Problem z Win32:AuCrypt

[kosmaku]

Witam,
mam problem z Win32:AuCrypt. Avast pokazuje, że wstępuje w wielu lokalizacjach, np.

C:\System Volume Information\_restore{B4C57B19-E9F4-4980-B0A2-D2B1B538E9

C:\System Volume Information\_restore{B4C57B19-E9F4-4980-B0A2-D2B1B538E92D}\RP153\A0021598.com2D}\RP153\A0021598.com

Proszę o wsparcie.
Dzięki i pozdrawiam

Poniżej log z Combofix:



ComboFix 08-03-17.1 - ziom 2008-03-18 19:17:20.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2610.2.1253.1.1045.18.61 [GMT 1:00]
Running from: C:\Documents and Settings\ziom\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-18 to 2008-03-18 )))))))))))))))))))))))))))))))
.

2008-03-11 20:39 . 2008-03-11 20:39 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-11 20:39 . 2008-03-11 20:39 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-11 00:34 . 2008-03-16 21:52 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-03-05 20:20 . 2008-03-05 20:24 <DIR> d-------- C:\Program Files\GRETECH
2008-03-04 20:26 . 2008-03-04 20:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-03-04 09:46 . 2008-03-18 19:13 <DIR> d-------- C:\Program Files\Kalendarz XP
2008-03-03 19:07 . 2008-03-03 19:10 <DIR> d-------- C:\WINDOWS\system32\quicktime
2008-03-01 17:41 . 2008-03-04 07:45 <DIR> d-------- C:\Program Files\OpenOffice.org1.1.5
2008-03-01 17:38 . 2008-03-01 17:38 69,632 --a------ C:\WINDOWS\uinst001.exe
2008-03-01 15:53 . 2008-03-01 15:53 <DIR> d--h----- C:\WINDOWS\PIF
2008-02-21 21:40 . 2008-02-21 21:40 <DIR> d-------- C:\Program Files\Firebird
2008-02-21 21:39 . 2008-02-21 21:44 <DIR> d-------- C:\Documents and Settings\ziom\Dane aplikacji\LeftHand
2008-02-21 15:08 . 2008-02-21 15:08 <DIR> d-------- C:\Program Files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 20:22 --------- d-----w C:\Documents and Settings\ziom\Dane aplikacji\Skype
2008-03-17 16:02 --------- d-----w C:\Documents and Settings\ziom\Dane aplikacji\skypePM
2008-03-16 20:52 --------- d-----w C:\Program Files\eMule1
2008-03-16 20:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 20:47 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-16 20:41 --------- d-----w C:\Program Files\Macromedia
2008-03-04 19:26 --------- d-----w C:\Program Files\CyberLink
2008-02-29 18:41 --------- d-----w C:\Program Files\eMule
2008-02-29 17:43 --------- d-----w C:\Program Files\Opera
2008-02-22 12:05 --------- d-----w C:\Documents and Settings\ziom\Dane aplikacji\AdobeUM
2008-02-17 20:27 --------- d-----w C:\Program Files\ffdshow
2008-02-17 20:23 --------- d-----w C:\Program Files\DivX
2008-02-17 20:08 --------- d-----w C:\Program Files\Winamp Remote
2008-02-17 20:05 --------- d-----w C:\Program Files\Codec Pack - All In 1
2008-02-15 18:13 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-02-15 18:13 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll
2008-02-14 17:50 --------- d-----w C:\Program Files\iTunes
2008-02-14 17:50 --------- d-----w C:\Program Files\iPod
2008-02-14 10:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-02-14 10:42 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-02-13 10:41 --------- d-----w C:\Documents and Settings\ziom\Dane aplikacji\Apple Computer
2008-02-13 10:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-02-13 10:37 --------- d-----w C:\Program Files\QuickTime
2008-02-13 10:34 --------- d-----w C:\Program Files\Apple Software Update
2008-02-13 10:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-01-29 21:21 --------- d-----w C:\Program Files\Google
2008-01-28 11:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Creative
2008-01-25 15:44 --------- d-----w C:\Program Files\Creative
2008-01-13 23:26 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-11-28 20:36 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2002-12-31 13:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-03 23:55 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"USB Storage Toolbox"="C:\Program Files\USBToolbox\Res.EXE" [2002-01-15 15:23 118784]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2002-12-31 13:00 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Kalendarz XP.lnk - C:\Program Files\Kalendarz XP\Kalendarz.exe [2008-03-04 09:46:13 882176]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\rundll32.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11645:TCP"= 11645:TCP:*:Disabled:127.0.0.1
"49414:UDP"= 49414:UDP:*:Disabled:127.0.0.1


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65d2cab1-7c14-11dc-9725-00b0d0e1849b}]
\Shell\AutoRun\command - F:\USBNB.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df876f48-71d5-11dc-9713-00b0d0e1849b}]
\Shell\AutoRun\command - E:\22wcb21o.exe
\Shell\explore\Command - E:\22wcb21o.exe
\Shell\open\Command - E:\22wcb21o.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-03-08 22:31:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-18 19:20:52
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-18 19:23:52
ComboFix2.txt 2008-03-18 13:29:34

[pp3088]

start>>uruchom>>wpisujesz "regedit">>odnajdujesz klucz
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\
i usuwasz go.

[kosmaku]

Ok pomogło (na razie). Dzięki wielkie.
Czy wiadomo wogóle co to za wynalazek?