Win32:rootkit - avast ciągle o nim informuje

[axeld]

Mam nadzieję, że to nic groźnego, oraz że logi zrobiłem dobrze

Oto logi z:
OTL - http://wklej.org/hash/528d78a3871/
RSIT - http://wklej.org/hash/dd650a0ceba/
GMER - http://wklej.org/hash/b2d04d68731/

[wojtas]

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1572363
FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Castle Age Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2536667&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
FF - prefs.js..extensions.enabledItems: {aac4043a-8832-4abe-9963-35377f30b8e6}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {64e8cc5b-20db-4212-8320-178fc5ae71f7}:1.0
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.13
FF - prefs.js..extensions.enabledItems: {eaf8a4ef-d221-45ca-9deb-d0934b45fa34}:1.3.0.3
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
O2 - BHO: (BrowserHelper Class) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll File not found
O4 - Startup: C:\Documents and Settings\Axel\Menu Start\Programy\Autostart\winesm32.exe ()
33 - MountPoints2\{16124bd8-cedd-11dd-97e5-000df30496e8}\Shell - "" = AutoRun
O33 - MountPoints2\{5f0e6ebe-46a3-11dd-9742-000df30496e8}\Shell\AutoRun\command - "" = RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
O33 - MountPoints2\{5f0e6ebe-46a3-11dd-9742-000df30496e8}\Shell\open\command - "" = RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
O33 - MountPoints2\{a58d4eb7-4950-11de-9868-000df30496e8}\Shell\AutoRun\command - "" = H:\setupSNK.exe -- File not found
O33 - MountPoints2\{c3cad9f6-af40-11de-9898-000df30496e8}\Shell - "" = AutoRun
O33 - MountPoints2\{c3cad9f6-af40-11de-9898-000df30496e8}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -- File not found
O33 - MountPoints2\{fc509540-0d6d-11dd-9711-000df30496e8}\Shell\AutoRun\command - "" = H:\EXPLORER.EXE -- File not found
O33 - MountPoints2\{fc509540-0d6d-11dd-9711-000df30496e8}\Shell\explore\Command - "" = H:\EXPLORER.EXE -- File not found
O33 - MountPoints2\{fc509540-0d6d-11dd-9711-000df30496e8}\Shell\open\Command - "" = H:\EXPLORER.EXE -- File not found


:Files
C:\Documents and Settings\Axel\Dane aplikacji\avdrn.dat
C:\Documents and Settings\Axel\Menu Start\Programy\Autostart\winesm32.exe
C:\Documents and Settings\Axel\Dane aplikacji\Mozilla\Firefox\Profiles\wnbkszv6.default\extensions\{aac4043a-8832-4abe-9963-35377f30b8e6}
C:\Documents and Settings\Axel\Dane aplikacji\Mozilla\Firefox\Profiles\wnbkszv6.default\searchplugins\conduit.xml
C:\Documents and Settings\Axel\Dane aplikacji\Mozilla\Firefox\Profiles\wnbkszv6.default\searchplugins\anfopl.xm


:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]

Kliknij w Run Fix. I potwierdz reset kompa .

te plik/i :

C:\WINDOWS\System32\drivers\rootrepeal.sys
C:\WINDOWS\System32\drivers\changer.sys
C:\WINDOWS\System32\dllcache\i2omgmt.sys

przeskanuj tu
http://virusscan.jotti.org/
http://www.virustotal.com/


Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia komputera i daj raporty ze skanow plików