Raport z combofix, czy mam robic cos jeszcze?


(Kozik176) #1

Witam. Mialem jakiegos wira, poczytalem troche o nim na forach i sciagnalem combofixa. Zrobilem co trzeba i teraz wszystko jest juz ok(twarde dyski widzial mi jako programy i pytal czym otworzyc,a teraz juz jest git) i nie wiem czy musze robic cos jeszcze? Wszedzie pisza o jakims zapisywaniu w notatniku i kopiowaniu na ikonke combofixa, nie wiem kompletnie o co chodzi :slight_smile: prosze o pomoc..

to moj raport

ComboFix 08-07-01.3 - Rotrans 2008-07-02 15:02:48.2 - NTFSx86

Running from: C:\Documents and Settings\Rotrans\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED!!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Previous Run -------

.

C:\autorun.inf

C:\WINDOWS\system32\amvo0.dll

C:\WINDOWS\system32\amvo1.dll

.

((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 )))))))))))))))))))))))))))))))

.

2100-02-23 14:35 . 2001-02-22 09:54 768 --a------ C:\WINDOWS\x73_lut.dat

2100-02-08 15:53 . 2008-01-06 14:05 1,440 --a------ C:\WINDOWS\GtX73.ini

2008-07-01 16:10 . 2008-05-11 11:54 104,253 -r-hs---- C:\r6r.exe

2008-06-11 10:45 . 2008-06-11 10:45 118 --a------ C:\WINDOWS\system32\MRT.INI

2008-06-11 09:42 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-06-11 09:42 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-02 12:18 --------- d-----w C:\Program Files\IrfanView

2008-07-02 12:17 --------- d-----w C:\Program Files\Google

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll

2008-04-28 07:59 104,269 --sh--r C:\jfvkcsy.bat

2008-04-27 16:48 105,128 --sh--r C:\oq.cmd

2008-04-23 07:20 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2007-09-22 14:11 793,536 ----a-w C:\Program Files\wmpcdcs8.exe

2007-09-22 14:10 23,769,896 ----a-w C:\Program Files\DivXInstaller.exe

2007-09-18 18:31 1,508,232 ----a-w C:\Program Files\winamp535_lite.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]

"Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17 102400]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]

"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-12 09:40 36864]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

"ISDN Monitor"="Linksts.exe" [2001-07-03 11:26 229376 C:\WINDOWS\system32\linksts.exe]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]

C:\Documents and Settings\Rotrans\Menu Start\Programy\Autostart\

Reboot.exe [2002-03-21 06:40:42 382464]

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Manager]

--a------ 2001-06-11 11:42 53248 C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Monitor]

--a------ 2001-10-08 16:21 53248 C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]

--a------ 2007-03-23 13:20 227328 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung Common SM]

--------- 2004-05-17 07:34 360448 C:\WINDOWS\Samsung\ComSMMgr\SSMMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"D:\Program Files\Gadu-Gadu\gg.exe"=

"C:\WINDOWS\system32\sessmgr.exe"=

"%windir%\Network Diagnostic\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R0 isdnlink;isdnlink;C:\WINDOWS\system32\DRIVERS\linkisdn.sys [2001-07-03 11:23]

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]

R2 rvsport;RVS Virtual COM Port;C:\WINDOWS\system32\drivers\rvsport.sys [2000-11-14 01:00]

R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2002-04-23 09:02]

R3 wanlink;wanlink;C:\WINDOWS\system32\DRIVERS\wanlink.sys [2001-07-03 11:23]

S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{f10d2c42-143b-11dd-b688-00600849fd52}]

\Shell\AutoRun\command - H:\mvxm.cmd

\Shell\explore\Command - H:\mvxm.cmd

\Shell\open\Command - H:\mvxm.cmd

.

  • ORPHANS REMOVED - - - -

MSConfigStartUp-swg - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-02 15:05:45

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-07-02 15:09:42

ComboFix-quarantined-files.txt 2008-07-02 13:09:35

Pre-Run: 4,765,237,248 bajt贸w wolnych

Post-Run: 4,757,696,512 bajt贸w wolnych

104 --- E O F --- 2008-06-20 08:36:43


(Kambor4) #2

Wklej do notatnika:

File::

C:\r6r.exe

C:\jfvkcsy.bat

C:\mvxm.cmd

C:\oq.cmd

H:\mvxm.cmd

D:\mvxm.cmd


Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f10d2c42-143b-11dd-b688-00600849fd52}]

>>Plik>>Zapisz jako... >>> CFScript

Przeci膮gnij i upu艣膰 plik CFScript.txt na plik ComboFix.exe

02f8f1e3c410a4cc.gif

Ma si臋 rozpocz膮膰 usuwanie. (i powstanie log). Daj ten log, kt贸ry powstanie w trakcie usuwania.

Je艣li p贸jdzie dobrze, to: Po restarcie usu艅 r臋cznie folder C:\Qoobox.


(Kozik176) #3

chyba posz艂o dobrze...

combofix2.txt to to?

ComboFix 08-07-01.3 - Rotrans 2008-07-02 15:02:48.2 - NTFSx86

Running from: C:\Documents and Settings\Rotrans\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED!!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Previous Run -------

.

C:\autorun.inf

C:\WINDOWS\system32\amvo0.dll

C:\WINDOWS\system32\amvo1.dll

.

((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 )))))))))))))))))))))))))))))))

.

2100-02-23 14:35 . 2001-02-22 09:54 768 --a------ C:\WINDOWS\x73_lut.dat

2100-02-08 15:53 . 2008-01-06 14:05 1,440 --a------ C:\WINDOWS\GtX73.ini

2008-07-01 16:10 . 2008-05-11 11:54 104,253 -r-hs---- C:\r6r.exe

2008-06-11 10:45 . 2008-06-11 10:45 118 --a------ C:\WINDOWS\system32\MRT.INI

2008-06-11 09:42 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-06-11 09:42 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-02 12:18 --------- d-----w C:\Program Files\IrfanView

2008-07-02 12:17 --------- d-----w C:\Program Files\Google

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll

2008-04-28 07:59 104,269 --sh--r C:\jfvkcsy.bat

2008-04-27 16:48 105,128 --sh--r C:\oq.cmd

2008-04-23 07:20 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2007-09-22 14:11 793,536 ----a-w C:\Program Files\wmpcdcs8.exe

2007-09-22 14:10 23,769,896 ----a-w C:\Program Files\DivXInstaller.exe

2007-09-18 18:31 1,508,232 ----a-w C:\Program Files\winamp535_lite.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]

"Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17 102400]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]

"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-12 09:40 36864]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

"ISDN Monitor"="Linksts.exe" [2001-07-03 11:26 229376 C:\WINDOWS\system32\linksts.exe]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]

C:\Documents and Settings\Rotrans\Menu Start\Programy\Autostart\

Reboot.exe [2002-03-21 06:40:42 382464]

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Manager]

--a------ 2001-06-11 11:42 53248 C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Monitor]

--a------ 2001-10-08 16:21 53248 C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]

--a------ 2007-03-23 13:20 227328 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung Common SM]

--------- 2004-05-17 07:34 360448 C:\WINDOWS\Samsung\ComSMMgr\SSMMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"D:\Program Files\Gadu-Gadu\gg.exe"=

"C:\WINDOWS\system32\sessmgr.exe"=

"%windir%\Network Diagnostic\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R0 isdnlink;isdnlink;C:\WINDOWS\system32\DRIVERS\linkisdn.sys [2001-07-03 11:23]

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]

R2 rvsport;RVS Virtual COM Port;C:\WINDOWS\system32\drivers\rvsport.sys [2000-11-14 01:00]

R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2002-04-23 09:02]

R3 wanlink;wanlink;C:\WINDOWS\system32\DRIVERS\wanlink.sys [2001-07-03 11:23]

S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{f10d2c42-143b-11dd-b688-00600849fd52}]

\Shell\AutoRun\command - H:\mvxm.cmd

\Shell\explore\Command - H:\mvxm.cmd

\Shell\open\Command - H:\mvxm.cmd

.

  • ORPHANS REMOVED - - - -

MSConfigStartUp-swg - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-02 15:05:45

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-07-02 15:09:42

ComboFix-quarantined-files.txt 2008-07-02 13:09:35

Pre-Run: 4,765,237,248 bajt贸w wolnych

Post-Run: 4,757,696,512 bajt贸w wolnych

104 --- E O F --- 2008-06-20 08:36:43


(huber2t) #4

Do wyleczenia pendrive z wirus贸w u偶yj

Perlovg Removal Tool

Flash Disinfector

lub format

Pobierz ComboFix, ale nie uruchamiaj

Wklej do notatnika:

File::

C:\r6r.exe

C:\jfvkcsy.bat

C:\oq.cmd


Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f10d2c42-143b-11dd-b688-00600849fd52}]

Plik -> zapisz jako -> CFScript.txt (najwygodniej b臋dzie, je艣li zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalaz艂a si臋 obok ikonki ComboFix.exe )

Przeci膮gnij i upu艣膰 ikonk臋 CFScript.txt na ikonk臋 ComboFix.exe tak jak tu ->

02f8f1e3c410a4cc.gif

Rozpocznie si臋 usuwanie i powstanie log, daj ten log na forum.

Logi dajesz na http://wklejto.pl a w po艣cie dajesz tylko link


(Kozik176) #5

nie nie, to chyba b臋dzie to :slight_smile:

ComboFix 08-07-01.3 - Rotrans 2008-07-02 17:35:31.3 - NTFSx86

Running from: C:\Documents and Settings\Rotrans\Pulpit\ComboFix.exe

Command switches used :: C:\Documents and Settings\Rotrans\Pulpit\CFScript.txt

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED!!

FILE ::

C:\jfvkcsy.bat

C:\mvxm.cmd

C:\oq.cmd

C:\r6r.exe

D:\mvxm.cmd

H:\mvxm.cmd

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\jfvkcsy.bat

C:\mvxm.cmd

C:\oq.cmd

C:\r6r.exe

D:\mvxm.cmd

.

((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 )))))))))))))))))))))))))))))))

.

2100-02-23 14:35 . 2001-02-22 09:54 768 --a------ C:\WINDOWS\x73_lut.dat

2100-02-08 15:53 . 2008-01-06 14:05 1,440 --a------ C:\WINDOWS\GtX73.ini

2008-06-11 10:45 . 2008-06-11 10:45 118 --a------ C:\WINDOWS\system32\MRT.INI

2008-06-11 09:42 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-06-11 09:42 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-02 13:29 2,864 ----a-w C:\WINDOWS\system32\winsock.dll

2008-07-02 12:18 --------- d-----w C:\Program Files\IrfanView

2008-07-02 12:17 --------- d-----w C:\Program Files\Google

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll

2008-04-23 07:20 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2007-09-22 14:11 793,536 ----a-w C:\Program Files\wmpcdcs8.exe

2007-09-22 14:10 23,769,896 ----a-w C:\Program Files\DivXInstaller.exe

2007-09-18 18:31 1,508,232 ----a-w C:\Program Files\winamp535_lite.exe

.

((((((((((((((((((((((((((((( snapshot@2008-07-02_15.09.13.25 )))))))))))))))))))))))))))))))))))))))))

.

  • 2008-03-29 17:45:49 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe

  • 2008-05-15 23:24:43 1,152,888 ----a-w C:\WINDOWS\system32\aswBoot.exe

  • 2008-03-29 17:23:22 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr

  • 2008-05-15 23:12:36 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr

  • 2006-03-02 12:00:00 2,864 -c--a-w C:\WINDOWS\system32\dllcache\winsock.dll

  • 2008-07-02 13:29:37 2,864 -c--a-w C:\WINDOWS\system32\dllcache\winsock.dll

  • 2008-03-29 17:26:52 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

  • 2008-05-15 23:13:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

  • 2008-03-29 17:35:49 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys

  • 2008-05-15 23:16:06 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys

  • 2008-03-29 17:35:21 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

  • 2008-05-15 23:18:33 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

  • 2008-03-29 17:29:08 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

  • 2008-05-15 23:15:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

  • 2008-03-29 17:31:34 75,856 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys

  • 2008-05-15 23:20:32 78,416 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys

  • 2008-03-29 17:27:33 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

  • 2008-05-15 23:14:11 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]

"Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17 102400]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]

"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-12 09:40 36864]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

"ISDN Monitor"="Linksts.exe" [2001-07-03 11:26 229376 C:\WINDOWS\system32\linksts.exe]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]

C:\Documents and Settings\Rotrans\Menu Start\Programy\Autostart\

Reboot.exe [2002-03-21 06:40:42 382464]

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Manager]

--a------ 2001-06-11 11:42 53248 C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Monitor]

--a------ 2001-10-08 16:21 53248 C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]

--a------ 2007-03-23 13:20 227328 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung Common SM]

--------- 2004-05-17 07:34 360448 C:\WINDOWS\Samsung\ComSMMgr\SSMMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"D:\Program Files\Gadu-Gadu\gg.exe"=

"C:\WINDOWS\system32\sessmgr.exe"=

"%windir%\Network Diagnostic\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R0 isdnlink;isdnlink;C:\WINDOWS\system32\DRIVERS\linkisdn.sys [2001-07-03 11:23]

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]

R2 rvsport;RVS Virtual COM Port;C:\WINDOWS\system32\drivers\rvsport.sys [2000-11-14 01:00]

R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2002-04-23 09:02]

R3 wanlink;wanlink;C:\WINDOWS\system32\DRIVERS\wanlink.sys [2001-07-03 11:23]

S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-02 17:38:15

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-07-02 17:41:48

ComboFix-quarantined-files.txt 2008-07-02 15:41:43

ComboFix2.txt 2008-07-02 13:09:45

Pre-Run: 4,716,695,552 bajt贸w wolnych

Post-Run: 4,714,135,552 bajt贸w wolnych

126 --- E O F --- 2008-06-20 08:36:43


(huber2t) #6

Log wyglada na czysty

usu艅 r臋cznie folder C: \Qoobox , usu艅 instalk臋 Combofix z dysku.

Przeczy艣膰 komputer Ccleanerem

Wykonaj optymalizacj臋 autostartu

Wy艂膮cz i w艂膮cz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!


(Kozik176) #7

Hubert2t myslisz ze to z pendrive'a przeszlo?mysle ze raczej z neta... A moglo przejsc na mp3'ke ktora podlaczylem? :confused: kopiowalem normalnie jakas tam muze, bo nie chce zarazic drugiego kompa:/


(huber2t) #8

Lepiej wylecz mp3, pod艂膮cz j膮 i przeskanuj antywirem


(Kozik176) #9

Zrobi艂em to wszystko i teraz skanowalem kaspersky'm i znalazlo jeszcze jakies syfy :confused:

http://wklejto.pl/4720

prosze o pomoc :confused:


(Gutek) #10

Infekcja z pendriva - u偶yj Perlovga Removal Tool

Po tym nowy log z Combo


(Kozik176) #11

ale nie mam podlaczonego zadnego pen drive itp. Uruchomilem ten program to dzialal moze sekunde i wyskoczylo ze gratuluje moj komputer jest teraz czysty itd. Mam uruchomic teraz combofixa?


(Gutek) #12

Nie masz tego co by艂 pod艂膮czony wcze艣niej? Skan z penem pod艂膮czonym do komputera i po tym kontrolnie nowy log z Combo


(Kozik176) #13

TO napewno nie bylo z pendrive'a! Nie bylo mnie dosc dlugo a moja mama nawet nie wie co to jest :wink: avast przez dluzszy czas nie byl aktualny i podejrzewam ze to przez neta wlasnie :confused: pendrive na 100 procent odpada... I jak byl ten wirus to chcialem zabezpieczyc dane i kopiowalem zdjecia muze itp na mp3-ke, czy ten wirus tez mogl przeskoczyc:/? antywir (nod32,na innym kompie) na niej nic nie znajduje.

Dzieki wielkie za zainteresowanie i pomoc


(Gutek) #14

Nie roz艣mieszja mnie, co艣 podpi臋te by艂o pod komupter :slight_smile: Ale skoro Ok to dobrze


(Kozik176) #15

czyli Twoim zdaniem to musialo byc z zewnatrz? :confused: popytam sie reszty rodziny i moze cos znajde... A z ta mp3ka co myslisz?


(Gutek) #16

No maszsprawc臋 te偶 masz dane na mp3 :slight_smile:


(Leon$) #17

wed艂ug Kasperskiego par臋 plik贸w do usuni臋cia

Pobierz i uruchom narz臋dzie The Avenger Zaznaczasz tekst podany do usuni臋cia na forum

kopiuj >> klikasz na Paste Script from Clipboard >> Execute >> Potwierdzasz i zgadzasz si臋 na restart klikaj膮c OK.

Kasujesz r臋cznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt

potem nowy log Combofix

:slight_smile:


(Gutek) #18

Zanim to zrobi niech da lepiej nowy log profilaktycznie, poniewa偶 napisa艂

Uruchomilem ten program to dzialal moze sekunde i wyskoczylo ze gratuluje moj komputer jest teraz czysty itd

(Leon$) #19

Tak tylko to si臋 tyczy uruchomienia

je偶eli komp jest czysty to Avanger nie usunie tych plik贸w skoro ich nie ma

ale je偶eli s膮 to usunie

:slight_smile:


(Kozik176) #20

Uzylem tego programu avenger, tu jest raport

http://wklejto.pl/4724

i teraz combo?