Mam problem prosze o pomoc

[Clinic]

ComboFix 08-03-20.5 - grzesiek 2008-03-21 9:48:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.477 [GMT 1:00]
Running from: C:\Documents and Settings\grzesiek\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\amvo1.dll
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-02-21 to 2008-03-21 )))))))))))))))))))))))))))))))
.

2008-03-21 09:48 . 2008-03-20 21:28 100,031 -r-hs---- C:\n2de.cmd
2008-03-20 21:25 . 2006-06-02 19:38 425,984 -ra------ C:\WINDOWS\system32\stmcfg32.dll
2008-03-20 21:25 . 2006-06-02 12:01 151,552 -ra------ C:\WINDOWS\system32\stmctrl.dll
2008-03-20 21:25 . 2008-03-20 21:25 2,849 --a------ C:\WINDOWS\stsetup.htm
2008-03-19 23:24 . 2008-03-19 23:24 38 --a------ C:\WINDOWS\avisplitter.INI
2008-03-18 20:44 . 2008-03-18 20:44 99,735 -r-hs---- C:\h6o0re.cmd
2008-03-16 16:39 . 2008-03-21 09:30 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-03-16 15:08 . 2008-03-16 15:08 <DIR> d-------- C:\Program Files\NeroInstall.bak
2008-03-16 15:06 . 2008-03-16 15:06 <DIR> d-------- C:\Documents and Settings\grzesiek\Dane aplikacji\Nero
2008-03-16 15:03 . 2008-03-16 15:05 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-03-16 15:03 . 2008-03-16 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-03-16 00:02 . 2008-03-17 18:07 100,836 -r-hs---- C:\3o.exe
2008-03-01 13:47 . 2008-03-01 13:47 <DIR> d-------- C:\Program Files\Borland
2008-03-01 13:47 . 2008-03-02 14:22 30 --a------ C:\WINDOWS\coder.ini
2008-02-28 23:11 . 2008-02-28 23:11 <DIR> d-------- C:\Documents and Settings\grzesiek\Dane aplikacji\Media Player Classic
2008-02-28 17:38 . 2008-02-28 17:38 972,072 --a------ C:\WINDOWS\UNNeroMediaHome.exe
2008-02-26 16:14 . 2008-02-26 16:14 972,072 --a------ C:\WINDOWS\UNRecode.exe
2008-02-25 16:37 . 2008-02-25 16:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\POPWWPROFILES
2008-02-25 13:18 . 2008-02-25 13:18 <DIR> d-------- C:\WINDOWS\Cache
2008-02-24 15:11 . 2008-02-24 15:12 <DIR> d-------- C:\Program Files\Hamachi

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-21 08:23 --------- d-----w C:\Program Files\neostrada tp
2008-03-18 20:19 --------- d-----w C:\Documents and Settings\grzesiek\Dane aplikacji\Hamachi
2008-03-16 20:04 --------- d-----w C:\Documents and Settings\grzesiek\Dane aplikacji\foobar2000
2008-03-16 14:03 --------- d-----w C:\Program Files\Nero
2008-03-16 13:51 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-16 12:42 --------- d-----w C:\Program Files\SkanerOnline
2008-03-02 14:04 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-25 15:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-25 12:25 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-24 14:11 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-02-23 12:38 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-23 12:12 --------- d-----w C:\Program Files\SubEdit-Player
2008-02-18 15:21 132,904 ----a-w C:\WINDOWS\system32\drivers\imagesrv.sys
2008-02-18 15:21 11,304 ----a-w C:\WINDOWS\system32\drivers\imagedrv.sys
2008-02-18 15:04 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
2008-01-10 12:16 159,839 ----a-w C:\WINDOWS\system32\xvidvfw.dll
2008-01-10 12:15 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll
2008-01-09 14:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-26 19:51 68856]
"ASUSTPE"="C:\WINDOWS\system32\ASUSTPE.exe" [2006-10-14 10:43 69632]
"AlcoholAutomount"="D:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-02-22 12:22 216520]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [ ]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]
"avpa"="C:\WINDOWS\system32\avpo.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-10-14 10:37 110592]
"nwiz"="nwiz.exe" [2006-04-27 03:48 1519616 C:\WINDOWS\system32\nwiz.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 13:02 786521]
"ACMON"="C:\Program Files\ASUS\Splendid\ACMON.exe" [2006-05-30 09:28 811008]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"ACU"="C:\Program Files\Atheros\ACU.exe" [2006-07-04 14:09 336001]
"avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 17:01 90112]
"ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-06-08 19:33 53248]
"PowerForPhone"="C:\Program Files\PowerForPhone\PowerForPhone\PowerForPhone.exe" [2006-06-29 13:40 774144]
"ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 14:20 180224]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768]
"WinampAgent"="D:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28 36352]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-12 13:08 185896]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 12:49 16269312 C:\WINDOWS\RTHDCPL.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-27 03:48 7561216]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 09:59 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 16:29 2221352]
"SMSERIAL"="C:\WINDOWS\sm56hlpr.exe" [2006-03-21 15:54 544768]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-27 03:48 86016]
"AdslTaskBar"="stmctrl.dll" [2006-06-02 12:01 151552 C:\WINDOWS\system32\stmctrl.dll]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 13:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 15:55 32768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
MultiFrame.lnk - C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe [2007-08-08 20:09:19 491520]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Medal of Honor Pacific Assault(tm)\\mohpa.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"D:\\Program Files\\DC++\\DCPlusPlus.exe"=
"D:\\Program Files\\SopCast\\SopCast.exe"=
"D:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Documents and Settings\\grzesiek\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"=
"D:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"D:\\DMTP_2.08_by_Klemens\\DMTP2.08\\Dream Match Tennis Pro.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10255:TCP"= 10255:TCP:BitComet 10255 TCP
"10255:UDP"= 10255:UDP:BitComet 10255 UDP
"10557:TCP"= 10557:TCP:BitComet 10557 TCP
"10557:UDP"= 10557:UDP:BitComet 10557 UDP

R3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\ATK0100\ASNDIS5.SYS [2004-05-28 03:13]
R3 nvsmu;nvsmu;C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2005-11-15 00:51]
R3 RTSTOR;USB Mass Stroage Device;C:\WINDOWS\system32\drivers\RTSTOR.SYS [2006-06-09 23:07]
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 15:51]
R3 SynMini;USB2.0 1.3M WebCam;C:\WINDOWS\system32\Drivers\SynMini.sys [2006-08-09 07:15]
R3 SynScan;USB2.0 1.3M WebCam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [2006-08-09 07:15]
R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\system32\DRIVERS\torususb.sys [2006-05-25 16:28]
S3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 13:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4d7808a-e20c-11dc-9d64-001bfcdc3dfc}]
\Shell\AutoRun\command - F:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3dcc936-ed09-11dc-9d7f-001bfcdc3dfc}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-21 09:50:43
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-21 9:51:28
ComboFix-quarantined-files.txt 2008-03-21 08:51:10
.
2007-08-10 15:25:03 --- E O F ---

Moze ktoś pomoże w usunięci tego wirusa byłbym wdzieczny

[pp3088]

start>>uruchom>>wpisujesz "regedit">>odnajdujesz klucz
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\
i usuwasz go.

[Clinic]

dzieki wielkie

[huber2t]

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

File::
C:\n2de.cmd
C:\h6o0re.cmd
C:\3o.exe


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox