Dziwny problem z Kaspersky,Avg antispy i SDFix

dawidek11 · 13 Listopad 2007 18:39

Witam mam problem, otoz jak uzywam SDFix’a to po restarcie kompa kaspersky pokazuje ze proces AVG (antispyware) che sie dostac to rejestru i zablokowac go… niewiem czy mam racje .Podam jeszcze log z SDFix’a i ComboFix’a.

SDFix

SDFix: Version 1.114 Run by Albert on Tue 11/13/2007 at 05:47 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-13 17:56:01 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40] “ujdew”=hex:20,02,00,00,ee,39,7c,30,8f,27,fc,d2,ea,50,60,15,03,0d,0b,3c,2e,… “ljej40”=hex:1f,eb,d4,7b,55,0c,76,61,75,51,1c,48,ba,96,54,9d,1a,25,9c,58,4d,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg41] “ujdew”=hex:20,02,00,00,ee,39,7c,30,3b,9e,83,dd,ea,50,60,15,7d,1c,0b,3c,29,… “ljej40”=hex:15,ea,d4,7b,45,0d,76,61,75,51,1c,48,ba,96,54,9d,1a,25,9c,58,34,… “ljej41”=hex:be,ea,d4,7b,3d,0d,76,61,74,51,1d,48,bb,96,54,9d,1a,25,9c,58,69,… “ljej42”=hex:be,ea,d4,7b,3d,0d,76,61,74,51,1d,48,bb,96,54,9d,1a,25,9c,58,69,… “ljej43”=hex:be,ea,d4,7b,3d,0d,76,61,74,51,1d,48,bb,96,54,9d,1a,25,9c,58,69,… “ljej44”=hex:be,ea,d4,7b,3d,0d,76,61,74,51,1d,48,bb,96,54,9d,1a,25,9c,58,69,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg42] “ujdew”=hex:20,02,00,00,ee,39,7c,30,b2,e5,e1,44,ea,50,60,15,56,0d,0b,3c,2e,… “ljej40”=hex:0e,eb,d4,7b,55,0c,76,61,75,51,1c,48,ba,96,54,9d,1a,25,9c,58,8f,… scanning hidden registry entries … [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{E9F81423-211E-46B6-9AE0-38568BC5CF6F}] “DisplayName”=“Alcohol 120%” scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Wed 18 Apr 2007 88 …SHR — “C:\WINDOWS\system32\300190A549.sys” Sat 29 Sep 2007 23 A.SH. — “C:\WINDOWS\system32\cfcffe_r.dll” Wed 18 Apr 2007 3,140 A.SH. — “C:\WINDOWS\system32\KGyGaAvL.sys” Sun 20 May 2007 4,348 A.SH. — “C:\Documents and Settings\All Users\DRM\DRMv1.bak” Wed 21 Mar 2007 0 A.SH. — “C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp” Finished!

Kaspersky

ComboFix

ComboFix 07-11-08.1 - Albert 2007-11-13 18:27:24.21 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1037 [GMT 0:00] Running from: C:\Documents and Settings\Albert\My Documents\Anti-Virus\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 ))))))))))))))))))))))))))))))) . 2007-11-13 16:24 2007-11-09 19:10 2007-11-08 15:28 2007-11-07 16:37 2007-11-05 18:18 2007-11-05 18:18 504,913 --a------ C:\WINDOWS\XP Ultimate Uninstaller.exe 2007-11-05 17:12 2007-11-05 17:11 2007-11-05 15:26 2007-11-05 13:19 2007-11-05 13:12 2007-11-05 12:24 2007-11-05 12:07 2007-11-05 09:24 49,152 --a------ C:\WINDOWS\rebuild.exe 2007-11-05 09:20 2007-11-05 09:13 2007-11-04 16:41 2007-11-01 15:39 2007-10-31 23:36 82,061 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-10-31 23:36 81,549 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-10-31 23:35 2007-10-31 23:35 16,617,248 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-31 23:35 140,320 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-31 21:40 2007-10-29 10:55 299,520 --a------ C:\WINDOWS\uninst.exe 2007-10-29 10:42 286,720 --------- C:\WINDOWS\Setup1.exe 2007-10-29 10:42 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-10-27 09:49 2007-10-20 23:55 2007-10-17 18:42 921,600 --a------ C:\WINDOWS\system32\vorbisenc.dll 2007-10-17 18:42 245,760 --a------ C:\WINDOWS\system32\mplvpx.dll 2007-10-17 18:42 237,568 --a------ C:\WINDOWS\system32\OggDS.dll 2007-10-17 18:42 188,416 --a------ C:\WINDOWS\system32\vorbis.dll 2007-10-17 18:42 45,056 --a------ C:\WINDOWS\system32\ogg.dll 2007-10-17 18:42 9,216 --a------ C:\WINDOWS\system32\cpuinf32.dll 2007-10-17 18:41 1,559,040 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-10-17 18:41 740,442 --a------ C:\WINDOWS\system32\DivX.dll 2007-10-14 23:32 2007-10-14 18:41 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-13 18:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-11-13 17:43 228,272 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-11-13 17:43 15,104 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-11-13 17:38 --------- d-----w C:\Program Files\PeerGuardian2 2007-11-12 12:59 --------- d-----w C:\Program Files\Skype 2007-11-11 12:56 --------- d-----w C:\Documents and Settings\Albert\Application Data\foobar2000 2007-11-05 14:58 --------- d-----w C:\Program Files\AveDesk 1.3 2007-11-04 17:46 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-03 11:24 --------- d-----w C:\Program Files\Audacity 2007-10-25 14:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Comodo 2007-10-25 14:46 --------- d-----w C:\Documents and Settings\Albert\Application Data\Comodo 2007-10-21 08:56 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-20 20:58 755,200 ----a-w C:\WINDOWS\system32\ir50_32.dll 2007-10-20 20:58 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll 2007-10-18 18:16 --------- d-----w C:\Documents and Settings\Albert\Application Data\AdobeUM 2007-10-18 18:00 --------- d-----w C:\Documents and Settings\Albert\Application Data\Skype 2007-10-14 18:54 --------- d-----w C:\Program Files\Webshots 2007-10-14 18:54 --------- d-----w C:\Program Files\RocketDock 2007-10-14 18:54 --------- d-----w C:\Program Files\Gadu-Gadu 2007-10-14 11:34 --------- d-----w C:\Program Files\SkanerOnline 2007-10-08 19:28 --------- d-----w C:\Program Files\Inno Setup 5 2007-10-07 16:04 --------- d-----w C:\Program Files\EsetOnlineScanner 2007-10-06 20:49 --------- d-----w C:\Program Files\Common Files\Skype 2007-10-06 20:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-10-06 20:18 --------- d-----w C:\Program Files\Common Files\snpstd3 2007-10-06 20:17 --------- d-----w C:\Documents and Settings\Albert\Application Data\InstallShield 2007-10-01 13:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-09-30 19:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2007-09-30 14:02 --------- d-----w C:\Program Files\RegCleaner 2007-09-29 20:31 --------- d-----w C:\Program Files\Lavasoft 2007-09-28 14:35 --------- d—a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-09-27 23:57 --------- d-----w C:\Program Files\QuickTime 2007-09-27 23:56 --------- d-----w C:\Program Files\ImTOO 2007-09-22 21:26 --------- d-----w C:\Program Files\AnMing 2007-09-14 13:45 --------- d-----w C:\Documents and Settings\Albert\Application Data\Grisoft 2007-09-13 22:49 --------- d-----w C:\Documents and Settings\Albert\Application Data\aicon 2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-11 08:10 476,752 ----a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe 2007-02-18 18:23 84,418 ----a-w C:\Documents and Settings\All Users\Application Data\firstlsp.reg.dat 2004-09-28 02:00 26,240 ----a-w C:\WINDOWS\inf\RAMDSK.SYS 2007-04-18 17:39:31 88 --sh–r C:\WINDOWS\system32\300190A549.sys 2007-04-18 17:40:14 3,140 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-04 01:07 C:\WINDOWS\system32\rundll32.exe] “NvMediaCenter”=“RunDLL32.exe” [2004-08-04 01:07 C:\WINDOWS\system32\rundll32.exe] “COMODO Firewall Pro”=“D:\Comodo\Firewall\CPF.exe” [2007-10-29 12:23] “DrvIcon”=“C:\Program Files\Vista Drive Icon\DrvIcon.exe” [2007-07-04 19:59] “!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2007-06-11 09:25] “AVP”=“C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe” [2007-06-28 12:51] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “RocketDock”=“C:\Program Files\RocketDock\RocketDock.exe” [2007-03-18 23:05] “AVEDESK”=“C:\Program Files\AveDesk 1.3\AVEDESK.EXE” [2005-10-25 22:44] “LClock”=“C:\Program Files\LClock\lclock.exe” [2004-09-19 18:27] C:\Documents and Settings\Albert\Start Menu\Programs\Startup\ Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2007-03-18 14:04:47] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] “UIHost”=“C:\Program Files\TGTSoft\StyleXP\Logon\CurrentLogon.EXE” [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 2005-12-06 20:16 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=wbsys.dll R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys S1 krnl_akl;krnl_akl;??\C:\WINDOWS\system32\drivers\krnl_akl.sys S3 BOCDRIVE;BOClean Kernel Monitor.;??\C:\Program Files\Comodo\CBOClean\BOCDRIVE.sys S3 MEMSWEEP2;MEMSWEEP2;??\C:\WINDOWS\system32\69.tmp S3 PRODIGY;PRODIGY;C:\WINDOWS\system32\Drivers\PRODIGY.SYS S3 SER120;OTI Serial port driver;C:\WINDOWS\system32\DRIVERS\SER120.sys . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-13 18:30:44 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-13 18:32:17 . — E O F —

Gutek · 13 Listopad 2007 20:04

Nic nie widzę

dawidek11 · 13 Listopad 2007 20:14

Serdecznie Dziekuje Gutek2222 ,ale czy mogl bym wiedziec co to za wpisy w SDFix

Final Check:


catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-11-13 17:56:01

Windows 5.1.2600 Service Pack 2 NTFS


scanning hidden processes ...


scanning hidden services & system hive ...


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40]

"ujdew"=hex:20,02,00,00,ee,39,7c,30,8f,27,fc,d2,ea,50,60,15,03,0d,0b,3c,2e,..

"ljej40"=hex:1f,eb,d4,7b,55,0c,76,61,75,51,1c,48,ba,96,54,9d,1a,25,9c,58,4d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg41]

"ujdew"=hex:20,02,00,00,ee,39,7c,30,3b,9e,83,dd,ea,50,60,15,7d,1c,0b,3c,29,..

"ljej40"=hex:15,ea,d4,7b,45,0d,76,61,75,51,1c,48,ba,96,54,9d,1a,25,9c,58,34,..

"ljej41"=hex:be,ea,d4,7b,3d,0d,76,61,74,51,1d,48,bb,96,54,9d,1a,25,9c,58,69,..

"ljej42"=hex:be,ea,d4,7b,3d,0d,76,61,74,51,1d,48,bb,96,54,9d,1a,25,9c,58,69,..

"ljej43"=hex:be,ea,d4,7b,3d,0d,76,61,74,51,1d,48,bb,96,54,9d,1a,25,9c,58,69,..

"ljej44"=hex:be,ea,d4,7b,3d,0d,76,61,74,51,1d,48,bb,96,54,9d,1a,25,9c,58,69,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg42]

"ujdew"=hex:20,02,00,00,ee,39,7c,30,b2,e5,e1,44,ea,50,60,15,56,0d,0b,3c,2e,..

"ljej40"=hex:0e,eb,d4,7b,55,0c,76,61,75,51,1c,48,ba,96,54,9d,1a,25,9c,58,8f,..

Gutek · 13 Listopad 2007 21:45

To najprawdopodobniej wpisy od Alcohol 120 - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ a347scsi