Co kilka minut wyskakuje mi antywirus że wykrył wirusa

patrykoss8857 · 27 Marzec 2007 14:24

Co kilka minut wyskakuje mi avast że wykrył wirusa (za każdym razem innego).

w folderach:

c/windows/temp/

albo:

c/windows/windows32/

co mam zrobić może mi ktoś pomóc?

adam9870 · 27 Marzec 2007 14:38

W jakich konkretnie plikach Avast znajduje te wirusy?

Wklej komplet logów - ComboScan i SilentRunners:

http://cybertrash.pl/images/tata/ComboS … oScan.html

http://forum.dobreprogramy.pl/viewtopic.php?t=36654

patrykoss8857 · 27 Marzec 2007 15:11

przeważnie jest to plik:

adirka.exe

ale też czasami rózne pliki .dll

adam9870 · 27 Marzec 2007 15:57

Pobierz i odpal LSP-Fix zaznacz " I know what I’m doing" następnie w okienku Keep zaznacz bibliotekę rsvp32_2.dll i za pomocą strzałki (>>) przenieś ją do okienka Remover i kliknij Finish i restart.

Pobierz The avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w lupkę => w okienku, które się otworzy wklej:

Files to delete: C:\WINDOWS\system32\jslffoku.exe C:\WINDOWS\system32\gemncuun.dll C:\WINDOWS\system32\hjjlm.bak2 C:\WINDOWS\system32\hjjlm.bak1 C:\WINDOWS\system32\mljjh.dll C:\WINDOWS\system32\agneqxpx.dll C:\WINDOWS\system32\sdmwpbra.dll C:\WINDOWS\system32\srvswc2.dll C:\WINDOWS\system32\ruudtewe.exe C:\WINDOWS\system32\fontqxet.dll C:\WINDOWS\system32\commnet8.dll C:\WINDOWS\system32\defrasw.dll C:\WINDOWS\system32\commnet8.dll C:\WINDOWS\system32\srvswc3.dll C:\WINDOWS\system32\hnetviw.dll C:\WINDOWS\system32\zlbw.dll C:\WINDOWS\system32\sm.exe C:\WINDOWS\system32\dd.exe C:\WINDOWS\system32\sfxzmtwbmail.dll C:\WINDOWS\system32\sfxzmtsmtspm.dll C:\WINDOWS\system32\sfxzmtsmt.dll C:\WINDOWS\system32\sfxzmtforum.dll C:\WINDOWS\system32\pfxzmtymsg.dll C:\WINDOWS\system32\pfxzmtwbmail.dll C:\WINDOWS\system32\pfxzmtsmtspm.dll C:\WINDOWS\system32\pfxzmtsmt.dll C:\WINDOWS\system32\pfxzmticq.dll C:\WINDOWS\system32\pfxzmtgtal.dll C:\WINDOWS\system32\pfxzmtforum.dll C:\WINDOWS\system32\pfxzmtaim.dll C:\WINDOWS\via.exe C:\WINDOWS\pp.exe C:\WINDOWS\system32\adirka.exe C:\WINDOWS\system32\rsvp32_2.dll C:\WINDOWS\system32\cscentfy.dll C:\WINDOWS\system32\dsuiexq.dll C:\WINDOWS\system32\comcs32c.dll C:\WINDOWS\system32\pbfmtnhm.dll C:\WINDOWS\system32\jbbyrsay.dll C:\WINDOWS\system32\mbljbnin.dll C:\WINDOWS\system32\bwbispla.dll C:\WINDOWS\system32\ddrewils.dll C:\WINDOWS\system32\xrixwkxq.dll C:\WINDOWS\system32\seqemiam.dll C:\WINDOWS\system32\mpupmues.dll C:\WINDOWS\system32\sstqo.dll C:\WINDOWS\system32\PCForDJ61721.dll C:\WINDOWS\system32\PCForDJ60464.dll C:\WINDOWS\system32\sexwwjr.dll C:\Program Files\abcwebwizardfull11 C:\WINDOWS\system32\kmtamyps.dll C:\WINDOWS\system32\vturono.dll C:\WINDOWS\system32\lsasss.exe Registry values to delete: “HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run” | “adirka” “HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run” | “Lexmark_X79-55” “HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run” | “sysinter” “HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run” | “SoundService” “HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks” | “{B07CB267-5E6F-441F-9B3C-324EFE70F897}” Registry keys to delete: HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljjh HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturono HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{00534B55-3155-CA4F-B41D-0E922121D03C} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{8D4E15E7-67C2-49BB-A490-4BB5BBE1987D} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{B07CB267-5E6F-441F-9B3C-324EFE70F897} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{E70166DC-ED0C-49E4-BFF0-780531E3D032}

=> Kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po resecie może pojawić się okienko na dosłownie kilka sekund oraz log w notatniku. Wejdź tam gdzie masz avengera i skasuj plik backup.zip czyli np. c:\avenger\backup.zip.

O2 - BHO: Shell Event Object Class - {00534B55-3155-CA4F-B41D-0E922121D03C} - C:\WINDOWS\system32\cscentfy.dll O2 - BHO: (no name) - {8D4E15E7-67C2-49BB-A490-4BB5BBE1987D} - C:\WINDOWS\system32\mljjh.dll O2 - BHO: (no name) - {B07CB267-5E6F-441F-9B3C-324EFE70F897} - C:\WINDOWS\system32\vturono.dll O2 - BHO: (no name) - {E70166DC-ED0C-49E4-BFF0-780531E3D032} - C:\WINDOWS\system32\sdmwpbra.dll O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe O4 - HKLM…\Run: [sysinter] C:\WINDOWS\system32\adirss.exe O4 - HKLM…\Run: [soundService] rundll32.exe “C:\WINDOWS\system32\agneqxpx.dll”,setvm O4 - HKCU…\Run: [adirka] C:\WINDOWS\system32\adirka.exe O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra ‘Tools’ menuitem: (no name) - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O20 - Winlogon Notify: mljjh - C:\WINDOWS\system32\mljjh.dll O20 - Winlogon Notify: vturono - C:\WINDOWS\system32\vturono.dll

Usuń wpisy HJT jeśli będą.

Użyj VundoFix + FixVundo + VirtumundoBeGone. Wszystkie narzędzia należy uruchomić będąc w trybie awaryjnym.

Po wykonaniu wklej log z HijackThis, SilentRunners oraz ComboFix.

patrykoss8857 · 27 Marzec 2007 19:39

VBG:

[03/27/2007, 21:02:26] - VirtumundoBeGone v1.5 ( “C:\Documents and Settings\Patryk\Pulpit\VirtumundoBeGone.exe” ) [03/27/2007, 21:02:35] - Detected System Information: [03/27/2007, 21:02:35] - Windows Version: 5.1.2600, Dodatek Service Pack 2 [03/27/2007, 21:02:35] - Current Username: Patryk (Admin) [03/27/2007, 21:02:35] - Windows is in SAFE mode with Networking. [03/27/2007, 21:02:35] - Searching for Browser Helper Objects: [03/27/2007, 21:02:35] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class) [03/27/2007, 21:02:35] - BHO 2: {182B90A3-F372-438A-800C-6814B4DE417B} () [03/27/2007, 21:02:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [03/27/2007, 21:02:35] - Checking for HKLM…\Winlogon\Notify\tuvvvsq [03/27/2007, 21:02:35] - Found: HKLM…\Winlogon\Notify\tuvvvsq - This is probably Virtumundo. [03/27/2007, 21:02:35] - Assigning {182B90A3-F372-438A-800C-6814B4DE417B} MSEvents Object [03/27/2007, 21:02:35] - BHO list has been changed! Starting over… [03/27/2007, 21:02:35] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class) [03/27/2007, 21:02:35] - BHO 2: {182B90A3-F372-438A-800C-6814B4DE417B} (MSEvents Object) [03/27/2007, 21:02:35] - ALERT: Found MSEvents Object! [03/27/2007, 21:02:35] - BHO 3: {57E218E6-5A80-4f0c-AB25-83598F25D7E9} () [03/27/2007, 21:02:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [03/27/2007, 21:02:35] - Checking for HKLM…\Winlogon\Notify\pfbvisto [03/27/2007, 21:02:35] - Key not found: HKLM…\Winlogon\Notify\pfbvisto, continuing. [03/27/2007, 21:02:35] - BHO 4: {B23C8EDC-0F96-414C-BA15-184884BD44FF} () [03/27/2007, 21:02:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [03/27/2007, 21:02:35] - Checking for HKLM…\Winlogon\Notify\mljjh [03/27/2007, 21:02:35] - Key not found: HKLM…\Winlogon\Notify\mljjh, continuing. [03/27/2007, 21:02:35] - Finished Searching Browser Helper Objects [03/27/2007, 21:02:35] - *** Detected MSEvents Object [03/27/2007, 21:02:35] - Trying to remove MSEvents Object… [03/27/2007, 21:02:36] - Terminating Process: IEXPLORE.EXE [03/27/2007, 21:02:36] - Terminating Process: RUNDLL32.EXE [03/27/2007, 21:02:36] - Disabling Automatic Shell Restart [03/27/2007, 21:02:36] - Terminating Process: EXPLORER.EXE [03/27/2007, 21:02:36] - Suspending the NT Session Manager System Service [03/27/2007, 21:02:36] - Terminating Windows NT Logon/Logoff Manager [03/27/2007, 21:02:36] - Re-enabling Automatic Shell Restart [03/27/2007, 21:02:36] - File to disable: C:\WINDOWS\system32\tuvvvsq.dll [03/27/2007, 21:02:36] - Renaming C:\WINDOWS\system32\tuvvvsq.dll -> C:\WINDOWS\system32\tuvvvsq.dll.vir [03/27/2007, 21:02:36] - File successfully renamed! [03/27/2007, 21:02:36] - Removing HKLM…\Browser Helper Objects{182B90A3-F372-438A-800C-6814B4DE417B} [03/27/2007, 21:02:36] - Removing HKCR\CLSID{182B90A3-F372-438A-800C-6814B4DE417B} [03/27/2007, 21:02:36] - Adding Kill Bit for ActiveX for GUID: {182B90A3-F372-438A-800C-6814B4DE417B} [03/27/2007, 21:02:36] - Deleting ATLEvents/MSEvents Registry entries [03/27/2007, 21:02:36] - Removing HKLM…\Winlogon\Notify\tuvvvsq [03/27/2007, 21:02:36] - Searching for Browser Helper Objects: [03/27/2007, 21:02:36] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class) [03/27/2007, 21:02:36] - BHO 2: {57E218E6-5A80-4f0c-AB25-83598F25D7E9} () [03/27/2007, 21:02:36] - WARNING: BHO has no default name. Checking for Winlogon reference. [03/27/2007, 21:02:36] - Checking for HKLM…\Winlogon\Notify\pfbvisto [03/27/2007, 21:02:36] - Key not found: HKLM…\Winlogon\Notify\pfbvisto, continuing. [03/27/2007, 21:02:36] - BHO 3: {B23C8EDC-0F96-414C-BA15-184884BD44FF} () [03/27/2007, 21:02:36] - WARNING: BHO has no default name. Checking for Winlogon reference. [03/27/2007, 21:02:36] - Checking for HKLM…\Winlogon\Notify\mljjh [03/27/2007, 21:02:36] - Key not found: HKLM…\Winlogon\Notify\mljjh, continuing. [03/27/2007, 21:02:36] - Finished Searching Browser Helper Objects [03/27/2007, 21:02:36] - Finishing up… [03/27/2007, 21:02:36] - A restart is needed. [03/27/2007, 21:02:37] - Attempting to Restart via STOP error (Blue Screen!) FixVundo:

Symantec Trojan.Vundo Removal Tool 1.5.0

C:\Documents and Settings\Patryk\Moje dokumenty\Music???: (not scanned)

C:\System Volume Information: (not scanned)

D:\System Volume Information: (not scanned)

Trojan.Vundo has not been found on your computer.

hijackthis:

Logfile of HijackThis v1.99.1 Scan saved at 21:35:48, on 2007-03-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\ALCWZRD.EXE C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ufdsvc.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Patryk\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - C:\WINDOWS\system32\pfbvisto.dll O2 - BHO: (no name) - {B23C8EDC-0F96-414C-BA15-184884BD44FF} - C:\WINDOWS\system32\mljjh.dll (file missing) O4 - HKLM…\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe O4 - HKLM…\Run: [mmtask] “C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe” O4 - HKLM…\Run: [sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [adirka] C:\WINDOWS\system32\adirka.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BlueSoleil.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_29.cab O17 - HKLM\System\CCS\Services\Tcpip…{4987CF65-A35D-4372-9590-D4ACE19D34E3}: NameServer = 61.115.192.18 O17 - HKLM\System\CCS\Services\Tcpip…{4B29F8E4-415C-431E-AAD9-B019A6E5B622}: NameServer = 61.115.192.18 O17 - HKLM\System\CCS\Services\Tcpip…{5DD69288-DC4D-475D-9CF1-260A929A13EC}: NameServer = 61.115.192.18 O17 - HKLM\System\CCS\Services\Tcpip…{A1AC7FAE-DEAF-4109-94A8-CF6F9B49D602}: NameServer = 61.115.192.18 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: UFD Command Service (UFDSVC) - Generic - C:\WINDOWS\system32\ufdsvc.exe to wszystko.

adam9870 · 27 Marzec 2007 20:07

Ściągasz program KillBox, zaznaczasz Delete on reboot , w polu full path of file wklej ścieżki:

C:\WINDOWS\system32\pfbvisto.dll

C:\WINDOWS\system32\adirka.exe

Po wklejeniu każdej ścieżki z osobna klikasz na czerwonego iksa, ale dopiero po wklejeniu ostatniej zgadzasz się na restart.

Usuń wpisy HJT.

Po wykonaniu wklej nowy log z hijacka, silenta i ComboFix’a.

patrykoss8857 · 28 Marzec 2007 17:57

hijackthis:

Logfile of HijackThis v1.99.1 Scan saved at 19:49, on 07-03-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\ALCWZRD.EXE C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ufdsvc.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe c:\program files\internet explorer\iexplore.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Patryk\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - C:\WINDOWS\system32\pfbvisto.dll (file missing) O2 - BHO: (no name) - {B23C8EDC-0F96-414C-BA15-184884BD44FF} - C:\WINDOWS\system32\mljjh.dll (file missing) O4 - HKLM…\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe O4 - HKLM…\Run: [mmtask] “C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe” O4 - HKLM…\Run: [sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [adirka] C:\WINDOWS\system32\adirka.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BlueSoleil.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_29.cab O17 - HKLM\System\CCS\Services\Tcpip…{4987CF65-A35D-4372-9590-D4ACE19D34E3}: NameServer = 61.115.192.18 O17 - HKLM\System\CCS\Services\Tcpip…{4B29F8E4-415C-431E-AAD9-B019A6E5B622}: NameServer = 61.115.192.18 O17 - HKLM\System\CCS\Services\Tcpip…{5DD69288-DC4D-475D-9CF1-260A929A13EC}: NameServer = 61.115.192.18 O17 - HKLM\System\CCS\Services\Tcpip…{A1AC7FAE-DEAF-4109-94A8-CF6F9B49D602}: NameServer = 61.115.192.18 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: UFD Command Service (UFDSVC) - Generic - C:\WINDOWS\system32\ufdsvc.exe Silent: “Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “Steam” = “(empty string)” [file not found] “adirka” = “C:\WINDOWS\system32\adirka.exe” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “High Definition Audio Property Page Shortcut” = “HDAShCut.exe” [“Windows ® Server 2003 DDK provider”] “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “AlcWzrd” = “ALCWZRD.EXE” [“RealTek Semicoductor Corp.”] “Alcmtr” = “ALCMTR.EXE” [“Realtek Semiconductor Corp.”] “RemoteControl” = ““C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe”” [null data] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [null data] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “MMTray” = “C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe” [null data] “mmtask” = ““C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe”” [null data] “(Default)” = “(empty string)” [file not found] “Sony Ericsson PC Suite” = ““C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions” [“Sony Ericsson Mobile Communications AB”] “WinampAgent” = “C:\Program Files\Winamp\winampa.exe” [null data] “BluetoothAuthenticationAgent” = “rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {57E218E6-5A80-4f0c-AB25-83598F25D7E9}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\pfbvisto.dll” [file not found] {B23C8EDC-0F96-414C-BA15-184884BD44FF}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\mljjh.dll” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{A5110426-177D-4e08-AB3F-785F10B4439C}” = “Sony Ericsson File Manager” -> {HKLM…CLSID} = “Sony Ericsson File Manager” \InProcServer32(Default) = “C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll” [“Sony Ericsson Mobile Communications AB”] “{ACBA0BA3-ACED-4E02-9221-794F7588DD9C}” = “All To MP3 Converter” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\LitexMedia\All To MP3 Converter\MP3ShellExt.dll” [empty string] “{e57ce731-33e8-4c51-8354-bb4de9d215d1}” = “Uniwersalne urządzenia Plug and Play” -> {HKLM…CLSID} = “Uniwersalne urządzenia Plug and Play” \InProcServer32(Default) = “C:\WINDOWS\system32\upnpui.dll” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS\system32\WPDShServiceObj.dll” [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <> “BootExecute” = “autocheck autochk *”|“aswBoot.exe /M:8784a1d2” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> igfxcui\DLLName = “igfxsrvc.dll” [“Intel Corporation”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] ZMP3ShellExt(Default) = “{ACBA0BA3-ACED-4E02-9221-794F7588DD9C}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\LitexMedia\All To MP3 Converter\MP3ShellExt.dll” [empty string] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] ZMP3ShellExt(Default) = “{ACBA0BA3-ACED-4E02-9221-794F7588DD9C}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\LitexMedia\All To MP3 Converter\MP3ShellExt.dll” [empty string] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\Web\Wallpaper\Idylla.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\Web\Wallpaper\Idylla.bmp” Startup items in “Patryk” & “All Users” startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Gamma Loader” -> shortcut to: “C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe” [“Adobe Systems, Inc.”] “BlueSoleil” -> shortcut to: “C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe” [“IVT Corporation”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\system32\wshbth.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 16 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to “Reset Web Settings”) Added lines (compared with English-language version): : ˙ţ[V e r s i o n] : S i g n a t u r e = " $ C H I C A G O $ " : A d v a n c e d I N F = 2 . 5 , " Y o u n e e d a n e w v e r s i o n o f a d v p a c k . d l l " : : [R e s t o r e H o m e P a g e] : A d d R e g = R e s t o r e H o m e P a g e . r e g : : [R e s t o r e B r o w s e r S e t t i n g s] : A d d R e g = R e s t o r e B r o w s e r S e t t i n g s . r e g : D e l R e g = D e l e t e T e m p l a t e s . r e g , D e l e t e A u t o s e a r c h . r e g : : [R e s t o r e H o m e P a g e . r e g] : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S t a r t P a g e " , 0 , % S T A R T _ P A G E _ U R L % : : [R e s t o r e B r o w s e r S e t t i n g s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ P a g e _ U R L " , 0 , % S T A R T _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ S e a r c h _ U R L " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 1 " , 0 , " w w w . % s . c o m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 2 " , 0 , " w w w . % s . o r g " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 3 " , 0 , " w w w . % s . n e t " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 4 " , 0 , " w w w . % s . e d u " : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L % : : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ S e a r c h U r l " , " P r o v i d e r " , 0 , " " : : t m " : t m " : H K L M , " S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ I n t e r n e t S e t t i n g s \ S a f e S i t e s " , % S A F E S I T E _ V A L U E % , 0 , " h t t p : / / i e . s e a r c h . m s n . c o m / * " : : [D e l e t e T e m p l a t e s . r e g] : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 5 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 6 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 7 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 8 " : H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 9 " : : [D e l e t e A u t o s e a r c h . r e g] : ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t : H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " A u t o S e a r c h " : : [S t r i n g s] : S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : S E A R C H _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & a r = i e s e a r c h " : S A F E S I T E _ V A L U E = " i e . s e a r c h . m s n . c o m " : : ; I M P O R T A N T N O T E : : ; I E b r a n d i n g d l l ( i e d k c s 3 2 . d l l ) u s e s t h e f o l l o w i n g e n t r i e s t o r e s t o r e t h e d e f a u l t M S v a l u e s . : ; I n t h e v a n i l l a v e r s i o n o f I E , t h e v a l u e s m u s t b e t h e s a m e a s t h e i r c o r r e s p o n d i n g n o n M S _ * v a l u e s . : ; F o r e x a m p l e , S T A R T _ P A G E _ U R L a n d M S _ S T A R T _ P A G E _ U R L m u s t h a v e t h e s a m e U R L i n t h e I E v e r s i o n r e l e a s e d b y M S . : M S _ S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e " : Missing lines (compared with English-language version): [Version]: 2 lines [RestoreHomePage]: 1 line [RestoreHomePage.reg]: 1 line [RestoreBrowserSettings.reg]: 12 lines [DeleteTemplates.reg]: 5 lines [DeleteAutosearch.reg]: 1 line [strings]: 1 line [RestoreBrowserSettings]: 2 lines [strings]: 3 lines Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] BlueSoleil Hid Service, BlueSoleil Hid Service, “C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe” [null data] Bluetooth Support Service, BthServ, “C:\WINDOWS\system32\svchost.exe -k bthsvcs” {“C:\WINDOWS\System32\bthserv.dll” [MS]} Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE”” [MS] STI Simulator, STI Simulator, “C:\WINDOWS\System32\PAStiSvc.exe” [null data] UFD Command Service, UFDSVC, “C:\WINDOWS\system32\ufdsvc.exe” [“Generic”] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 59 seconds, including 7 seconds for message boxes)

adam9870 · 28 Marzec 2007 22:05

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Usuń wpisy HJT jeśli będą.

Po wykonaniu wklej nowe logi plus koniecznie log z ComboFix’a:

http://unicorn.ksiezyc.pl/WWW/instrukcje/combofix.html

patrykoss8857 · 29 Marzec 2007 20:01

“Patryk” - 07-03-29 21:59:16 Dodatek Service Pack 2

ComboFix 07-03-27.4.2 - Running from: “C:\Documents and Settings\Patryk\Pulpit”

((((((((((((((((((((((((((((((( Files Created from 2007-02-28 to 2007-03-29 ))))))))))))))))))))))))))))))))))

2007-03-27 21:01 524,288 --ah----- C:\DOCUME~1\ADMINI~1.DOM\NTUSER.DAT

2007-03-27 21:01

2007-03-27 20:16 26,730 --a------ C:\WINDOWS\system32\tuvvvsq.dll.vir

2007-03-22 17:00 0 --a------ C:\WINDOWS\system32\comcbx2.dll

2007-03-21 16:55 0 --a------ C:\WINDOWS\system32\kiscbxw.dat

2007-03-21 14:54 0 --a------ C:\WINDOWS\system32\winivfop.dll

2007-03-20 11:42 8,047 --a------ C:\WINDOWS\system32\msratnit.dll

2007-03-20 11:42 8 --a------ C:\WINDOWS\system32\sdfinacs.dll

2007-03-20 11:42 14 --a------ C:\WINDOWS\system32\rasqervy.dll

2007-03-20 00:44 8,704 --a------ C:\WINDOWS\system32\sporder.dll

2007-03-20 00:44 115 --a------ C:\WINDOWS\system32\wuasirvy.dll

2007-03-17 01:17

2007-03-16 17:52

2007-03-15 16:42

2007-03-15 16:38

2007-03-14 20:30 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll

2007-03-14 20:30 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll

2007-03-14 20:30 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys

2007-03-13 17:52

2007-03-12 21:33 0 --a------ C:\WINDOWS\nsreg.dat

2007-03-12 21:33

2007-03-12 21:32 2,301 --a------ C:\WINDOWS\mozver.dat

2007-03-12 21:30

2007-03-10 20:14

2007-03-10 20:11 185,856 --a------ C:\WINDOWS\system32\Bmp2Jpeg.dll

2007-03-10 20:11 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL

2007-03-10 20:11

2007-03-09 00:38

2007-03-08 22:21

2007-03-08 21:46 332 --a------ C:\WINDOWS\desctemp.dat

2007-03-08 21:39 8,192 --a------ C:\WINDOWS\system32\wshirda.dll

2007-03-08 21:39 59,648 --a------ C:\WINDOWS\system32\drivers\rfcomm.sys

2007-03-08 21:39 275,200 --a------ C:\WINDOWS\system32\drivers\bthport.sys

2007-03-08 21:39 27,648 --a------ C:\WINDOWS\system32\irmon.dll

2007-03-08 21:39 18,944 --a------ C:\WINDOWS\system32\drivers\BTHUSB.SYS

2007-03-08 21:39 17,024 --a------ C:\WINDOWS\system32\drivers\BthEnum.sys

2007-03-08 21:39 153,088 --a------ C:\WINDOWS\system32\irftp.exe

2007-03-08 21:38

2007-03-08 21:34 54,784 --a------ C:\WINDOWS\system32\drivers\vfwwdm32.dll

2007-03-08 21:33 82,148 --a------ C:\WINDOWS\system32\drivers\VcommMgr.sys

2007-03-08 21:33 77,824 -ra------ C:\WINDOWS\system32\drivers\SioUi2k.dll

2007-03-08 21:33 7,680 --a------ C:\WINDOWS\system32\btinstall.dll

2007-03-08 21:33 63,488 -ra------ C:\WINDOWS\system32\drivers\wssbtr1f.sys

2007-03-08 21:33 61,312 --a------ C:\WINDOWS\system32\drivers\VComm.sys

2007-03-08 21:33 51,169 -ra------ C:\WINDOWS\system32\drivers\OXSER.SYS

2007-03-08 21:33 49,152 --a------ C:\WINDOWS\system32\btfunc.dll

2007-03-08 21:33 48,556 -ra------ C:\WINDOWS\system32\drivers\SktBt2k.sys

2007-03-08 21:33 48,076 -ra------ C:\WINDOWS\system32\drivers\Sio9502k.sys

2007-03-08 21:33 40,960 -ra------ C:\WINDOWS\system32\drivers\SCTray.exe

2007-03-08 21:33 28,271 --a------ C:\WINDOWS\system32\drivers\BTHidMgr.sys

2007-03-08 21:33 23,000 --a------ C:\WINDOWS\system32\drivers\btcusb.sys

2007-03-08 21:33 20,480 --a------ C:\WINDOWS\system32\drivers\blueletaudio.sys

2007-03-08 21:33 148,830 --a------ C:\WINDOWS\system32\drivers\bcbthub.sys

2007-03-08 21:33 13,304 --a------ C:\WINDOWS\system32\drivers\BTNetFilter.sys

2007-03-08 21:33 116,021 --a------ C:\WINDOWS\system32\drivers\fw203x.sys

2007-03-08 21:33 11,860 --a------ C:\WINDOWS\system32\drivers\vbtenum.sys

2007-03-08 21:33 11,736 --a------ C:\WINDOWS\system32\drivers\VHIDMini.sys

2007-03-08 21:33 10,804 --a------ C:\WINDOWS\system32\drivers\BtNetDrv.sys

2007-03-08 21:33

2007-03-03 23:36 126,976 --a------ C:\WINDOWS\system32\coclassfast.dll

2007-03-03 23:36

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-03-28 19:54 -------- d-------- C:\Program Files\winamp

2007-03-27 19:45 -------- d-------- C:\DOCUME~1\Patryk\DANEAP~1\skype

2007-03-25 09:57 49712 --a------ C:\WINDOWS\system32\perfc015.dat

2007-03-25 09:57 355830 --a------ C:\WINDOWS\system32\perfh015.dat

2007-03-21 00:45 -------- d-------- C:\Program Files\gadu-gadu

2007-03-08 21:33 -------- d–h----- C:\Program Files\installshield installation information

2007-02-24 23:48 -------- d-------- C:\Program Files\ganymedenet

2007-02-24 23:44 4 --a------ C:\WINDOWS\system32\proc-220146841.bin

2007-02-24 23:44 -------- d-------- C:\Program Files\temp

2007-02-24 23:44 -------- d-------- C:\Program Files\ginbillard

2007-02-24 23:44 -------- d-------- C:\Program Files\common

2007-02-24 23:44 -------- d-------- C:\Program Files\adv

2007-02-23 18:14 -------- d-------- C:\Program Files\elastomania

2007-02-23 17:51 716 --a------ C:\WINDOWS\unins000.dat

2007-02-23 06:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe

2007-02-23 06:29 36624 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys

2007-02-23 06:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll

2007-02-23 06:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll

2007-02-23 06:29 129784 --a------ C:\WINDOWS\system32\pxafs.dll

2007-02-23 06:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe

2007-02-23 06:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe

2007-02-23 06:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll

2007-02-23 06:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll

2007-02-23 06:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll

2007-02-23 06:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll

2007-02-23 06:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll

2007-02-23 06:25 639066 --a------ C:\WINDOWS\system32\divx.dll

2007-02-23 06:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll

2007-02-23 06:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll

2007-02-23 06:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll

2007-02-23 06:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll

2007-02-23 06:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll

2007-02-23 06:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll

2007-02-23 06:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll

2007-02-23 00:45 -------- d-------- C:\Program Files\daemon tools

2007-02-23 00:21 98304 --a------ C:\WINDOWS\system32\cmdlineext.dll

2007-02-22 23:55 -------- d-------- C:\Program Files\messenger

2007-02-22 22:45 639224 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2007-02-18 21:35 -------- d-------- C:\Program Files\nokia

2007-02-18 21:25 -------- d-------- C:\DOCUME~1\Patryk\DANEAP~1\pc suite

2007-02-16 03:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe

2007-02-11 14:52 -------- d-------- C:\Program Files\allok mp3 to amr converter

2007-02-11 14:43 -------- d-------- C:\Program Files\litexmedia

2007-02-09 16:08 -------- d-------- C:\DOCUME~1\Patryk\DANEAP~1\xnview

2007-02-09 01:13 -------- d-------- C:\DOCUME~1\Patryk\DANEAP~1\help

2007-02-07 20:54 -------- d-------- C:\Program Files\valve

2007-02-01 19:21 -------- d-------- C:\Program Files\arkanoidactivation

2007-02-01 15:59 -------- d-------- C:\Program Files\steam

2007-02-01 15:59 -------- d-------- C:\Program Files\free audio pack

2007-02-01 15:59 -------- d-------- C:\DOCUME~1\Patryk\DANEAP~1\musicmatch

2007-02-01 15:44 -------- d-------- C:\Program Files\windows nt

2007-02-01 15:44 -------- d-------- C:\Program Files\movie maker

2007-01-31 16:22 87 --a------ C:\WINDOWS\system32\buyurl0502.dat

2007-01-28 21:27 -------- d-------- C:\Program Files\miksoft

2007-01-15 19:32 689280 --a------ C:\WINDOWS\system32\aswboot.exe

2007-01-15 19:23 90112 --a------ C:\WINDOWS\system32\avastss.scr

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]

“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe”

“MSMSGS”="“C:\Program Files\Messenger\msmsgs.exe” /background"

“Steam”=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]

“High Definition Audio Property Page Shortcut”=“HDAShCut.exe”

“SoundMan”=“SOUNDMAN.EXE”

“AlcWzrd”=“ALCWZRD.EXE”

“Alcmtr”=“ALCMTR.EXE”

“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe”

@=""

“Sony Ericsson PC Suite”="“C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions"

“BluetoothAuthenticationAgent”=“rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent”

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]

“Installed”=“1”

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]

“Installed”=“1”

“NoChange”=“1”

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]

“Installed”=“1”

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]

“UPnPMonitor”="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"

“WPDShServiceObj”="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

“SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll”

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]

HTTPFilter REG_MULTI_SZ HTTPFilter\0\0

LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0

NetworkService REG_MULTI_SZ DnsCache\0\0

DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0

rpcss REG_MULTI_SZ RpcSs\0\0

imgsvc REG_MULTI_SZ StiSvc\0\0

termsvcs REG_MULTI_SZ TermService\0\0

bthsvcs REG_MULTI_SZ BthServ\0\0

WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006

http://www.gmer.net

scanning hidden processes …

scanning hidden services …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

********************************************************************

Completion time: 07-03-29 22:01:25

adam9870 · 29 Marzec 2007 20:17

Pobierz The avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w lupkę => w okienku, które się otworzy wklej:

=> Kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po resecie może pojawić się okienko na dosłownie kilka sekund oraz log w notatniku. Wejdź tam gdzie masz avengera i skasuj plik backup.zip czyli np. c:\avenger\backup.zip.

Po wykonaniu wklej nowy log z Silenta i ComboFix’a.

patrykoss8857 · 29 Marzec 2007 20:37

Combofix:

“Patryk” - 07-03-29 22:31:03 Dodatek Service Pack 2 ComboFix 07-03-27.4.2 - Running from: “C:\Documents and Settings\Patryk\Pulpit” ((((((((((((((((((((((((((((((( Files Created from 2007-02-28 to 2007-03-29 )))))))))))))))))))))))))))))))))) 2007-03-27 21:01 524,288 --ah----- C:\DOCUME~1\ADMINI~1.DOM\NTUSER.DAT 2007-03-27 21:01 2007-03-27 21:01 2007-03-27 21:01 2007-03-27 21:01 2007-03-27 21:01 2007-03-27 21:01 2007-03-27 21:01 2007-03-27 20:16 26,730 --a------ C:\WINDOWS\system32\tuvvvsq.dll.vir 2007-03-22 17:00 0 --a------ C:\WINDOWS\system32\comcbx2.dll 2007-03-21 16:55 0 --a------ C:\WINDOWS\system32\kiscbxw.dat 2007-03-21 14:54 0 --a------ C:\WINDOWS\system32\winivfop.dll 2007-03-20 11:42 8,047 --a------ C:\WINDOWS\system32\msratnit.dll 2007-03-20 11:42 8 --a------ C:\WINDOWS\system32\sdfinacs.dll 2007-03-20 11:42 14 --a------ C:\WINDOWS\system32\rasqervy.dll 2007-03-20 00:44 8,704 --a------ C:\WINDOWS\system32\sporder.dll 2007-03-20 00:44 115 --a------ C:\WINDOWS\system32\wuasirvy.dll 2007-03-17 01:17 2007-03-17 01:17 2007-03-16 17:52 2007-03-15 16:42 2007-03-15 16:38 2007-03-14 20:30 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-03-14 20:30 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-03-14 20:30 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-03-13 17:52 2007-03-12 21:33 0 --a------ C:\WINDOWS\nsreg.dat 2007-03-12 21:33 2007-03-12 21:32 2,301 --a------ C:\WINDOWS\mozver.dat 2007-03-12 21:30 2007-03-10 20:14 2007-03-10 20:11 185,856 --a------ C:\WINDOWS\system32\Bmp2Jpeg.dll 2007-03-10 20:11 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL 2007-03-09 00:38 2007-03-08 22:21 2007-03-08 22:21 2007-03-08 21:46 332 --a------ C:\WINDOWS\desctemp.dat 2007-03-08 21:39 8,192 --a------ C:\WINDOWS\system32\wshirda.dll 2007-03-08 21:39 59,648 --a------ C:\WINDOWS\system32\drivers\rfcomm.sys 2007-03-08 21:39 275,200 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2007-03-08 21:39 27,648 --a------ C:\WINDOWS\system32\irmon.dll 2007-03-08 21:39 18,944 --a------ C:\WINDOWS\system32\drivers\BTHUSB.SYS 2007-03-08 21:39 17,024 --a------ C:\WINDOWS\system32\drivers\BthEnum.sys 2007-03-08 21:39 153,088 --a------ C:\WINDOWS\system32\irftp.exe 2007-03-08 21:38 2007-03-08 21:34 54,784 --a------ C:\WINDOWS\system32\drivers\vfwwdm32.dll 2007-03-08 21:33 82,148 --a------ C:\WINDOWS\system32\drivers\VcommMgr.sys 2007-03-08 21:33 77,824 -ra------ C:\WINDOWS\system32\drivers\SioUi2k.dll 2007-03-08 21:33 7,680 --a------ C:\WINDOWS\system32\btinstall.dll 2007-03-08 21:33 63,488 -ra------ C:\WINDOWS\system32\drivers\wssbtr1f.sys 2007-03-08 21:33 61,312 --a------ C:\WINDOWS\system32\drivers\VComm.sys 2007-03-08 21:33 51,169 -ra------ C:\WINDOWS\system32\drivers\OXSER.SYS 2007-03-08 21:33 49,152 --a------ C:\WINDOWS\system32\btfunc.dll 2007-03-08 21:33 48,556 -ra------ C:\WINDOWS\system32\drivers\SktBt2k.sys 2007-03-08 21:33 48,076 -ra------ C:\WINDOWS\system32\drivers\Sio9502k.sys 2007-03-08 21:33 40,960 -ra------ C:\WINDOWS\system32\drivers\SCTray.exe 2007-03-08 21:33 28,271 --a------ C:\WINDOWS\system32\drivers\BTHidMgr.sys 2007-03-08 21:33 23,000 --a------ C:\WINDOWS\system32\drivers\btcusb.sys 2007-03-08 21:33 20,480 --a------ C:\WINDOWS\system32\drivers\blueletaudio.sys 2007-03-08 21:33 148,830 --a------ C:\WINDOWS\system32\drivers\bcbthub.sys 2007-03-08 21:33 13,304 --a------ C:\WINDOWS\system32\drivers\BTNetFilter.sys 2007-03-08 21:33 116,021 --a------ C:\WINDOWS\system32\drivers\fw203x.sys 2007-03-08 21:33 11,860 --a------ C:\WINDOWS\system32\drivers\vbtenum.sys 2007-03-08 21:33 11,736 --a------ C:\WINDOWS\system32\drivers\VHIDMini.sys 2007-03-08 21:33 10,804 --a------ C:\WINDOWS\system32\drivers\BtNetDrv.sys 2007-03-08 21:33 2007-03-03 23:36 126,976 --a------ C:\WINDOWS\system32\coclassfast.dll 2007-03-03 23:36 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-03-28 19:54 -------- d-------- C:\Program Files\winamp 2007-03-27 19:45 -------- d-------- C:\DOCUME~1\Patryk\DANEAP~1\skype 2007-03-25 09:57 49712 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-25 09:57 355830 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-21 00:45 -------- d-------- C:\Program Files\gadu-gadu 2007-03-08 21:33 -------- d–h----- C:\Program Files\installshield installation information 2007-02-24 23:48 -------- d-------- C:\Program Files\ganymedenet 2007-02-24 23:44 4 --a------ C:\WINDOWS\system32\proc-220146841.bin 2007-02-24 23:44 -------- d-------- C:\Program Files\temp 2007-02-24 23:44 -------- d-------- C:\Program Files\ginbillard 2007-02-24 23:44 -------- d-------- C:\Program Files\common 2007-02-23 18:14 -------- d-------- C:\Program Files\elastomania 2007-02-23 17:51 716 --a------ C:\WINDOWS\unins000.dat 2007-02-23 06:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe 2007-02-23 06:29 36624 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-02-23 06:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-02-23 06:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-02-23 06:29 129784 --a------ C:\WINDOWS\system32\pxafs.dll 2007-02-23 06:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-02-23 06:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-02-23 06:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-02-23 06:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-02-23 06:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-02-23 06:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-02-23 06:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-02-23 06:25 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-02-23 06:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll 2007-02-23 06:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-02-23 06:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll 2007-02-23 06:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-02-23 06:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-02-23 06:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-02-23 06:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-02-23 00:45 -------- d-------- C:\Program Files\daemon tools 2007-02-23 00:21 98304 --a------ C:\WINDOWS\system32\cmdlineext.dll 2007-02-22 23:55 -------- d-------- C:\Program Files\messenger 2007-02-22 22:45 639224 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-02-18 21:35 -------- d-------- C:\Program Files\nokia 2007-02-18 21:25 -------- d-------- C:\DOCUME~1\Patryk\DANEAP~1\pc suite 2007-02-16 03:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe 2007-02-11 14:52 -------- d-------- C:\Program Files\allok mp3 to amr converter 2007-02-11 14:43 -------- d-------- C:\Program Files\litexmedia 2007-02-09 16:08 -------- d-------- C:\DOCUME~1\Patryk\DANEAP~1\xnview 2007-02-09 01:13 -------- d-------- C:\DOCUME~1\Patryk\DANEAP~1\help 2007-02-07 20:54 -------- d-------- C:\Program Files\valve 2007-02-01 19:21 -------- d-------- C:\Program Files\arkanoidactivation 2007-02-01 15:59 -------- d-------- C:\Program Files\steam 2007-02-01 15:59 -------- d-------- C:\Program Files\free audio pack 2007-02-01 15:59 -------- d-------- C:\DOCUME~1\Patryk\DANEAP~1\musicmatch 2007-02-01 15:44 -------- d-------- C:\Program Files\windows nt 2007-02-01 15:44 -------- d-------- C:\Program Files\movie maker 2007-01-31 16:22 87 --a------ C:\WINDOWS\system32\buyurl0502.dat 2007-01-28 21:27 -------- d-------- C:\Program Files\miksoft 2007-01-15 19:32 689280 --a------ C:\WINDOWS\system32\aswboot.exe 2007-01-15 19:23 90112 --a------ C:\WINDOWS\system32\avastss.scr (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” “MSMSGS”="“C:\Program Files\Messenger\msmsgs.exe” /background" “Steam”="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “High Definition Audio Property Page Shortcut”=“HDAShCut.exe” “SoundMan”=“SOUNDMAN.EXE” “AlcWzrd”=“ALCWZRD.EXE” “Alcmtr”=“ALCMTR.EXE” “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” @="" “Sony Ericsson PC Suite”="“C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions" “BluetoothAuthenticationAgent”=“rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] “Installed”=“1” “NoChange”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] “UPnPMonitor”="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" “WPDShServiceObj”="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] “SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll” [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 bthsvcs REG_MULTI_SZ BthServ\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-03-29 22:32:20 Silent: “Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “Steam” = “(empty string)” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “High Definition Audio Property Page Shortcut” = “HDAShCut.exe” [“Windows ® Server 2003 DDK provider”] “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “AlcWzrd” = “ALCWZRD.EXE” [“RealTek Semicoductor Corp.”] “Alcmtr” = “ALCMTR.EXE” [“Realtek Semiconductor Corp.”] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “(Default)” = “(empty string)” [file not found] “Sony Ericsson PC Suite” = ““C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions” [“Sony Ericsson Mobile Communications AB”] “BluetoothAuthenticationAgent” = “rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{A5110426-177D-4e08-AB3F-785F10B4439C}” = “Sony Ericsson File Manager” -> {HKLM…CLSID} = “Sony Ericsson File Manager” \InProcServer32(Default) = “C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll” [“Sony Ericsson Mobile Communications AB”] “{ACBA0BA3-ACED-4E02-9221-794F7588DD9C}” = “All To MP3 Converter” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\LitexMedia\All To MP3 Converter\MP3ShellExt.dll” [empty string] “{e57ce731-33e8-4c51-8354-bb4de9d215d1}” = “Uniwersalne urządzenia Plug and Play” -> {HKLM…CLSID} = “Uniwersalne urządzenia Plug and Play” \InProcServer32(Default) = “C:\WINDOWS\system32\upnpui.dll” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS\system32\WPDShServiceObj.dll” [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> igfxcui\DLLName = “igfxsrvc.dll” [“Intel Corporation”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] ZMP3ShellExt(Default) = “{ACBA0BA3-ACED-4E02-9221-794F7588DD9C}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\LitexMedia\All To MP3 Converter\MP3ShellExt.dll” [empty string] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] ZMP3ShellExt(Default) = “{ACBA0BA3-ACED-4E02-9221-794F7588DD9C}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\LitexMedia\All To MP3 Converter\MP3ShellExt.dll” [empty string] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\Web\Wallpaper\Idylla.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\Web\Wallpaper\Idylla.bmp” Startup items in “Patryk” & “All Users” startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Gamma Loader” -> shortcut to: “C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe” [“Adobe Systems, Inc.”] “BlueSoleil” -> shortcut to: “C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe” [“IVT Corporation”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\system32\wshbth.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 16 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] BlueSoleil Hid Service, BlueSoleil Hid Service, “C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe” [null data] Bluetooth Support Service, BthServ, “C:\WINDOWS\system32\svchost.exe -k bthsvcs” {“C:\WINDOWS\System32\bthserv.dll” [MS]} Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE”” [MS] STI Simulator, STI Simulator, “C:\WINDOWS\System32\PAStiSvc.exe” [null data] UFD Command Service, UFDSVC, “C:\WINDOWS\system32\ufdsvc.exe” [“Generic”] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 41 seconds, including 7 seconds for message boxes)

adam9870 · 30 Marzec 2007 13:18

Ściągasz program KillBox, zaznaczasz Delete on reboot , w polu full path of file wklej ścieżki:

C:\WINDOWS\system32\tuvvvsq.dll.vir

C:\WINDOWS\system32\comcbx2.dll

C:\WINDOWS\system32\kiscbxw.dat

C:\WINDOWS\system32\winivfop.dll

C:\WINDOWS\system32\msratnit.dll

C:\WINDOWS\system32\sdfinacs.dll

C:\WINDOWS\system32\rasqervy.dll

C:\WINDOWS\system32\wuasirvy.dll

Po wklejeniu każdej ścieżki z osobna klikasz na czerwonego iksa, ale dopiero po wklejeniu ostatniej zgadzasz się na restart.

Po wykonaniu wklej nowy log z ComboFix’a.

patrykoss8857 · 31 Marzec 2007 20:12

"Patryk" - 07-03-31 22:08:54 Dodatek Service Pack 2

adam9870 · 31 Marzec 2007 20:16

Już jest Ok

Czy masz jeszcze jakiś problem?

Gutek · 1 Kwiecień 2007 06:54

Uwaga: Jak wklejasz loga to obejmuj go znacznikiem (tagiem) CODE lub QUOTE - popraw i ta informacja jest na przyszłość

Pozdrawiam Gutek2222

patrykoss8857 · 1 Kwiecień 2007 08:47

poprawiłem i dzięki za pomoc…

ale mam jeszcze inne pytanie…

gram w taką internetową gre “Tibia”

ale mi się strasznie zacina…

mój komputer to:

Intel®

Celeron® CPU 3,06GHz

0,99GB RAM

ale mam troche kiepską karte graficzną kiepską bo zintegrowaną:

Intel® 82915G Express Chipset Family

może ktoś się orintuje dlaczego ta gra mi sie zacina?