 16384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-06-23 10:34 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-06-23 10:34 114688]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-06-23 10:35 147456]
"LManager"="C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE" [2003-06-20 20:10 155648]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-07-03 13:04 949376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-03 02:23 116040]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2003-12-16 22:37 188416]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2003-12-16 22:39 77824]
"SoundMan"="SOUNDMAN.EXE" [2003-06-20 19:55 55296 C:\WINDOWS\SOUNDMAN.EXE]
"AGRSMMSG"="AGRSMMSG.exe" [2003-06-23 10:35 88267 C:\WINDOWS\AGRSMMSG.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"pdoskegl"= {6C91520A-2E16-49A0-A7D3-9F28F5D03B45} - C:\WINDOWS\pdoskegl.dll [ ]
"rqbmvpso"= {26C4AE34-12F8-4494-AF4C-D2801E35D7D7} - C:\WINDOWS\rqbmvpso.dll [2008-08-30 01:22 270336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=pyjztm.dll raborc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.enc"= ITIG726.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-07-30 10:47 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11671:TCP"= 11671:TCP:BitComet 11671 TCP
"11671:UDP"= 11671:UDP:BitComet 11671 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
.
- - - - ORPHANS REMOVED - - - -

BHO-{4982d93b-a463-4f84-b297-63e32c4a92f4} - C:\WINDOWS\system32\raborc.dll
BHO-{AEC96647-C722-4332-94A2-B6F24C2E32B0} - C:\WINDOWS\system32\nnnkLeby.dll
BHO-{FDDB29B3-A4F5-32D8-9D10-302705B1649C} - C:\WINDOWS\system32\mmx31403.dll
BHO-{FEEAD861-8455-42F3-8A7E-B7756084BB36} - C:\WINDOWS\system32\khfGwTkH.dll
HKLM-Run-2629165f - C:\WINDOWS\system32\elechulm.dll
ShellExecuteHooks-{FEEAD861-8455-42F3-8A7E-B7756084BB36} - C:\WINDOWS\system32\khfGwTkH.dll
Notify-khfGwTkH - khfGwTkH.dll


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://global.acer.com/
R1 -: HKCU-Internet Settings,ProxyOverride = *.local;localhost
O8 -: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 -: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 -: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 -: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-02 09:52:58
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\PROGRAM FILES\FICHIERS COMMUNS\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE
C:\PROGRAM FILES\ESET\NOD32KRN.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\LAUNCH MANAGER\CPLBCL53.EXE
C:\WINDOWS\SYSTEM32\LVCOMS.EXE
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\PROGRAM FILES\APOINT2K\APNTEX.EXE
.
**************************************************************************
.
Temps d'accomplissement: 2008-09-02  9:54:52 - machine was rebooted
ComboFix-quarantined-files.txt  2008-09-02 07:54:48

Pre-Run: 63,211,765,760 octets libres
Post-Run: 63,881,183,232 octets libres

244   --- E O F ---   2008-08-16 08:29:08




[Okocza]

Prawym na ,,Mój komputer">właściwości>Zakładka "Zaawansowane" -> Uruchamianie i odzyskiwanie i klikamy "ustawienia">
w części "Awaria systemu" odznaczamy pole "Automatycznie uruchom ponownie"

teraz zamiast resetu pojawi sie bluescreen przepisz kod bledu z dolu strony bluescreena

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

[djarta]

U Ciebie nie ma czasu na SDFixa!


Wklej do Notatnika:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\rqbmvpso.dll
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\ptpusd.dll
C:\WINDOWS\system32\drivers\usbscan.sys
C:\WINDOWS\system32\dllcache\usbscan.sys
C:\WINDOWS\system32\ptpusb.dll
C:\WINDOWS\rodqgpvlsrd.dll
C:\WINDOWS\pdoskegl.dll
C:\WINDOWS\system32\rqRlMCRH.dll
C:\WINDOWS\system32\pmnkHXrR.dll
C:\WINDOWS\system32\ddcBUkjH.dll
C:\WINDOWS\system32\mlJYqPjI.dll
C:\WINDOWS\system32\mx31403.dll
C:\WINDOWS\system32\mbk81444.dll
C:\WINDOWS\system32\bk81444.dll
C:\WINDOWS\system32\wx63805.dll
C:\WINDOWS\system32\wx65634.dll
C:\WINDOWS\qalkfxor.dll
C:\WINDOWS\rvoelbxt.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{BD8713A4-DDDD-4A46-8363-6D1CF0D27364}"=-
"{BEB6B37A-BC8B-46B6-B59D-BF83429C7FC7}"=-
[-KEY_CLASSES_ROOT\clsid\{bd8713a4-dddd-4a46-8363-6d1cf0d27364}]
[-KEY_CLASSES_ROOT\qalkfxor.1]
[-KEY_CLASSES_ROOT\TypeLib\{123AE155-D37C-4D9D-9816-92A55AAC88F8}]
[-KEY_CLASSES_ROOT\qalkfxor]
[-KEY_CLASSES_ROOT\clsid\{beb6b37a-bc8b-46b6-b59d-bf83429c7fc7}]
[-KEY_CLASSES_ROOT\qalkfxor.1]
[-KEY_CLASSES_ROOT\TypeLib\{543C6090-CD1E-48F3-8814-AA3A42404E47}]
[-KEY_CLASSES_ROOT\qalkfxor]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"pdoskegl"=-
"rqbmvpso"=-


>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.



=========================
K.

[biigos]

I teraz zrestartowac i usunac tamten folder tak??

Kod: Zaznacz wszystko

ComboFix 08-09-01.01 - XoXo 2008-09-02 15:20:27.2 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.33.1036.18.899 [GMT 2:00]
Endroit: C:\Documents and Settings\XoXo\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\XoXo\Bureau\CFScript.txt.txt
* Création d'un nouveau point de restauration
* Resident AV is active


[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\WINDOWS\pdoskegl.dll
C:\WINDOWS\qalkfxor.dll
C:\WINDOWS\rodqgpvlsrd.dll
C:\WINDOWS\rqbmvpso.dll
C:\WINDOWS\rvoelbxt.exe
C:\WINDOWS\system32\bk81444.dll
C:\WINDOWS\system32\ddcBUkjH.dll
C:\WINDOWS\system32\dllcache\usbscan.sys
C:\WINDOWS\system32\drivers\usbscan.sys
C:\WINDOWS\system32\mbk81444.dll
C:\WINDOWS\system32\mlJYqPjI.dll
C:\WINDOWS\system32\mx31403.dll
C:\WINDOWS\system32\pmnkHXrR.dll
C:\WINDOWS\system32\ptpusb.dll
C:\WINDOWS\system32\ptpusd.dll
C:\WINDOWS\system32\rqRlMCRH.dll
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\wx63805.dll
C:\WINDOWS\system32\wx65634.dll
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pdoskegl.dll
C:\WINDOWS\qalkfxor.dll
C:\WINDOWS\rodqgpvlsrd.dll
C:\WINDOWS\rqbmvpso.dll
C:\WINDOWS\rvoelbxt.exe
C:\WINDOWS\system32\bk81444.dll
C:\WINDOWS\system32\ddcBUkjH.dll
C:\WINDOWS\system32\dllcache\usbscan.sys
C:\WINDOWS\system32\drivers\usbscan.sys
C:\WINDOWS\system32\mbk81444.dll
C:\WINDOWS\system32\mlJYqPjI.dll
C:\WINDOWS\system32\mx31403.dll
C:\WINDOWS\system32\pmnkHXrR.dll
C:\WINDOWS\system32\ptpusb.dll
C:\WINDOWS\system32\ptpusd.dll
C:\WINDOWS\system32\rqRlMCRH.dll
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\wx63805.dll
C:\WINDOWS\system32\wx65634.dll

.
(((((((((((((((((((((((((((((   Fichiers créés 2008-08-02 to 2008-09-02  ))))))))))))))))))))))))))))))))))))
.

2008-09-02 09:27 . 2008-09-02 09:27   <REP>   d--------   C:\Program Files\Trend Micro
2008-08-26 13:31 . 2008-08-26 13:31   <REP>   d--------   C:\Program Files\Alwil Software
2008-08-14 18:37 . 2008-05-01 16:31   331,776   ---------   C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 19:08 . 2008-08-11 19:08   <REP>   d--------   C:\Program Files\iPod

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-02 07:10   90,112   ----a-w   C:\WINDOWS\DUMP39b3.tmp
2008-08-31 09:54   90,112   ----a-w   C:\WINDOWS\DUMP39bd.tmp
2008-08-31 09:52   90,112   ----a-w   C:\WINDOWS\DUMP5605.tmp
2008-08-31 09:50   90,112   ----a-w   C:\WINDOWS\DUMP55f1.tmp
2008-08-31 09:46   90,112   ----a-w   C:\WINDOWS\DUMP564b.tmp
2008-07-20 15:06   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\vlc
2008-07-20 14:50   ---------   d-----w   C:\Program Files\VideoLAN
2008-07-13 18:28   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\Azureus
2008-07-13 18:28   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Azureus
2008-07-13 18:27   ---------   d-----w   C:\Program Files\Azureus
2008-07-13 09:19   ---------   d-----w   C:\Program Files\MSXML 4.0
2008-07-11 17:35   ---------   d-----w   C:\Program Files\Fichiers communs\FotoWire
2008-07-11 17:35   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\FotoWire
2008-07-11 17:31   81,920   ------r   C:\WINDOWS\bwUnin-6.1.4.36-8876480L.exe
2008-07-11 17:31   ---------   d-----w   C:\Program Files\Logitech
2008-07-11 16:25   ---------   d-----w   C:\Program Files\directx
2008-07-11 16:22   ---------   d-----w   C:\Program Files\Fichiers communs\Logitech
2008-07-10 16:21   ---------   d-----w   C:\Program Files\iTunes
2008-07-10 16:21   ---------   d-----w   C:\Program Files\Bonjour
2008-07-10 16:21   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\Apple Computer
2008-07-10 16:20   ---------   d-----w   C:\Program Files\QuickTime
2008-07-10 16:20   ---------   d-----w   C:\Program Files\Fichiers communs\Apple
2008-07-10 16:20   ---------   d-----w   C:\Program Files\Apple Software Update
2008-07-10 16:20   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-10 16:20   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Apple
2008-07-07 20:31   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2008-07-07 20:31   253,952   ------w   C:\WINDOWS\system32\dllcache\es.dll
2008-07-07 18:25   ---------   d-----w   C:\Program Files\Windows Media Connect 2
2008-07-07 18:11   2,560   ----a-w   C:\WINDOWS\system32\bitcometres.dll
2008-07-07 18:09   ---------   d-----w   C:\Program Files\BitComet
2008-07-07 05:07   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-07-06 16:46   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\LimeWire
2008-07-06 16:45   ---------   d-----w   C:\Program Files\Java
2008-07-06 16:44   ---------   d-----w   C:\Program Files\Fichiers communs\Java
2008-07-06 16:43   ---------   d-----w   C:\Program Files\LimeWire
2008-07-06 10:44   ---------   d-----w   C:\Program Files\Messenger Plus! Live
2008-07-03 11:10   ---------   d-sh--w   C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-07-03 11:10   ---------   d-----w   C:\Program Files\Windows Live
2008-07-03 11:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-03 11:04   512,096   ----a-w   C:\WINDOWS\system32\drivers\amon.sys
2008-07-03 11:04   298,104   ----a-w   C:\WINDOWS\system32\imon.dll
2008-07-03 11:04   15,424   ----a-w   C:\WINDOWS\system32\drivers\nod32drv.sys
2008-07-03 11:04   ---------   d-----w   C:\Program Files\ESET
2008-06-24 16:23   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23   74,240   ------w   C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 08:28   3,592,192   ----a-w   C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:21   70,656   ------w   C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:21   625,664   ------w   C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20   13,824   ------w   C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-21 05:23   161,792   ----a-w   C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:41   247,808   ----a-w   C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41   247,808   ------w   C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41   148,992   ----a-w   C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45   360,320   ----a-w   C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44   138,368   ------w   C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52   225,920   ----a-w   C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-14 17:59   272,768   ------w   C:\WINDOWS\system32\dllcache\bthport.sys
.

(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-07-11 19:31 16384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-06-23 10:34 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-06-23 10:34 114688]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-06-23 10:35 147456]
"LManager"="C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE" [2003-06-20 20:10 155648]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-07-03 13:04 949376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-03 02:23 116040]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2003-12-16 22:37 188416]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2003-12-16 22:39 77824]
"SoundMan"="SOUNDMAN.EXE" [2003-06-20 19:55 55296 C:\WINDOWS\SOUNDMAN.EXE]
"AGRSMMSG"="AGRSMMSG.exe" [2003-06-23 10:35 88267 C:\WINDOWS\AGRSMMSG.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-07-11 19:31:31 169472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=pyjztm.dll raborc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.enc"= ITIG726.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-07-30 10:47 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11671:TCP"= 11671:TCP:BitComet 11671 TCP
"11671:UDP"= 11671:UDP:BitComet 11671 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-02 15:22:44
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Temps d'accomplissement: 2008-09-02 15:23:20
ComboFix-quarantined-files.txt  2008-09-02 13:23:18
ComboFix2.txt  2008-09-02 07:54:56

Pre-Run: 63,988,727,808 octets libres
Post-Run: 63,970,082,816 octets libres

191   --- E O F ---   2008-08-16 08:29:08


[djarta]

C:\WINDOWS\DUMP39b3.tmp
C:\WINDOWS\DUMP39bd.tmp
C:\WINDOWS\DUMP5605.tmp
C:\WINDOWS\DUMP55f1.tmp
C:\WINDOWS\DUMP564b.tmp

Usuń ręcznie te zrzuty pamięci.

Jeśli chcesz możesz użyć SDFixa, ale myślę, że się nie opłaca.

Trochę masz dziwnego ComboFixa, nie ten język.

=====================
K.

[biigos]

juz, i restart?? mam francuksi jezyk na lapie...

[djarta]

Acha, dlatego.

Restart.

Nowy normalny log z ComboFixa.


==========================
K.

Autor postu otrzymał pochwałę

[biigos]

Kod: Zaznacz wszystko

ComboFix 08-09-01.01 - XoXo 2008-09-02 15:37:05.3 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.33.1036.18.899 [GMT 2:00]
Endroit: C:\Documents and Settings\XoXo\Bureau\ComboFix.exe
* Resident AV is active


[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((   Fichiers créés 2008-08-02 to 2008-09-02  ))))))))))))))))))))))))))))))))))))
.

2008-09-02 15:33 . 2008-09-02 15:33   <REP>   d--hs----   C:\FOUND.000
2008-09-02 15:21 . 2004-08-04 07:58   15,104   --a------   C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-02 15:21 . 2004-08-04 07:58   15,104   --a------   C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-02 09:27 . 2008-09-02 09:27   <REP>   d--------   C:\Program Files\Trend Micro
2008-08-26 13:31 . 2008-08-26 13:31   <REP>   d--------   C:\Program Files\Alwil Software
2008-08-14 18:37 . 2008-05-01 16:31   331,776   ---------   C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 19:08 . 2008-08-11 19:08   <REP>   d--------   C:\Program Files\iPod

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-20 15:06   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\vlc
2008-07-20 14:50   ---------   d-----w   C:\Program Files\VideoLAN
2008-07-13 18:28   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\Azureus
2008-07-13 18:28   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Azureus
2008-07-13 18:27   ---------   d-----w   C:\Program Files\Azureus
2008-07-13 09:19   ---------   d-----w   C:\Program Files\MSXML 4.0
2008-07-11 17:35   ---------   d-----w   C:\Program Files\Fichiers communs\FotoWire
2008-07-11 17:35   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\FotoWire
2008-07-11 17:31   81,920   ------r   C:\WINDOWS\bwUnin-6.1.4.36-8876480L.exe
2008-07-11 17:31   ---------   d-----w   C:\Program Files\Logitech
2008-07-11 16:25   ---------   d-----w   C:\Program Files\directx
2008-07-11 16:22   ---------   d-----w   C:\Program Files\Fichiers communs\Logitech
2008-07-10 16:21   ---------   d-----w   C:\Program Files\iTunes
2008-07-10 16:21   ---------   d-----w   C:\Program Files\Bonjour
2008-07-10 16:21   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\Apple Computer
2008-07-10 16:20   ---------   d-----w   C:\Program Files\QuickTime
2008-07-10 16:20   ---------   d-----w   C:\Program Files\Fichiers communs\Apple
2008-07-10 16:20   ---------   d-----w   C:\Program Files\Apple Software Update
2008-07-10 16:20   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-10 16:20   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Apple
2008-07-07 20:31   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2008-07-07 20:31   253,952   ------w   C:\WINDOWS\system32\dllcache\es.dll
2008-07-07 18:25   ---------   d-----w   C:\Program Files\Windows Media Connect 2
2008-07-07 18:11   2,560   ----a-w   C:\WINDOWS\system32\bitcometres.dll
2008-07-07 18:09   ---------   d-----w   C:\Program Files\BitComet
2008-07-07 05:07   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-07-06 16:46   ---------   d-----w   C:\Documents and Settings\XoXo\Application Data\LimeWire
2008-07-06 16:45   ---------   d-----w   C:\Program Files\Java
2008-07-06 16:44   ---------   d-----w   C:\Program Files\Fichiers communs\Java
2008-07-06 16:43   ---------   d-----w   C:\Program Files\LimeWire
2008-07-06 10:44   ---------   d-----w   C:\Program Files\Messenger Plus! Live
2008-07-03 11:10   ---------   d-sh--w   C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-07-03 11:10   ---------   d-----w   C:\Program Files\Windows Live
2008-07-03 11:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-03 11:04   512,096   ----a-w   C:\WINDOWS\system32\drivers\amon.sys
2008-07-03 11:04   298,104   ----a-w   C:\WINDOWS\system32\imon.dll
2008-07-03 11:04   15,424   ----a-w   C:\WINDOWS\system32\drivers\nod32drv.sys
2008-07-03 11:04   ---------   d-----w   C:\Program Files\ESET
2008-06-24 16:23   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23   74,240   ------w   C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 08:28   3,592,192   ----a-w   C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:21   70,656   ------w   C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:21   625,664   ------w   C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20   13,824   ------w   C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-21 05:23   161,792   ----a-w   C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:41   247,808   ----a-w   C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41   247,808   ------w   C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41   148,992   ----a-w   C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45   360,320   ----a-w   C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44   138,368   ------w   C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52   225,920   ----a-w   C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-14 17:59   272,768   ------w   C:\WINDOWS\system32\dllcache\bthport.sys
.

(((((((((((((((((((((((((((((   snapshot@2008-09-02_ 9.54.15.38   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-02 13:34:34   16,384   ----a-w   C:\WINDOWS\Temp\Perflib_Perfdata_67c.dat
.
(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-07-11 19:31 16384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-06-23 10:34 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-06-23 10:34 114688]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-06-23 10:35 147456]
"LManager"="C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE" [2003-06-20 20:10 155648]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-07-03 13:04 949376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-03 02:23 116040]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2003-12-16 22:37 188416]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2003-12-16 22:39 77824]
"SoundMan"="SOUNDMAN.EXE" [2003-06-20 19:55 55296 C:\WINDOWS\SOUNDMAN.EXE]
"AGRSMMSG"="AGRSMMSG.exe" [2003-06-23 10:35 88267 C:\WINDOWS\AGRSMMSG.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-07-11 19:31:31 169472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=pyjztm.dll raborc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.enc"= ITIG726.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-07-30 10:47 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11671:TCP"= 11671:TCP:BitComet 11671 TCP
"11671:UDP"= 11671:UDP:BitComet 11671 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://global.acer.com/
R1 -: HKCU-Internet Settings,ProxyOverride = *.local;localhost
O8 -: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 -: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 -: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 -: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-02 15:39:01
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Temps d'accomplissement: 2008-09-02 15:39:40
ComboFix-quarantined-files.txt  2008-09-02 13:39:38
ComboFix3.txt  2008-09-02 07:54:56
ComboFix2.txt  2008-09-02 13:23:22

Pre-Run: 63,980,273,664 octets libres
Post-Run: 63,965,593,600 octets libres

163   --- E O F ---   2008-08-16 08:29:08


I wszystko gra??

[Okocza]

Prawym na ,,Mój komputer">właściwości>Zakładka "Zaawansowane" -> Uruchamianie i odzyskiwanie i klikamy "ustawienia">
w części "Awaria systemu" odznaczamy pole "Automatycznie uruchom ponownie"

teraz zamiast resetu pojawi sie bluescreen przepisz kod bledu z dolu strony bluescreena

[biigos]

Wszystko ladnie smiga,....Dziekuje szanowny kolego!!

[djarta]

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.



=======================
K.