Problém po odstranění spywaru

[klikamon]

Přátelé díky,posílám všechny potřebné logy:

VirusTotal:
STATUS: FINISHED
Complete scanning result of "anxyanwl.dll", received in VirusTotal at 05.14.2007, 20:07:18 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.5.15.0 05.14.2007 no virus found
AntiVir 7.4.0.15 05.14.2007 HEUR/Malware
Authentium 4.93.8 05.12.2007 no virus found
Avast 4.7.997.0 05.13.2007 no virus found
AVG 7.5.0.467 05.14.2007 no virus found
BitDefender 7.2 05.14.2007 no virus found
CAT-QuickHeal 9.00 05.14.2007 no virus found
ClamAV devel-20070416 05.14.2007 Trojan.Packed-7
DrWeb 4.33 05.14.2007 Trojan.Virtumod
eSafe 7.0.15.0 05.14.2007 no virus found
eTrust-Vet 30.7.3632 05.14.2007 no virus found
Ewido 4.0 05.14.2007 no virus found
FileAdvisor 1 05.14.2007 no virus found
Fortinet 2.85.0.0 05.14.2007 suspicious
F-Prot 4.3.2.48 05.14.2007 no virus found
F-Secure 6.70.13030.0 05.14.2007 no virus found
Ikarus T3.1.1.7 05.14.2007 no virus found
Kaspersky 4.0.2.24 05.14.2007 no virus found
McAfee 5030 05.14.2007 no virus found
Microsoft 1.2503 05.14.2007 no virus found
NOD32v2 2265 05.14.2007 no virus found
Norman 5.80.02 05.14.2007 no virus found
Panda 9.0.0.4 05.14.2007 Suspicious file
Prevx1 V2 05.14.2007 no virus found
Sophos 4.17.0 05.11.2007 no virus found
Sunbelt 2.2.907.0 05.12.2007 VIPRE.Suspicious
Symantec 10 05.14.2007 Trojan.Duntek
TheHacker 6.1.6.115 05.14.2007 no virus found
VBA32 3.12.0 05.13.2007 no virus found
VirusBuster 4.3.7:9 05.14.2007 no virus found
Webwasher-Gateway 6.0.1 05.14.2007 Heuristic.Malware
Aditional Information
File size: 49204 bytes
MD5: 4b5447a78cfcdf316b5fa998ea25a868
SHA1: 496eb4073939cbdde0e93114f88bd7b3749cfd8e
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

Vundofix:
VundoFix V6.3.21

Checking Java version...

Java version is 1.5.0.2
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 19:57:03 12.5.2007

Listing files found while scanning....

C:\WINDOWS\system32\awvts.dll
C:\WINDOWS\system32\opnkhef.dll
C:\WINDOWS\system32\stvwa.bak1
C:\WINDOWS\system32\stvwa.bak2
C:\WINDOWS\system32\stvwa.ini
C:\WINDOWS\system32\stvwa.ini2
C:\WINDOWS\system32\stvwa.tmp
C:\WINDOWS\system32\xdyaekia.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\awvts.dll
C:\WINDOWS\system32\awvts.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\opnkhef.dll
C:\WINDOWS\system32\opnkhef.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\stvwa.bak1
C:\WINDOWS\system32\stvwa.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\stvwa.bak2
C:\WINDOWS\system32\stvwa.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\stvwa.ini
C:\WINDOWS\system32\stvwa.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\stvwa.ini2
C:\WINDOWS\system32\stvwa.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\stvwa.tmp
C:\WINDOWS\system32\stvwa.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\xdyaekia.dll
C:\WINDOWS\system32\xdyaekia.dll Has been deleted!

Performing Repairs to the registry.
Done!

Combofix:
"Jirka Krob" - 2007-05-14 20:29:57 Service Pack 2
ComboFix 07-05.13.V - Running from: "D:\Ovladaźe\Oprava poźˇtaź\"


(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\anxyanwl.dll
C:\WINDOWS\system32\eqglgqao.dll
C:\WINDOWS\system32\omtfilwi.dll
C:\WINDOWS\system32\vdobkvwq.dll
C:\WINDOWS\system32\iwliftmo.ini


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\JIRKAK~1\Plocha.\internet explorer.lnk


((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\nm


((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-14 ))))))))))))))))))))))))))))))))))


2007-05-13 20:42 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-05-12 21:51 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-05-12 21:15 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-05-12 19:57 <DIR> d-------- C:\VundoFix Backups
2007-05-12 14:05 <DIR> d-------- C:\DOCUME~1\JIRKAK~1\DATAAP~1\Comodo
2007-05-12 14:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Comodo
2007-05-12 14:02 <DIR> d-------- C:\Program Files\Comodo
2007-05-12 08:51 <DIR> d-------- C:\!KillBox
2007-05-06 16:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Spybot - Search & Destroy
2007-05-06 15:57 <DIR> d-------- C:\Program Files\PConPoint
2007-04-24 20:41 <DIR> d-------- C:\WINDOWS\setup.pss
2007-04-24 20:24 <DIR> d-------- C:\Program Files\uTorrent


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-05-14 12:00:21 80,852 ----a-w C:\WINDOWS\system32\perfc005.dat
2007-05-14 12:00:21 416,302 ----a-w C:\WINDOWS\system32\perfh005.dat
2007-05-13 18:39:46 -------- d-----w C:\Program Files\Magentic
2007-05-13 12:06:55 -------- d-----w C:\Program Files\SpeedFan
2007-05-11 18:26:33 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-05-08 10:09:46 -------- d-----w C:\DOCUME~1\JIRKAK~1\DATAAP~1\Vso
2007-05-05 11:15:39 -------- d-----w C:\Program Files\Incomplete
2007-05-05 11:15:27 -------- d-----w C:\Program Files\LimeWire
2007-05-01 12:35:06 44,048 ----a-w C:\DOCUME~1\JIRKAK~1\DATAAP~1\GDIPFONTCACHEV1.DAT
2007-04-29 08:45:05 -------- d-----w C:\Program Files\Setup Files
2007-04-29 08:44:04 -------- d-----w C:\Program Files\MSI
2007-04-24 18:28:54 -------- d-----w C:\DOCUME~1\JIRKAK~1\DATAAP~1\uTorrent
2007-04-23 18:09:02 -------- d-----w C:\Program Files\Acronis
2007-04-22 17:50:13 -------- d-----w C:\Program Files\Microsoft IntelliPoint
2007-04-21 06:36:44 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-04-17 18:08:52 -------- d-----w C:\Program Files\Arovax AntiSpyware
2007-04-14 17:53:07 3,208 ----a-w C:\WINDOWS\im32st.dat
2007-04-11 19:07:21 -------- d-----w C:\Program Files\BitComet
2007-04-11 18:28:57 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
2007-04-11 13:38:44 725,067 ----a-w C:\WINDOWS\system32\Magentic Screensaver.scr
2007-04-09 11:23:20 -------- d-----w C:\DOCUME~1\JIRKAK~1\DATAAP~1\BSplayer Pro
2007-04-09 11:17:33 -------- d-----w C:\Program Files\iTunes
2007-04-09 11:17:29 -------- d-----w C:\Program Files\iPod
2007-04-09 11:17:11 -------- d-----w C:\Program Files\QuickTime
2007-04-09 11:16:51 -------- d-----w C:\Program Files\Apple Software Update
2007-04-09 11:02:20 -------- d-----w C:\DOCUME~1\JIRKAK~1\DATAAP~1\Lavasoft
2007-04-09 10:51:14 -------- d-----w C:\Program Files\Sunbelt Software
2007-04-08 09:25:17 -------- d-----w C:\Program Files\BitLord
2007-04-03 15:22:30 -------- d-----w C:\Program Files\FDRLab
2007-04-03 14:52:33 37,888 ----a-w C:\WINDOWS\system32\setupnt.dll
2007-04-01 15:51:58 -------- d-----w C:\Program Files\AGEIA Technologies
2007-04-01 15:51:47 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-04-01 11:52:00 -------- d-----w C:\Program Files\GSC World Publishing
2007-03-31 09:52:36 -------- d-----w C:\Program Files\THQ
2007-03-31 09:52:17 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-03-28 18:53:47 -------- d-----w C:\Program Files\PJsoft
2007-03-20 19:43:29 -------- d-----w C:\Program Files\mIRC
2007-03-15 20:11:25 -------- d-----w C:\Program Files\Common Files\Macrovision Shared
2007-03-15 18:50:01 -------- d-----w C:\Program Files\Google
2007-03-15 18:49:16 -------- d-----w C:\Program Files\Opera
2007-03-09 18:13:28 -------- d-----w C:\Program Files\ICQLite
2007-03-06 17:51:40 -------- d-----w C:\DOCUME~1\JIRKAK~1\DATAAP~1\LimeWire
2007-03-01 19:20:00 95 ----a-w C:\AUTOEXEC.BAT


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll [2007-03-19 10:47]
{53707962-6F74-2D53-2644-206D7942484F}=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2005-05-31 01:04]
{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}=C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-04-18 20:04]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-07-07 13:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"TI WLAN"="C:\\Program Files\\AirLive Wireless LAN Utility\\TIWLANCu.exe"
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"SoundMan"="SOUNDMAN.EXE"
"nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"COMODO Firewall Pro"="\"C:\\Program Files\\Comodo\\Firewall\\CPF.exe\" /background"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 07:15]
"TI WLAN"="C:\Program Files\AirLive Wireless LAN Utility\TIWLANCu.exe" [2005-08-29 11:57]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 02:50]
"SoundMan"="SOUNDMAN.EXE" [])
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-01-06 15:15]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-05-12 14:02]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages msv1_0\0\0
Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages scecli\0\0




[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"Magentic"="C:\\PROGRA~1\\Magentic\\bin\\Magentic.exe /c"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ICQ Lite"="\"C:\\Program Files\\ICQLite\\ICQLite.exe\" -minimize"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
"HydraVisionDesktopManager"="C:\\Program Files\\ATI Technologies\\ATI HYDRAVISION\\HydraDM.exe"
"OSSelectorReinstall"="C:\\Program Files\\Common Files\\Acronis\\Acronis Disk Director\\oss_reinstall.exe"
"SpeedOptimizer"="C:\\PROGRA~1\\SPEEDO~1\\SPO.EXE -s "
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"KernelFaultCheck"="%systemroot%\\system32\\dumprep 0 -k"
"LiveMonitor"="C:\\Program Files\\MSI\\Live Update 3\\LMonitor.exe"
"CorelDRAW Graphics Suite 11b"="C:\\Program Files\\Corel\\Corel Graphics 12\\Languages\\EN\\Programs\\Registration.exe /title=\"CorelDRAW Graphics Suite 12\" /date=020507 serial=DR12WEX-1504397-KTY lang=EN"
"Acrobat Assistant 8.0"="\"C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\Acrotray.exe\""
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService DnsCache\0\0
rpcss RpcSs\0\0
imgsvc StiSvc\0\0
termsvcs TermService\0\0
HTTPFilter HTTPFilter\0\0
DcomLaunch DcomLaunch\0TermService\0\0

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost
UxTuneUp


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(0)\command D:\Recycled\ctfmon.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
Shell\AutoRun\command F:\Install.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G]
Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(0)\command G:\Recycled\ctfmon.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J]
Shell\AutoRun\command welcome.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K]
Shell\AutoRun\command welcome.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{68f4a2a9-9654-11db-8471-001109cd699d}]
Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(0)\command F:\Recycled\ctfmon.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7da03f52-9355-11db-8467-001109cd699d}]
Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(0)\command F:\Recycled\ctfmon.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e3a5500-cb17-11db-84fd-001109cd699d}]
Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(0)\command F:\Recycled\ctfmon.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e868f92-e1ea-11db-852f-001109cd699d}]
Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(0)\command F:\Recycled\ctfmon.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{920bffb9-97e6-11db-8476-001109cd699d}]
Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(0)\command F:\Recycled\ctfmon.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6bbcf4a-8dc0-11db-845a-001109cd699d}]
Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(0)\command H:\Recycled\ctfmon.exe
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_COMHOST

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-14 20:34:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


********************************************************************

Completion time: 2007-05-14 20:34:50 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-05-14 20:34

Samozřejmě jsem fixnul doporučené,pouze O2 - BHO: (no name) - {D3802366-B2EB-40CC-BE0A-FC67578A5E5A} - C:\WINDOWS\system32\awvts.dll (file missing) není k nalezení.

Ještě jednou díky za další rady a pomoc.

[Reklama]

[sakiri]

Možná už vím proč ti nejdou normálně otevírat složky.

Máš tam totiž vira , který to způsobuje.
Bohužel jsem zatím o tom nic nenašel jak to mám odstranit.

Počkám jak se k tomu vyjádří ostatní.

Mezitím udělej toto:
Pročisti systém CCleanerem .

Položky k pročištění:Cleaner (Čistič)
Issues (Problémy)

Poté proscanuj PC MWAVem

Zvol možnost Scan & Clean - Znamená to že nezaškrkávej Scan Only.

Poté sem vlož log z toho spodního okna pro jistotu.

Jinak jak to mezitím budeš scanovat tak já hledat jak to odstranit.

Jinak mám podezření na pár položek co to asi dělají.

[franticek]

Tady se řešil stejný problém a úspěšně, zkus se tím prokousat.

[klikamon]

Všem,kteří pomohli moc díky.Provedl jsem všechny operace a myslím, že léčení začíná být úspěšné.
Dokonce i otevírání HD už jde zcela normálně.Myslím,že nejvíce pomohl MWAV.
Pro jistotu posílám log ze jmenovaného programu ke kontrole,jestli je můj stroj opravdu zdráv.
Ještě jednou díky.

//za 1.-už po čtvrté ti přesouvám přízpěvek do původního tématu(příště mažu,oki?! )

//Baron Prášil

[Baron Prášil]

za 2.-to co si poslal,nám k ničemu není,protože MWAV jsi špatně nastavil.
nastav ho takto
a nezapomeň ho aktualizovat

[sakiri]

Takže + sem dej nový log z ComboFixu.


Jinak musíš ještě dávat pravý tlačítko k otevření disku a složky? Nebo už ti jdou oba dva otvírat normálně?

+ by se hodil log z MWAV pro jistotu.Udělej ten upravený log dle toho linku. znovu spusť MWAV a dáš View log.


Samozřejmě nevím jestli jsi sem dal ten log správný a jestli jsi to měl dobře nastavený. Já jsem to bohužel neviděl.Poté co jsem nám dáš ten upravený log z MWAV tak to pro jistotu proscanuj znovu s nastavením ci ti dal Baron Prášil.

[Baron Prášil]

jo,měl to blbě.měl tam výpis i s tabulkou nastavení