Proszę o sprawdzenie loga

[ora007]

ComboFix 08-08-27.05 - Ola 2008-08-28 11:41:56.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.193 [GMT 2:00]
Running from: C:\Documents and Settings\Ola\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\krg62.cmd
C:\u9dyi.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\amvo1.dll
C:\WINDOWS\system32\ckvo.exe
C:\WINDOWS\system32\ckvo0.dll
C:\WINDOWS\system32\ckvo1.dll
D:\Autorun.inf
D:\krg62.cmd
D:\u9dyi.exe
E:\Autorun.inf
E:\krg62.cmd
E:\u9dyi.exe
F:\Autorun.inf
F:\krg62.cmd
F:\u9dyi.exe

.
((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-28 )))))))))))))))))))))))))))))))
.

2008-08-27 22:24 . 2008-08-27 22:24 <DIR> d-------- C:\Program Files\Damian Pasternak
2008-08-27 08:40 . 2008-08-27 22:23 90,120 -r-hs---- C:\ph.com
2008-08-25 19:09 . 2008-08-25 19:10 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-08-04 12:03 . 2008-08-04 12:03 <DIR> d-------- C:\Program Files\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-26 18:02 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Skype
2008-08-26 17:29 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\skypePM
2008-08-13 14:29 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\BearShare
2008-08-04 10:02 --------- d-----w C:\Program Files\Java
2008-07-17 14:00 --------- d-----w C:\Program Files\Dietetyk 2001
2008-07-09 11:36 --------- d-----w C:\Program Files\Gadu-Gadu
2008-03-23 15:31 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot@2008-05-07_13.04.46.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-31 06:00:00 73,728 ----a-w C:\WINDOWS\fdsv.exe
+ 2000-08-31 06:00:00 89,504 ----a-w C:\WINDOWS\fdsv.exe
+ 2008-08-25 17:10:56 295,606 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1045-7B44-A81200000003}\SC_Reader.exe
+ 2008-07-22 17:23:47 1,656 ----a-w C:\WINDOWS\mozver.dat
- 2000-08-31 06:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 06:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe
- 2008-03-29 17:45:49 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe
+ 2008-07-19 14:43:08 1,163,960 ----a-w C:\WINDOWS\system32\aswBoot.exe
- 2008-03-29 17:23:22 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
+ 2008-07-19 14:30:53 94,392 ----a-w C:\WINDOWS\system32\AvastSS.scr
+ 2004-08-03 20:58:46 15,104 -c--a-w C:\WINDOWS\system32\dllcache\usbscan.sys
- 2008-03-29 17:26:52 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
+ 2008-07-19 14:32:15 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
- 2008-03-29 17:35:49 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys
+ 2008-07-19 14:37:42 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys
- 2008-03-29 17:35:21 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
+ 2008-07-19 14:37:21 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
- 2008-03-29 17:29:08 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
+ 2008-07-19 14:33:42 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
- 2008-03-29 17:31:34 75,856 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys
+ 2008-07-19 14:35:18 78,416 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys
- 2008-03-29 17:27:33 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
+ 2008-07-19 14:32:36 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
+ 2004-08-03 20:58:46 15,104 ----a-w C:\WINDOWS\system32\drivers\usbscan.sys
+ 1999-09-09 09:28:18 446,464 ----a-w C:\WINDOWS\system32\HHActiveX.dll
- 2008-02-22 00:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-06-09 23:21:01 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2008-02-22 00:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-09 23:21:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2008-02-22 01:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-06-10 00:32:34 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
- 2008-05-04 10:42:57 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-28 09:31:41 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-05-04 10:42:57 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
+ 2008-08-28 09:31:41 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
- 2008-05-04 10:42:57 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-28 09:31:41 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-05-04 10:42:57 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-08-28 09:31:41 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2001-10-26 15:29:42 5,632 ----a-w C:\WINDOWS\system32\ptpusb.dll
+ 2004-08-03 22:44:10 159,232 ----a-w C:\WINDOWS\system32\ptpusd.dll
+ 2001-03-05 10:11:38 98,304 ----a-w C:\WINDOWS\system32\tsccvid.dll
+ 2008-08-28 09:44:54 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6a8.dat
+ 2000-07-08 13:06:34 87,040 ----a-w C:\WINDOWS\UnGins.exe
- 2006-06-05 13:14:28 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
+ 2006-06-05 12:14:28 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
- 2006-06-05 13:14:28 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
+ 2006-06-05 12:14:28 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
- 2006-06-05 13:14:28 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
+ 2006-06-05 12:14:28 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Secure Disks]
@="{666C7836-A9B6-4AB4-94ED-DC238C81E925}"
[HKEY_CLASSES_ROOT\CLSID\{666C7836-A9B6-4AB4-94ED-DC238C81E925}]
2006-04-03 02:08 381952 -ra------ C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\SFSShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-04-17 11:24 110592]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-02-07 02:39 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-02-07 02:36 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-02-07 02:40 118784]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 08:26 761945]
"UMonit"="C:\WINDOWS\system32\UMonit.exe" [2006-06-09 12:47 200704]
"CognizanceTS"="C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 14:12 17920]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-08-06 10:45 877568]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 10:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-11-03 14:58 28160 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
Logitech SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-03-22 22:18:57 532480]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2006-05-03 07:23 40448 C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=APSHook.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R1 ItSDisk;ItSDisk;C:\WINDOWS\system32\Drivers\ItSDisk.sys [2006-05-16 20:14]
R2 ASChannel;Local Communication Channel;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R3 FIXUSTOR;FIXUSTOR;C:\WINDOWS\system32\DRIVERS\fixustor.sys [2006-01-26 05:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47e67c2a-31ac-11dd-9bf2-0018de1019ed}]
\Shell\AutoRun\command - x6.bat
\Shell\explore\Command - x6.bat
\Shell\open\Command - x6.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d1bd311-0b8c-11dd-9b51-0018de1019ed}]
\Shell\AutoRun\command - G:\lkxcqdb.bat
\Shell\explore\Command - G:\lkxcqdb.bat
\Shell\open\Command - G:\lkxcqdb.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa0c0b7d-fffb-11dc-9b1e-0018de1019ed}]
\Shell\AutoRun\command - I:\u9dyi.exe
\Shell\explore\Command - I:\u9dyi.exe
\Shell\open\Command - I:\u9dyi.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1348d96-6207-11dd-9c97-000e50aeeee1}]
\Shell\Auto\command - I:\fun.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-kamsoft - C:\WINDOWS\system32\ckvo.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Ola\Dane aplikacji\Mozilla\Firefox\Profiles\8l6l8xax.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE -
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 11:45:13
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\asghost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\scardsvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2008-08-28 11:46:55 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-28 09:46:51
ComboFix2.txt 2008-05-07 11:04:56

Pre-Run: 3,641,360,384 bajtów wolnych
Post-Run: 3,739,648,000 bajt˘w wolnych

211

[huber2t]

Do wyleczenia pendrive z wirusów użyj
Perlovga Removal Tool
Flash Disinfector
lub format

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

File::
C:\ph.com

Registry::
"NeroFilterCheck"=-
"WinampAgent"=-
"SunJavaUpdateSched"=-
"HP Software Update"=-
"Adobe Reader Speed Launcher"=-
"RTHDCPL"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47e67c2a-31ac-11dd-9bf2-0018de1019ed}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d1bd311-0b8c-11dd-9b51-0018de1019ed}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa0c0b7d-fffb-11dc-9b1e-0018de1019ed}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1348d96-6207-11dd-9c97-000e50aeeee1}]


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

Logi dajesz na http://www.wklej.eu/ a w poście dajesz tylko link

[ora007]

Log z Combofix'a

http://www.wklej.eu/index.php?id=cb1bd8fcfe

[huber2t]

Log wyglada na czysty

usuń ręcznie folder C: \Qoobox , usuń instalkę Combofix z dysku.

Przeczyść komputer Ccleanerem

Wykonaj optymalizację autostartu

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!

[ora007]

Skąd mam wiedzieć jakie programy mam wyłączyć w narzędziach konfiguracji systemu, żeby szybciej się Windows uruchamiał?

[huber2t]

Ja ci je podałem, ale ty ich nie wpisaleś do scriptu

[ora007]

log ze skanera on line

http://www.wklej.eu/index.php?id=e5d582fd70

[huber2t]

W raporcie czysto

[ora007]

A w raporcie pisało, że jakieś 3 pliki są zainfekowane Trojanem. Czy nie trzeba się tego pozbyć?

[huber2t]

ehh, przeskanuj obszar całego komputera

[ora007]

no przeskanowałam i raport wrzuciłam na forum. Podaję linka jeszcze raz:

http://www.wklej.eu/index.php?id=e64b052690

[huber2t]

Pobierz The Avenger

wklej do niego ten tekst:

Kod: Zaznacz wszystko

Files to delete:
D:\ph.com
E:\ph.com
F:\ph.com


kopiuj to i klikasz na Paste Script from Clipboard wybierasz Execute oraz Potwierdzasz i zgadzasz się na restart klikając OK.
Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt

[ora007]

log z Avenger:

http://www.wklej.eu/index.php?id=f54525078f

[huber2t]

Pliki usunięte