Proszę o sprawdzenie loga i dokładne wytłumaczenie jak dalej postępować
ComboFix 08-04-18.3 - admin 2008-04-19 16:35:39.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.232 [GMT 2:00]
Running from: C:\Documents and Settings\admin\Pulpit\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
C:\Documents and Settings\admin\Dane aplikacji\ShoppingReport
C:\Documents and Settings\admin\Dane aplikacji\ShoppingReport\cs\Config.xml
C:\Documents and Settings\admin\Dane aplikacji\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\admin\Dane aplikacji\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\admin\Dane aplikacji\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\admin\Dane aplikacji\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\admin\Dane aplikacji\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\admin\Dane aplikacji\ShoppingReport\cs\res1\WhiteList.dbs
C:\Program Files\ShoppingReport
C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
C:\Program Files\ShoppingReport\Uninst.exe
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-03-19 to 2008-04-19 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-19 14:33 --------- d-----w C:\Program Files\Neostrada TP
2008-04-19 14:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PrevxCSI
2008-04-19 14:26 10,880 ----a-w C:\WINDOWS\system32\drivers\pxark.sys
2008-04-05 21:14 103,966 --sh–r C:\t.com
2008-02-08 12:44 191,488 ----a-w C:\WINDOWS\system32\hlvdd.dll
2008-01-30 15:10 274,432 ----a-w C:\WINDOWS\system32\libcurl.dll
2007-04-19 01:03 19,552 ----a-w C:\Documents and Settings\admin\Dane aplikacji\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44 15360]
“MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-08-04 01:55 1667584]
“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-11-14 12:54 2131392]
“AdVantage”=“C:\Program Files\AdVantage\AdVantage.exe” []
“DAEMON Tools Lite”=“D:\Programy\Zainstalowane\DAEMON Tools Lite\daemon.exe” [2008-02-14 01:09 486856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-08-05 22:05 344064]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2008-03-29 19:37 79224]
“WooCnxMon”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [2003-10-16 19:07 24576]
“SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-01-26 12:38 866816]
“WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2003-10-16 19:07 20480]
“WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [2003-10-16 19:07 53248]
“Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2008-01-11 23:16 39792]
“WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2008-01-16 00:54 37376]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 00:44 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360]
VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2008-02-06 16:36:17 565248]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
“UpdatesDisableNotify”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“C:\Program Files\Gadu-Gadu\gg.exe”=
“D:\Programy\Zainstalowane\uTorrent\utorrent.exe”=
“D:\Programy\Zainstalowane\SopCast\adv\SopAdver.exe”=
“D:\Programy\Zainstalowane\SopCast\SopCast.exe”=
“D:\Programy\Zainstalowane\TVAnts\Tvants.exe”=
“D:\Programy\Zainstalowane\TVUPlayer\TVUPlayer.exe”=
“D:\Programy\Zainstalowane\DC++\DCPlusPlus.exe”=
“D:\Programy\Zainstalowane\PPStream\PPSAP.exe”=
“C:\Program Files\Internet Explorer\IEXPLORE.EXE”=
“D:\Gry\Zainstalowane\Sports Interactive\Football Manager 2008\fm.exe”=
R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-04-19 16:26]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 CSIScanner;CSIScanner;“C:\Program Files\PrevxCSI\PrevxCSI.exe” /service []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{d962c305-d4aa-11db-a456-000e505da655}]
\Shell\AutoRun\command - G:\t.com
\Shell\explore\Command - G:\t.com
\Shell\open\Command - G:\t.com
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-19 16:37:00
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-19 16:37:36
ComboFix-quarantined-files.txt 2008-04-19 14:37:33
Pre-Run: 3,729,596,416 bajtów wolnych
Post-Run: 3,783,557,120 bajtów wolnych
103