Bardzo zamulony komp, avast informuje o wirusach

[system]

Proszę o sprawdzenie loga

Logfile of HijackThis v1.99.1 Scan saved at 15:45:42, on 2007-08-23 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\program files\zte corporation\zxdsl852\CnxDslTb.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\mmdmm.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Common Files\MicroWorld\Agent\MWASER.EXE C:\Program Files\Common Files\MicroWorld\Agent\MWAgent.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\System32\mdm.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Alwil Software\Avast4\setup\avast.setup G:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\ntos.exe, O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [CnxDslTaskBar] “c:\program files\zte corporation\zxdsl852\CnxDslTb.exe” “ZTE Corporation\ZXDSL852” O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [Windows Security Centers] C:\WINDOWS\System32\wimnini.exe O4 - HKLM…\Run: [mmsass] mmdmm.exe O4 - HKLM…\Run: [Microsoft Office] C:\WINDOWS\System32\mdm.exe O4 - HKLM…\RunServices: [mmsass] mmdmm.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Windows Security Centers] C:\WINDOWS\System32\wimnini.exe O4 - HKCU…\Run: [userinit] C:\WINDOWS\System32\ntos.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip…{75436F5F-4510-4B2F-ADA0-6BAD5F285CEC}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: MWAgent - MicroWorld Technologies Inc. - C:\Program Files\Common Files\MicroWorld\Agent\MWASER.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

[Gutek]

Najpierw automaty - Pobierz program SDFix

[system]

SDFix: Version 1.100 Run by admin on 2007-08-23 at 17:33 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\regedit.com - Deleted C:\WINDOWS\system32\mmdmm.exe - Deleted C:\WINDOWS\system32\ntos.exe - Deleted C:\WINDOWS\system32\wsnpoem\audio.dll - Deleted C:\WINDOWS\system32\wsnpoem\video.dll - Deleted Folder C:\WINDOWS\system32\wsnpoem - Removed Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: C:\WINDOWS\system32\mdm.exe Finished

ComboFix 07-08-04.3 - “admin” 2007-08-23 17:39:45.1 [GMT 2:00] - NTFS Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.Prawda * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\admin.DOM\Pulpit.\internet explorer.lnk C:\WINDOWS\system32\taskmgr.com ((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 ))))))))))))))))))))))))))))))) 2007-08-23 17:38 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-23 17:17 2007-08-23 17:16 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:03 2007-08-23 16:56 55,584 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-08-23 16:56 3,104 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-08-23 15:59 2007-08-23 15:56 2007-08-23 15:41 69,205 --a------ C:\WINDOWS\system32\msv.exe 2007-08-23 15:39 53,760 —hs---- C:\WINDOWS\system32\mdm.exe 2007-08-20 18:49 41,984 --a------ C:\WINDOWS\pgykftui.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-23 17:30 559 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-08-23 17:11 3908 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-08-23 17:11 2408 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2007-08-23 16:22 --------- d-------- C:\Program Files\Neostrada TP 2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-28 00:02 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-28 00:02 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-28 00:00 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-27 23:59 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-27 23:58 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-03-09 22:52 87608 --a------ C:\DOCUME~1\admin.DOM\DANEAP~1\ezpinst.exe 2007-03-09 22:52 47360 --a------ C:\DOCUME~1\admin.DOM\DANEAP~1\pcouffin.sys 2007-02-09 11:45 4837 --a------ C:\Program Files\ST6UNST.LOG 2002-01-19 13:08 5492736 --a------ C:\Program Files\Maximusdvd.exe 2002-01-19 13:07 513 --a------ C:\Program Files\maximusdvd.ini 2002-01-19 03:10 6060 --a------ C:\Program Files\Readme.txt ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-07-28 00:03] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “Microsoft Office”=C:\WINDOWS\System32\mdm.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “SynchronousMachineGroupPolicy”=0 (0x0) “SynchronousUserGroupPolicy”=0 (0x0) R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys R3 cmuda;C-Media WDM Audio Interface;C:\WINDOWS\System32\drivers\cmuda.sys R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\System32\DRIVERS\CnxEtP.sys R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\System32\DRIVERS\CnxEtU.sys R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\System32\DRIVERS\CnxTgNW.sys R3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet;C:\WINDOWS\System32\DRIVERS\fetnd5.sys R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\System32\Drivers\pcouffin.sys S3 k750bus;Sony Ericsson 750 driver (WDM);C:\WINDOWS\System32\DRIVERS\k750bus.sys Contents of the ‘Scheduled Tasks’ folder 2007-08-23 14:00:14 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-23 17:41:47 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes … C:\WINDOWS\system32\cmd.exe [1000] 0x81AAF020 scanning hidden registry entries … source file error: C:\Documents and Settings\ADMIN~~1\ntuser.dat scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-23 17:43:20 C:\ComboFix-quarantined-files.txt … 2007-08-23 17:43 — E O F —

[Gutek]

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

Files to delete: C:\WINDOWS\system32\msv.exe C:\WINDOWS\system32\mdm.exe C:\WINDOWS\pgykftui.exe Registry values to delete: “HKEY_USERS.default\software\microsoft\windows\currentversion\run” | “Microsoft Office”

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po tym nowy log z Combo

[system]

ComboFix 07-08-04.3 - “admin” 2007-08-23 18:25:27.2 [GMT 2:00] - NTFS Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.Prawda ((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 ))))))))))))))))))))))))))))))) 2007-08-23 17:38 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-23 17:17 2007-08-23 17:16 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:03 2007-08-23 16:56 55,584 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-08-23 16:56 3,104 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-08-23 15:59 2007-08-23 15:56 2007-08-23 15:41 69,205 --a------ C:\WINDOWS\system32\msv.exe 2007-08-23 15:39 53,760 —hs---- C:\WINDOWS\system32\mdm.exe 2007-08-20 18:49 41,984 --a------ C:\WINDOWS\pgykftui.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-23 17:30 559 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-08-23 17:11 3908 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-08-23 17:11 2408 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2007-08-23 16:22 --------- d-------- C:\Program Files\Neostrada TP 2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-28 00:02 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-28 00:02 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-28 00:00 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-27 23:59 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-27 23:58 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-03-09 22:52 87608 --a------ C:\DOCUME~1\admin.DOM\DANEAP~1\ezpinst.exe 2007-03-09 22:52 47360 --a------ C:\DOCUME~1\admin.DOM\DANEAP~1\pcouffin.sys 2007-02-09 11:45 4837 --a------ C:\Program Files\ST6UNST.LOG 2002-01-19 13:08 5492736 --a------ C:\Program Files\Maximusdvd.exe 2002-01-19 13:07 513 --a------ C:\Program Files\maximusdvd.ini 2002-01-19 03:10 6060 --a------ C:\Program Files\Readme.txt ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-07-28 00:03] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “Microsoft Office”=C:\WINDOWS\System32\mdm.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “SynchronousMachineGroupPolicy”=0 (0x0) “SynchronousUserGroupPolicy”=0 (0x0) R0 hrbqmihy;hrbqmihy;C:\WINDOWS\System32\drivers\xcbgnvpa.sys R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys R3 cmuda;C-Media WDM Audio Interface;C:\WINDOWS\System32\drivers\cmuda.sys R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\System32\DRIVERS\CnxEtP.sys R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\System32\DRIVERS\CnxEtU.sys R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\System32\DRIVERS\CnxTgNW.sys R3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet;C:\WINDOWS\System32\DRIVERS\fetnd5.sys R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\System32\Drivers\pcouffin.sys S3 k750bus;Sony Ericsson 750 driver (WDM);C:\WINDOWS\System32\DRIVERS\k750bus.sys *Newly Created Service* - HRBQMIHY Contents of the ‘Scheduled Tasks’ folder 2007-08-23 14:00:14 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-23 18:27:50 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes … scanning hidden registry entries … source file error: C:\Documents and Settings\ADMIN~~1\ntuser.dat scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-23 18:29:33 C:\ComboFix-quarantined-files.txt … 2007-08-23 18:29 C:\ComboFix2.txt … 2007-08-23 17:43 — E O F —

[Gutek]

Zrób to co napsiałem wyżej nadal jest

C:\WINDOWS\system32\msv.exe C:\WINDOWS\system32\mdm.exe C:\WINDOWS\pgykftui.exe

• daj raport z The Avenger

[system]

Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\hlxyyyjk ******************* Script file located at: ??\C:\WINDOWS\nsltrvvc.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\msv.exe deleted successfully. File C:\WINDOWS\system32\mdm.exe deleted successfully. File C:\WINDOWS\pgykftui.exe deleted successfully. Completed script processing. ******************* Finished! Terminate.

[Gutek]

Nowy log z Combofix-a

[system]

ComboFix 07-08-04.3 - “admin” 2007-08-23 18:54:51.3 [GMT 2:00] - NTFS Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.Prawda ((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 ))))))))))))))))))))))))))))))) 2007-08-23 17:38 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-23 17:17 2007-08-23 17:16 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:16 2007-08-23 17:03 2007-08-23 16:56 96,800 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-08-23 16:56 3,872 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-08-23 15:59 2007-08-23 15:56 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-23 18:44 4460 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-08-23 18:44 2480 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2007-08-23 17:30 559 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-08-23 16:22 --------- d-------- C:\Program Files\Neostrada TP 2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-28 00:02 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-28 00:02 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-28 00:00 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-27 23:59 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-27 23:58 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-03-09 22:52 87608 --a------ C:\DOCUME~1\admin.DOM\DANEAP~1\ezpinst.exe 2007-03-09 22:52 47360 --a------ C:\DOCUME~1\admin.DOM\DANEAP~1\pcouffin.sys 2007-02-09 11:45 4837 --a------ C:\Program Files\ST6UNST.LOG 2002-01-19 13:08 5492736 --a------ C:\Program Files\Maximusdvd.exe 2002-01-19 13:07 513 --a------ C:\Program Files\maximusdvd.ini 2002-01-19 03:10 6060 --a------ C:\Program Files\Readme.txt ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-07-28 00:03] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “Microsoft Office”=C:\WINDOWS\System32\mdm.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “SynchronousMachineGroupPolicy”=0 (0x0) “SynchronousUserGroupPolicy”=0 (0x0) R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys R3 cmuda;C-Media WDM Audio Interface;C:\WINDOWS\System32\drivers\cmuda.sys R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\System32\DRIVERS\CnxEtP.sys R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\System32\DRIVERS\CnxEtU.sys R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\System32\DRIVERS\CnxTgNW.sys R3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet;C:\WINDOWS\System32\DRIVERS\fetnd5.sys R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\System32\Drivers\pcouffin.sys S0 hrbqmihy;hrbqmihy;C:\WINDOWS\System32\drivers\xcbgnvpa.sys S3 k750bus;Sony Ericsson 750 driver (WDM);C:\WINDOWS\System32\DRIVERS\k750bus.sys Contents of the ‘Scheduled Tasks’ folder 2007-08-23 14:00:14 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-23 18:57:14 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes … scanning hidden registry entries … source file error: C:\Documents and Settings\ADMIN~~1\ntuser.dat scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-23 18:59:01 C:\ComboFix-quarantined-files.txt … 2007-08-23 18:58 C:\ComboFix2.txt … 2007-08-23 18:29 C:\ComboFix3.txt … 2007-08-23 17:43 — E O F —

[qrczak13]

Do notatnika wklej:

Windows Registry Editor Version 5.00 [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “Microsoft Office”=-

Plik > zapisz jako > zmień rozszerzenie z .txt na wszystkie pliki > zapisz pod nazwą Fix.reg np na

pulpicie > dwuklik na Fix.reg > potwierdzasz > restart.

C:\WINDOWS\System32\drivers\xcbgnvpa.sys

Przeskanuj na http://www.virustotal.com/pl/ i wklej raport po skanowaniu.