Log z ComboFix. Proszę o pomoc.

[fola87]

Jestem w tych rzeczach zielona, więc proszę o pomoc. Ciągle mi wyskakuje alarm o trojanach, których nie mogę usunąć. Do tego nie działa mi w ogóle opcja "Pokaż ukryte pliki i foldery". Co mam zrobić.

ComboFix 08-03-17.1 - Olusia 2008-03-17 23:02:14.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.124 [GMT 1:00]
Running from: C:\Documents and Settings\Olusia\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Documents and Settings\Olusia\Dane aplikacji\urlredir.cfg
C:\WINDOWS\system32\adssite-remove.exe
C:\WINDOWS\system32\adssite_sidebar.dll
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo1.dll
C:\WINDOWS\system32\iebrowserc.dll
C:\WINDOWS\system32\nsi20.dll
C:\WINDOWS\system32\rightonadz-uninst.exe
D:\Autorun.inf
E:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-02-17 to 2008-03-17 )))))))))))))))))))))))))))))))
.

2008-03-17 22:40 . 2008-03-17 22:40 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-17 22:40 . 2008-03-17 22:41 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-03-17 22:39 . 2008-03-17 22:39 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-17 22:26 . 2008-03-17 22:31 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-03-17 22:25 . 2008-03-17 22:26 <DIR> d-------- C:\Program Files\Trojan Remover
2008-03-17 22:25 . 2008-03-17 22:25 <DIR> d-------- C:\Documents and Settings\Olusia\Dane aplikacji\Simply Super Software
2008-03-17 22:25 . 2008-03-17 22:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Simply Super Software
2008-03-17 22:25 . 2006-05-25 14:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2008-03-17 22:25 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-03-17 22:25 . 2005-08-26 00:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2008-03-17 22:25 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-03-17 22:25 . 2006-06-19 12:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2008-03-17 21:56 . 2008-03-17 21:56 <DIR> d-------- C:\Program Files\The Cleaner Free
2008-03-17 21:56 . 2008-03-17 21:56 5,376 --a------ C:\WINDOWS\system32\drivers\MS1000.sys
2008-03-17 21:53 . 2008-03-17 21:53 <DIR> d-------- C:\Program Files\a-squared HiJackFree
2008-03-17 19:22 . 2008-03-17 19:26 84,729 --a------ C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe
2008-03-14 13:15 . 2008-03-16 12:28 107,155 -r-hs---- C:\fppg1.exe
2008-03-11 14:45 . 2008-03-11 14:45 339,968 --a------ C:\WINDOWS\system32\mysidesearch_sidebar.dll
2008-02-26 18:46 . 2008-03-13 23:54 107,489 -r-hs---- C:\u2.cmd
2008-02-20 12:04 . 2008-02-25 12:55 107,959 -r-hs---- C:\oufddh.exe
2008-02-19 21:32 . 2008-02-19 21:31 107,052 -r-hs---- C:\gumkrhf.bat
2008-02-18 17:32 . 2008-02-19 21:31 107,052 -r-hs---- C:\0hct8ybw.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 21:55 --------- d-----w C:\Documents and Settings\Olusia\Dane aplikacji\Skype
2008-02-15 14:44 103,461 --sh--r C:\d6fagcs8.cmd
2008-02-14 18:33 104,813 --sh--r C:\3wcxx91.cmd
2008-02-10 01:34 77,353 ----a-w C:\WINDOWS\system32\adssite_sidebar_uninstall.exe
2008-02-08 14:26 --------- d-----w C:\Program Files\Google
2008-02-08 10:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-08 10:23 --------- d-----w C:\Program Files\IrfanView
2008-02-08 10:17 --------- d-----w C:\Program Files\Microtek
2008-02-06 14:41 103,404 --sh--r C:\x.com
2008-02-04 20:07 103,367 --sh--r C:\2ifetri.cmd
2008-02-02 17:20 104,644 --sh--r C:\i.cmd
2008-02-01 15:09 103,574 --sh--r C:\h.cmd
2008-01-29 20:21 103,683 --sh--r C:\ylr.exe
2008-01-25 13:14 46,300 ----a-w C:\WINDOWS\system32\AdssiteSocial-uninstall.exe
2008-01-20 22:20 --------- d-----w C:\Program Files\Sony Ericsson
2007-12-21 14:39 10,752 ----a-w C:\WINDOWS\system32\WhoisCL.exe
2006-11-06 20:01 17,144 ----a-w C:\Documents and Settings\Olusia\Dane aplikacji\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DDFA1356-E6ED-42a5-9D62-93211D424A90}]
2008-03-11 14:45 339968 --a------ C:\WINDOWS\system32\mysidesearch_sidebar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-08-28 15:52 21710888]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"Gadu-Gadu"="D:\Programy\Gadu-Gadu\gg.exe" [2006-10-03 12:55 1631944]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-02-08 10:54 171448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-02-23 05:40 106496]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-08 20:05 344064]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 07:26 761945]
"avast!"="D:\Programy\Avast\ashDisp.exe" [2007-12-04 14:00 79224]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-15 13:30 196608]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-04 08:59 16206848 C:\WINDOWS\RTHDCPL.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 12:03 36975]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-02-19 16:16 185784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-03-17 16:38 873552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - D:\Programy\office\Office10\OSA.EXE [2001-02-13 09:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
--a------ 2006-01-20 05:34 544768 C:\WINDOWS\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"D:\\Programy\\Gadu-Gadu\\gg.exe"=
"D:\\Program Files\\BearShare\\BearShare.exe"=
"D:\\Programy\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 18:54]
R3 SynMini;USB2.0 1.3M Web Cam;C:\WINDOWS\system32\Drivers\SynMini.sys [2005-10-03 09:26]
R3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [2005-10-03 09:26]
S3 axsaki;axsaki;C:\WINDOWS\system32\DRIVERS\axsaki.sys [2003-03-30 20:38]
S3 axskbus;axskbus;C:\WINDOWS\system32\DRIVERS\axskbus.sys [2003-03-28 10:58]
S3 pmxscan;USB ScanModule V5.1 Driver;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{263fa353-5619-11db-931e-0018f32ee07a}]
\Shell\AutoRun\command - G:\x6.bat
\Shell\explore\Command - G:\x6.bat
\Shell\open\Command - G:\x6.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a703832-ce3f-11dc-997f-0018f32ee07a}]
\Shell\AutoRun\command - G:\u.bat
\Shell\explore\Command - G:\u.bat
\Shell\open\Command - G:\u.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{457d6678-bce7-11db-94d0-0018f32ee07a}]
\Shell\AutoRun\command - G:\2ifetri.cmd
\Shell\explore\Command - G:\2ifetri.cmd
\Shell\open\Command - G:\2ifetri.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6227e298-fc9e-11db-95ff-0018f32ee07a}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe pagefile.sys.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4d2d39a-f4c9-11dc-99dc-0018f32ee07a}]
\Shell\AutoRun\command - G:\x6.bat
\Shell\explore\Command - G:\x6.bat
\Shell\open\Command - G:\x6.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a5f88f96-cf42-11dc-9986-0018f32ee07a}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e21a4fd8-7f00-11dc-9805-0018f32ee07a}]
\Shell\AutoRun\command - H:\x6.bat
\Shell\explore\Command - H:\x6.bat
\Shell\open\Command - H:\x6.bat

*Newly Created Service* - AAWSERVICE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-17 23:04:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-17 23:04:49
ComboFix-quarantined-files.txt 2008-03-17 22:04:33
ComboFix2.txt 2008-01-29 21:14:47
ComboFix3.txt 2008-01-29 20:56:39
.
2008-02-15 08:57:19 --- E O F ---

[pp3088]

start>>uruchom>>wpisujesz "regedit">>odnajdujesz klucz
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\
i usuwasz go.

[fola87]

Dziękuje bardzo .
Opcja wróciła .

[huber2t]

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

File::
C:\fppg1.exe
C:\u2.cmd
C:\oufddh.exe
C:\gumkrhf.bat
C:\0hct8ybw.bat
C:\d6fagcs8.cmd
C:\3wcxx91.cmd
C:\x.com
C:\2ifetri.cmd
C:\i.cmd
C:\h.cmd
C:\ylr.exe


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox