Witam, dopiszę się do tego tematu, bo mam podobny problem, a nie chcę zaśmiecać forum. Ze względu, iż jest mi bliżej do laika niż do profesjonalisty, to przeczytałem co nie co o swoim problemie w postaci amvo.exe i zainstalowałem combofixa, a następnie go zapuściłem.
O to mój log:
ComboFix 08-04-10.4 - Blaesus 2008-04-11 1:12:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1582 [GMT 2:00]
Running from: C:\Documents and Settings\Blaesus\Pulpit\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-03-10 to 2008-04-10 )))))))))))))))))))))))))))))))
.
2008-04-11 01:07 . 2008-04-11 01:07
2008-04-11 00:42 . 2008-04-11 00:42
2008-04-11 00:42 . 2008-04-11 00:43
2008-04-11 00:42 . 2008-04-11 00:42 10,880 --a------ C:\WINDOWS\system32\drivers\pxark.sys
2008-04-10 23:39 . 2008-04-10 23:39
2008-04-10 23:35 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-10 23:35 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-10 23:25 . 2008-04-10 23:26 1,003,008 --a–c— C:\WINDOWS\system32\dllcache\wmvdmoe2.dll
2008-04-10 15:44 . 2008-03-28 11:13 104,310 -r-hs---- C:\tknn6.bat
2008-04-08 14:48 . 2008-04-08 14:48
2008-04-03 20:31 . 2008-04-03 20:31 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-03 20:31 . 2008-04-03 20:31 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-26 11:52 . 2008-03-26 11:52 215 --a------ C:\WINDOWS\RomeTW.ini
2008-03-16 19:52 . 2008-03-16 19:52
2008-03-12 12:58 . 2008-03-12 12:59
2008-03-12 12:42 . 2008-03-12 12:42
2008-03-12 10:40 . 2008-04-09 11:01
2008-03-11 12:45 . 2008-03-11 12:45
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-10 21:35 624,128 ----a-w C:\WINDOWS\system32\autoconv.exe
2008-04-10 20:10 --------- d-----w C:\Documents and Settings\Blaesus\Dane aplikacji\OpenOffice.org2
2008-04-08 12:48 --------- d–h--w C:\Program Files\InstallShield Installation Information
2008-04-08 12:48 --------- d-----w C:\Program Files\TOSHIBA
2008-03-29 22:11 --------- d-----w C:\Program Files\ArmyBuilder
2008-03-29 17:45 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe
2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-29 17:23 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2008-03-09 19:46 --------- d-----w C:\Program Files\Realtek
2008-03-08 10:51 --------- d-----w C:\Program Files\Java
2008-03-05 16:11 --------- d-----w C:\Documents and Settings\Blaesus\Dane aplikacji\Media Player Classic
2008-03-05 10:45 --------- d-----w C:\Documents and Settings\Blaesus\Dane aplikacji\Winamp
2008-03-05 10:03 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-03-05 10:03 --------- d-----w C:\Program Files\Common Files\Java
2008-03-02 18:13 --------- d-----w C:\Program Files\WapSter
2008-03-02 17:35 278,984 ------w C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-02 17:35 25,416 ------w C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-02 14:48 --------- d-----w C:\Program Files\Winamp
2008-03-02 14:33 --------- d-----w C:\Program Files\QuickTime
2008-03-02 14:33 --------- d-----w C:\Program Files\Apple Software Update
2008-03-02 14:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-03-02 14:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-03-02 14:32 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-03-02 14:14 --------- d-----w C:\Program Files\Synaptics
2008-03-02 14:14 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-02 14:08 315,392 ------w C:\WINDOWS\HideWin.exe
2008-03-02 14:03 --------- d-----w C:\Program Files\DIFX
2008-03-02 14:01 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\XP
2008-03-02 14:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Vista64
2008-03-02 13:56 --------- d-----w C:\Program Files\Camera Assistant Software for Toshiba
2008-03-02 13:52 --------- d-----w C:\Program Files\Intel
2008-03-02 13:52 --------- d-----w C:\Documents and Settings\Blaesus\Dane aplikacji\InstallShield
2008-03-02 13:50 --------- d-----w C:\Program Files\Alwil Software
2008-03-02 13:33 --------- d-----w C:\Program Files\microsoft frontpage
2008-03-02 13:32 --------- d-----w C:\Program Files\Usługi online
2008-01-10 12:16 159,839 ------w C:\WINDOWS\system32\xvidvfw.dll
2008-01-10 12:15 755,027 ------w C:\WINDOWS\system32\xvidcore.dll
2006-12-12 10:13 32,768 ------w C:\Documents and Settings\All Users\Dane aplikacji\EBLib.dll
2006-07-28 15:25 19,456 ------w C:\Documents and Settings\All Users\Dane aplikacji\LPCFilter.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44 15360]
“MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 18:24 1694208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“nwiz”=“nwiz.exe” [2006-02-16 19:34 1519616 C:\WINDOWS\system32\nwiz.exe]
“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-02-16 19:34 7557120]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2008-03-29 19:37 79224]
“HWSetup”=“C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe” [2004-05-01 14:45 28672]
“Camera Assistant Software”=“C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe” [2007-05-22 11:50 413696]
“TCtryIOHook”=“TCtrlIOHook.exe” [2007-06-30 09:18 28672 C:\WINDOWS\system32\TCtrlIOHook.exe]
“RTHDCPL”=“RTHDCPL.EXE” [2007-08-10 16:21 16384000 C:\WINDOWS\RTHDCPL.exe]
“SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2007-07-25 19:19 888832]
“QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2008-02-01 00:13 385024]
“WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2008-01-16 00:54 37376]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe” [2008-02-22 05:25 144784]
“Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2008-01-11 23:16 39792]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 00:44 15360]
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“C:\Program Files\WapSter\AQQ\AQQ.exe”=
“C:\kav\kav7.0\english\setup.exe”=
R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-04-11 00:42]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 CSIScanner;CSIScanner;“C:\Program Files\PrevxCSI\PrevxCSI.exe” /service []
R3 UVCFTR;UVCFTR;C:\WINDOWS\system32\Drivers\UVCFTR_S.SYS [2007-04-16 11:19]
*Newly Created Service* - CATCHME
*Newly Created Service* - CSISCANNER
*Newly Created Service* - PXARK
.
Contents of the ‘Scheduled Tasks’ folder
“2008-03-05 14:20:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job”
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-11 01:13:35
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-11 1:14:19
ComboFix-quarantined-files.txt 2008-04-10 23:13:54
Pre-Run: 10,615,373,824 bajtów wolnych
Post-Run: 10,642,341,888 bajtów wolnych
.
2008-03-14 00:37:17 — E O F —
Proszę o pomoc i pozdrawiam
