Trojan amvo.com

ciaper79 · 7 Sierpień 2008 17:23

Witam,

Znalazłem w msconfig trojana amvo.exe:

Szukałem, bo z kompem dzieje się coś dziwnego:

nie mogę przestawić widoku na widoczne pliki ukryte
wyrzucony został Avast z msconfigu i nie ładuje się ze startem systemu
dyski (tylko dyski i pendrive) po kliknięciu otwierają się w nowych oknach pomimo tego, że domyślne otwieranie folderów to otwieranie w tym smaym oknie
komp chodzi wolniej
po włożeniu pendrive’a nie pojawia się powitalne okienko.

Kilka dni temu dałem loga na forum, ale dostałem odpowiedź, że wszystko jest OK. :shock:

viewtopic.php?f=13t=261836p=1739364#p1739364

Mam nadzieję, że tym razem ktoś naprawdę pomoże.

Poniżej wklejam loga z Combofix i proszę o pomoc.

ComboFix 08-08-02.01 - Mariusz 2008-08-07 19:15:26.2 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.48.1033.18.528 [GMT 2:00] Running from: D:\Downloads\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\WINDOWS\system32\amvo.exe C:\WINDOWS\system32\amvo0.dll C:\WINDOWS\system32\amvo1.dll D:\Autorun.inf G:\autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-07-07 to 2008-08-07 ))))))))))))))))))))))))))))))) . 2008-08-07 17:21 . 2008-08-07 11:54 89,090 -r-hs---- C:\x0.cmd 2008-08-04 19:27 . 2008-08-05 08:40 89,300 -r-hs---- C:\knupkb.com 2008-07-17 20:23 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-07-17 20:23 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-07-17 20:23 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-07-17 20:23 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-07-10 22:36 . 2008-07-10 22:37 2008-07-10 22:35 . 2008-07-10 22:35 2008-07-08 18:50 . 2008-07-08 18:50 17,408 --a------ C:\WINDOWS\system32\drivers\aksusb.sys 2008-07-08 18:50 . 2008-05-19 18:36 2,626 --a------ C:\WINDOWS\system32\config.hsp 2008-07-08 18:50 . 2008-07-08 18:50 139 --a------ C:\WINDOWS\splendor.ini 2008-07-08 18:49 . 2008-07-08 18:49 2008-07-08 18:49 . 1996-12-18 09:11 284,160 --a------ C:\WINDOWS\unin0415.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-17 17:12 74,208 ----a-w C:\Documents and Settings\Mariusz\Application Data\GDIPFONTCACHEV1.DAT 2008-06-23 17:56 --------- d-----w C:\Program Files\Athenasoft 2008-06-22 20:19 --------- d-----w C:\Program Files\emakeup 2008-06-22 15:48 --------- d-----w C:\Program Files\uTorrent 2008-06-22 15:47 --------- d-----w C:\Documents and Settings\Mariusz\Application Data\uTorrent 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-03 15:34 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll 2008-01-17 17:32 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat . ((((((((((((((((((((((((((((( snapshot@2008-08-03_19.45.58.14 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 17:19:32 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_d0.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 05:00 15360] “GoD”=“C:\Documents and Settings\Mariusz\My Documents\GoD\GoD.exe” [2008-07-21 00:48 2456576] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2005-11-02 00:11 102491] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2005-11-02 00:11 692315] “PCMService”=“C:\Program Files\Acer\Acer Arcade\PCMService.exe” [2005-12-02 15:42 151552] “IMJPMIG8.1”=“C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” [2004-08-04 05:00 208952] “MSPY2002”=“C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe” [2004-08-04 05:00 59392] “PHIME2002ASync”=“C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE” [2004-08-04 05:00 455168] “PHIME2002A”=“C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE” [2004-08-04 05:00 455168] “ePower_DMC”=“C:\Acer\Empowering Technology\ePower\ePower_DMC.exe” [2006-01-17 18:28 344064] “LManager”=“C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE” [2005-12-06 17:11 458752] “Acer ePower Management”=“C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe” [2006-01-16 11:58 3080192] “RTHDCPL”=“RTHDCPL.EXE” [2005-11-16 20:27 15600128 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 05:00 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] “VIDC.YV12”= yv12vfw.dll [HKLM~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp] Alaunch [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg!AVG Anti-Spyware] --a------ 2007-06-11 10:25 6731312 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADMTray.exe] --a------ 2005-10-24 16:45 2462208 C:\Acer\Empowering Technology\admtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2005-08-12 14:43 45056 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 05:00 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-03 23:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e-Kiosk] --a------ 2008-06-06 12:03 565248 C:\Program Files\e-Kiosk Reader\eGazetaST.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader] --a------ 2005-10-19 09:30 69632 C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService] --a------ 2006-01-24 18:00 397312 C:\Acer\Empowering Technology\eRecovery\Monitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] --a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] -ra------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-01 17:22 21898024 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-05-02 04:15 75520 C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “C:\Program Files\Acer\Acer Arcade\PCMService.exe”= “%windir%\Network Diagnostic\xpnetdiag.exe”= “C:\Program Files\Gadu-Gadu\gg.exe”= “C:\Program Files\SopCast\SopCast.exe”= “C:\Program Files\Tlen.pl\tlen.exe”= “C:\Program Files\uTorrent\uTorrent.exe”= “C:\Program Files\Skype\Phone\Skype.exe”= [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] “8461:TCP”= 8461:TCP:GoD High Port “8462:TCP”= 8462:TCP:GoD Low Port R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R1 OsaFsLoc;OsaFsLoc;C:\WINDOWS\system32\drivers\OsaFsLoc.sys [2005-10-15 18:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2005-04-22 16:57] R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-22 16:57] R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 16:58] R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 15:57] S2 Kmm4xNT;Kmm4xNT;C:\WINDOWS\system32\drivers\Kmm4xNT.sys [2002-04-26 12:04] S3 AVerM115;AVerM115 service;C:\WINDOWS\system32\DRIVERS\AVerM115.sys [2005-08-24 07:07] S3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\Drivers\lv321av.sys [2005-11-30 05:28] S3 NdisFilt;OSA NdisFilter Protocol;C:\WINDOWS\system32\Drivers\NdisFilt.sys [2005-09-13 15:34] S3 SMCB000;SMSC CIR HID Miniport Device Driver;C:\WINDOWS\system32\DRIVERS\hidsmsc.sys [2005-12-06 17:50] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{9c82fed0-5578-11dd-9e9a-0016363d35ff}] \Shell\AutoRun\command - G:\knupkb.com \Shell\explore\Command - G:\knupkb.com \Shell\open\Command - G:\knupkb.com . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.wp.pl/ R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://global.acer.com/ O8 -: Sample Toolband Serach - C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM O8 -: Eksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O17 -: HKLM\CCS\Interface{AB247771-B8D7-45E7-B693-696DE3E4C049}: NameServer = 191.191.2.3,190.100.10.1 O16 -: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} - hxxps://www.bph.pl/pi/components/SignActivX.cab C:\WINDOWS\Downloaded Program Files\SignActivX.ocx ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-07 19:19:48 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE C:\PROGRAM FILES\INTEL\WIRELESS\BIN\EVTENG.EXE C:\PROGRAM FILES\INTEL\WIRELESS\BIN\S24EVMON.EXE C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE C:\ACER\EMPOWERING TECHNOLOGY\ADMSERV.EXE C:\PROGRAM FILES\LAUNCH MANAGER\QTZGACER.EXE C:\PROGRAM FILES\ACER\ACER ARCADE\KERNEL\TV\CLCAPSVC.EXE C:\PROGRAM FILES\ACER\ACER ARCADE\KERNEL\CLML_NTSERVICE\CLMLSERVER.EXE C:\PROGRAM FILES\ACER\ACER ARCADE\KERNEL\CLML_NTSERVICE\CLMLSERVICE.EXE C:\PROGRAM FILES\INTEL\WIRELESS\BIN\REGSRVC.EXE C:\PROGRAM FILES\CYBERLINK\SHARED FILES\RICHVIDEO.EXE C:\PROGRAM FILES\ACER\ACER ARCADE\KERNEL\TV\CLSCHED.EXE C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE C:\WINDOWS\SYSTEM32\WBEM\UNSECAPP.EXE . ************************************************************************** . Completion time: 2008-08-07 19:21:38 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-07 17:21:36 ComboFix2.txt 2008-08-03 17:46:20 Pre-Run: 10,258,350,080 bytes free Post-Run: 10,259,660,800 bytes free 194 — E O F — 2008-07-11 15:03:23 Z góry dziękuję i pozdrawiam.

djarta · 7 Sierpień 2008 17:29

Wylecz pendriva lub kartę pamięci

Perlovga Removal Tool

Flash Disinfector

lub format

Wklej do Notatnika :

File::

C:\x0.cmd

D:\x0.cmd

G:\x0.cmd

C:\knupkb.com

D:\knupkb.com

G:\knupkb.com


Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c82fed0-5578-11dd-9e9a-0016363d35ff}]

>>Plik>>Zapisz jako… >>> CFScript

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe

–>

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log.

Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:** Qoobox.**

Dom1 · 7 Sierpień 2008 17:30

Z tego co widzę to kilka dni temu, we wcześniejszym temacie go nie było w logu, a teraz jest.

Leon1 · 7 Sierpień 2008 17:40

w jednym jak i drugim temacie nikt nie pisał że jest wszystko OK

viewtopic.php?f=13&t=262749&p=1745705#p1745705

Tematy należy pisać w działach do tego przeznaczonych

ciaper79 · 8 Sierpień 2008 06:25

Pisał, pisał. Ale to nie jest istota rzeczy. Później zrobię rzeczy zaproponowane przez djarta.

ciaper79 · 9 Sierpień 2008 08:06

Ale mam b.ważne pytanie - czy przed użyciem np. Flash Disinfectora muszę skopiować na dysk wszystkie dane z Pen’a żeby ich nie stracić ?? czy ten program tylko skanuje Pen’a i zadnego pliku nie stracę ??

Gutek · 9 Sierpień 2008 09:07

Zainfekowane usunie pliki

ciaper79 · 9 Sierpień 2008 15:35

djarta:

1) Wylecz pendriva lub kartę pamięci Perlovga Removal Tool Flash Disinfector lub format 2) Wklej do Notatnika: File:: C:\x0.cmd D:\x0.cmd G:\x0.cmd C:\knupkb.com D:\knupkb.com G:\knupkb.com Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{9c82fed0-5578-11dd-9e9a-0016363d35ff}] >>Plik>>Zapisz jako… >>> CFScript Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe --> Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log. Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox. To jest log po restarcie: ComboFix 08-08-02.01 - Mariusz 2008-08-09 17:30:59.3 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.48.1033.18.583 [GMT 2:00] Running from: D:\Downloads\ComboFix.exe Command switches used :: D:\Downloads\CFScript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED FILE :: C:\knupkb.com C:\x0.cmd D:\knupkb.com D:\x0.cmd G:\knupkb.com G:\x0.cmd . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\knupkb.com C:\x0.cmd D:\knupkb.com D:\x0.cmd G:\knupkb.com G:\x0.cmd . ((((((((((((((((((((((((( Files Created from 2008-07-09 to 2008-08-09 ))))))))))))))))))))))))))))))) . 2008-07-17 20:23 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-07-17 20:23 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-07-17 20:23 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-07-17 20:23 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-07-10 22:36 . 2008-07-10 22:37 2008-07-10 22:35 . 2008-07-10 22:35 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-17 17:12 74,208 ----a-w C:\Documents and Settings\Mariusz\Application Data\GDIPFONTCACHEV1.DAT 2008-07-08 16:50 17,408 ----a-w C:\WINDOWS\system32\drivers\aksusb.sys 2008-06-23 17:56 --------- d-----w C:\Program Files\Athenasoft 2008-06-22 20:19 --------- d-----w C:\Program Files\emakeup 2008-06-22 15:48 --------- d-----w C:\Program Files\uTorrent 2008-06-22 15:47 --------- d-----w C:\Documents and Settings\Mariusz\Application Data\uTorrent 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-03 15:34 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-01-17 17:32 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat . ((((((((((((((((((((((((((((( snapshot@2008-08-03_19.45.58.14 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-09 15:23:00 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_b0.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 05:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2005-11-02 00:11 102491] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2005-11-02 00:11 692315] “PCMService”=“C:\Program Files\Acer\Acer Arcade\PCMService.exe” [2005-12-02 15:42 151552] “IMJPMIG8.1”=“C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” [2004-08-04 05:00 208952] “MSPY2002”=“C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe” [2004-08-04 05:00 59392] “PHIME2002ASync”=“C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE” [2004-08-04 05:00 455168] “PHIME2002A”=“C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE” [2004-08-04 05:00 455168] “ePower_DMC”=“C:\Acer\Empowering Technology\ePower\ePower_DMC.exe” [2006-01-17 18:28 344064] “LManager”=“C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE” [2005-12-06 17:11 458752] “Acer ePower Management”=“C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe” [2006-01-16 11:58 3080192] “RTHDCPL”=“RTHDCPL.EXE” [2005-11-16 20:27 15600128 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 05:00 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] “VIDC.YV12”= yv12vfw.dll [HKLM~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp] Alaunch [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg!AVG Anti-Spyware] --a------ 2007-06-11 10:25 6731312 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADMTray.exe] --a------ 2005-10-24 16:45 2462208 C:\Acer\Empowering Technology\admtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2005-08-12 14:43 45056 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 05:00 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-03 23:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e-Kiosk] --a------ 2008-06-06 12:03 565248 C:\Program Files\e-Kiosk Reader\eGazetaST.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader] --a------ 2005-10-19 09:30 69632 C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService] --a------ 2006-01-24 18:00 397312 C:\Acer\Empowering Technology\eRecovery\Monitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoD] --a------ 2008-07-21 00:48 2456576 C:\Documents and Settings\Mariusz\My Documents\GoD\GoD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] --a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] -ra------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-01 17:22 21898024 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-05-02 04:15 75520 C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “C:\Program Files\Acer\Acer Arcade\PCMService.exe”= “%windir%\Network Diagnostic\xpnetdiag.exe”= “C:\Program Files\Gadu-Gadu\gg.exe”= “C:\Program Files\SopCast\SopCast.exe”= “C:\Program Files\Tlen.pl\tlen.exe”= “C:\Program Files\uTorrent\uTorrent.exe”= “C:\Program Files\Skype\Phone\Skype.exe”= [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] “8461:TCP”= 8461:TCP:GoD High Port “8462:TCP”= 8462:TCP:GoD Low Port R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R1 OsaFsLoc;OsaFsLoc;C:\WINDOWS\system32\drivers\OsaFsLoc.sys [2005-10-15 18:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2005-04-22 16:57] R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-22 16:57] R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 16:58] R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 15:57] S2 Kmm4xNT;Kmm4xNT;C:\WINDOWS\system32\drivers\Kmm4xNT.sys [2002-04-26 12:04] S3 AVerM115;AVerM115 service;C:\WINDOWS\system32\DRIVERS\AVerM115.sys [2005-08-24 07:07] S3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\Drivers\lv321av.sys [2005-11-30 05:28] S3 NdisFilt;OSA NdisFilter Protocol;C:\WINDOWS\system32\Drivers\NdisFilt.sys [2005-09-13 15:34] S3 SMCB000;SMSC CIR HID Miniport Device Driver;C:\WINDOWS\system32\DRIVERS\hidsmsc.sys [2005-12-06 17:50] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-09 17:32:35 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-09 17:32:56 ComboFix-quarantined-files.txt 2008-08-09 15:32:54 ComboFix3.txt 2008-08-03 17:46:20 ComboFix2.txt 2008-08-07 17:21:40 Pre-Run: 10,114,269,184 bytes free Post-Run: 10,195,369,984 bytes free 160 — E O F — 2008-07-11 15:03:23 Czy teraz jest już wszystko OK i mogę usunąć tego Qoobox ??

wesseb · 9 Sierpień 2008 15:41

Czysto.

Usuń ręcznie folder C:** Qoobox**,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer Ccleanerem

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!.

ciaper79 · 9 Sierpień 2008 16:30

Jeśli jest czysto, to też muszę to zrobić? W jakim celu?

Combofix się przeciez nie instaluje. Mam tylko wyrzucić tak po prostu ten plik Combofix?

djarta · 9 Sierpień 2008 16:36

Tak.