antivirus-2008.exe

ComboFix 08-08-04.05 - Michał 2008-08-05 15:55:58.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1147 [GMT 2:00]
Running from: E:\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Michał\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk
C:\Documents and Settings\Michał\Menu Start\Programy\Antivirus 2008 PRO
C:\Documents and Settings\Michał\Menu Start\Programy\Antivirus 2008 PRO\antivirus-2008pro.lnk
C:\Documents and Settings\Michał\Pulpit\Error Cleaner.url
C:\Documents and Settings\Michał\Pulpit\Privacy Protector.url
C:\Documents and Settings\Michał\Pulpit\Spyware&Malware Protection.url
C:\Documents and Settings\Michał\Ulubione\Error Cleaner.url
C:\Documents and Settings\Michał\Ulubione\Privacy Protector.url
C:\Documents and Settings\Michał\Ulubione\Spyware&Malware Protection.url
C:\Program Files\Antivirus 2008 PRO
C:\Program Files\Antivirus 2008 PRO\antivirus-2008pro.exe
C:\Program Files\Antivirus 2008 PRO\vscan.tsi
C:\Program Files\Antivirus 2008 PRO\zlib.dll
C:\WINDOWS\edot.exe
C:\WINDOWS\eqvwamkl.dll
C:\WINDOWS\fdkowvbp.dll
C:\WINDOWS\grswptdl.exe
C:\WINDOWS\nfavxwdbdfm.dll
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\system32\byXRlMcy.dll
C:\WINDOWS\system32\hgGyyyvu.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\qoMfdeBr.dll
C:\WINDOWS\system32\rBedfMoq.ini
C:\WINDOWS\system32\rBedfMoq.ini2
C:\WINDOWS\system32\ssqPJbBr.dll
C:\WINDOWS\system32\uhvpakmt.ini
C:\WINDOWS\system32\urqRHbXr.dll
C:\WINDOWS\wnslvxtf.dll

.
((((((((((((((((((((((((( Files Created from 2008-07-05 to 2008-08-05 )))))))))))))))))))))))))))))))
.

2008-08-05 16:08 . 2008-08-05 16:08 1,382,137 ---hs---- C:\WINDOWS\system32\uhvpakmt.ini
2008-08-05 16:04 . 2008-08-05 16:04 2,309 --a------ C:\Documents and Settings\Michacatchme.zip
2008-08-05 15:36 . 2008-08-05 15:36 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-08-05 14:06 . 2008-08-05 14:43 <DIR> d-------- C:\Program Files\SkanerOnline
2008-08-05 13:33 . 2008-08-05 13:33 99,712 --a------ C:\WINDOWS\system32\tmkapvhu.dll
2008-08-01 10:23 . 2008-08-01 21:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-01 10:23 . 2008-08-01 10:23 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-05 11:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-24 09:56 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-08 13:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ZoomBrowser
2008-01-04 14:41 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-05-05 16:34 3805184]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-05-05 16:34 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Adobe Reader Speed Launcher"="E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"QuickTime Task"="E:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"70529141"="C:\WINDOWS\system32\tmkapvhu.dll" [2008-08-05 13:33 99712]
"nwiz"="nwiz.exe" [2004-05-05 16:34 831488 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 10:53 65024 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360]
"Nokia.PCSync"="E:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-01-04 13:18:21 113664]
Microsoft Office.lnk - E:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.DVX4"= DivX4.dll
"msacm.divxa32"= DivXa32.acm
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\totalcmd\\TOTALCMD.EXE"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"E:\\Program Files\\Opera\\Opera.exe"=

.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Skype - C:\Documents and Settings\Michał\Pulpit\Skype.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Michał\Dane aplikacji\Mozilla\Firefox\Profiles\kdddlbii.default\


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-05 16:08:25
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\system32\uhvpakmt.ini 1382137 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\tmkapvhu.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\MichaE:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-08-05 16:12:59 - machine was rebooted [Michaˆ]
ComboFix-quarantined-files.txt 2008-08-05 14:12:44
ComboFix2.txt 2008-03-03 21:57:48

Pre-Run: 2,159,857,664 bajtów wolnych
Post-Run: 2,913,505,280 bajt˘w wolnych

143

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod:

File::
C:\WINDOWS\system32\uhvpakmt.ini
C:\WINDOWS\system32\tmkapvhu.dll

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"70529141"=-


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

Logi dajesz na http://www.wklej.eu/ a w poście dajesz tylko link

http://www.wklejto.pl/7376

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod:

File::
C:\WINDOWS\system32\tmkapvhu.dll


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

Logi dajesz na http://www.wklej.eu/ a w poście dajesz tylko link