proszę o sprawdzenie loga, problem m.in z Win32:Aucrypt

System przeskanowany avastem w trakcie rozruchu, wykrył m.in. Win32:AuCrypt i VBS:MAlware-gen. Po przeskanowaniu systemu, nie dało się wejść na partycje z poziomu "Mojego Komputera", wyrzucało błąd amvo1.dll, pomimo że avast usunął ten plik. Po użyciu combofixa wydaje się być ok, proszę tylko o informacje jak pozbyć się tego na dobre. Z góry dziękuję za pomoc

ComboFix 08-05-27.4 - Emi 2008-05-28 14:42:15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.496 [GMT 2:00]
Running from: D:\programs\combofix\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\avi.dll
C:\WINDOWS\system32\cpuinf32.dll
C:\WINDOWS\system32\DivXsm.exe
C:\WINDOWS\system32\ff_liba52.dll
C:\WINDOWS\system32\ff_libdts.dll
C:\WINDOWS\system32\ff_libfaad2.dll
C:\WINDOWS\system32\ff_libmad.dll
C:\WINDOWS\system32\ff_realaac.dll
C:\WINDOWS\system32\ff_samplerate.dll
C:\WINDOWS\system32\ff_tremor.dll
C:\WINDOWS\system32\ff_unrar.dll
C:\WINDOWS\system32\ff_wmv9.dll
C:\WINDOWS\system32\iconv.dll
C:\WINDOWS\system32\libavcodec.dll
C:\WINDOWS\system32\libmpeg2_ff.dll
C:\WINDOWS\system32\libmplayer.dll
C:\WINDOWS\system32\mkunicode.dll
C:\WINDOWS\system32\mkx.dll
C:\WINDOWS\system32\mkzlib.dll
C:\WINDOWS\system32\mmfinfo.dll
C:\WINDOWS\system32\mp4.dll
C:\WINDOWS\system32\mplvpx.dll
C:\WINDOWS\system32\ogg.dll
C:\WINDOWS\system32\OggDS.dll
C:\WINDOWS\system32\ogm.dll
C:\WINDOWS\system32\ts.dll
C:\WINDOWS\system32\vorbis.dll
C:\WINDOWS\system32\vorbisenc.dll
C:\WINDOWS\system32\WMV9VCM.dll
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-28 )))))))))))))))))))))))))))))))
.

2008-05-28 00:20 . 2008-05-28 00:41 <DIR> d-------- C:\Documents and Settings\LogMeInRemoteUser
2008-05-28 00:17 . 2008-05-28 00:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LogMeIn
2008-05-28 00:17 . 2008-05-19 15:23 87,352 --a------ C:\WINDOWS\system32\LMIinit.dll
2008-05-28 00:17 . 2008-05-19 15:24 83,288 --a------ C:\WINDOWS\system32\LMIRfsClientNP.dll
2008-05-28 00:17 . 2008-03-07 13:39 45,848 --a------ C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
2008-05-28 00:17 . 2008-05-19 15:23 24,608 --a------ C:\WINDOWS\system32\LMIport.dll
2008-05-28 00:17 . 2008-05-28 00:17 1,024 --a------ C:\.rnd
2008-05-27 23:56 . 2008-05-27 23:56 <DIR> d-------- C:\WINDOWS\Sun
2008-05-23 19:24 . 2008-05-23 19:24 <DIR> d-------- C:\Program Files\QT Lite
2008-05-23 19:24 . 2008-05-23 19:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-23 19:24 . 2008-03-28 21:07 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-05-23 19:24 . 2008-03-28 21:07 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-05-23 19:19 . 2008-05-23 19:19 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-05-19 15:23 . 2008-05-19 15:23 23,736 --a------ C:\WINDOWS\system32\lmimirr.dll
2008-05-19 15:23 . 2008-05-19 15:23 10,040 --a------ C:\WINDOWS\system32\lmimirr2.dll
2008-05-16 13:41 . 2008-05-16 14:14 <DIR> d-------- C:\Documents and Settings\Emi\Application Data\Winamp
2008-05-16 13:41 . 2007-03-08 01:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2008-05-14 15:01 . 2008-05-28 00:19 1,310 --a------ C:\WINDOWS\mozver.dat
2008-05-10 15:00 . 2006-03-24 08:53 35,840 -ra------ C:\WINDOWS\system32\drivers\bqe61cdc.sys
2008-05-09 18:56 . 2008-05-10 15:12 8 --a------ C:\WINDOWS\SavedMmsUserFile.muf
2008-05-09 18:51 . 2008-05-09 18:51 28 --a------ C:\WINDOWS\SavedMsgFolderFile.ini
2008-05-09 18:47 . 2006-03-24 08:53 53,248 -ra------ C:\WINDOWS\bqe61_un.exe
2008-05-09 18:42 . 2008-05-09 18:42 <DIR> d-------- C:\PureUSBCableDrv
2008-05-04 22:56 . 2008-05-04 22:56 105,379 -r-hs---- C:\xlu8a8sy.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-28 12:06 --------- d-----w C:\Program Files\Neostrada TP
2008-05-26 20:07 --------- d-----w C:\Documents and Settings\Emi\Application Data\Skype
2008-05-26 19:46 --------- d-----w C:\Documents and Settings\Emi\Application Data\skypePM
2008-05-09 16:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-17 11:53 --------- d-----w C:\Documents and Settings\Emi\Application Data\Ahead
2008-04-04 13:35 --------- d-----w C:\Documents and Settings\Emi\Application Data\Media Player Classic
2008-04-04 13:34 --------- d-----w C:\Program Files\Media Player Classic
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\divx.dll
2008-03-28 17:41 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-20 18:24 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-19 22:01 2,560 ----a-w C:\WINDOWS\system32\bitcometres.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2004-07-22 09:51 3,432,656 ----a-w C:\Program Files\ManagedDX.CAB
2004-07-19 21:58 1,156,363 ----a-w C:\Program Files\BDANT.cab
2004-07-19 21:53 976,020 ----a-w C:\Program Files\BDAXP.cab
2004-07-09 13:17 13,265,040 ----a-w C:\Program Files\dxnt.cab
2004-07-09 08:13 703,080 ----a-w C:\Program Files\BDA.cab
2004-07-09 08:13 15,493,481 ----a-w C:\Program Files\DirectX.cab
2004-07-09 03:08 472,576 ----a-w C:\Program Files\dxsetup.exe
2004-07-09 03:08 2,242,560 ----a-w C:\Program Files\dsetup32.dll
2004-07-09 02:03 62,976 ----a-w C:\Program Files\DSETUP.dll
2008-02-28 12:30 8,784 ----a-w C:\Program Files\mozilla firefox\plugins\ractrlkeyhook.dll
2008-02-28 12:33 245,408 ----a-w C:\Program Files\mozilla firefox\plugins\unicows.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Konnekt"="D:\programs\Konnekt\konnekt.exe" [2005-05-24 23:41 503808]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-30 13:47 68856]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:56 64512]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 17:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 19:04 2879488 C:\WINDOWS\SkyTel.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-01-25 19:45 53248]
"fscp"="C:\Program Files\AVC Finger-sensing Pad Driver\fscp.exe" [2006-09-18 11:38 995328]
"FuncKey"="C:\Program Files\Hotkey Management\FuncKey.exe" [2006-09-05 21:29 139264]
"PowerManager"="C:\Program Files\Power Manager\PM.exe" [2006-09-06 20:13 151552]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-16 11:42 7585792]
"nwiz"="nwiz.exe" [2006-08-16 11:42 1617920 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07 24576]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07 53248]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="D:\programs\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"LogMeIn GUI"="D:\programs\LogMeIn\x86\LogMeInSystray.exe" [2008-02-28 15:31 63048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 21:00 15360]
"Picasa Media Detector"="D:\programs\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-03-08 22:53:26 962661]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ClearRecentDocsOn Exit"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2008-05-19 15:23 87352 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\programs\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9845:TCP"= 9845:TCP:BitComet 9845 TCP
"9845:UDP"= 9845:UDP:BitComet 9845 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 FspadSvc;FspadSvc;C:\Program Files\AVC Finger-sensing Pad Driver\FspadSvr.exe [2006-08-23 15:05]
R2 LMIInfo;LogMeIn Kernel Information Provider;D:\programs\LogMeIn\x86\RaInfo.sys [2008-02-28 15:31]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2008-03-07 13:39]
R3 fspad;AVC Finger-sensing Pad Driver for Windows 2000/XP;C:\WINDOWS\system32\DRIVERS\fspad.sys [2006-09-18 11:40]
R3 nvsmu;nvsmu;C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-07 06:49]
S3 BQE61CDC;BenQ-Siemens E61 Driver;C:\WINDOWS\system32\DRIVERS\bqe61cdc.sys [2006-03-24 08:53]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2aa842d9-fe7b-11dc-bb45-b195b4b8a23d}]
\Shell\AutoRun\command - F:\xlu8a8sy.exe
\Shell\explore\Command - F:\xlu8a8sy.exe
\Shell\open\Command - F:\xlu8a8sy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2aa842da-fe7b-11dc-bb45-b195b4b8a23d}]
\Shell\AutoRun\command - G:\jfvkcsy.bat
\Shell\explore\Command - G:\jfvkcsy.bat
\Shell\open\Command - G:\jfvkcsy.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{60056c28-fdc5-11dc-bb43-00140b051d0e}]
\Shell\AutoRun\command - F:\jfvkcsy.bat
\Shell\explore\Command - F:\jfvkcsy.bat
\Shell\open\Command - F:\jfvkcsy.bat

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-28 14:43:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-28 14:44:50
ComboFix-quarantined-files.txt 2008-05-28 12:44:42

Pre-Run: 17,562,681,344 bytes free
Post-Run: 17,632,145,408 bytes free

186 --- E O F --- 2008-05-15 20:43:01

edit:
po usunięciu klucza HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 zgodnie z instrukcją na http://instalki.pl/forum/viewtopic.php?t=13889 i ponownym użyciu combofixa z loga została usunięta część

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2aa842d9-fe7b-11dc-bb45-b195b4b8a23d}]
\Shell\AutoRun\command - F:\xlu8a8sy.exe
\Shell\explore\Command - F:\xlu8a8sy.exe
\Shell\open\Command - F:\xlu8a8sy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2aa842da-fe7b-11dc-bb45-b195b4b8a23d}]
\Shell\AutoRun\command - G:\jfvkcsy.bat
\Shell\explore\Command - G:\jfvkcsy.bat
\Shell\open\Command - G:\jfvkcsy.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{60056c28-fdc5-11dc-bb43-00140b051d0e}]
\Shell\AutoRun\command - F:\jfvkcsy.bat
\Shell\explore\Command - F:\jfvkcsy.bat
\Shell\open\Command - F:\jfvkcsy.bat

co jeszcze powinnam zrobić?

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod:

File::
C:\WINDOWS\bqe61_un.exe
C:\xlu8a8sy.exe


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

Logi dajesz na http://www.wklej.eu/

zamieszczam log po zrobieniu tego co mówiłeś

http://www.wklej.org/id/96277d0eb9

Usuń ręcznie to:

C:\.rnd

Wyłącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

Włącz przywracanie systemu.

http://www.wklej.org/id/0c27123d6b

Pobierz The Avenger

wklej do niego ten tekst:

Kod:

Files to delete:
D:\programs\LogMeIn\x86\LogMeIn.dll
D:\programs\RealVNC\WinVNC\othread2.dll
D:\programs\RealVNC\WinVNC\winvnc.exe

Folders to delete:
C:\QooBox


kopiuj to i klikasz na Paste Script from Clipboard wybierasz Execute oraz Potwierdzasz i zgadzasz się na restart klikając OK.
Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "D:\programs\LogMeIn\x86\LogMeIn.dll" deleted successfully.
File "D:\programs\RealVNC\WinVNC\othread2.dll" deleted successfully.
File "D:\programs\RealVNC\WinVNC\winvnc.exe" deleted successfully.
Folder "C:\QooBox" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

to już chyba wszysto dobrze:) dzięki za pomoc;)

Wszystko co było do usunięcia sie usuneło

dziekuję za pomoc