Prośba o sprawdzenie loga z cobofixa - nie moge odkryć ukryt

[mateusz455]

oto mój log:




ComboFix 08-07-25.7 - Mateusz 2008-07-26 15:19:37.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.575 [GMT 2:00]
Running from: C:\Documents and Settings\Mateusz\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
C:\WINNT\system32\amvo.exe
C:\WINNT\system32\amvo0.dll
C:\WINNT\system32\amvo1.dll
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-06-26 to 2008-07-26 )))))))))))))))))))))))))))))))
.

2008-07-26 09:28 . 2008-07-26 09:27 87,761 -r-hs---- C:\kdxdweli.cmd
2008-07-26 09:27 . 2008-07-25 21:49 86,679 -r-hs---- C:\jk.exe
2008-07-25 18:57 . 2008-07-25 18:57 54,156 --ah----- C:\WINNT\QTFont.qfn
2008-07-25 18:57 . 2008-07-25 18:57 1,409 --a------ C:\WINNT\QTFont.for
2008-07-18 22:18 . 2008-07-18 22:18 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-18 22:18 . 2008-07-18 22:18 385 --a------ C:\WINNT\{2158ED55-19D1-4C0C-B213-5EFF748248AC}_WiseFW.ini
2008-07-18 22:08 . 2008-07-18 22:08 <DIR> d-------- C:\Program Files\Salling Software AB
2008-07-18 22:07 . 2008-07-18 22:07 <DIR> d-------- C:\WINNT\SxsCaPendDel
2008-07-17 22:26 . 2008-07-17 22:26 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Salling Software AB
2008-07-17 22:25 . 2008-07-17 22:25 360,580 --a------ C:\WINNT\eSellerateEngine.dll
2008-07-09 00:37 . 2008-07-09 00:38 <DIR> d-------- C:\Program Files\NAPI-PROJEKT

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-25 21:54 --------- d-----w C:\Documents and Settings\Mateusz\Dane aplikacji\uTorrent
2008-07-17 20:36 --------- d-----w C:\Program Files\Winamp
2008-06-20 20:03 --------- d-----w C:\Program Files\FlashGet
2008-06-20 17:37 246,784 ----a-w C:\WINNT\system32\mswsock.dll
2008-06-20 10:44 360,960 ----a-w C:\WINNT\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINNT\system32\drivers\afd.sys
2008-06-20 09:32 225,920 ----a-w C:\WINNT\system32\drivers\tcpip6.sys
2008-06-14 18:01 273,024 ------w C:\WINNT\system32\drivers\bthport.sys
2008-06-13 11:40 --------- d-----w C:\Program Files\uTorrent
2008-06-13 08:53 --------- d-----w C:\Program Files\Lonely Cat Games
2008-06-12 12:34 --------- d-----w C:\Program Files\Opera
2008-06-03 11:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-07 05:03 1,291,776 ----a-w C:\WINNT\system32\quartz.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472]
"WinClicker.exe"="C:\Program Files\Salling Software AB\Salling Clicker\WinClicker.exe" [2007-05-11 11:25 1150976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-30 16:09 737370]
"NvCplDaemon"="C:\WINNT\system32\NvCpl.dll" [2005-12-15 11:42 7331840]
"ACU"="C:\Program Files\Atheros\ACU.exe" [2006-04-26 11:37 331776]
"NeroFilterCheck"="C:\WINNT\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 08:23 132624]
"Samsung Common SM"="C:\WINNT\Samsung\ComSMMgr\ssmmgr.exe" [2005-07-03 09:20 372736]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-02-03 10:43 61952 C:\WINNT\system32\CHDAudPropShortcut.exe]
"nwiz"="nwiz.exe" [2005-12-15 11:42 1519616 C:\WINNT\system32\nwiz.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINNT\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINNT\system32\CTFMON.EXE" [2004-08-04 04:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe [2006-03-05 14:43:54 11000]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-04-25 21:00:57 692224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
backup=C:\WINNT\pss\BTTray.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 16:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"btwdins"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\TC PowerPack\\TOTALCMD.EXE"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\EA GAMES\\Need for Speed Most Wanted\\speed.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Salling Software AB\\Salling Clicker\\WinClicker.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Grupowanie sieci równorzędnej Windows
"3540:UDP"= 3540:UDP:Protokół rozpoznawania nazw równorzędnych (PNRP)
"5353:UDP"= 5353:UDP:Salling Clicker mDNS

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINNT\system32\drivers\sfsync03.sys [2005-12-06 17:11]
R1 aswSP;avast! Self Protection;C:\WINNT\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINNT\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
S3 p2pgasvc;Uwierzytelnianie grup sieci równorzędnej;C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 p2pimsvc;Menedżer tożsamości sieci równorzędnej;C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 p2psvc;Sieć równorzędna;C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 PNRPSvc;Protokół PNRP (Peer Name Resolution Protocol);C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINNT\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0d6680ec-ee84-11dc-a810-0019d2123e32}]
\Shell\AutoRun\command - G:\jk.exe
\Shell\explore\Command - G:\jk.exe
\Shell\open\Command - G:\jk.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
2008-07-19 C:\WINNT\Tasks\AppleSoftwareUpdate.job - s!:C:\Program Files\Apple Software Update\SoftwareUpdate.exe-TaskSYSTEM0@ []
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://google.bearshare.com/pl
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
R1 -: HKCU-Internet Settings,ProxyServer = 192.168.0.1:3128
R1 -: HKCU-Internet Settings,ProxyOverride = <local>
O8 -: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm
O8 -: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm
O8 -: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 -: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O17 -: HKLM\CCS\Interface\{7A5CD072-6E49-4DB5-8260-A291ECC75C52}: NameServer = 192.168.0.1

O16 -: Microsoft XML Parser for Java - file://C:\WINNT\Java\classes\xmldso.cab
C:\WINNT\Downloaded Program Files\Microsoft XML Parser for Java.osd


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-26 15:21:43
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-26 15:23:09
ComboFix-quarantined-files.txt 2008-07-26 13:22:47

Pre-Run: 6,287,724,544 bajtów wolnych
Post-Run: 6,495,150,080 bajtów wolnych

149 --- E O F --- 2008-07-09 07:02:51

[huber2t]

Do wyleczenia pendrive z wirusów użyj
Perlovga Removal Tool
Flash Disinfector
lub format

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

File::
C:\kdxdweli.cmd
C:\jk.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0d6680ec-ee84-11dc-a810-0019d2123e32}]


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

Logi dajesz na http://www.wklej.eu/ a w poście dajesz tylko link