problem z amvo

[guiara]

Mam problem z amvo. Jak się tego pzobyć? Proszę o pomoc.
Log z Comboix

ComboFix 08-05-01.3 - Agulek 2008-05-03 16:42:03.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.682 [GMT 2:00]
Running from: C:\Documents and Settings\Agulek\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\amvo1.dll
D:\Autorun.inf
E:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-04-03 to 2008-05-03 )))))))))))))))))))))))))))))))
.

2008-05-02 12:28 . 2008-05-02 12:28 <DIR> d-------- C:\Program Files\InterMute
2008-05-02 11:41 . 2008-05-02 11:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-02 11:41 . 2008-05-02 11:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-28 13:36 . 2008-04-28 13:35 104,269 -r-hs---- C:\jfvkcsy.bat
2008-04-27 18:44 . 2008-04-27 18:44 105,128 -r-hs---- C:\oq.cmd
2008-04-26 23:40 . 2008-04-06 08:33 103,966 -r-hs---- C:\t.com
2008-04-10 15:45 . 2008-05-01 22:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-10 15:45 . 2008-04-10 15:45 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 22:47 21,052 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2008-03-25 22:47 15,144 ----a-w C:\WINDOWS\system32\SIntf32.dll
2008-03-25 22:47 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2008-03-25 15:54 --------- d-----w C:\Program Files\Blaze Media Pro
2008-03-25 15:53 --------- d--h--w C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}
2008-03-23 22:10 --------- d-----w C:\Program Files\YDP
2008-03-21 20:32 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-21 20:32 --------- d-----w C:\Documents and Settings\Agulek\Application Data\skypePM
2008-03-21 20:30 --------- d-----w C:\Documents and Settings\Agulek\Application Data\Skype
2008-03-21 20:29 --------- d-----w C:\Program Files\Skype
2008-03-21 20:29 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-21 20:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-03-20 23:40 --------- d-----w C:\Program Files\WMV9_VCM
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-11 08:32 --------- d-----w C:\Documents and Settings\Agulek\Application Data\ABBYY
2008-03-11 08:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\ABBYY
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:32 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-16 22:29 3,059,712 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-15 09:23 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
2008-02-09 14:28 323,584 ----a-w C:\WINDOWS\system32\AudioGenie2.dll
2007-12-07 16:20 32,424 ----a-w C:\Documents and Settings\Agulek\Application Data\GDIPFONTCACHEV1.DAT
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LAN Messenger"="" []
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25 1961984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"PFO Check Settings"="pfochk.exe" [2003-08-14 21:53 57344 C:\WINDOWS\pfochk.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 18:00 98304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:07 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll
"msacm.l3codec"= l3codecp.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Aktywacja Testera.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Aktywacja Testera.lnk
backup=C:\WINDOWS\pss\Aktywacja Testera.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2006-03-14 04:06 1397760 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-02-08 21:36 155648 C:\Program Files\QuickTime\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\LAN Messenger\\LANMsg.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\LDC\\LDCPlusPlus.exe"=
"C:\\Program Files\\PeerCast\\PeerCast.exe"=
"C:\\Program Files\\iDC\\oDC.exe"=
"C:\\Program Files\\Microsoft Office\\Office10\\WINWORD.EXE"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{21ac6ae8-24dc-11dc-9e78-000c7644bb48}]
\Shell\AutoRun\command - fooool.exe
\Shell\explore\Command - fooool.exe
\Shell\open\Command - fooool.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{378b2750-b0c3-11dc-a08e-000c7644bb48}]
\Shell\AutoRun\command - H:\jfvkcsy.bat
\Shell\explore\Command - H:\jfvkcsy.bat
\Shell\open\Command - H:\jfvkcsy.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c3f21e69-5f46-11da-b3e3-806d6172696f}]
\Shell\AutoRun\command - F:\AutoRun\Demo.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-03 16:43:31
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-03 16:44:02
ComboFix-quarantined-files.txt 2008-05-03 14:44:00

Pre-Run: 3,269,861,376 bytes free
Post-Run: 4,209,016,832 bytes free

131 --- E O F --- 2008-04-11 14:00:19

[Okocza]

otwórz notatnik wklej w nim:

Kod: Zaznacz wszystko

Files::
C:\jfvkcsy.bat
C:\oq.cmd
C:\t.com

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c3f21e69-5f46-11da-b3e3-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{378b2750-b0c3-11dc-a08e-000c7644bb48}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{21ac6ae8-24dc-11dc-9e78-000c7644bb48}]


Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

[guiara]

wygenerował się następujący log

ComboFix 08-05-01.3 - Agulek 2008-05-03 17:57:41.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.666 [GMT 2:00]
Running from: C:\Documents and Settings\Agulek\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Agulek\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-03 to 2008-05-03 )))))))))))))))))))))))))))))))
.

2008-05-02 12:28 . 2008-05-02 12:28 <DIR> d-------- C:\Program Files\InterMute
2008-05-02 11:41 . 2008-05-02 11:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-02 11:41 . 2008-05-02 11:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-28 13:36 . 2008-04-28 13:35 104,269 -r-hs---- C:\jfvkcsy.bat
2008-04-27 18:44 . 2008-04-27 18:44 105,128 -r-hs---- C:\oq.cmd
2008-04-26 23:40 . 2008-04-06 08:33 103,966 -r-hs---- C:\t.com
2008-04-10 15:45 . 2008-05-01 22:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-10 15:45 . 2008-04-10 15:45 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 22:47 21,052 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2008-03-25 22:47 15,144 ----a-w C:\WINDOWS\system32\SIntf32.dll
2008-03-25 22:47 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2008-03-25 15:54 --------- d-----w C:\Program Files\Blaze Media Pro
2008-03-25 15:53 --------- d--h--w C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}
2008-03-23 22:10 --------- d-----w C:\Program Files\YDP
2008-03-21 20:32 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-21 20:32 --------- d-----w C:\Documents and Settings\Agulek\Application Data\skypePM
2008-03-21 20:30 --------- d-----w C:\Documents and Settings\Agulek\Application Data\Skype
2008-03-21 20:29 --------- d-----w C:\Program Files\Skype
2008-03-21 20:29 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-21 20:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-03-20 23:40 --------- d-----w C:\Program Files\WMV9_VCM
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-11 08:32 --------- d-----w C:\Documents and Settings\Agulek\Application Data\ABBYY
2008-03-11 08:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\ABBYY
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:32 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-16 22:29 3,059,712 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-15 09:23 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
2008-02-09 14:28 323,584 ----a-w C:\WINDOWS\system32\AudioGenie2.dll
2007-12-07 16:20 32,424 ----a-w C:\Documents and Settings\Agulek\Application Data\GDIPFONTCACHEV1.DAT
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LAN Messenger"="" []
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25 1961984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"PFO Check Settings"="pfochk.exe" [2003-08-14 21:53 57344 C:\WINDOWS\pfochk.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 18:00 98304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:07 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll
"msacm.l3codec"= l3codecp.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Aktywacja Testera.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Aktywacja Testera.lnk
backup=C:\WINDOWS\pss\Aktywacja Testera.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2006-03-14 04:06 1397760 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-02-08 21:36 155648 C:\Program Files\QuickTime\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\LAN Messenger\\LANMsg.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\LDC\\LDCPlusPlus.exe"=
"C:\\Program Files\\PeerCast\\PeerCast.exe"=
"C:\\Program Files\\iDC\\oDC.exe"=
"C:\\Program Files\\Microsoft Office\\Office10\\WINWORD.EXE"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-03 17:58:45
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-03 17:59:15
ComboFix-quarantined-files.txt 2008-05-03 15:59:14
ComboFix2.txt 2008-05-03 14:44:04

Pre-Run: 4,160,520,192 bytes free
Post-Run: 4,161,961,984 bytes free

113 --- E O F --- 2008-04-11 14:00:19

[Okocza]

otwórz notatnik wklej w nim:

Folders::
C:\jfvkcsy.bat
C:\oq.cmd
C:\t.com

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

[guiara]

zrobilam to i teraz jest taki log

ComboFix 08-05-01.3 - Agulek 2008-05-03 18:10:32.3 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.747 [GMT 2:00]
Running from: C:\Documents and Settings\Agulek\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Agulek\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-03 to 2008-05-03 )))))))))))))))))))))))))))))))
.

2008-05-02 12:28 . 2008-05-02 12:28 <DIR> d-------- C:\Program Files\InterMute
2008-05-02 11:41 . 2008-05-02 11:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-02 11:41 . 2008-05-02 11:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-28 13:36 . 2008-04-28 13:35 104,269 -r-hs---- C:\jfvkcsy.bat
2008-04-27 18:44 . 2008-04-27 18:44 105,128 -r-hs---- C:\oq.cmd
2008-04-26 23:40 . 2008-04-06 08:33 103,966 -r-hs---- C:\t.com
2008-04-10 15:45 . 2008-05-01 22:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-10 15:45 . 2008-04-10 15:45 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 22:47 21,052 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2008-03-25 22:47 15,144 ----a-w C:\WINDOWS\system32\SIntf32.dll
2008-03-25 22:47 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2008-03-25 15:54 --------- d-----w C:\Program Files\Blaze Media Pro
2008-03-25 15:53 --------- d--h--w C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}
2008-03-23 22:10 --------- d-----w C:\Program Files\YDP
2008-03-21 20:32 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-21 20:32 --------- d-----w C:\Documents and Settings\Agulek\Application Data\skypePM
2008-03-21 20:30 --------- d-----w C:\Documents and Settings\Agulek\Application Data\Skype
2008-03-21 20:29 --------- d-----w C:\Program Files\Skype
2008-03-21 20:29 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-21 20:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-03-20 23:40 --------- d-----w C:\Program Files\WMV9_VCM
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-11 08:32 --------- d-----w C:\Documents and Settings\Agulek\Application Data\ABBYY
2008-03-11 08:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\ABBYY
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:32 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-16 22:29 3,059,712 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-15 09:23 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
2008-02-09 14:28 323,584 ----a-w C:\WINDOWS\system32\AudioGenie2.dll
2007-12-07 16:20 32,424 ----a-w C:\Documents and Settings\Agulek\Application Data\GDIPFONTCACHEV1.DAT
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((( snapshot@2008-05-03_16.43.47.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-03 14:36:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-03 16:07:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-05-03 14:36:32 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_600.dat
+ 2008-05-03 16:07:32 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_600.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LAN Messenger"="" []
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25 1961984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"PFO Check Settings"="pfochk.exe" [2003-08-14 21:53 57344 C:\WINDOWS\pfochk.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 18:00 98304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:07 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll
"msacm.l3codec"= l3codecp.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Aktywacja Testera.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Aktywacja Testera.lnk
backup=C:\WINDOWS\pss\Aktywacja Testera.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2006-03-14 04:06 1397760 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-02-08 21:36 155648 C:\Program Files\QuickTime\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\LAN Messenger\\LANMsg.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\LDC\\LDCPlusPlus.exe"=
"C:\\Program Files\\PeerCast\\PeerCast.exe"=
"C:\\Program Files\\iDC\\oDC.exe"=
"C:\\Program Files\\Microsoft Office\\Office10\\WINWORD.EXE"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-03 18:11:42
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-03 18:12:14
ComboFix-quarantined-files.txt 2008-05-03 16:12:10
ComboFix3.txt 2008-05-03 14:44:04
ComboFix2.txt 2008-05-03 15:59:18

Pre-Run: 4,124,983,296 bytes free
Post-Run: 4,116,717,568 bytes free

120 --- E O F --- 2008-04-11 14:00:19

[Okocza]

C:\jfvkcsy.bat
C:\oq.cmd
C:\t.com

zobacz czy masz na dysku te 3 scieżki.. bo combo niechce ich usunąć...

[guiara]

nie widze na dysku C tych ścieżek, nawet w plikach ukrytych

[wojtas]

okocza nie usunie bo zły skrypt wprowadziles (patrz gg)

Otworz notatnik i wklej w nim to:

File::
C:\jfvkcsy.bat
C:\oq.cmd
C:\t.com

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[guiara]

Po zastosowaniu sie do wyżej wymienionego polecenia, po wygenerowaniu nowego log'a komuter sie sam zrestartował (wcześniej tak nie robił), po włączeniu pojawiło się ostrzeżenie typu "the system has recoverd from a serious error" oraz "OSA.exe - corrupt File".
A wygenerowany log jest bardzo dziwny :|

ComboFix 08-05-01.3 - Agulek 2008-05-03 21:28:30.5 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.737 [GMT 2:00]
Running from: C:\Documents and Settings\Agulek\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.




rĄŁ8Ł8


¤
&not;
&middot;
¨




Ź
ˇ
‘
—
ۤŁ8Ł8

Ż
ş
ź
‰
‘
•
“
™
…
&brvbar;
§
Ť
3
i

ĄŁ8&reg;Ěz
ĄŁ8ŻĚj
ĄŁ8ŞĚ
ĄŁ8&copy;Ě
-
đ
đ˙˙˙ •
đ˙˙˙ —
đ˙˙˙ ›
đ˙˙˙(
đ˙˙˙`Ą
đ˙˙˙`­
đ˙˙˙Ȇ
đ˙˙˙Č‚
đ˙˙˙ČŠ
đ˙˙˙°Ě
đ˙˙˙°“
đ˙˙˙°™
đ˙˙˙ř¸
đ˙˙˙8Ź
đ˙˙˙8­
đ˙˙˙8Ť
đ˙˙˙ ‰
đ˙˙˙ …
đ˙˙˙€Ş
đ˙˙˙€ź
đ˙˙˙€˘
đ˙˙˙Ш
đ˙˙˙lf

đ˙˙˙ŕß
đ˙˙˙¸ż
đ˙˙˙X~
đ˙˙˙x&brvbar;
đď
đ&reg;
đĽ
đ˛
đ&para;
đ¤
đ¤Ł8:€
đź
đ’
đ
đ…
đ&brvbar;


&plusmn;
Ş
 
€

&middot;

ˇ
˘
Ł
&laquo;
˙˙˙˙
˙˙˙˙

˙˙˙˙
˙˙˙˙˙˙˙˙
˙˙Đ˙˙˙J
˙˙ĺP
˙˙ĺSO27F4 WMF

0
C:\jfvkcsy.bat
C:\oq.cmd
C:\t.com
$drvnam$
&
(&reg;
(&micro;
(­
(ś
,
.
.. 
.ŞŁ8ű
.net clr data
.net clr networking
.net data provider for oracle
.net data provider for sqlserver
.netframework
/
:
;::@@::
@
@´
@ą
@ƒ
@‡
@‹ R­Č

@”
@‹
@˜
@
@š
@§
\
_
__o
_iomega_active_disk_service_
`{
`ł
`ź
`ˇ
`•
`­
`—
`›
`Ł
`§
`&laquo;
{185B5CA6-927B-4251-8B1E-9605D01AD548}
{6080a529-897e-4629-a488-aba0c29b635e}
{834170a7-af3b-4d34-a757-e05eb29ee96d}
{85ccb53b-23d8-4e73-b1b7-9ddb71827d9b}
{a7447300-8075-4b0d-83f1-3d75c8ebc623}
{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}10 ˙˙˙nk
{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}11 ˙˙˙nk
{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}˙˙ ˙˙˙nk
{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}12 ˙˙˙nk
{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}12 ˙˙˙nk
{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}13 ˙˙˙nk
{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}13 ˙˙˙nk
{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}
{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}Ç
 ˙˙˙C
{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}14 ˙˙˙nk
{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}m
{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}in ˙˙˙nk
{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}17 ˙˙˙nk
{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}P
{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}18 ˙˙˙nk
{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}a
{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}19č˙˙˙vk
{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}FF ˙˙˙nk
{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}FF ˙˙˙nk
{d31a0762-0ceb-444e-acff-b049a1f6fe91}
{eda5f5d3-9e0f-4f4d-8a13-1d1cf469c9cc}
{FBE1D620-5418-4aae-A0F0-316D590663A1}
ôT R­Č

ń1
<ĄŁ8Ł8
=C
Čş
ČĚ
Č´
ČŽ
Ȥ
Č&not;
Č€
Č&middot;
Ȩ
ČŚ
Ŕ•
Čť
Č“
Č™
Ŕá
Č—
ȁ
ČŤ
ܤŁ8Ě
°
°˛
°Ž
ۤŁ8e
ۤŁ8Q2
°Ź
°–
°•
°”
°­
°š
Ď
ř˙˙˙
ř˙˙˙&raquo;
ř˙˙˙&plusmn;
ř˙˙˙ť
ř˙˙˙ą
ř˙˙˙&micro;
ř˙˙˙ł
ř˙˙˙đś
ř˙˙˙ “
ř˙˙˙ ™
ř˙˙˙(ˇ
ř˙˙˙@Ż
ř˙˙˙@ˇ
ř˙˙˙`“
ř˙˙˙`™
ř˙˙˙0Ą
ř˙˙˙0&copy;
ř˙˙˙8‰
ř˙˙˙8…
ř˙˙˙€â
ř˙˙˙€—
ř˙˙˙ĐĘ
ř˙˙˙Řź
ř˙˙˙‹
ř˙˙˙HŁ
ř˙˙˙ˆ‰
ř˙˙˙ˆ…
ř˙˙˙ŕ&not;
ř˙˙˙ŕŹ
ř˙˙˙ŕ¸
ř˙˙˙˜Ź
ř}
ř~
řŞ
ř 
ř&not;
řŹ
ř
ř¨
ř–
ř˘
ř¸
0
0{
0Ż
0ł
0Ú¤Ł8Ł8
0&raquo;
0ą
000031be
08CC8
0&micro;
0Ź
0‰
0‘
0’
0…
0§
0Ť
1
15anregprot
15msofftdi
1Google Online Search Service
2
2d49a3e8
2wirepcp
3
3com 3crdag675b wireless lan pci adapter wlservice
3com dmi agent
3combootp
3compxe
3comtftp
3klagia
4
45msofftdi
47msofftdi
5
50msofftdi
51anregprot
51msofftdi
6
61883
67388760
6to4
7
7753e06a
8
8Ź
8•
8–
8NASCAR
8“
8™
8—
8›
8Ł
8&laquo;
9
9ĄŁ8Ł8
a
 
Ç
Ř˙˙˙vk
 ˙˙˙C
 ˙˙˙nk
 ž
 ş
 ˛
a1oosleh
a2antimalware
a2free
a347bus
a347scsi
 ƒ
aavmker4
aawservice
 Ą
abhcop
abiosdsk
abp480n5
 ‡
ac97intc
accctsggw
acdservice
acedrv05
acedrv07
acer media server
acermemusagecheckservice
acpi
acpidisk
acpiec
acrotray
Active HelpAssistants
acw0q72kp1eikfukiwcfhrig
ad-watch connect filter
ad-watch real-time scanner
ad-watch registry filter
adaptec i/o manager server
adaptec raid remote services agent
adaptec storage manager notifier
adaptec web server
Adobe
adobe lm service
adobe version cue cs2
adobe version cue cs3
Adobe32
adobeactivefilemonitor4.0
adobeactivefilemonitor5.0
adobeversioncue
adpu160m
adserver
adsrsvc
adswinie
 ‰
aec
aegisp
afd
agehhtd
ageremodemaudio
ageresoftmodem
agp440
agpbrdg5
aha154x
aic78u2
aic78xx
aiqpbter
albus
alcxwdm
alerter
alg
aliide
alim1541
allowcontinue
altiris recovery solution agent
altiris recovery solution fal stopper
aluria spyware eliminator service
amdagp
amdk5
amdk7
amdk8
amdppm
amon
amsint
amstr32
anfad
antivir service
antivir update
antivirscheduler
antivirservice
anydvd
 ”
AOL-AntiSpy_Serv
aol acs
aol topspeedmonitor
aolavupd
aolservice
ap. 
apache
apache2
apcdli
ApiMon
applog
appmanagemes
armdvc
armrfc
arprmdg5
 ­
asc355
asc3550a
asc3550o
asc3550p
asc3550u
asc355o
asc355p
ASP.NET SSL Service
aspi113210
aspimgr
aspwstate
ast
asusrx25
 ˜
AtdiskNt
ati2ksag
ati2psag
atiddbxx
atixdbxx
atmsig
 š
 
 …
Auto HotKey Poller
AutoRemote
autoupgrade
avsvr
axdebugld
Ą
¤F
b
bdguard
bdt11
bflytsat
bingdu
bits32
BITSUPS
bjo12
bkmarks
bness
brgns
buzor
C
ź
€
€}
€ƒ
CAManager
CBEVTSVC
€‡
CcEvtSvc
cdnprot
cdntran
cdscsix3r
€‰
celindrv
€&copy;
cjwriiigqazft
ckptrqor
ۥ
client ip-ipx
clipart
cmdservice
cnprov
cnsminkp
€“
€™
€‹
com+ messages
comeventhelper
comint32
Completed Stage_2
ComSysCnt
comsysuser
Core
CoreService
cpudev
cqit
creaordn
CryptographicServer
CsdDriver
CSNetManagerXp
€›
ctl_w32
€…
€ľ
d
Đ˙˙˙J
Đ~
ĐĎ
Ѓ
daming
Ї
ddirectxt
demnsvr
Desk Managl
dglp13
dhlp
directout
directprt
directx
dirvin
distridiskman
DllEntry
DLLHOST32
dmtd
DNS Clieat
DNSCacheReader
DNSCL1ENT
dnscon
docentd
dohs
DomainService
dos.eeewl.com
Driver
driverpp
drop
drv
и
dvdkernl
e

Ř
Ř˙˙˙vk
ز
ƒ
Ř&para;
Ą
‡
edfscv
efidriver
el
’
el0
EmonSrv
Ř‹
eps32sys
epsn2sys
epsonsys
¸
&middot;çÔĆÍřÂç
estsprt
Ł
example
example1
exmtlst
ext20
§
&brvbar;
&laquo;
ŘŤ
Řľ
&copy;
¨


¨˛
¨&copy;
¨ˇ
¨‘
¨‹
F
fad
fan.eeewl.com
fanxctrld
Fast
FCI
ffpbek
file replication
FirstFantasy_Service
fkwld
flashdrv3
fmsq
fmtr
fnhoje
FOPF
FOPN
fpids32
fpuext
framework
front
fsprot
fwdrv.sys
FWSvc
g
gb
gdiw2k
gdow2k
General Socket Service
Google Online Search Service - 3d
Googles Onlines Search Services
GRANDE48
guhvj
guntest
gzg8wud2rcccs
hł
h&raquo;
h&plusmn;
hƒ
haxdrv
HĄ
h¤
hbin
HBKernel
h&not;
h‡
hcalway
h†
hdfs
hdusb
h‚
H&middot;
h¨
H&copy;
hflt_ipf
hhlmken
hidport
hidproc
HidServf
hipsrv
h‘
HlpSrv
hŠ
h‹
hpdriver
hpprintdrv
hqaply
hqiopa
husjdd8s
hwregprot
i
ˇ
ŚË† R­Č

i82440bx
icf
idersrvc
idnaux
IEAgent
iegrep
ies4service
iesprt
iesservice4
iexplor
imsvc
Indexingbox
Indexingboxs
indexingservice
indtry
infoxmid
Inprđ˙˙˙lf

Inprř˙˙˙@§
Inprř˙˙˙H&laquo;
Inprř˙˙˙č
Inprř˙˙˙čŻ
InprĐ˙˙˙J
InprŘ˙˙˙vk
Inprˆ˙˙˙nk
InprocServer32
InprocServer32-0 ˙˙˙C
InprocServer32Ç
 ˙˙˙C
InprocServer32Se ˙˙˙C
InprocServer32Seč˙˙˙vk
Inprč˙˙˙vk
Int-AOL_ConfSVC
internet connection manager
internets
investor
ippflt
iprip
ipudpb2
isponer
ispvcr
J
jmediaservice
jqvm465hmygebkpp6
jr
jsefusf
jtio
jwlbqzpi
k53lock
kasutio
ke7dnl
kednld
kkdj3sdf3
kkduusfsd
kprof
ks8j3jsisd
ksd2service
kusn33sd
kxsmp
l
•
lagednick
lanfs
lanmandrv
lanport
ldrsvc
lgkaisite
LinkServic
linksrvd
Live
lnk
localservices
LogicStorageMon
LPTRDCsrv
ˆ˙˙˙nk
ˆ&reg;
ˆŻ
ˆŞ
ˆŹ
ˆ˘
m
m_hook
m32lock
maimaiwei
mcfdrv
media serial number service
mediadrver
medie sariel number service
medie sariel number services
mercha2
merqpo
Mespanger
messageservice
messageservices
Messanger
Messssanger
mfbx
mfstcpip
mhfp
mi5035a5
Microsoft
Microsoft IE Updater_2
Microsoft Inet Service
Microsoft Internet Explorer
Microsoft_IE_Updater_1
mkwsqp
mm77lgn
mmc
mmccrd
mmlogon
mmupdate
mnsf
mobill
moprot
mp32
mpsmp
mqzprwe
ms_2fax
MSDebugsvc
msdirect
msdirectx
msdlobjdrv
msertk
msfpfis64
msftcpip
msgsat
mspath
mspcidrv
msprotect
msqmx
msrdr2
MsSecurity1.209.4
msskye
mssock
mssoftwareshadow
MSSysInterv
msudp4
msupdate
msusbbux
mswsaf
Msxesed
msyaxk
mxdispdr
mydns
myService12.0
mzu_rk
n
ĺa
Navoct
nĄŁ8’
ncio
nclaby
ndcia
ĺDF2143 TMP ‹ĄŁ8Ł8
ĺDF3540 TMP 
ĄŁ8Ł8
ĺDF4EE3 TMP bűĄŁ8Ł8
ĺDFB6E3 TMP ŹmĄŁ8Ł8
NdisWon
NDnet1
ne
ĺERFLI~1DAT
Nessery
nested
Net Agent
Net Assert
net event
net monitor
NetApi000
netdisdde
netdown
NetManager
netmon
NetSpoolsvs
network monitor
networklogon
networklogons
new_drv
nexkaqf
nfswzcsvc
nkgfs
ĺm
NNServ
nodantivir
noskrnl
ĺPDATE TMP 9藍8Ł8
ĺPT12 TMP ľ„ĄŁ8Ł8
nqaplwj
ĺSO390C8WMF
ĺSOCD2E9WMF
ĺSODECBEWMF
ĺSOE11F7WMF
ntio256
ntkrnl
ntldr.sys
ntload
NtmlSvc
ntndis
ntosnh.sys
ntoss.sys
ntprostorage
NtTf
ntworkstan
nucdrv
nuclab
numb
o
™
obbf117
obbn13rt
od32
odbcasvc
Oddysee
Office Source Engine Help
ohciusb
ohctusb
openglssd
openglwxd
oqtxde
oUltraf
ŕł
ŕ&raquo;
ŕ´
ŕĎ
ŕƒ
ŕź
ŕ‡
ŕŹ
ŕ†
ŕ‚
ŕ‰
ŕŠ
ŕ‹
ŕ
ŕ…
P
p

p


p
p~
p4p service
p76xxsks
p79bsksb
p81eskse
P&para;
PŽ
PagingSYS
Parallax
paraudio
parcls
PartMsg
partner
patterns
Pź
PciHardDisk
pcmmup
pcximg
PŹ
P‰
P&middot;
perfmons
performance monitor
ping
p•
plug-in
P“
poof
pop
popwinie
PowerIO
PowerManager
prĐ˙˙˙J
procserv
prot
protect
prowinmax
prč˙˙˙vk
prt21sks
prt47sys
prw76sks
P­
p—
p›
ptfs
P…
pzqlp
PŤ
qalwpmdgt
qosvc
qqd.sys
qwer78
qwetab
r
č
č
č˙˙˙A
č˙˙˙vk
čĘ
čÎ
r2
ramvxt
rasc1man
rĄŁ8̸
rĄŁ8Ł8
rcluma
rdriv
ReDevMonitor
regepsrvc
reiisadmin
relations
rem0teregistry
remon
remote access
remote access connection management
remote log
RemoteDbg
RESSDT
restoreservice
restoreservices
retx2
reveal32
č¨
rgwatch
RioDrvs
rkbypass
rlx66dob
robh
rofl
romman
roreg
rosa
routing
RpcApi
rpcs
rpcs11
rpcs2
rpcscfgb
rpcss32
rqksgpu
čś
runtime
runtime2
rwtatpl
rYehhbqzx
s
ć-‰ R­Č

¸ş
¸ą
s8696664
¸„
satad645
satau325
sĄŁ8Ěľ
sĄŁ8Ě&brvbar;
scce4
scripts
scsipsrvc
sdagentservice
sdcardX2
¸‰
se500mdmd
se633mxxd
security
SecurityMonitoringDriver
Selaris
serazavr
ServerAC
service.sys
service8696663
servicel
SERVICEMGR.EXE
services
Serviceusbhelp
ServicevcHelp
Serviceyyhelp
shiping
¸Ś
simple
sks2drvr
¸‘
¸ˆ
smonitor
smtpdrv
soceese
socket573
socketx113
soscar
SpyKillerProFilter
sqlservech
squell
srboty1.microsoft.com
srosa
á
¸¸
SServ
ssipod1
SsvcUpdate
stdio
stdservice
stdupnet
¸…
svchost
svcname
sxserv
symavc32
SYSATTRlB
SysLibrary
Sysload
sysloader
syssrv
system
System Event Browser
system sever
system32
systeminspect
systemm
SystemSet
syswindrv
szan1b
szkg5
˜Ş
˜ 
˜ź
˜€
˜
˜&copy;
˜–
˜˘
˜—
˜Ť
t
›
tap64drv
TASKMNG
TASKMNGR
taskmon.sys
te1net
tech
templates
test
test1
Thre&
ThreadingModel
ThreadingModel
ThreadingModel\
ThreadingModel0
ThreadingModelinč˙˙˙A
ThreadingModell
ThreadingModelprđ˙˙˙‘
timedrv26
tjk8rla0zxexp
TnIDriver
TPLinks
ttt_12
tuding
tuhdn
tunnet
u
šňŤ R­Č

…ĄŁ8
uerj45kj
umk8
umwdfmgr
uninterruptible
universal disk manager
upe
usb2
usb8028
usb8028x
usbpda
userinfo32
uxgrafj
v
viptray
virtualhardwareprotect
visionservice
vlansys0008
voodoo
vspf
vspf_hk
vxdgfx
vxvgfv
w
w3a9
wamer
wartamd
wcvs
wer32
werasqlp
WERFGH
wfprotect
wfprotects
wfsvl
Win32DDS
wincom32
windbg48
windhcpsvc
windownetpker
windows log
windows login
Windows Management Service
Windows Media_Player
windows nt service32
windows overlay components
windows smrss service
Windows XP Vista
windows_0
windows_rejoice
Windows_rejoice2007
windowssys
WinINI
winlogin
winmon
Winnotify
winsflash
Winsp2
winxpdhcpsvc
wizca
wmdmpmd
WmdmPWD
WMIApiSrv
wnlogon
wnlogow
wnttech
wrepmon
wrmdrv
wsfit32
wsmsge
wsnpoem.sys
wspipe
wzcsrvc
x
XŻ
xş
Xż
XĎ
x&micro;
X„
xartcd7
XĄ
xź
xcdkernl
xŹ
X&copy;
Xˇ
XŚ
xkeyshd
X‘
xlavba8
Xˆ
xmlprovider
x“
x™
xpdx
xprot
XPROTECTOR
xpsp2reg
xpsp2tdi
x­
X§
xŤ
YahooSvr
yeTyezzd
yeyqase
Yiqilai
yqzsypbgh
yutsubk
za
zalpqbj
zclient
zeqbqwp
zeqwur
zloguwzp
zopenssld
zpzbwbhu
zstdp
Zumie Search Service
zyxelmodem
zzz
ZZZdrv_lich
ZZZsvc_lich

.
((((((((((((((((((((((((( Files Created from 2008-04-03 to 2008-05-03 )))))))))))))))))))))))))))))))
.

2008-05-03 21:26 . 2008-05-03 21:29 0 --a------ C:\WINDOWS\system.ini
2008-05-03 21:22 . 2008-05-03 21:22 <DIR> d--hs---- C:\FOUND.005
2008-05-02 12:28 . 2008-05-02 12:28 <DIR> d-------- C:\Program Files\InterMute
2008-05-02 11:41 . 2008-05-02 11:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-02 11:41 . 2008-05-02 11:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-10 15:45 . 2008-05-01 22:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-10 15:45 . 2008-04-10 15:45 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 22:47 21,052 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2008-03-25 22:47 15,144 ----a-w C:\WINDOWS\system32\SIntf32.dll
2008-03-25 22:47 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2008-03-25 15:54 --------- d-----w C:\Program Files\Blaze Media Pro
2008-03-25 15:53 --------- d--h--w C:\Documents and Settings\All Users\Application Data\{56759C22-EA1E-4BE5-A903-72F67D450F43}
2008-03-23 22:10 --------- d-----w C:\Program Files\YDP
2008-03-21 20:32 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-21 20:32 --------- d-----w C:\Documents and Settings\Agulek\Application Data\skypePM
2008-03-21 20:30 --------- d-----w C:\Documents and Settings\Agulek\Application Data\Skype
2008-03-21 20:29 --------- d-----w C:\Program Files\Skype
2008-03-21 20:29 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-21 20:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-03-20 23:40 --------- d-----w C:\Program Files\WMV9_VCM
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-11 08:32 --------- d-----w C:\Documents and Settings\Agulek\Application Data\ABBYY
2008-03-11 08:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\ABBYY
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:32 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-16 22:29 3,059,712 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-15 09:23 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
2008-02-09 14:28 323,584 ----a-w C:\WINDOWS\system32\AudioGenie2.dll
2007-12-07 16:20 32,424 ----a-w C:\Documents and Settings\Agulek\Application Data\GDIPFONTCACHEV1.DAT
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((( snapshot@2008-05-03_20.38.35.84 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-03 16:07:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-03 19:27:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-03 19:27:28 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_614.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LAN Messenger"="" []
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25 1961984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"PFO Check Settings"="pfochk.exe" [2003-08-14 21:53 57344 C:\WINDOWS\pfochk.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 18:00 98304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:07 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll
"msacm.l3codec"= l3codecp.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Aktywacja Testera.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Aktywacja Testera.lnk
backup=C:\WINDOWS\pss\Aktywacja Testera.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2006-03-14 04:06 1397760 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-02-08 21:36 155648 C:\Program Files\QuickTime\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\LAN Messenger\\LANMsg.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\LDC\\LDCPlusPlus.exe"=
"C:\\Program Files\\PeerCast\\PeerCast.exe"=
"C:\\Program Files\\iDC\\oDC.exe"=
"C:\\Program Files\\Microsoft Office\\Office10\\WINWORD.EXE"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-03 21:29:51
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-03 21:30:25
ComboFix2.txt 2008-05-03 18:38:52
ComboFix-quarantined-files.txt 2008-05-03 19:30:22

Pre-Run: 4,073,152,512 bytes free
Post-Run: 4,068,941,824 bytes free

1357 --- E O F --- 2008-04-11 14:00:19

[ Dodano: Dzisiaj o 23:44 ]
czy ma ktoś jakieś nowe pomysły? bo jestem bezradna:(

[wojtas]

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....potem nowy log z hijacka i combo

[piotrekf]

Witam!

Ja równiez mam problem z amvo.exe. Jesli moglbym prosić o pomoc to bede wdzieczny.

Oto log z combofix:



ComboFix 08-05-01.3 - Piotr Fater 2008-05-04 11:57:35.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.168 [GMT 2:00]
Running from: C:\Documents and Settings\Piotr Fater\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\setup.exe
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
I:\Autorun.inf
J:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-04-04 to 2008-05-04 )))))))))))))))))))))))))))))))
.

2008-05-04 11:52 . 2008-05-04 11:52 <DIR> d-------- C:\Program Files\PrevxCSI
2008-05-04 11:52 . 2008-05-04 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PrevxCSI
2008-05-04 11:52 . 2008-05-04 11:52 10,880 --a------ C:\WINDOWS\system32\drivers\pxark.sys
2008-05-03 16:44 . 2008-05-03 16:44 <DIR> d--hs---- C:\FOUND.018
2008-05-01 18:21 . 2008-04-28 09:04 105,128 -r-hs---- C:\oq.cmd
2008-05-01 18:19 . 2008-05-01 18:19 <DIR> d--hs---- C:\FOUND.017
2008-04-22 21:46 . 2008-04-29 16:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-22 21:46 . 2008-04-22 21:46 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-11 18:43 . 2008-04-11 18:43 <DIR> d-------- C:\Program Files\vghd
2008-04-08 07:56 . 2008-04-08 07:56 <DIR> d--hs---- C:\FOUND.016
2008-04-07 17:54 . 2008-04-05 20:05 26,986 --a------ C:\WINDOWS\_detmp.1
2008-04-05 20:04 . 2008-04-05 20:04 <DIR> d-------- C:\Documents and Settings\Piotr Fater\WINDOWS
2008-04-05 20:04 . 1996-11-05 16:13 299,008 --a------ C:\WINDOWS\uninst.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-02 18:15 1,112 ----a-w C:\Documents and Settings\Piotr Fater\Dane aplikacji\ViewerApp.dat
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,504 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-05 21:44 --------- d-----w C:\Program Files\NetMeter
2008-03-01 16:32 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 08:59 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-29 08:59 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:38 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:38 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-26 14:23 40,776 ----a-w C:\Documents and Settings\Piotr Fater\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-01-25 01:52 65,536 ----a-w C:\Program Files\Common Files\NMSAccessU.exe
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
2007-06-11 12:48 8 --sh--r C:\WINDOWS\system32\AA0EF28E1C.sys
2007-08-23 16:45 6,580 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-23 16:45 56 --sh--r C:\WINDOWS\system32\1C8EF20EAA.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"MSMSGS"=":C:\Program Files\Messenger\msmsgs.exe" [ ]
"Malware Sweeper"=":C:\Program Files\MalwareSweeper.com\Malware Sweeper\MalSwep.exe" [ ]
"PowerBar"="" []
"BitTorrent"=":I:\Program Files\BitTorrent\bittorrent.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2003-07-18 00:53 147456]
"UpdReg"=":C:\WINDOWS\Updreg.exe" [ ]
"Disc Detector"=":C:\Program Files\Creative\ShareDLL\CtNotify.exe" [ ]
"AHQInit"=":C:\Program Files\Creative\SBLive\Program\AHQInit.exe" [ ]
"AudioHQ"="C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE" [2001-08-17 17:01 180224]
"NeroFilterCheck"=":C:\WINDOWS\system32\NeroCheck.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-28 11:20 188416]
"ATICCC"=":C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [ ]
"InCD"=":E:\Program Files\ahead\InCD\InCD.exe" [ ]
"PWRISOVM.EXE"=":E:\Program Files\PowerISO\PWRISOVM.EXE" [ ]
"PCSuiteTrayApplication"=":C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [ ]
"RemoteControl"=":I:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [ ]
"Adobe Photo Downloader"=":I:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [ ]
"hffsrv"="c:\windows\hffext\hffsrv.exe" [2007-02-03 01:17 83968]
"ISUSPM Startup"=":C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [ ]
"ISUSScheduler"=":C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [ ]
"Sony Ericsson PC Suite"=":I:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-03 12:25:03 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= ctwdm32.dll
"msacm.ctmp3"= C:\WINDOWS\system32\ctmp3.acm
"aux1"= ctwdm32.dll
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FDCENT.SYS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HideFilesAndFolders_S]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\GG.EXE"=
"E:\\Program Files\\eMule\\emule.exe"=
"E:\\Program Files\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Tlen.pl\\TLEN.EXE"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"I:\\Program Files\\Opera\\Opera.exe"=
"I:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Documents and Settings\\Piotr Fater\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"I:\\Program Files\\KONAMI\\Pro Evolution Soccer 6\\PES6.exe"=
"E:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5100:TCP"= 5100:TCP:wp.pl
"5000:TCP"= 5000:TCP:gryonline.wp.pl
"20225:TCP"= 20225:TCP:BitComet 20225 TCP
"20225:UDP"= 20225:UDP:BitComet 20225 UDP
"21678:TCP"= 21678:TCP:BitComet 21678 TCP
"21678:UDP"= 21678:UDP:BitComet 21678 UDP

R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-05-04 11:52]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R1 FDCENT;FDCENT;C:\WINDOWS\system32\drivers\FDCENT.SYS [2007-01-27 19:28]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 CSIScanner;CSIScanner;"C:\Program Files\PrevxCSI\\PrevxCSI.exe" /service []
R2 NMSAccessU;NMSAccessU;C:\Program Files\Common Files\NMSAccessU.exe [2007-01-25 03:52]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2003-02-26 18:28]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 15:54]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15:54]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 15:54]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 15:54]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 15:54]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);C:\WINDOWS\system32\DRIVERS\s816bus.sys [2007-06-19 09:51]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s816mdfl.sys [2007-06-19 09:51]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s816mdm.sys [2007-06-19 09:51]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s816mgmt.sys [2007-06-19 09:51]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);C:\WINDOWS\system32\DRIVERS\s816nd5.sys [2007-06-19 09:51]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s816obex.sys [2007-06-19 09:51]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);C:\WINDOWS\system32\DRIVERS\s816unic.sys [2007-06-19 09:51]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1667f988-26a8-11da-9eeb-000ce584221f}]
\Shell\AutoRun\command - K:\oq.cmd
\Shell\explore\Command - K:\oq.cmd
\Shell\open\Command - K:\oq.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a96a34e2-b173-11dc-a86a-000ce584221f}]
\Shell\AutoRun\command - L:\oq.cmd
\Shell\explore\Command - L:\oq.cmd
\Shell\open\Command - L:\oq.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c6a7cae2-bae3-11dc-a87a-000ce584221f}]
\Shell\AutoRun\command - L:\start.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - CSISCANNER
*Newly Created Service* - PXARK
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-04 11:59:44
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PowerBar = ????<???D??sh?????6~????h???Z?6~(???*?6~t?@?l?@???d???????????????????????????6~??????????????????6~????W?9~0?6~????*?6~??6~????D??s ?????????6~????l?@???????6~????t?@??Yb?????????l?@?l?@?????Q?7~????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-04 12:00:32
ComboFix-quarantined-files.txt 2008-05-04 10:00:28

Pre-Run: 1,888,215,040 bajtów wolnych
Post-Run: 1,985,724,416 bajtów wolnych

172 --- E O F --- 2008-04-11 16:41:55

[Okocza]

załóż swój temat