Infekcja MediaSupplyCodec

[arekmalek]

Witam.

Złapałem infekcję MediaSupplyCodec, już sobie z nią poradziłem ale chciałbym dowiedzieć się czy jest czysto do końca.

Pozdrawiam.

LOG Z DSS:

Deckard’s System Scanner v20071014.68 Run by Aero on 2007-12-27 12:33:03 Computer is in Normal Mode. -------------------------------------------------------------------------------- System Drive D: has 7.97 GiB (less than 15%) free. – HijackThis (run as Aero.exe) ------------------------------------------------ Logfile of HijackThis v1.99.1 Scan saved at 12:33:06, on 2007-12-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Radeon Omega Drivers\v3.8.421\ATI Tray Tools\atitray.exe D:\Program Files\SAGEM WiFi manager\WLANUTL.exe D:\Program Files\OpenOfficeT7 2.3\program\soffice.exe D:\Program Files\OpenOfficeT7 2.3\program\soffice.BIN D:\Program Files\Opera\Opera.exe D:\Program Files\Gadu-Gadu\gg.exe D:\Documents and Settings\Aero\Pulpit\dss.exe D:\DOCUME~1\Aero\Pulpit\CUDESK~1\Aero.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM…\Run: [AtiPTA] atiptaxx.exe O4 - HKCU…\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [AtiTrayTools] “D:\Program Files\Radeon Omega Drivers\v3.8.421\ATI Tray Tools\atitray.exe” O4 - Startup: OpenOfficeT7 2.3.lnk = D:\Program Files\OpenOfficeT7 2.3\program\quickstart.exe O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: (no name) - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 8.0\SCIEPlgn.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~3.0\adialhk.dll O20 - Winlogon Notify: klogon - D:\WINDOWS\system32\klogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avp - Unknown owner - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 8.0\avp.exe" -r (file missing) – Files created between 2007-11-27 and 2007-12-27 ----------------------------- 2007-12-25 21:27:19 0 --a------ D:\WINDOWS\ativpsrm.bin 2007-12-23 20:08:36 0 d-------- D:\Program Files\Fotosik Manager 2007-12-23 18:06:12 407129 --a------ D:\WINDOWS\MarioForever_Toolbar_Uninstaller_4671.exe 2007-12-23 18:06:12 0 d-------- D:\Program Files\Mario Forever Toolbar 2007-12-23 18:06:07 0 d-------- D:\Program Files\Mario Forever 2007-12-21 21:05:04 0 d-------- D:\Program Files\Mozilla Firefox 3 Beta 2 2007-12-14 13:38:31 0 d-------- D:\Program Files\Paint.NET 2007-12-10 18:39:11 0 d-------- D:\Program Files\Real Alternative 2007-12-07 20:02:32 0 d-------- D:\Program Files\MultiRes 2007-12-07 20:01:59 0 d-------- D:\Program Files\Radeon Omega Drivers 2007-12-07 19:54:48 0 d-------- D:\Program Files\ATI Technologies 2007-11-27 16:58:09 0 d-------- D:\Program Files\Mozilla Firefox 3 Beta 1 – Find3M Report --------------------------------------------------------------- 2007-12-27 11:28:48 0 d-------- D:\Documents and Settings\Aero\Dane aplikacji\OpenOfficeT72 2007-12-26 18:43:51 458022 --a------ D:\WINDOWS\system32\perfh015.dat 2007-12-26 18:43:51 79408 --a------ D:\WINDOWS\system32\perfc015.dat 2007-12-25 20:56:03 0 d-------- D:\Documents and Settings\Aero\Dane aplikacji\gtk-2.0 2007-12-15 15:42:19 0 d–h----- D:\Program Files\InstallShield Installation Information 2007-12-11 17:24:56 0 d-------- D:\Program Files\RogueRemover FREE 2007-12-10 18:39:11 0 d-------- D:\Documents and Settings\Aero\Dane aplikacji\Real 2007-12-01 18:02:27 0 d-------- D:\Documents and Settings\Aero\Dane aplikacji\Kingston 2007-11-24 15:52:36 0 d-------- D:\Documents and Settings\Aero\Dane aplikacji\IrfanView 2007-11-24 10:42:01 0 d-------- D:\Documents and Settings\Aero\Dane aplikacji\Skype 2007-11-22 20:25:41 0 d-------- D:\Documents and Settings\Aero\Dane aplikacji\Hamachi 2007-11-22 20:23:00 0 d-------- D:\Program Files\Hamachi 2007-11-22 15:22:50 0 d-------- D:\Program Files\Gadu-Gadu 2007-11-22 15:21:05 0 d-------- D:\Documents and Settings\Aero\Dane aplikacji\Sierra Entertainment 2007-11-22 15:17:47 0 d-------- D:\Program Files\AGEIA Technologies 2007-11-22 15:17:33 0 d-------- D:\Program Files\Common Files\Wise Installation Wizard 2007-11-22 15:11:03 0 d-------- D:\Program Files\Sierra Entertainment 2007-11-22 10:09:45 0 d-------- D:\Documents and Settings\Aero\Dane aplikacji\MfcEmbed 2007-11-21 21:36:24 0 d-------- D:\Program Files\OpenOfficeT7 2.3 2007-11-21 17:07:21 0 d-------- D:\Program Files\IP Hider 2007-11-21 15:46:24 0 d-------- D:\Program Files\eMule 2007-11-20 21:19:39 0 d-------- D:\Program Files\Kaspersky Lab 2007-11-19 22:25:10 0 d-------- D:\Program Files\IrfanView 2007-11-19 20:28:39 0 d-------- D:\Program Files\JAM KT v3 2007-11-19 20:06:26 0 d-------- D:\Program Files\JAM’s Jedi Knight KT v2.0 2007-11-17 16:19:03 0 d-------- D:\Program Files\Techland 2007-11-17 10:31:09 0 d-------- D:\Documents and Settings\Aero\Dane aplikacji\Reallusion 2007-11-17 10:30:42 0 d-------- D:\Program Files\Reallusion 2007-11-17 10:30:37 0 d-------- D:\Program Files\Common Files\InstallShield 2007-11-06 20:54:52 0 d-------- D:\Program Files\Cartoon Maker 2007-11-06 19:38:33 724992 --a------ D:\WINDOWS\iun6002.exe 2007-11-06 19:37:52 0 d-------- D:\Program Files\MalwareBurn 7.2 2007-11-03 18:50:02 0 d-------- D:\Program Files\vJA Kill Tracker 2007-10-31 15:45:28 429568 --a------ D:\WINDOWS\system32\fmod64.dll 2007-10-31 15:45:27 161280 --a------ D:\WINDOWS\system32\fmod.dll 2007-10-30 16:39:06 0 d-------- D:\Program Files\LucasArts 2007-10-29 20:59:16 0 d-------- D:\Program Files\Common Files 2007-10-29 18:41:32 0 d-------- D:\Program Files\GIMP-2.0 2007-10-19 18:57:51 444 --a------ D:\WINDOWS\system32\tmp.reg 2007-10-11 14:39:49 25600 --a------ D:\WINDOWS\system32\WS2Fix.exe 2007-10-11 14:39:49 289144 --a------ D:\WINDOWS\system32\VCCLSID.exe 2007-10-11 14:39:49 288417 --a------ D:\WINDOWS\system32\SrchSTS.exe 2007-10-11 14:39:48 53248 --a------ D:\WINDOWS\system32\Process.exe http://www.beyondlogic.org; Command Line Process Utility> 2007-10-11 14:39:48 51200 --a------ D:\WINDOWS\system32\dumphive.exe 2007-09-29 05:21:29 9854976 --a------ D:\WINDOWS\system32\atioglx2.dll 2007-09-29 05:07:23 356352 --a------ D:\WINDOWS\system32\ATIDEMGX.dll 2007-09-29 05:06:17 268800 --a------ D:\WINDOWS\system32\ati2dvag.dll 2007-09-29 04:58:34 143360 --a------ D:\WINDOWS\system32\atipdlxx.dll 2007-09-29 04:58:22 122880 --a------ D:\WINDOWS\system32\Oemdspif.dll 2007-09-29 04:58:15 26112 --a------ D:\WINDOWS\system32\Ati2mdxx.exe 2007-09-29 04:58:07 43520 --a------ D:\WINDOWS\system32\ati2edxx.dll 2007-09-29 04:57:55 122880 --a------ D:\WINDOWS\system32\ati2evxx.dll 2007-09-29 04:56:32 483328 --a------ D:\WINDOWS\system32\ati2evxx.exe 2007-09-29 04:55:43 53248 --a------ D:\WINDOWS\system32\ATIDDC.DLL 2007-09-29 04:49:19 307200 --a------ D:\WINDOWS\system32\atiiiexx.dll 2007-09-29 04:47:38 172032 --a------ D:\WINDOWS\system32\atiok3x2.dll 2007-09-29 04:47:26 3130720 --a------ D:\WINDOWS\system32\ati3duag.dll 2007-09-29 04:36:24 1593600 --a------ D:\WINDOWS\system32\ativvaxx.dll 2007-09-29 04:23:23 5435392 --a------ D:\WINDOWS\system32\atioglxx.dll 2007-09-29 04:22:08 376832 --a------ D:\WINDOWS\system32\atikvmag.dll 2007-09-29 04:20:14 17408 --a------ D:\WINDOWS\system32\atitvo32.dll 2007-09-29 04:14:14 499712 --a------ D:\WINDOWS\system32\ati2cqag.dll – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “IPHider”="" [] “AtiPTA”=“atiptaxx.exe” [2006-02-22 02:05 D:\WINDOWS\system32\atiptaxx.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“D:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44] “AtiTrayTools”=“D:\Program Files\Radeon Omega Drivers\v3.8.421\ATI Tray Tools\atitray.exe” [2007-10-21 22:06] D:\Documents and Settings\Aero\Menu Start\Programy\Autostart\ OpenOfficeT7 2.3.lnk - D:\Program Files\OpenOfficeT7 2.3\program\quickstart.exe [2007-09-20 13:51:54] D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - D:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2007-07-30 11:19:54] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”= D:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “appinit_dlls”=D:\PROGRA~1\KASPER~1\KASPER~3.0\adialhk.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @=“Service” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^Aero^Menu Start^Programy^Autostart^hamachi.lnk] backup=D:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] “D:\Program Files\Messenger\msmsgs.exe” /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] “D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “Ati HotKey Poller”=2 (0x2) “W32Time”=2 (0x2) “RemoteRegistry”=2 (0x2) “RDSessMgr”=3 (0x3) “RasMan”=3 (0x3) “CiSvc”=3 (0x3) “ATI Smart”=2 (0x2) “AresChatServer”=3 (0x3) “wscsvc”=2 (0x2) – End of Deckard’s System Scanner: finished at 2007-12-27 12:33:26 ------------

[Gutek]

W logu nic nie widzę