Niezniszczalny Rootkit

[kill3rs4]

Witam. Chciałem się dowiedzieć, jak usunąć rootkita. Gdy 1 raz go zauważyłem,
usuwałem go przez avasta. Nic nie dało, więc sformatowałem komputer, lecz on
nic nie dał. Cały czas nie mogę odkryć folderów.
Pozdrawiam

[Gość: Kolobos]

Daj log z combofix.

[kill3rs4]

2008-08-01 20:42 . 2008-08-01 20:42 <DIR> d-------- C:\NVIDIA
2008-08-01 20:42 . 2006-10-22 15:06 208,896 --a------
C:\WINDOWS\system32\NVUNINST.EXE
2008-08-01 20:33 . 2004-08-03 23:07 171,776 --a------
C:\WINDOWS\system32\drivers\kmixer.sys
2008-08-01 20:33 . 2004-08-03 22:39 142,464 --a------
C:\WINDOWS\system32\drivers\aec.sys
2008-08-01 20:33 . 2004-08-03 23:15 82,944 --a------
C:\WINDOWS\system32\drivers\wdmaud.sys
2008-08-01 20:33 . 2004-08-03 23:15 60,800 --a------
C:\WINDOWS\system32\drivers\sysaudio.sys
2008-08-01 20:33 . 2001-08-17 23:00 54,272 --a------
C:\WINDOWS\system32\drivers\swmidi.sys
2008-08-01 20:33 . 2004-08-03 23:07 52,864 --a------
C:\WINDOWS\system32\drivers\dmusic.sys
2008-08-01 20:33 . 2004-08-03 23:07 6,400 --a------
C:\WINDOWS\system32\drivers\splitter.sys
2008-08-01 20:33 . 2001-08-17 22:59 3,072 --a------
C:\WINDOWS\system32\drivers\audstub.sys
2008-08-01 20:33 . 2004-08-03 23:07 2,944 --a------
C:\WINDOWS\system32\drivers\drmkaud.sys
2008-08-01 20:30 . 2008-08-06 19:53 <DIR> dr------- C:\Program Files
2008-08-01 20:30 . 2008-08-01 20:30 <DIR> dr-h----- C:\Documents and
Settings\Default User\Ustawienia lokalne
2008-08-01 20:30 . 2008-08-01 20:30 <DIR> d-------- C:\Documents and
Settings\Default User\Ulubione
2008-08-01 20:30 . 2008-08-01 19:37 <DIR> d--h----- C:\Documents and
Settings\Default User\Szablony
2008-08-01 20:30 . 2008-08-01 20:30 <DIR> d-------- C:\Documents and
Settings\Default User\Pulpit
2008-08-01 20:30 . 2008-08-01 20:30 <DIR> d-------- C:\Documents and
Settings\Default User\Moje dokumenty
2008-08-01 20:30 . 2008-08-01 20:30 <DIR> dr------- C:\Documents and
Settings\Default User\Menu Start
2008-08-01 20:30 . 2008-08-01 20:30 <DIR> d-------- C:\Documents and
Settings\All Users\Ulubione
2008-08-01 20:30 . 2008-08-01 20:30 <DIR> d--h----- C:\Documents and
Settings\All Users\Szablony
2008-08-01 20:30 . 2008-08-07 17:50 <DIR> d-------- C:\Documents and
Settings\All Users\Pulpit
2008-08-01 20:30 . 2008-08-01 21:20 <DIR> dr------- C:\Documents and
Settings\All Users\Menu Start
2008-08-01 20:30 . 2008-08-01 21:29 <DIR> dr------- C:\Documents and
Settings\All Users\Dokumenty
2008-08-01 20:29 . 2008-08-09 21:05 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-08-01 20:29 . 2008-08-01 21:25 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2008-08-01 20:29 . 2008-08-01 20:30 <DIR> dr-h----- C:\Documents and
Settings\Default User\Dane aplikacji
2008-08-01 20:29 . 2008-08-01 19:47 <DIR> d--h----- C:\Documents and
Settings\Default User
2008-08-01 20:29 . 2008-08-06 19:53 <DIR> dr-h----- C:\Documents and
Settings\All Users\Dane aplikacji
2008-08-01 20:29 . 2008-08-01 19:40 <DIR> d-------- C:\Documents and
Settings\All Users
2008-08-01 20:29 . 2008-08-09 21:06 <DIR> d-------- C:\Documents and Settings
2008-08-01 20:13 . 2008-08-01 20:13 <DIR> d-------- C:\Program Files\Foxit Software
2008-08-01 20:12 . 2008-08-01 20:12 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-08-01 20:09 . 2008-08-01 20:10 <DIR> d-------- C:\Program Files\blaxxun Contact
2008-08-02 11:17 --------- d-----w C:\Documents and Settings\Michał\Dane
aplikacji\MargonemMapki
2008-08-02 07:22 88,881 --sh--r C:\e.com
2008-08-02 07:22 --------- d-----w C:\Program Files\Gadu-Gadu
2008-08-01 20:17 --------- d--h--w C:\Program Files\InstallShield Installation
Information
2008-08-01 18:42 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-01 17:53 24,064 ----a-w C:\WINDOWS\autoload.exe
2008-08-01 17:49 --------- d-----w C:\Program Files\AvRack
2008-08-01 17:49 --------- d-----w C:\Program Files\Avance Sound Manager
2008-08-01 17:42 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-01 17:37 --------- d-----w C:\Program Files\Usługi online
2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-30 12:19 507,400 ----a-w C:\WINDOWS\system32\XAudio2_1.dll
2008-05-30 12:18 238,088 ----a-w C:\WINDOWS\system32\xactengine3_1.dll
2008-05-30 12:17 65,032 ----a-w C:\WINDOWS\system32\XAPOFX1_0.dll
2008-05-30 12:17 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_4.dll
2008-05-30 12:11 467,984 ----a-w C:\WINDOWS\system32\d3dx10_38.dll
2008-05-30 12:11 3,850,760 ----a-w C:\WINDOWS\system32\D3DX9_38.dll
2008-05-30 12:11 1,491,992 ----a-w C:\WINDOWS\system32\D3DCompiler_38.dll
2008-05-30 12:01 80,896 ----a-w C:\WINDOWS\system32\dxdllreg.exe
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:44 1667584]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 03:54 507904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 12:22 7700480]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-10-22 12:22 86016]
"CameraFixer"="C:\WINDOWS\CameraFixer.exe" [2005-12-06 13:08 20480]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [2005-10-11 13:54 339968]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 01:02 36352]
"SoundMan"="SOUNDMAN.EXE" [2002-08-02 13:00 46592 C:\WINDOWS\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Messenger"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"E:\\Program Files\\HLSW\\hlsw.exe"=
"E:\\Gry\\cs 1.5\\Half-Life\\hl.exe"=
"E:\\Gry\\Metin2_PL\\metin2.bin"=
"E:\\Gry\\Steam\\SteamApps\\drhz007\\counter-strike\\hl.exe"=
"C:\\Program Files\\SHOUTcast\\sc_serv.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
S3 EverestDriver;Lavalys EVEREST Kernel Driver;E:\Program Files\Lavalys\EVEREST
Home Edition\kerneld.wnt [2005-08-18 00:00]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e607f215-63ac-11dd-9a1a-000e2e967c2c}]
\Shell\AutoRun\command - H:\svdioajm.cmd
\Shell\explore\Command - H:\svdioajm.cmd
\Shell\open\Command - H:\svdioajm.cmd
FireFox -: Profile - C:\Documents and Settings\Michał\Dane
aplikacji\Mozilla\Firefox\Profiles\4julqkei.default\

[Gość: Kolobos]

Nie potrafisz czytac? Moze juz czas na nauke! -> forum.gazeta.pl/forum/72,2.html?f=430&w=76799955

[Gość: Kill3rs4]

wklej.org/id/4b87c77e5f :P

[Gość: Kolobos]

Masz dac caly log, a nie jakies scinki. Uzyj jeszcze raz combofix i daj pelny log.