avast wykrył w systemie cos takiego c:\windows\system32\nmdfgds0.dll i nie może go usunąć.
wg wskazówek z forum przeskanowałam komputer combofix.
to jest raport:
- Kod: Zaznacz wszystko
ComboFix 09-03-15.01 - anna 2009-03-16 17:17:04.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1033.18.894.444 [GMT 1:00]
Uruchomiony z: c:\documents and settings\anna\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090316-0] *On-access scanning disabled* (Updated)
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
c:\documents and settings\anna\Application Data\.#
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\olhrwef.exe
c:\windows\Tasks\JkDefragCmd.exe
.
((((((((((((((((((((((((( Pliki utworzone od 2009-02-16 do 2009-03-16 )))))))))))))))))))))))))))))))
.
2009-03-16 15:10 . 2009-03-16 08:01 110,629 -r-hs---- C:\luk1ylq.com
2009-03-12 21:38 . 2009-03-12 21:38 <DIR> d-------- c:\program files\Common Files\SWF Studio
2009-03-09 22:02 . 2009-03-09 22:03 <DIR> d-------- c:\program files\K-Lite Codec Pack
2009-03-09 22:02 . 2008-09-16 20:23 168,448 --a------ c:\windows\system32\unrar.dll
2009-02-19 22:55 . 2009-02-19 23:00 <DIR> d-------- c:\program files\Francuskie Czasowniki
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-15 18:20 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-14 11:25 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-14 11:24 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-12 15:35 --------- d-----w c:\documents and settings\anna\Application Data\foobar2000
2009-03-11 22:57 --------- d-----w c:\documents and settings\anna\Application Data\Skype
2009-03-11 20:38 --------- d-----w c:\documents and settings\anna\Application Data\skypePM
2009-03-08 23:22 --------- d-----w c:\documents and settings\anna\Application Data\Any Video Converter
2009-03-08 23:17 --------- d-----w c:\program files\Any Video Converter
2009-02-13 11:05 --------- d-----w c:\program files\Google
2009-02-12 19:43 --------- d-----w c:\program files\Windows Media Connect 2
2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-02-06 14:00 --------- d-----w c:\documents and settings\anna\Application Data\Apple Computer
2009-02-02 18:06 --------- d-----w c:\program files\QuickTime
2009-02-02 18:06 --------- d-----w c:\program files\Apple Software Update
2009-02-02 18:06 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-02-02 18:06 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-01-29 13:36 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-01-29 13:36 --------- d-----w c:\program files\Java
2009-01-18 16:57 --------- d-----w c:\documents and settings\anna\Application Data\ZoomBrowser EX
2009-01-16 11:33 --------- d-----w c:\program files\Skype
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-29 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 c:\windows\stsystra.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-07-22 c:\windows\KHALMNPR.Exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\anna\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-10-12 113664]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-10-12 113664]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-10 528384]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [2008-10-05 3456]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-10-05 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-10-05 20560]
R3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [2008-12-12 93440]
S2 gupdate1c989eaf13040d6;Google Update Service (gupdate1c989eaf13040d6);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 133104]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a9e1244b-9889-11dd-ba4b-0015c5c5f07b}]
\Shell\AutoRun\command - F:\luk1ylq.com
\Shell\open\Command - F:\luk1ylq.com
.
Zawartość folderu 'Zaplanowane zadania'
2009-03-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-08 13:41]
2009-03-16 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 13:44]
2009-03-15 c:\windows\Tasks\JkDefrag.job
- c:\windows\tasks\JkDefragTask.cmd [2009-03-15 22:44]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKCU-Run-cdoosoft - c:\windows\system32\olhrwef.exe
.
------- Skan uzupełniający -------
.
uStart Page = wyborcza.pl/0,0.html?p=017
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Tlumacz z LING... - http://www.ling.pl/ling/def-src.php4
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {34D61A77-E10D-4108-9991-41354FA92E94} = 193.41.112.18 193.41.112.14
FF - ProfilePath - c:\documents and settings\anna\Application Data\Mozilla\Firefox\Profiles\vkyesrt4.default\
FF - prefs.js: browser.search.selectedEngine - LING.pl
FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/
FF - plugin: c:\program files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-16 17:18:20
Windows 5.1.2600 Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(852)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
Czas ukończenia: 2009-03-16 17:19:20
ComboFix-quarantined-files.txt 2009-03-16 16:19:18
Przed: 39 956 553 728 bytes free
Po: 40,071,634,944 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
140 --- E O F --- 2009-03-11 23:06:43
czy ktoś mógłby mi napisać co mam zrobić dalej,
bardzo proszę.
możesz sobie zastąpić go programem OTmove it i odpalić z opcji clean up! 