Muli i jest wirus jakis ~autorun czy cos...

Komp bez dostepu do internetu, nie moglam w zaden sposob uaktualnic bazy sygnatur do noda, zainstalowalam avasta no i wyszlo na to jakbym go wogole nie miala...Zrobiłam formata ale nic nie pomogło. Nie jestem "biegła" w sprawach komputerowych, wiec prosze o pomoc...no i wyrozumialość :]

ComboFix 08-04-10.9 - Monika 2008-04-11 17:21:34.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.76 [GMT 2:00]
Running from: C:\Documents and Settings\Monika\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-11 to 2008-04-11 )))))))))))))))))))))))))))))))
.

2008-04-11 16:01 . 2008-04-11 16:55 1,632 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-04-10 23:24 . 2008-04-10 23:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-10 23:17 . 2008-04-10 23:17 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-04-10 23:14 . 2008-04-10 23:41 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-04-10 23:10 . 2008-04-10 23:12 <DIR> d-------- C:\WINDOWS\nview
2008-04-10 23:10 . 2004-10-29 16:50 172,032 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-04-10 23:10 . 2004-10-29 16:50 13,653 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-04-10 23:09 . 2008-04-10 23:09 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-04-10 23:09 . 2008-04-10 23:09 <DIR> d-------- C:\NVIDIA
2008-04-10 23:03 . 2008-04-10 23:03 <DIR> d-------- C:\Program Files\Lexmark 640 Series
2008-04-10 23:03 . 2006-04-17 19:42 311,296 --a------ C:\WINDOWS\system32\LEXBCES.EXE
2008-04-10 23:03 . 2006-04-17 19:41 201,216 --a------ C:\WINDOWS\system32\LEXP2P32.DLL
2008-04-10 23:03 . 2006-04-17 19:48 200,704 --a------ C:\WINDOWS\system32\lexlmpm.dll
2008-04-10 23:03 . 2006-04-17 19:42 198,144 --a------ C:\WINDOWS\system32\LEX2KUSB.DLL
2008-04-10 23:03 . 2006-04-17 19:41 174,592 --a------ C:\WINDOWS\system32\LEXPPS.EXE
2008-04-10 23:03 . 2006-04-17 19:41 147,456 --a------ C:\WINDOWS\system32\LEXBCE.DLL
2008-04-10 23:03 . 2006-05-11 06:14 73,728 --a------ C:\WINDOWS\system32\lxdapwr.dll
2008-04-10 22:55 . 2001-10-26 17:29 177,152 --a------ C:\WINDOWS\system32\LXACSUI.DLL
2008-04-10 22:37 . 2008-04-10 23:37 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-04-10 22:35 . 2008-04-10 22:36 <DIR> d-------- C:\Documents and Settings\Monika\Dane aplikacji\Ahead
2008-04-10 22:33 . 2008-04-10 22:33 <DIR> d-------- C:\Program Files\Nero
2008-04-10 22:33 . 2008-04-10 22:34 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-04-10 22:33 . 2008-04-10 22:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-10 21:24 --------- d-----w C:\Program Files\ESET
2008-04-10 19:04 --------- d-----w C:\Program Files\Winamp
2008-04-10 18:59 --------- d-----w C:\Program Files\Real Alternative
2008-04-10 18:59 --------- d-----w C:\Program Files\MarBit
2008-04-10 18:58 --------- d-----w C:\Program Files\Google
2008-04-10 18:58 --------- d-----w C:\Program Files\DivX
2008-04-10 18:57 --------- d-----w C:\Program Files\XviD
2008-04-10 18:57 --------- d-----w C:\Program Files\ffdshow
2008-04-10 18:57 --------- d-----w C:\Program Files\AC3Filter
2008-04-10 18:56 --------- d-----w C:\Program Files\DivX_311alpha
2008-04-10 18:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-04-10 18:31 --------- d-----w C:\Program Files\MSBuild
2008-04-10 18:31 --------- d-----w C:\Program Files\Microsoft Works
2008-04-10 18:09 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-10 18:05 --------- d-----w C:\Program Files\Usługi online
2008-01-14 22:04 104,451 --sh--r C:\d.com
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 19:14 35328]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-29 16:50 4620288]
"nwiz"="nwiz.exe" [2004-10-29 16:50 921600 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-10-29 16:50 86016]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-10-25 09:26 1410304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-10-25 09:27]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6c2a77f0-07d1-11dd-9cf5-00304f1fd793}]
\Shell\AutoRun\command - F:\d.com
\Shell\explore\Command - F:\d.com
\Shell\open\Command - F:\d.com

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-11 17:23:45
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-11 17:24:31
ComboFix-quarantined-files.txt 2008-04-11 15:24:13
Pre-Run: 10,744,803,328 bajtów wolnych
Post-Run: 10,738,884,608 bajtów wolnych

start>>uruchom>>wpisujesz "regedit">>odnajdujesz klucz
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\
i usuwasz go.

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod:

File::
C:\d.com

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox

ComboFix 08-04-10.9 - Monika 2008-04-13 22:08:26.2 - NTFSx86
Running from: C:\Documents and Settings\Monika\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Monika\Pulpit\CFScript.txt.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\d.com
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\d.com
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-03-13 to 2008-04-13 )))))))))))))))))))))))))))))))
.

2008-04-13 21:47 . 2008-04-13 21:46 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2008-04-13 21:47 . 2008-04-13 21:46 298,104 --a------ C:\WINDOWS\system32\imon.dll
2008-04-13 21:47 . 2008-04-13 21:46 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2008-04-11 19:45 . 2008-04-01 17:56 103,084 -r-hs---- C:\6l6w8.com
2008-04-11 16:01 . 2008-04-11 16:55 1,632 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-04-10 23:24 . 2008-04-10 23:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-10 23:17 . 2008-04-10 23:17 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-04-10 23:14 . 2008-04-10 23:41 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-04-10 23:10 . 2008-04-10 23:12 <DIR> d-------- C:\WINDOWS\nview
2008-04-10 23:10 . 2004-10-29 16:50 172,032 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-04-10 23:10 . 2004-10-29 16:50 13,653 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-04-10 23:09 . 2008-04-10 23:09 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-04-10 23:09 . 2008-04-10 23:09 <DIR> d-------- C:\NVIDIA
2008-04-10 23:03 . 2008-04-10 23:03 <DIR> d-------- C:\Program Files\Lexmark 640 Series
2008-04-10 23:03 . 2006-04-17 19:42 311,296 --a------ C:\WINDOWS\system32\LEXBCES.EXE
2008-04-10 23:03 . 2006-04-17 19:41 201,216 --a------ C:\WINDOWS\system32\LEXP2P32.DLL
2008-04-10 23:03 . 2006-04-17 19:48 200,704 --a------ C:\WINDOWS\system32\lexlmpm.dll
2008-04-10 23:03 . 2006-04-17 19:42 198,144 --a------ C:\WINDOWS\system32\LEX2KUSB.DLL
2008-04-10 23:03 . 2006-04-17 19:41 174,592 --a------ C:\WINDOWS\system32\LEXPPS.EXE
2008-04-10 23:03 . 2006-04-17 19:41 147,456 --a------ C:\WINDOWS\system32\LEXBCE.DLL
2008-04-10 23:03 . 2006-05-11 06:14 73,728 --a------ C:\WINDOWS\system32\lxdapwr.dll
2008-04-10 22:55 . 2001-10-26 17:29 177,152 --a------ C:\WINDOWS\system32\LXACSUI.DLL
2008-04-10 22:37 . 2008-04-10 23:37 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-04-10 22:35 . 2008-04-10 22:36 <DIR> d-------- C:\Documents and Settings\Monika\Dane aplikacji\Ahead
2008-04-10 22:33 . 2008-04-10 22:33 <DIR> d-------- C:\Program Files\Nero
2008-04-10 22:33 . 2008-04-10 22:34 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-04-10 22:33 . 2008-04-10 22:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-13 20:08 --------- d-----w C:\Program Files\ESET
2008-04-10 19:04 --------- d-----w C:\Program Files\Winamp
2008-04-10 18:59 --------- d-----w C:\Program Files\Real Alternative
2008-04-10 18:59 --------- d-----w C:\Program Files\MarBit
2008-04-10 18:58 --------- d-----w C:\Program Files\Google
2008-04-10 18:58 --------- d-----w C:\Program Files\DivX
2008-04-10 18:57 --------- d-----w C:\Program Files\XviD
2008-04-10 18:57 --------- d-----w C:\Program Files\ffdshow
2008-04-10 18:57 --------- d-----w C:\Program Files\AC3Filter
2008-04-10 18:56 --------- d-----w C:\Program Files\DivX_311alpha
2008-04-10 18:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-04-10 18:31 --------- d-----w C:\Program Files\MSBuild
2008-04-10 18:31 --------- d-----w C:\Program Files\Microsoft Works
2008-04-10 18:09 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-10 18:05 --------- d-----w C:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 19:14 35328]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-29 16:50 4620288]
"nwiz"="nwiz.exe" [2004-10-29 16:50 921600 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-10-29 16:50 86016]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-04-13 21:46 949376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=


*Newly Created Service* - NOD32KRN
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-13 22:10:34
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-13 22:11:19
ComboFix-quarantined-files.txt 2008-04-13 20:11:01
ComboFix2.txt 2008-04-11 15:24:32
Pre-Run: 10,633,678,848 bajtów wolnych
Post-Run: 10,626,224,128 bajtów wolnych

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod:

File::
C:\6l6w8.com


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox

ComboFix 08-04-10.9 - Monika 2008-04-15 15:03:08.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.62 [GMT 2:00]
Running from: C:\Documents and Settings\Monika\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Monika\Pulpit\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\616w8.com
.

((((((((((((((((((((((((( Files Created from 2008-03-15 to 2008-04-15 )))))))))))))))))))))))))))))))
.

2008-04-13 22:51 . 2008-04-13 22:51 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-04-13 22:25 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-13 22:25 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-13 22:25 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-13 22:25 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-13 22:25 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-13 22:25 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-13 22:25 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-13 22:25 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-13 22:24 . 2008-04-13 22:24 <DIR> d-------- C:\Program Files\Alwil Software
2008-04-13 22:24 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-13 22:24 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-04-13 22:24 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-13 21:47 . 2008-04-13 21:46 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2008-04-13 21:47 . 2008-04-13 21:46 298,104 --a------ C:\WINDOWS\system32\imon.dll
2008-04-13 21:47 . 2008-04-13 21:46 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2008-04-11 19:45 . 2008-04-01 17:56 103,084 -r-hs---- C:\6l6w8.com
2008-04-11 16:01 . 2008-04-15 00:14 1,632 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-04-10 23:24 . 2008-04-10 23:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-10 23:17 . 2008-04-10 23:17 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-04-10 23:14 . 2008-04-10 23:41 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-04-10 23:10 . 2008-04-10 23:12 <DIR> d-------- C:\WINDOWS\nview
2008-04-10 23:10 . 2004-10-29 16:50 172,032 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-04-10 23:10 . 2004-10-29 16:50 13,653 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-04-10 23:09 . 2008-04-10 23:09 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-04-10 23:09 . 2008-04-10 23:09 <DIR> d-------- C:\NVIDIA
2008-04-10 23:03 . 2008-04-10 23:03 <DIR> d-------- C:\Program Files\Lexmark 640 Series
2008-04-10 23:03 . 2006-04-17 19:42 311,296 --a------ C:\WINDOWS\system32\LEXBCES.EXE
2008-04-10 23:03 . 2006-04-17 19:41 201,216 --a------ C:\WINDOWS\system32\LEXP2P32.DLL
2008-04-10 23:03 . 2006-04-17 19:48 200,704 --a------ C:\WINDOWS\system32\lexlmpm.dll
2008-04-10 23:03 . 2006-04-17 19:42 198,144 --a------ C:\WINDOWS\system32\LEX2KUSB.DLL
2008-04-10 23:03 . 2006-04-17 19:41 174,592 --a------ C:\WINDOWS\system32\LEXPPS.EXE
2008-04-10 23:03 . 2006-04-17 19:41 147,456 --a------ C:\WINDOWS\system32\LEXBCE.DLL
2008-04-10 23:03 . 2006-05-11 06:14 73,728 --a------ C:\WINDOWS\system32\lxdapwr.dll
2008-04-10 22:55 . 2001-10-26 17:29 177,152 --a------ C:\WINDOWS\system32\LXACSUI.DLL
2008-04-10 22:37 . 2008-04-10 23:37 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-04-10 22:35 . 2008-04-10 22:36 <DIR> d-------- C:\Documents and Settings\Monika\Dane aplikacji\Ahead
2008-04-10 22:33 . 2008-04-10 22:33 <DIR> d-------- C:\Program Files\Nero
2008-04-10 22:33 . 2008-04-10 22:34 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-04-10 22:33 . 2008-04-10 22:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-13 20:08 --------- d-----w C:\Program Files\ESET
2008-04-10 19:04 --------- d-----w C:\Program Files\Winamp
2008-04-10 18:59 --------- d-----w C:\Program Files\Real Alternative
2008-04-10 18:59 --------- d-----w C:\Program Files\MarBit
2008-04-10 18:58 --------- d-----w C:\Program Files\Google
2008-04-10 18:58 --------- d-----w C:\Program Files\DivX
2008-04-10 18:57 --------- d-----w C:\Program Files\XviD
2008-04-10 18:57 --------- d-----w C:\Program Files\ffdshow
2008-04-10 18:57 --------- d-----w C:\Program Files\AC3Filter
2008-04-10 18:56 --------- d-----w C:\Program Files\DivX_311alpha
2008-04-10 18:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-04-10 18:31 --------- d-----w C:\Program Files\MSBuild
2008-04-10 18:31 --------- d-----w C:\Program Files\Microsoft Works
2008-04-10 18:09 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-10 18:05 --------- d-----w C:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 19:14 35328]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-29 16:50 4620288]
"nwiz"="nwiz.exe" [2004-10-29 16:50 921600 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-10-29 16:50 86016]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-04-13 21:46 949376]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]

.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-15 15:05:54
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-15 15:06:50
ComboFix-quarantined-files.txt 2008-04-15 13:06:37
ComboFix2.txt 2008-04-13 20:11:20
Pre-Run: 10,624,634,880 bajtów wolnych
Post-Run: 10,623,676,416 bajtów wolnych

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod:

File::
C:\6l6w8.com


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox


Przeskanuj komputer tym http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum

Usuń ręcznie folder C: \Qoobox
usuń instalkę Combofix z dysku.

Kasperskiego nie mogłam zainstalować...ale zainstalowałam Nortona. Wykrył kilka wirusów, usunął... Zrobiłam Loga i podaje...


ComboFix 08-04-22.5 - Monika 2008-04-24 23:22:18.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.99 [GMT 2:00]
Running from: C:\Documents and Settings\Monika\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-03-24 to 2008-04-24 )))))))))))))))))))))))))))))))
.

2008-04-24 22:26 . 2008-04-24 22:32 <DIR> d-------- C:\Filmy
2008-04-23 20:15 . 2008-04-23 20:15 <DIR> d-------- C:\Program Files\Windows Sidebar
2008-04-23 20:15 . 2008-04-23 20:25 <DIR> d-------- C:\Program Files\Norton AntiVirus
2008-04-23 20:14 . 2008-04-23 20:16 <DIR> d-------- C:\Program Files\Symantec
2008-04-23 20:14 . 2008-04-23 20:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-04-23 20:14 . 2008-04-23 20:16 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-04-23 20:14 . 2008-04-23 20:16 60,808 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-04-23 20:14 . 2008-04-23 20:16 10,652 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-04-23 20:14 . 2008-04-23 20:16 806 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-04-23 20:12 . 2008-04-23 20:26 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-04-23 20:08 . 2008-04-24 23:22 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG
2008-04-20 19:37 . 2008-04-20 19:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-13 22:51 . 2008-04-22 20:22 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-04-13 22:24 . 2008-04-13 22:24 <DIR> d-------- C:\Program Files\Alwil Software
2008-04-13 22:24 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-04-11 16:01 . 2008-04-24 22:56 1,632 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-04-10 23:24 . 2008-04-10 23:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-10 23:17 . 2008-04-10 23:17 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-04-10 23:14 . 2008-04-10 23:41 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-04-10 23:10 . 2008-04-10 23:12 <DIR> d-------- C:\WINDOWS\nview
2008-04-10 23:10 . 2004-10-29 16:50 172,032 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-04-10 23:10 . 2004-10-29 16:50 13,653 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-04-10 23:09 . 2008-04-10 23:09 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-04-10 23:09 . 2008-04-10 23:09 <DIR> d-------- C:\NVIDIA
2008-04-10 23:03 . 2008-04-10 23:03 <DIR> d-------- C:\Program Files\Lexmark 640 Series
2008-04-10 23:03 . 2006-04-17 19:42 311,296 --a------ C:\WINDOWS\system32\LEXBCES.EXE
2008-04-10 23:03 . 2006-04-17 19:41 201,216 --a------ C:\WINDOWS\system32\LEXP2P32.DLL
2008-04-10 23:03 . 2006-04-17 19:48 200,704 --a------ C:\WINDOWS\system32\lexlmpm.dll
2008-04-10 23:03 . 2006-04-17 19:42 198,144 --a------ C:\WINDOWS\system32\LEX2KUSB.DLL
2008-04-10 23:03 . 2006-04-17 19:41 174,592 --a------ C:\WINDOWS\system32\LEXPPS.EXE
2008-04-10 23:03 . 2006-04-17 19:41 147,456 --a------ C:\WINDOWS\system32\LEXBCE.DLL
2008-04-10 23:03 . 2006-05-11 06:14 73,728 --a------ C:\WINDOWS\system32\lxdapwr.dll
2008-04-10 22:55 . 2001-10-26 17:29 177,152 --a------ C:\WINDOWS\system32\LXACSUI.DLL
2008-04-10 22:37 . 2008-04-10 23:37 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-04-10 22:37 . 2008-04-10 22:37 1,024 --ah----- C:\Documents and Settings\Default User\NtUser.dat.LOG
2008-04-10 22:35 . 2008-04-16 19:50 <DIR> d-------- C:\Documents and Settings\Monika\Dane aplikacji\Ahead
2008-04-10 22:33 . 2008-04-10 22:33 <DIR> d-------- C:\Program Files\Nero
2008-04-10 22:33 . 2008-04-10 22:34 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-04-10 22:33 . 2008-04-10 22:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-10 19:04 --------- d-----w C:\Program Files\Winamp
2008-04-10 18:59 --------- d-----w C:\Program Files\Real Alternative
2008-04-10 18:59 --------- d-----w C:\Program Files\MarBit
2008-04-10 18:58 --------- d-----w C:\Program Files\Google
2008-04-10 18:58 --------- d-----w C:\Program Files\DivX
2008-04-10 18:57 --------- d-----w C:\Program Files\XviD
2008-04-10 18:57 --------- d-----w C:\Program Files\ffdshow
2008-04-10 18:57 --------- d-----w C:\Program Files\AC3Filter
2008-04-10 18:56 --------- d-----w C:\Program Files\DivX_311alpha
2008-04-10 18:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-04-10 18:31 --------- d-----w C:\Program Files\MSBuild
2008-04-10 18:31 --------- d-----w C:\Program Files\Microsoft Works
2008-04-10 18:09 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-10 18:05 --------- d-----w C:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-04-23 20:18 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 19:14 35328]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-29 16:50 4620288]
"nwiz"="nwiz.exe" [2004-10-29 16:50 921600 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-10-29 16:50 86016]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-08-24 23:07 51048]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 22:53 714608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

C:\Documents and Settings\Monika\Menu Start\Programy\Autostart\
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []

*Newly Created Service* - CLTNETCNSERVICE
*Newly Created Service* - ERASERUTILREBOOTDRV
*Newly Created Service* - LIVEUPDATE_NOTICE
.
Contents of the 'Scheduled Tasks' folder
"2008-04-23 18:26:40 C:\WINDOWS\Tasks\Norton AntiVirus - Uruchom pełne skanowanie systemu - Monika.job"
- C:\Program Files\Norton AntiVirus\Navw32.exef/TASK:
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-24 23:25:46
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-24 23:27:59
ComboFix-quarantined-files.txt 2008-04-24 21:27:49
ComboFix2.txt 2008-04-15 13:06:52

Pre-Run: 7,219,286,016 bajtów wolnych
Post-Run: 7,656,697,856 bajtów wolnych

128

Log wyglada na czysty

Przeskanuj komputer tym (uruchom przez IE) http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum

Usuń ręcznie folder C: \Qoobox

usuń instalkę Combofix z dysku.