Witam. Mam problem z plikiem amvo.exe. Użyłem programu ComboFix (poniżej log), ale nie wiem co dalej z tym zrobić. Niestety jestem zielony w tych sprawach, więc proszę o pomoc
. Z góry dziękuję
.
ComboFix 08-12-26.03 - Monika Wachowska 2008-12-28 14:17:18.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.503.216 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Monika Wachowska\Pulpit\ComboFix.exe
AV: avast! antivirus 4.8.1201 [VPS 081218-0] *On-access scanning disabled* (Outdated)
* Utworzono nowy punkt przywracania
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
c:\program files\Mozilla Firefox\plugins\NPMyGlSh.dll
c:\program files\myglobalsearch
c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
c:\program files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
c:\program files\myglobalsearch\bar\1.bin\MGSBAR.DLL
c:\program files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
c:\program files\myglobalsearch\bar\Cache\000238AA
c:\program files\myglobalsearch\bar\Cache\002E036B.bin
c:\program files\myglobalsearch\bar\Cache\002E056E.bin
c:\program files\myglobalsearch\bar\Cache\002E0697.bin
c:\program files\myglobalsearch\bar\Cache\00E70878
c:\program files\myglobalsearch\bar\Cache\0109A9A4
c:\program files\myglobalsearch\bar\Cache\files.ini
c:\program files\myglobalsearch\bar\History\search
c:\program files\myglobalsearch\bar\Settings\prevcfg.htm
c:\windows\IE4 Error Log.txt
c:\windows\system32\amvo.exe
D:\Autorun.inf
E:\Autorun.inf
G:\autorun.inf
.
((((((((((((((((((((((((( Pliki utworzone od 2008-11-28 do 2008-12-28 )))))))))))))))))))))))))))))))
.
2008-12-25 12:34 . 2008-12-21 02:40 116,977 -r-hs---- C:\2vk6wn.exe
2008-12-25 12:33 . 2008-12-28 12:13 84,992 -r-hs---- c:\windows\system32\kav320.dll
2008-12-18 09:17 . 2008-12-18 09:17 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-18 09:17 . 2008-12-18 09:17 1,409 --a------ c:\windows\QTFont.for
2008-12-06 03:42 . 2008-12-06 03:42 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll
2008-12-06 03:41 . 2008-12-06 03:41 147,456 --ah----- c:\windows\system32\aston.mt
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-06 02:42 580,096 ----a-w c:\windows\system32\user32.DLL
2008-11-22 18:22 --------- d-----w c:\program files\InterActual
2008-11-21 13:47 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-21 13:47 --------- d-----w c:\program files\Codemasters
2008-11-21 13:46 --------- d-----w c:\documents and settings\Monika Wachowska\Dane aplikacji\InstallShield
2008-11-18 18:35 --------- d-----w c:\documents and settings\Monika Wachowska\Dane aplikacji\ACD Systems
2008-11-18 18:34 --------- d-----w c:\program files\Common Files\ACD Systems
2008-11-18 18:34 --------- d-----w c:\program files\ACD Systems
2008-11-18 18:34 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ACD Systems
2008-11-05 08:02 --------- d-----w c:\documents and settings\Monika Wachowska\Dane aplikacji\Tlen.pl
2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-18 23:05 9,895 ----a-w c:\windows\system32\ fsmgmt.dll
2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-11-13 22:24 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-11-13 22:24 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-11-13 22:24 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-11-13 22:24 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-11-13 22:24 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.
c:\windows\system32\user32.dll ... jest zarażony !!
578,560 2005-03-02 18:21:08 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
579,584 2007-03-08 15:51:57 c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
579,072 2007-03-08 15:38:47 c:\windows\$NtServicePackUninstall$\user32.dll
578,560 2006-03-02 12:00:00 c:\windows\$NtUninstallKB890859$\user32.dll
578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll
578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll.000
580,096 2008-04-14 17:20:56 c:\windows\ServicePackFiles\i386\user32.dll
580,096 2008-12-06 02:42:17 c:\windows\system32\user32.DLL
580,096 2008-12-06 02:42:17 c:\windows\system32\dllcache\user32.dll
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-19 94208]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"EXPLORER.EXE"="EXPLORER.EXE" [2008-04-14 c:\windows\explorer.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-08 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-08 126976]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2006-02-17 163840]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 487424]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 79224]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-08-09 c:\windows\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BearShare\\BearShare.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\Tlen.pl\\tlen.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real Alternative\\Media Player Classic\\mplayerc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-05-05 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-05-05 20560]
S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};\??\c:\windows\TEMP\61.tmp []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ba9feae-086e-11dd-b2a7-0013d37e36b7}]
\Shell\AutoRun\command - setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6c4e6593-035a-11dd-b297-0040d09a0655}]
\Shell\AutoRun\command - G:\xpbkh.com
\Shell\explore\Command - G:\xpbkh.com
\Shell\open\Command - G:\xpbkh.com
*Newly Created Service* - PROCEXP90
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKCU-Run-wsctf.exe - wsctf.exe
HKLM-Run-NWEReboot - (no file)
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
uInternet Connection Wizard,ShellNext = hxxp://google.bearshare.com/pl/
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Monika Wachowska\Dane aplikacji\Mozilla\Firefox\Profiles\zwfh050a.default\
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-28 14:20:00
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}]
"ImagePath"="\??\c:\windows\TEMP\61.tmp"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(580)
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL
.
Czas ukończenia: 2008-12-28 14:21:06
ComboFix-quarantined-files.txt 2008-12-28 13:20:37
Przed: 2˙999˙361˙536 bajt˘w wolnych
Po: 4,431,740,928 bajt˘w wolnych
167 --- E O F --- 2008-12-18 02:02:01
. Log z całości dam później