Wirus...

[LevyKwidzyn]

Witam. Mam problem. Od 3 dni przy właczaniu każdej aplikacji na komputerze Avira Antyvirus wyskakuje z alertem o ckvo0.dll ... Szukałem w necie jak naprawić ale nic nie pomaga... Daje loga z Combofix:

 

ps. Zanim pokazał sie log z combo fix to z 20 razy musialem w Antywirusie IGNORE kliknąc

 

ComboFix 08-11-23.02 - LeVuSkoVo 2008-11-24 19:30:03.7 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.414 [GMT 1:00]

Uruchomiony z: c:\documents and settings\LeVuSkoVo\Pulpit\ComboFix.exe

* Utworzono nowy punkt przywracania

 

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!

.

 

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\autorun.inf

c:\windows\system32\ckvo.exe

c:\windows\system32\ckvo0.dll

D:\Autorun.inf

 

.

((((((((((((((((((((((((( Pliki utworzone od 2008-10-24 do 2008-11-24 )))))))))))))))))))))))))))))))

.

 

2008-11-23 13:19 . 2008-11-08 15:44 108,973 -r-hs---- C:\sq.com

2008-11-20 19:13 . 2008-11-20 19:51 <DIR> d-------- c:\documents and settings\LeVuSkoVo\Dane aplikacji\IObit

2008-11-11 12:55 . 2008-11-11 13:00 <DIR> d-------- c:\program files\Jufsoft

2008-11-10 17:59 . 2008-11-10 17:59 <DIR> d-------- c:\program files\Avira

2008-11-10 17:59 . 2008-11-10 17:59 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Avira

2008-11-10 11:30 . 2003-03-18 22:20 1,060,864 --a------ c:\windows\system32\MFC71.dll

2008-11-10 11:29 . 2008-11-10 11:29 <DIR> d-------- c:\program files\Alwil Software

2008-11-10 11:01 . 2001-08-17 21:52 18,688 --a------ c:\windows\system32\drivers\cdaudio.sys

2008-11-10 11:01 . 2001-08-17 21:52 18,688 --a--c--- c:\windows\system32\dllcache\cdaudio.sys

2008-11-10 10:44 . 2008-11-10 10:44 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files

2008-11-09 12:35 . 2008-11-09 22:17 <DIR> d-------- c:\program files\cFosSpeed

2008-11-09 12:29 . 2008-11-09 12:29 <DIR> d-------- c:\program files\SkanerOnline

2008-11-04 16:05 . 2008-11-04 16:05 <DIR> d-------- c:\program files\Astonsoft

2008-11-04 16:05 . 2008-11-04 16:26 <DIR> d-------- c:\documents and settings\LeVuSkoVo\Dane aplikacji\DeepBurner

2008-10-29 21:51 . 2008-11-10 16:37 <DIR> d-------- c:\program files\ipla

2008-10-29 21:51 . 2008-10-29 21:51 <DIR> d-------- c:\documents and settings\LeVuSkoVo\Dane aplikacji\ipla

2008-10-29 21:51 . 2008-10-29 21:52 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Dane aplikacji\ipla

2008-10-24 15:35 . 2008-10-24 15:41 <DIR> d-------- c:\program files\ATITool

 

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-11-24 15:00 --------- d-----w c:\documents and settings\LeVuSkoVo\Dane aplikacji\foobar2000

2008-11-23 03:09 --------- d-----w c:\documents and settings\LeVuSkoVo\Dane aplikacji\uTorrent

2008-11-20 18:08 --------- d--h--w c:\program files\InstallShield Installation Information

2008-11-10 17:15 --------- d-----w c:\program files\Gadu-Gadu

2008-11-10 16:56 --------- d-----w c:\program files\Unlocker

2008-11-10 16:14 --------- d-----w c:\program files\Real Alternative

2008-11-10 15:39 --------- d-----w c:\program files\Winamp

2008-11-10 15:37 --------- d-----w c:\program files\Lexmark 1200 Series

2008-11-10 15:37 --------- d-----w c:\program files\KM Wakeup

2008-11-10 15:36 --------- d-----w c:\program files\Ganymede

2008-11-10 15:36 --------- d-----w c:\program files\DivX

2008-11-10 15:36 --------- d-----w c:\program files\DAEMON Tools Lite

2008-11-10 15:35 --------- d-----w c:\program files\ABBYY FineReader 5.0 Sprint

2008-11-10 10:38 --------- d-----w c:\program files\MultiRes

2008-11-07 23:40 --------- d-----w c:\documents and settings\LeVuSkoVo\Dane aplikacji\OpenOffice.org2

2008-10-25 21:47 --------- d-----w c:\documents and settings\LeVuSkoVo\Dane aplikacji\Skype

2008-10-22 18:51 --------- d-----w c:\program files\NCSoft

2008-10-22 18:51 --------- d-----w c:\documents and settings\LeVuSkoVo\Dane aplikacji\InstallShield

2008-10-22 13:36 --------- d-----w c:\program files\Common Files\Blizzard Entertainment

2008-10-21 17:16 --------- d-----w c:\program files\Skype

2008-10-21 17:16 --------- d-----w c:\program files\Common Files\Skype

2008-10-21 17:16 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Skype

2008-10-20 16:53 2,423 ----a-w c:\windows\NewRecorder.reg

2008-10-20 16:53 1,816,779 ----a-w c:\windows\Recorder.reg

2008-10-20 16:53 --------- d-----w c:\program files\Pinnacle

2008-10-18 21:23 --------- d-----w c:\documents and settings\LeVuSkoVo\Dane aplikacji\Desktopicon

2008-10-17 14:29 --------- d-----w c:\documents and settings\LeVuSkoVo\Dane aplikacji\GetRightToGo

2008-10-11 21:59 --------- d-----w c:\program files\MyPortal

2008-10-04 06:58 --------- d-----w c:\documents and settings\LeVuSkoVo\Dane aplikacji\Dev-Cpp

2008-10-03 17:39 107,888 ----a-w c:\windows\system32\CmdLineExt.dll

2008-10-03 17:39 --------- d--h--r c:\documents and settings\LeVuSkoVo\Dane aplikacji\SecuROM

2008-09-26 19:31 --------- d-----w c:\documents and settings\LeVuSkoVo\Dane aplikacji\Nowe Gadu-Gadu

2008-09-25 22:08 --------- d-----w c:\program files\GameTribe

2008-09-15 15:46 86,016 ----a-w c:\windows\system32\OpenAL32.dll

2008-09-15 15:46 262,144 ----a-w c:\windows\system32\wrap_oal.dll

2008-08-28 11:23 472,576 ----a-w c:\windows\Radeon Omega Drivers v4.8.442 Uninstall.exe

.

 

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ATITool"="c:\program files\ATITool\ATITool.exe" [2007-06-21 3119616]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"SynchronousMachineGroupPolicy"= 0 (0x0)

"SynchronousUserGroupPolicy"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveSearch"= 1 (0x1)

"NoStrCmpLogical"= 1 (0x1)

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMBalloonTip"= 1 (0x1)

"MemCheckBoxInRunDlg"= 0 (0x0)

"NoResolveTrack"= 0 (0x0)

"NoResolveSearch"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

"NoRecentDocsNetHood"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.l3acm"= l3codecp.acm

 

[HKLM\~\startupfolder\C:^Documents and Settings^LeVuSkoVo^Menu Start^Programy^Autostart^Xfire.lnk]

path=c:\documents and settings\LeVuSkoVo\Menu Start\Programy\Autostart\Xfire.lnk

backup=c:\windows\pss\Xfire.lnkStartup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]

--a------ 2008-08-21 16:45 888832 d:\programy\Ares\Ares.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]

--a------ 2008-06-12 14:28 266497 c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

--a------ 2008-07-17 13:20 490952 c:\program files\DAEMON Tools Lite\daemon.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]

--a------ 2004-08-03 21:32 208952 c:\windows\ime\imjp8_1\imjpmig.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]

--a------ 2006-09-10 21:56 218032 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 1200 Series]

--a------ 2006-07-13 06:33 57344 c:\program files\Lexmark 1200 Series\lxczbmgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--a------ 2004-08-03 23:55 1667584 c:\program files\Messenger\msmsgs.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]

--a------ 2004-08-03 21:31 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]

--a------ 2004-08-03 21:32 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]

--a------ 2004-08-03 21:32 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]

--a------ 2003-11-10 15:06 406016 c:\windows\system32\PSDrvCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

-ra------ 2007-09-13 12:31 22880040 c:\program files\Skype\Phone\Skype.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

--a------ 2002-07-12 06:17 46592 c:\windows\SOUNDMAN.EXE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"avast! Web Scanner"=3 (0x3)

"avast! Mail Scanner"=3 (0x3)

"avast! Antivirus"=2 (0x2)

"aswUpdSv"=2 (0x2)

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"d:\\Programy\\Ares\\Ares.exe"=

"d:\\gry\\CS1.6\\hl.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"d:\\Programy\\Gadu-Gadu\\Nowe Gadu-Gadu\\gg.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"8461:TCP"= 8461:TCP:GoD High Port

"8462:TCP"= 8462:TCP:GoD Low Port

"11046:TCP"= 11046:TCP:BitComet 11046 TCP

"11046:UDP"= 11046:UDP:BitComet 11046 UDP

"23482:TCP"= 23482:TCP:BitComet 23482 TCP

"23482:UDP"= 23482:UDP:BitComet 23482 UDP

 

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-10 78416]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-10 20560]

S1 atitray;atitray;\??\c:\program files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys []

S3 AVPsys;AVPsys;\??\c:\windows\system32\drivers\cdaudio.sys [2008-11-10 18688]

S3 msvista;msvista;\??\c:\documents and settings\LeVuSkoVo\Pulpit\sd\msvista.sys []

S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);c:\windows\system32\DRIVERS\ss_bus.sys [2008-09-05 83592]

S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;c:\windows\system32\DRIVERS\ss_mdfl.sys [2008-09-05 15112]

S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;c:\windows\system32\DRIVERS\ss_mdm.sys [2008-09-05 109704]

S3 XDva076;XDva076;\??\c:\windows\system32\XDva076.sys []

S3 XDva168;XDva168;\??\c:\windows\system32\XDva168.sys []

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90ed4356-615c-11dd-be2d-000e2e0f95df}]

\Shell\AutoRun\command - I:\sq.com

\Shell\explore\Command - I:\sq.com

\Shell\open\Command - I:\sq.com

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90ed4357-615c-11dd-be2d-000e2e0f95df}]

\Shell\AutoRun\command - J:\sq.com

\Shell\explore\Command - J:\sq.com

\Shell\open\Command - J:\sq.com

.

- - - - USUNIĘTO PUSTE WPISY - - - -

 

MSConfigStartUp-kamsoft - c:\windows\system32\ckvo.exe

 

 

.

------- Skan uzupełniający -------

.

FireFox -: Profile - c:\documents and settings\LeVuSkoVo\Dane aplikacji\Mozilla\Firefox\Profiles\pi5qxeq1.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/

FF -: plugin - d:\programy\Mozilla Firefox\plugins\np32dsw.dll

FF -: plugin - d:\programy\Mozilla Firefox\plugins\npBitCometAgent.dll

FF -: plugin - d:\programy\Mozilla Firefox\plugins\npdivx32.dll

FF -: plugin - d:\programy\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll

FF -: plugin - d:\programy\Mozilla Firefox\plugins\npganymedenet.dll

FF -: plugin - d:\programy\Mozilla Firefox\plugins\NPHoldemFireLauncher.dll

FF -: plugin - d:\programy\Mozilla Firefox\plugins\NPMFireLauncher.dll

FF -: plugin - d:\programy\Mozilla Firefox\plugins\npnul32.dll

FF -: plugin - d:\programy\Mozilla Firefox\plugins\nppl3260.dll

FF -: plugin - d:\programy\Mozilla Firefox\plugins\NPROULETTE.dll

FF -: plugin - d:\programy\Mozilla Firefox\plugins\nprpjplug.dll

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-11-24 19:31:45

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

 

skanowanie ukrytych procesów ...

 

skanowanie ukrytych wpisów autostartu ...

 

skanowanie ukrytych plików ...

 

skanowanie pomyślnie ukończone

ukryte pliki: 0

 

**************************************************************************

.

--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

 

- - - - - - - > 'winlogon.exe'(580)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\rsaenh.dll

 

- - - - - - - > 'lsass.exe'(636)

c:\windows\system32\msprivs.dll

c:\windows\system32\rsaenh.dll

.

Czas ukończenia: 2008-11-24 19:32:45

ComboFix-quarantined-files.txt 2008-11-24 18:32:40

 

Przed: 4 741 120 000 bajtów wolnych

Po: 4,733,227,008 bajtów wolnych

 

210

 

Jeszcze 1 problem... Nie moge pokazać ukrytych plikow i folderów... Poprostu niereaguje po zaznaczeniu.

Edytowane 24 Listopada 2008 przez LevyKwidzyn

[Kolobos]

Podlacz zainfekowane nosniki i uzyj Flash Disinfector, nastepnie CFScript.txt do combofix:

 

File::

C:\sq.com

 

Driver::

msvista

XDva076

XDva168

 

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90ed4356-615c-11dd-be2d-000e2e0f95df}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90ed4357-615c-11dd-be2d-000e2e0f95df}]

 

Na koniec zablokuj dostep do klucza mountpoints2.