Prozba o sprawdzenie loga - net bardzo wolno chodzi

[Drusss]

Log z hijakckhits

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:14:14, on 2008-12-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Everest\everest.exe
C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [EVEREST AutoStart] C:\Everest\everest.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" /SCB
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 6551 bytes

Dzieki za pomoc

[huber2t]

Log ok

Podaj log z Combofix

[Drusss]

Kurde moze Wy mi cos powiecie i podpowiecie jak mam walczyc z jakims wirusem co zamula mi neta ... zamulil mi do tego stopnia ze nawet combofix'a niemoze mi sciagnac ... a to tylko prawie 3mb ...
na kompie mam noda i wczsniej niemialem zadnych taki problemow ! wczoraj od samego rana sie wszystko popsulo ... nod nic nieznajduje ...

niedlugo ide do kumpla i bede u niego sciagal, powiedzcie mi co sciaganac zeby sobie z tym poradzilo ?? Avast ? czy moze jeszcze cos innego ??

czekam na wasze propozycje ...

[huber2t]

Narazie ściągnij combofix, i daj log

W czasie pobierania i skanowania combofixem zamknij wszelkie programy ochronne (Antywirusa, zaporę)

Jak nie pomoże:

Spróbuj podczas pobierania zapisać nie pod nazwą ComboFix.exe tylko z kreską pomiędzy:

Combo-Fix.exe

Jeśli to również:

Uruchom combofix w trybie awaryjnym

[Drusss]

log z combo fix'a

ComboFix 08-12-11.05 - Druss 2008-12-12 14:53:31.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.108 [GMT 1:00]
Running from: c:\documents and settings\Druss\Pulpit\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\hlvdd.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-12 to 2008-12-12 )))))))))))))))))))))))))))))))
.

2008-12-12 12:48 . 2008-12-12 12:48 <DIR> d-------- c:\program files\ALWIL Software
2008-12-12 12:48 . 2001-08-31 09:13 130,048 --------- c:\windows\system32\vic32.dll
2008-12-12 12:48 . 2002-10-02 11:36 42,560 --a------ c:\windows\system32\drivers\avmon.sys
2008-12-12 12:48 . 2002-10-02 11:38 40,192 --a------ c:\windows\system32\drivers\avmon2.sys
2008-12-12 12:48 . 2002-10-02 11:54 32,768 --a------ c:\windows\system32\avss30.scr
2008-12-12 12:48 . 2002-10-02 11:34 16,560 --a------ c:\windows\system32\drivers\aavmker.sys
2008-12-12 12:47 . 2008-12-12 12:47 2,491 --a------ c:\windows\Avast32.MIF
2008-12-12 12:46 . 2008-12-12 12:46 <DIR> d-------- C:\CHIP
2008-12-12 12:45 . 2008-12-12 12:49 208 --a------ c:\windows\VOGEL.INI
2008-12-01 21:01 . 2008-12-01 21:01 <DIR> d-------- c:\program files\Avanquest update
2008-12-01 20:58 . 2008-12-01 21:00 <DIR> d-------- c:\program files\Motorola Phone Tools
2008-11-26 14:22 . 2008-11-26 15:10 <DIR> d-------- c:\documents and settings\Druss\Dane aplikacji\U3
2008-11-12 18:05 . 2005-07-28 08:18 685,056 --a------ c:\windows\system32\drivers\hardlock.sys
2008-11-12 18:05 . 2008-12-12 12:51 0 --a------ c:\windows\TempFile
2008-11-12 17:27 . 2006-02-02 07:42 468,084 --a------ c:\windows\cluninst.exe
2008-11-12 17:26 . 2006-08-25 01:35 4,096 --a------ c:\windows\system\LEXHDL5.DLL
2008-11-12 17:25 . 2008-11-12 17:26 <DIR> d-------- C:\etka
2008-11-12 17:25 . 2008-11-12 17:40 98 --a------ c:\windows\etkinst.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-10 20:22 --------- d-----w c:\program files\eMule
2008-12-01 20:01 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-01 19:58 92,064 ----a-w c:\documents and settings\Druss\mqdmmdm.sys
2008-12-01 19:58 9,232 ----a-w c:\documents and settings\Druss\mqdmmdfl.sys
2008-12-01 19:58 79,328 ----a-w c:\documents and settings\Druss\mqdmserd.sys
2008-12-01 19:58 66,656 ----a-w c:\documents and settings\Druss\mqdmbus.sys
2008-12-01 19:58 6,208 ----a-w c:\documents and settings\Druss\mqdmcmnt.sys
2008-12-01 19:58 5,936 ----a-w c:\documents and settings\Druss\mqdmwhnt.sys
2008-12-01 19:58 4,048 ----a-w c:\documents and settings\Druss\mqdmcr.sys
2008-12-01 19:58 25,600 ----a-w c:\windows\system32\drivers\usbsermptxp.sys
2008-12-01 19:58 25,600 ----a-w c:\documents and settings\Druss\usbsermptxp.sys
2008-12-01 19:58 22,768 ----a-w c:\documents and settings\Druss\usbsermpt.sys
2008-11-11 11:38 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\FLEXnet
2008-11-11 11:18 --------- d-----w c:\program files\Common Files\Adobe
2008-11-11 11:14 --------- d-----w c:\program files\Bonjour
2008-11-11 10:45 --------- d-----w c:\program files\Common Files\Macrovision Shared
2008-11-11 00:37 --------- d-----w c:\program files\Nokia
2008-11-10 14:08 --------- d-----w c:\documents and settings\Druss\Dane aplikacji\Nokia Multimedia Player
2008-11-10 14:08 --------- d-----w c:\documents and settings\Druss\Dane aplikacji\Nokia
2008-11-10 13:44 --------- d-----w c:\program files\Common Files\PCSuite
2008-11-10 13:44 --------- d-----w c:\program files\Common Files\Nokia
2008-11-10 13:43 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Downloaded Installations
2008-11-10 13:39 --------- d-----w c:\program files\PC Connectivity Solution
2008-11-10 13:39 --------- d-----w c:\program files\DIFX
2008-11-10 13:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Installations
2007-11-21 21:20 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-04-17 2113536]
"EVEREST AutoStart"="c:\everest\everest.exe" [2007-10-17 2043488]
"Creative MediaSource Go"="c:\program files\Creative\MediaSource5\Go\CTCMSGoU.exe" [2006-11-09 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-03-31 950664]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2005-12-14 176128]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 32768]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2007-04-08 721656]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AvMaiSrv"="c:\progra~1\ALWILS~1\AVAST32\AvMaiSrv.exe" [2002-10-02 172032]
"Avast32"="c:\progra~1\ALWILS~1\AVAST32\ASTART32.EXE" [2002-10-02 32768]
"ATIPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 32768]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-02-22 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a------ 2005-02-22 21:21 32768 c:\program files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2005-11-08 23:00 128920 c:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2006-03-23 17:06 1398272 c:\program files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 06:03 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 06:03 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 17:24 1694208 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--------- 2005-02-10 16:00 1937408 c:\program files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--------- 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--------- 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2007-06-18 15:10 271360 c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
--a------ 2007-06-19 10:17 1241088 c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 00:00 90112 c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-04-01 19:49 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
-ra------ 2005-05-03 12:38 64512 c:\windows\system32\P17.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Atari\\Test Drive Unlimited\\TestDriveUnlimited.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\NAPI-PROJEKT\\napisy.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\ALWIL Software\\AVAST32\\avserver.exe"=
"c:\\Program Files\\ALWIL Software\\AVAST32\\quick32.exe"=

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-06 35328]
R1 Aavmker;Avast32 Asynchronous Virus Monitor;c:\windows\system32\drivers\Aavmker.sys [2008-12-12 16560]
R1 atitray;atitray;\??\c:\program files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [2008-02-11 17952]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2007-03-31 15424]
R2 AvMon2;Avast32 Standard Shield Support;c:\windows\system32\drivers\AvMon2.sys [2008-12-12 40192]
R2 PStrip;PStrip;c:\windows\system32\drivers\pstrip.sys [2006-09-30 27936]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\DRIVERS\Amps2prt.sys [2005-12-08 12800]
R3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\DRIVERS\e4usbaw.sys [2006-12-23 116992]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\c:\everest\kerneld.wnt [2008-02-12 22640]
S1 SpyEmrg;Spy Emergency Driver;c:\windows\system32\Drivers\spyemrg.sys []
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\Drivers\e4ldr.sys [2006-12-23 64000]
S3 Avast32 Start as Service;Avast32 Start as Service;c:\program files\ALWIL Software\AVAST32\avserver.exe /ServiceStart [2008-12-12 245760]
S3 iteio;iteio;\??\c:\windows\system32\drivers\iteio.sys [2006-10-04 3680]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - AAVMKER
*Newly Created Service* - AVMON2
*Newly Created Service* - AVUPDSVC
*Newly Created Service* - EVERESTDRIVER

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DDDFC9C8-A0F8-E0CF-AF00-F0F423E36752}]
c:\windows\system32\svchast.exe
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-StartCCC - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
MSConfigStartUp-avast! - c:\progra~1\ALWILS~1\Avast4\ashDisp.exe
MSConfigStartUp-AVFX Engine - c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
MSConfigStartUp-BearShare - c:\program files\BearShare\BearShare.exe
MSConfigStartUp-SpyEmergency - c:\program files\Spy Emergency 2005\SpyEmergency.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_02\bin\jusched.exe
MSConfigStartUp-SoundMan - SOUNDMAN.EXE


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.pl/
mStart Page = about:blank
IE: Download all links using BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Download all videos using BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Download link using &BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
LSP: c:\windows\system32\imon.dll
TCP: {CE9B9E42-11FF-4744-B896-8EF7691691D8} = 194.204.159.1 217.98.63.164

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll
O16 -: {68282C51-9459-467B-95BF-3C0E89627E55}
hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
c:\windows\Downloaded Program Files\SkanerOnline.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-12 14:59:04
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Creative Detector = "c:\program files\Creative\MediaSource\Detector\CTDetect.exe" /R???w0??w????*??w???w????O??w:???m????? ?????????????L???L??????????wO??w:???m????? ?????????????k!?sO??w:???m????? ?????L??????????sm????? ?????m???????$??????sm????? ?????????????rl?w?? ?N??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\everest\kerneld.wnt"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(636)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(692)
c:\windows\system32\imon.dll
.
Completion time: 2008-12-12 15:03:05
ComboFix-quarantined-files.txt 2008-12-12 14:02:01

Pre-Run: 8˙159˙150˙080 bajt˘w wolnych
Post-Run: 8,707,821,568 bajt˘w wolnych

209

[huber2t]

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

Driver::
SpyEmrg


Plik zapisz jako CFScript.txt.
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu->

Rozpocznie się usuwanie i powstanie log, który dasz na forum.

Logi dajesz na http://www.wklej.eu a w poście dajesz tylko link

[Drusss]

Pobierz ComboFix, ale nie uruchamiaj

z tym to juz zapozno ...

Czy mam pozwolic combo zeby on cos sciagal ??

[Drusss]

link z logiem

http://www.wklej.eu/index.php?id=11f0dd721c

[huber2t]

Log wygląda na czysty

usuń ręcznie folder C: \Qoobox , usuń instalkę Combofix z dysku.

Przeczyść komputer Ccleanerem

Wykonaj optymalizację autostartu

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!

[Drusss]

A wiec logczysty, z kasperskiego niemoge korzystac bo net mam tak zamulony ze niechce nic sciagac wiec kolega sciagnol mi Dr.Web'a i jak narazie na nim sprawdzam. jak skonczy to wkle raport.

[Drusss]

A wiec Dr Web dzialal przez prawie 9 godz i znalazl okolo 15 rzeczy. wzielem i usunelem wszystko. mam nadzieje ze pomoze. z netem jest juz lepiej niz bylo. zobaczymy na jak dlugo ..

[Drusss]

http://www.wklej.eu/index.php?id=9c4653e7c7

log z kasperskiego.

robionuy bez resetu kopa, moze to byl blad ...

[huber2t]

Pobierz The Avenger

wklej do niego ten tekst:

Kod: Zaznacz wszystko

Files to delete:
C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Quarantine\3E1C317C.tmp
C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Quarantine\3E1C317C.tmp
C:\Documents and Settings\Druss\DoctorWeb\Quarantine\1QONWRBA.NQF
C:\Documents and Settings\Druss\DoctorWeb\Quarantine\1QONWRBA.NQF
C:\Documents and Settings\Druss\DoctorWeb\Quarantine\WPPPN0CA.NQF
C:\Program Files\Eset\infected\0ES3HBAA.NQF


kopiuj to i klikasz na Paste Script from Clipboard wybierasz Execute oraz Potwierdzasz i zgadzasz się na restart klikając OK.
Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt