win32:Rootkit-gen

Mam kłpopt z wirusem który nie mogę wyrzucic Avastem.
poniżej podaję log z combofixa:
ComboFix 08-07-14.2 - zbych 2008-07-15 19:47:45.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.212 [GMT 2:00]
Running from: C:\DAP\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\avi.dll
C:\WINDOWS\system32\cpuinf32.dll
C:\WINDOWS\system32\DivXsm.exe
C:\WINDOWS\system32\fadeceffea2_z.dll
C:\WINDOWS\system32\ff_liba52.dll
C:\WINDOWS\system32\ff_libdts.dll
C:\WINDOWS\system32\ff_libfaad2.dll
C:\WINDOWS\system32\ff_libmad.dll
C:\WINDOWS\system32\ff_realaac.dll
C:\WINDOWS\system32\ff_samplerate.dll
C:\WINDOWS\system32\ff_tremor.dll
C:\WINDOWS\system32\ff_unrar.dll
C:\WINDOWS\system32\ff_wmv9.dll
C:\WINDOWS\system32\iconv.dll
C:\WINDOWS\system32\libavcodec.dll
C:\WINDOWS\system32\libmpeg2_ff.dll
C:\WINDOWS\system32\libmplayer.dll
C:\WINDOWS\system32\mkunicode.dll
C:\WINDOWS\system32\mkx.dll
C:\WINDOWS\system32\mkzlib.dll
C:\WINDOWS\system32\mmfinfo.dll
C:\WINDOWS\system32\mp4.dll
C:\WINDOWS\system32\mplvpx.dll
C:\WINDOWS\system32\ogg.dll
C:\WINDOWS\system32\OggDS.dll
C:\WINDOWS\system32\ogm.dll
C:\WINDOWS\system32\ts.dll
C:\WINDOWS\system32\vorbis.dll
C:\WINDOWS\system32\vorbisenc.dll
C:\WINDOWS\system32\WMV9VCM.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-15 to 2008-07-15 )))))))))))))))))))))))))))))))
.

2008-07-14 18:00 . 2008-07-14 18:00 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-07-14 18:00 . 2008-07-14 18:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-07-09 17:39 . 2008-07-09 17:39 <DIR> d-------- C:\Documents and Settings\zbych\Dane aplikacji\iGO
2008-07-08 19:10 . 2008-07-08 19:10 <DIR> d-------- C:\Program Files\Apple Software Update
2008-07-05 12:34 . 2008-07-05 12:34 <DIR> d-------- C:\Documents and Settings\zbych\Dane aplikacji\Nokia Multimedia Player
2008-07-05 12:30 . 2008-07-05 12:31 <DIR> d-------- C:\Documents and Settings\zbych\Dane aplikacji\Teleca
2008-07-05 12:25 . 2008-07-05 12:25 <DIR> d-------- C:\Program Files\Sony
2008-07-05 12:17 . 2008-07-05 12:17 <DIR> d-------- C:\Documents and Settings\zbych\Dane aplikacji\Sony Ericsson
2008-07-05 12:16 . 2008-07-05 12:16 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-07-05 12:16 . 2008-07-05 12:16 <DIR> d-------- C:\Program Files\Sony Ericsson
2008-07-05 12:16 . 2008-07-05 12:18 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2008-07-05 12:16 . 2008-07-05 12:16 <DIR> d-------- C:\Program Files\Common Files\Sony Ericsson Shared
2008-07-05 12:14 . 2008-07-05 12:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Teleca
2008-07-05 12:14 . 2008-07-05 12:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson
2008-07-01 17:48 . 2008-07-01 17:48 <DIR> d-------- C:\Documents and Settings\zbych\Dane aplikacji\Bricsys
2008-07-01 17:36 . 2008-07-01 17:36 <DIR> d-------- C:\Documents and Settings\zbych\Dane aplikacji\InstallShield
2008-07-01 17:35 . 2008-07-01 17:46 <DIR> d-------- C:\CadProfi
2008-07-01 17:33 . 2008-07-01 17:33 <DIR> d-------- C:\Program Files\Common Files\Bricsys
2008-07-01 17:33 . 2008-07-01 17:33 <DIR> d-------- C:\Program Files\Bricsys
2008-06-20 18:29 . 2008-06-20 18:29 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-06-20 18:29 . 2008-06-20 18:29 <DIR> d-------- C:\Program Files\MSBuild
2008-06-20 18:28 . 2008-06-20 18:28 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-06-20 18:28 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-06-20 18:23 . 2008-06-20 18:23 <DIR> d-------- C:\Program Files\MSXML 6.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-15 17:33 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-07-15 17:18 --------- d-----w C:\Program Files\English Translator 3
2008-07-08 16:55 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-05 10:56 --------- d-----w C:\Program Files\MoorHunt
2008-07-05 10:50 --------- d-----w C:\Program Files\Opera
2008-07-01 15:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-12 18:02 --------- d-----w C:\Program Files\ABBYY FineReader 4.0 Sprint
2008-06-11 15:42 16 ----a-w C:\Documents and Settings\zbych\pnzp011.dll
2008-06-11 15:42 16 ----a-w C:\Documents and Settings\zbych\pBAP21.dll
2008-06-09 16:19 16 ----a-w C:\Documents and Settings\zbych\poww511.dll
2008-06-08 11:24 --------- d-----w C:\Program Files\iTunes
2008-06-08 11:24 --------- d-----w C:\Documents and Settings\zbych\Dane aplikacji\Apple Computer
2008-06-08 11:23 --------- d-----w C:\Program Files\QuickTime
2008-06-08 11:23 --------- d-----w C:\Program Files\iPod
2008-06-08 11:23 --------- d-----w C:\Program Files\Bonjour
2008-06-08 11:23 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-06-08 11:21 --------- d-----w C:\Program Files\Common Files\Apple
2008-06-08 11:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-06-07 14:04 --------- d-----w C:\Program Files\LizardTech
2008-06-07 13:53 410,976 ----a-w C:\WINDOWS\system32\deploytk.dll
2008-06-07 13:53 --------- d-----w C:\Program Files\Java
2008-05-31 03:52 --------- d-----w C:\Documents and Settings\zbych\Dane aplikacji\NeroDCTemplates
2008-05-30 16:22 --------- d-----w C:\Program Files\NAPI-PROJEKT
2008-05-25 05:53 --------- d-----w C:\Program Files\Ahead
2008-05-25 05:45 --------- d-----w C:\Program Files\Common Files\Ahead
2008-05-24 17:58 --------- d-----w C:\Program Files\Common Files\NSV
2008-05-24 17:36 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-05-24 17:34 --------- d-----w C:\Program Files\Common Files\Nero
2008-05-24 17:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-05-24 17:30 --------- d-----w C:\Program Files\CyberLink
2008-05-24 17:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-05-24 09:46 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-05-23 18:11 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-23 18:11 --------- d-----w C:\Documents and Settings\zbych\Dane aplikacji\Mathsoft
2008-05-23 18:09 --------- d-----w C:\Program Files\Mathcad
2008-05-23 18:05 --------- d-----w C:\Program Files\CDRWIN 6
2008-05-23 17:52 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-23 17:31 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-23 17:31 --------- d-----w C:\Documents and Settings\zbych\Dane aplikacji\DAEMON Tools
2008-05-23 14:52 --------- d-----w C:\Program Files\GetData
2008-05-23 14:37 --------- d-----w C:\Program Files\TC UP
2008-05-23 14:36 --------- d-----w C:\Documents and Settings\zbych\Dane aplikacji\HEXelon
2008-05-23 08:52 --------- d-----w C:\Documents and Settings\zbych\Dane aplikacji\Winamp
2008-05-23 07:47 --------- d-----w C:\Program Files\Winamp Toolbar
2008-05-23 07:47 --------- d-----w C:\Program Files\Winamp
2008-05-23 07:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2008-05-17 04:05 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-05-10 05:38 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
2008-04-25 15:37 558,142 ----a-w C:\WINDOWS\java\Packages\9JXZF539.ZIP
2008-04-25 15:37 155,995 ----a-w C:\WINDOWS\java\Packages\B5R5V5NX.ZIP
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
2008-05-10 05:38 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{268dece7-4ace-473e-a426-a9810c7f4ba1}]
2008-02-25 16:41 1470488 --a------ C:\Program Files\speedbit-TE\tbspee.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{268dece7-4ace-473e-a426-a9810c7f4ba1}"= "C:\Program Files\speedbit-TE\tbspee.dll" [2008-02-25 16:41 1470488]

[HKEY_CLASSES_ROOT\clsid\{268dece7-4ace-473e-a426-a9810c7f4ba1}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{268DECE7-4ACE-473E-A426-A9810C7F4BA1}"= "C:\Program Files\speedbit-TE\tbspee.dll" [2008-02-25 16:41 1470488]

[HKEY_CLASSES_ROOT\clsid\{268dece7-4ace-473e-a426-a9810c7f4ba1}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-07-12 14:53 290816]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-07-12 11:58 1397760]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.EXE" [2008-05-10 07:38 3053056]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-06-07 15:53 136600]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 08:16 528384]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"SoundMan"="SOUNDMAN.EXE" [2002-09-11 04:57 46592 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
gwum.lnk - C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe [2008-04-25 18:27:44 475136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R1 VD_FileDisk;VD_FileDisk;C:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 14:00]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2008-06-07 15:53]
R2 Kmm4xNT;Kmm4xNT;C:\WINDOWS\system32\drivers\Kmm4xNT.sys [2000-11-25 09:38]
R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 KMM4xUSB;KMM4xUSB Driver (kmm4xusb.sys);C:\WINDOWS\system32\Drivers\KMM4xUSB.sys [2003-06-02 21:10]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);C:\WINDOWS\system32\DRIVERS\s816bus.sys [2007-06-19 09:51]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s816mdfl.sys [2007-06-19 09:51]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s816mdm.sys [2007-06-19 09:51]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s816mgmt.sys [2007-06-19 09:51]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);C:\WINDOWS\system32\DRIVERS\s816nd5.sys [2007-06-19 09:51]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s816obex.sys [2007-06-19 09:51]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);C:\WINDOWS\system32\DRIVERS\s816unic.sys [2007-06-19 09:51]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-07-08 17:10:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-07-15 17:35:14 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 19:49:50
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-15 19:50:45
ComboFix-quarantined-files.txt 2008-07-15 17:50:40

Pre-Run: 67,220,463,616 bajtów wolnych
Post-Run: 67,446,456,320 bajtów wolnych

204
bardzo proszę o pomoc.

otwórz notatnik i wklej

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\clsid\{268dece7-4ace-473e-a426-a9810c7f4ba1}]
[-HKEY_CLASSES_ROOT\clsid\{268dece7-4ace-473e-a426-a9810c7f4ba1}]

Z menu Notatnika Plik Zapisz jako Zmień rozszerzenie z .txt na wszystkie pliki zapisz pod nazwą Fix.reg

Uruchom ten plik, uruchom ponownie komputer

usuń ręcznie folder C: \Qoobox , usuń instalkę Combofix z dysku.

Przeczyść komputer Ccleanerem

Wykonaj optymalizację autostartu

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!

Bardzo dziękuję,
zrobiłem tak jak w treści, przeskanowałem programem Dr Web, i pokazał mi, iż nie mam żadnego wirusa.
super extra, jeszcze raz serdeczne dzięki!!!

Przesknauj dla bezpieczeństwa jeszcze innym antywirusem np. Kasperskim