Nie mogę usunąć Syfu po Vundo

[Oblivion (Darek131)]

Mój skan programem ComboFix już po wykonania działania w trybie awaryjnym. Jeśli coś źle zamieściłem, to pisać.

“Administrator” - 2007-06-02 18:22:05 Dodatek Service Pack 2 [sAFE MODE] ComboFix 07-05.27.BV - Running from: “E:\Programy\Trojan Vundo” (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\cuddrsuc.dll C:\WINDOWS\system32\jkhhh.dll C:\WINDOWS\system32\cbxxvvv.dll C:\WINDOWS\system32\ihkmp.bak1 C:\WINDOWS\system32\ihkmp.bak2 C:\WINDOWS\system32\ihkmp.ini * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((( Files Created from 2007-05-02 to 2007-06-02 )))))))))))))))))))))))))))))))))) 2007-06-02 17:33 2007-06-02 16:23 2007-05-31 13:19 2007-05-23 10:59 2007-05-22 00:31 2007-05-22 00:19 2007-05-21 18:21 305,152 --a------ C:\WINDOWS\IsUninst.exe 2007-05-21 18:21 2007-05-19 18:29 4,096 --a------ C:\WINDOWS\d3dx.dat 2007-05-19 18:14 327,168 --a------ C:\WINDOWS\IsUn0415.exe 2007-05-10 19:37 20,480 --a------ C:\WINDOWS\system32\H@tKeysH@@k.DLL (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-02 15:58:15 288 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-00000006-00001102-00000004-10021102}.dat 2007-06-02 15:58:15 288 ----a-w C:\WINDOWS\system32\DVCState-{00000002-00000000-00000006-00001102-00000004-10021102}.dat 2007-06-02 15:32:52 -------- d-----w C:\Program Files\Neostrada TP 2007-06-02 11:12:33 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-06-02 11:12:33 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-05-30 13:56:35 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-21 22:20:28 10,544 ----a-w C:\WINDOWS\system32\wowexec.exe 2007-05-16 11:15:18 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-05-10 17:35:58 92,728 ----a-w C:\WINDOWS\system32\bass.dll 2007-05-07 15:03:01 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-04-25 14:54:40 4 ----a-w C:\WINDOWS\system32\proc625010911.bin 2007-04-24 20:05:13 53,248 ----a-w C:\WINDOWS\system32\apache.dll 2007-04-24 18:12:58 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-04-24 16:24:52 -------- d-----w C:\Program Files\Common Files\DirectX 2007-04-22 18:56:21 -------- d-----w C:\Program Files\A4Tech 2007-04-19 18:09:07 -------- d-----w C:\Program Files\hp deskjet 940c series 2007-04-19 18:05:44 376 ----a-w C:\WINDOWS\mozregistry.dat 2007-04-19 18:05:26 -------- d-----w C:\Program Files\Hewlett-Packard 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 16:56:48 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-04-17 13:50:47 -------- d-----w C:\Program Files\Messenger 2007-04-17 12:53:39 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-17 12:53:36 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-17 12:28:41 -------- d-----w C:\Program Files\Winamp 2007-04-17 12:26:03 -------- d-----w C:\Program Files\ACE Mega CoDecS Pack 2007-04-17 12:25:06 -------- d-----w C:\Program Files\Real Alternative 2007-04-17 12:20:23 639,224 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-04-17 12:14:50 -------- d-----w C:\Program Files\Microsoft Works 2007-04-17 12:07:29 -------- d-----w C:\Program Files\Creative 2007-04-17 12:04:05 184 ----a-w C:\WINDOWS\system32\e000001.dat 2007-04-17 11:44:53 -------- d-----w C:\Program Files\Panda Software 2007-04-17 11:34:09 -------- d-----w C:\Program Files\Thomson 2007-04-17 11:18:47 8 ----a-w C:\WINDOWS\system32\nvModes.dat 2007-04-17 11:00:16 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-17 11:00:06 0 --sha-r C:\MSDOS.SYS 2007-04-17 11:00:06 0 --sha-r C:\IO.SYS 2007-04-17 11:00:06 0 ----a-w C:\CONFIG.SYS 2007-04-17 11:00:06 0 ----a-w C:\AUTOEXEC.BAT 2007-04-17 10:59:14 -------- d–h--w C:\Program Files\WindowsUpdate 2007-04-17 10:59:13 -------- d-----w C:\Program Files\Usługi online 2007-04-17 10:58:39 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-17 10:58:33 -------- d-----w C:\Program Files\Movie Maker 2007-04-17 10:58:13 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-17 10:57:44 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-04-17 10:57:38 -------- d-----w C:\Program Files\Windows NT 2007-04-04 16:55:00 261,480 ----a-w C:\WINDOWS\system32\xactengine2_7.dll 2007-04-04 16:53:42 81,768 ----a-w C:\WINDOWS\system32\xinput1_3.dll 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-15 14:57:58 443,752 ----a-w C:\WINDOWS\system32\d3dx10_33.dll 2007-03-12 14:42:30 3,495,784 ----a-w C:\WINDOWS\system32\d3dx9_33.dll 2007-03-12 14:42:30 1,123,696 ----a-w C:\WINDOWS\system32\D3DCompiler_33.dll 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys 2007-03-05 10:42:18 15,128 ----a-w C:\WINDOWS\system32\x3daudio1_1.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {39FB75C4-AB59-4206-A1B7-3CC0B92701D2}=C:\WINDOWS\system32\eycrdstp.dll [] {9897E3CA-1683-43B6-A00D-FBBEADD86F6B}=C:\WINDOWS\system32\pmkhi.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “WooCnxMon”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [2003-10-16 19:07] “SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-01-26 11:38] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2003-10-16 19:07] “APVXDWIN”=“C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.exe” [2006-09-13 08:59] “CTSysVol”=“C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe” [2002-10-29 09:18] “CTDVDDet”=“C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE” [2002-09-30 01:00] “CTHelper”=“CTHELPER.EXE” [2002-11-13 12:11 C:\WINDOWS\system32\CTHELPER.EXE] “AsioReg”=“REGSVR32.exe” [2006-03-02 14:00 C:\WINDOWS\system32\regsvr32.exe] “SBDrvDet”=“C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe” [2002-12-03 18:06] “CTStartup”=“C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe” [2002-09-13 01:04] “DAEMON Tools”=“d:\DAEMON Tools\daemon.exe” [2006-11-12 12:48] “WinampAgent”=“d:\Winamp\winampa.exe” [2006-11-21 19:38] “WheelMouse”=“C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe” [2005-08-29 08:43] “nwiz”=“nwiz.exe” [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“NvMCTray.dll” [2006-10-22 12:22 C:\WINDOWS\system32\nvmctray.dll] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2006-03-02 14:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] “VundoFix”=“E:\Programy\Trojan Vundo\vundofix.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] avldr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhi] C:\WINDOWS\system32\pmkhi.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteCenter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] AutoRun\command- J:\autorun.exe *Newly Created Service* - PXHELP20 ******************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-02 18:22:56 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = “C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE” /run?Z?6~d???*?6~??? ???h?@?x???7~D???sx??s?G???y??w???@@@???|D@@???>??w???x;7?H???|???|???|L(?sx;7???/?s???D???,???+?s@@@?D???`|?w???@ scanning hidden files … scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-06-02 18:23:17 C:\ComboFix-quarantined-files.txt … 2007-06-02 18:23 — E O F —

[Gutek]

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

Files to delete: C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-00000006-00001102-00000004-10021102}.dat C:\WINDOWS\system32\DVCState-{00000002-00000000-00000006-00001102-00000004-10021102}.dat C:\WINDOWS\system32\H@tKeysH@@k.DLL C:\WINDOWS\system32\cuddrsuc.dll C:\WINDOWS\system32\jkhhh.dll C:\WINDOWS\system32\cbxxvvv.dll C:\WINDOWS\system32\ihkmp.bak1 C:\WINDOWS\system32\ihkmp.bak2 C:\WINDOWS\system32\ihkmp.ini Registry keys to delete: HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhi HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{39FB75C4-AB59-4206-A1B7-3CC0B92701D2} HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{9897E3CA-1683-43B6-A00D-FBBEADD86F6B} HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J\AutoRun\command

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).