Usuniecie amvo.exe


(87pawel1) #1

jak to usunac? prosze o pomoc

oto log

ComboFix 08-04-15.8 - Pawel 2008-04-16 19:07:41.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.160 [GMT 2:00]

Running from: C:\Documents and Settings\Pawel\Pulpit\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED!!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\Downloaded Program Files\setup.inf

C:\WINDOWS\system32\amvo.exe

.

((((((((((((((((((((((((( Files Created from 2008-03-16 to 2008-04-16 )))))))))))))))))))))))))))))))

.

2008-04-05 21:54 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys

2008-04-05 21:54 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys

2008-04-05 16:24 . 2008-04-05 16:24

2008-04-05 16:20 . 2008-04-05 16:20

2008-04-05 16:20 . 2008-04-05 16:20

2008-04-05 16:20 . 2008-04-05 16:20

2008-03-16 16:26 . 2008-03-16 16:26

2008-03-16 16:25 . 2008-03-16 16:25

2008-03-16 16:24 . 2008-03-16 16:25

2008-03-16 06:27 . 2008-03-16 06:31

2008-03-16 06:27 . 2008-03-16 06:27

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-04-16 13:29 --------- d-----w C:\Program Files\Kalendarz XP

2008-04-09 16:20 --------- d-----w C:\Program Files\Opera

2008-04-09 11:29 --------- d-----w C:\Program Files\eMule

2008-04-09 07:37 --------- d-----w C:\Program Files\DC++

2008-04-05 14:20 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-03-29 17:45 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe

2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2008-03-29 17:23 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr

2008-03-26 19:27 --------- d-----w C:\Program Files\SopCast

2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys

2008-03-16 04:27 --------- d-----w C:\Documents and Settings\Pawel\Dane aplikacji\TVU networks

2008-03-15 21:44 45,056 ----a-w C:\WINDOWS\NCUNINST.EXE

2008-03-15 21:43 --------- d-----w C:\Program Files\Common Files\SWF Studio

2008-03-10 21:09 --------- d-----w C:\Documents and Settings\Pawel\Dane aplikacji\U3

2008-03-08 10:20 --------- d-----w C:\Program Files\CoffeeCup Software

2008-03-08 09:57 --------- d-----w C:\Program Files\PDFCreator

2008-03-08 09:56 253,116 ----a-w C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_6046.exe

2008-03-08 09:56 14,290 ----a-w C:\Program Files\settings.dat

2008-03-08 09:56 --------- d-----w C:\Program Files\PDFCreator Toolbar

2008-03-07 22:13 --------- d-----w C:\Program Files\Advanced GIF Animator

2008-03-03 18:40 --------- d-----w C:\Program Files\TextReader

2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2008-02-28 18:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\stamina

2008-02-27 19:35 --------- d-----w C:\Program Files\Common Files\Synacast

2008-02-27 19:35 --------- d-----w C:\Documents and Settings\Pawel\Dane aplikacji\PPMate

2008-02-27 17:24 --------- d-----w C:\Program Files\Deluxe Ski Jump 3

2008-02-24 11:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TEMP

2008-02-24 10:49 --------- d-----w C:\Program Files\Rainlendar2

2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll

2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll

2008-01-20 17:16 5,018 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 16:35 202024]

"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HTpatch"="C:\WINDOWS\htpatch.exe" [2007-10-10 12:00 28672]

"MPB"="C:\WINDOWS\system32\MPB.exe" [2007-10-10 12:00 286720]

"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2007-10-10 12:00 114688]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-10 12:00 630784]

"SiS Tray"="C:\WINDOWS\system32\sistray.EXE" [2002-11-17 10:36 303104]

"SiS KHooker"="C:\WINDOWS\system32\khooker.exe" [2002-09-24 01:50 290816]

"AGRSMMSG"="AGRSMMSG.exe" [2007-10-10 12:00 88363 C:\WINDOWS\AGRSMMSG.exe]

"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2007-10-10 12:00 184320]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]

"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 10:51 1836328]

"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 18:05 81920]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Kalendarz XP.lnk - C:\Program Files\Kalendarz XP\Kalendarz.exe [2007-11-06 22:03:08 882176]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe"=

"C:\Program Files\Gadu-Gadu\gg.exe"=

"C:\Program Files\eMule\emule.exe"=

"C:\Program Files\Internet Explorer\IEXPLORE.EXE"=

"C:\Program Files\DC++\DCPlusPlus.exe"=

"C:\Program Files\Opera\Opera.exe"=

"%windir%\Network Diagnostic\xpnetdiag.exe"=

"C:\Program Files\SopCast\SopCast.exe"=

"C:\Program Files\SopCast\adv\SopAdver.exe"=

"C:\Program Files\TVUPlayer\TVUPlayer.exe"=

R0 DlPortio;DlPortio;C:\WINDOWS\system32\dlportio.sys [2001-02-27 12:50]

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]

R3 MTC0001_MPB;MPB device driver;C:\WINDOWS\system32\ntMPB.sys [2007-10-10 12:00]

S3 MTK;Media Technology Kernel Driver;C:\WINDOWS\system32\Drivers\fide.sys [2007-10-22 16:51]

S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-06-29 02:01]

S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{7c4d6084-04c3-11dd-8137-0040d05115a5}]

\Shell\AutoRun\command - G:\2.bat

\Shell\explore\Command - G:\2.bat

\Shell\open\Command - G:\2.bat

.

**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-04-16 19:10:15

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HTpatch = C:\WINDOWS\htpatch.exe?ows\CurrentVersion\Run???\???/??[?????? [?? [???????????????????[???[?D???? [$??????[????????????S??[????????m??[???w????(???{??w???w???????w???w???[????????d???b6?[%??[?? [????"??[A??[???[.??wZ??[?3?[?3?[????st.I???????[????d???0=?[?K?[

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-04-16 19:12:09

ComboFix-quarantined-files.txt 2008-04-16 17:11:57

Pre-Run: 3,927,179,264 bajtów wolnych

Post-Run: 3,946,409,984 bajtów wolnych

.

2008-04-09 07:19:55 --- E O F ---


(Leon$) #2

Wyłącz przywracanie systemu na wszystkich dyskach.http://support.microsoft.com/kb/310405/pl

Wylecz pendriva lub kartę pamięci http://www.softpedia.com/get/Security/S ... Tool.shtml lub format

Otwórz notatnik i wklej

zapisz jako plik.reg >> wszystkie pliki >> scal z rejestrem >> restart

b57f17008275c957m.jpg

powstanie plik o takiej ikonie

062aec4c9b51c033m.jpg

w który dwa razy klikniesz potwierdzisz chęć dodania do rejestru potem restart

Log wygląda na czysty

zrób optymalizacje uruchamiania http://cybertrash.netarteria.pl/cyber/index.php/topic,378.0.html

usuń ręcznie folder C: \Qoobox usuń instalkę Combofix z dysku.

przeskanuj obszar Mój komputer http://www.kaspersky.pl/virusscanner.html pokaż raport

włącz przywracanie systemu

:slight_smile: :slight_smile:


(Gutek) #3

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=213350