Mega zawirusowany - Cycbot-F, Ramnnit, MalOb-IK, Malwere

zjesion · 3 Kwiecień 2012 20:38

Witam, jak w temacie… jestem strasznie zawirusowany (Ramnit-AC, Malware gen, MalOb-IK i pewnie coś jeszcze). Nie chcę instalować nowego systemu bo mam do dyspozycji tylko obraz na dysku i jak go nagram to pewnie tam też coś wejdzie.

Próbowałem ściągnąć z dobreprogramy.pl jakieś inne programy antywirusowe ale nie da rady, gdyż nie może otworzyć danej strony jak kliknę “pobierz”.

Próbowałem też otworzyć Malwarebytes Anti-Malware ale nie chce tego uczynić.

Pomocy

Widzę, że wszędzie praktycznie potrzebne są logi, więc wrzucę loga z OTL’a.

OTL logfile created on: 2012-04-03 21:15:27 - Run 1

OTL by OldTimer - Version 3.2.39.2 Folder = E:\

Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd


2,97 Gb Total Physical Memory | 2,20 Gb Available Physical Memory | 74,34% Memory free

5,13 Gb Paging File | 0,63 Gb Available in Paging File | 12,34% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]


%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 73,25 Gb Total Space | 5,66 Gb Free Space | 7,72% Space Free | Partition Type: NTFS

Drive D: | 97,66 Gb Total Space | 9,69 Gb Free Space | 9,92% Space Free | Partition Type: NTFS

Drive E: | 127,18 Gb Total Space | 9,80 Gb Free Space | 7,70% Space Free | Partition Type: NTFS

Drive G: | 1,81 Gb Total Space | 0,08 Gb Free Space | 4,60% Space Free | Partition Type: FAT


Computer Name: JESION-1 | User Name: ZIBI | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days


[color=#E56717]========== Processes (SafeList) ==========[/color]


PRC - [2012-04-03 21:10:21 | 000,593,920 | ---- | M] (OldTimer Tools) -- E:\OTL.exe

PRC - [2012-03-18 13:32:15 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2012-03-07 00:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe

PRC - [2012-03-07 00:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

PRC - [2008-04-15 13:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe



[color=#E56717]========== Modules (No Company Name) ==========[/color]


MOD - [2012-04-03 12:02:00 | 001,753,088 | ---- | M] () -- C:\Program Files\Alwil Software\Avast5\defs\12040301\algo.dll

MOD - [2012-03-28 15:44:54 | 000,085,288 | ---- | M] () -- C:\Documents and Settings\ZIBI\Dane aplikacji\Mozilla\Firefox\Profiles\1pyv7mkx.default\extensions\{ebd898f8-fcf6-4694-bc3b-eabc7271eeb1}\components\RadioWMPCoreGecko11.dll

MOD - [2012-03-18 13:32:15 | 001,969,080 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll

MOD - [2011-04-25 17:20:21 | 006,053,536 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

MOD - [2009-11-04 01:14:04 | 000,154,112 | ---- | M] () -- C:\Program Files\Notepad++\NppShell_01.dll

MOD - [2009-06-03 05:15:54 | 000,466,944 | ---- | M] () -- C:\WINDOWS\system32\nvshell.dll

MOD - [2009-02-27 19:04:20 | 000,311,296 | ---- | M] () -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\pdfshell.POL

MOD - [2008-03-29 16:41:52 | 000,023,552 | ---- | M] () -- C:\Program Files\SubEdit-Player\codec\MatroskaSplitter\mkunicode.dll

MOD - [2008-03-29 15:42:20 | 000,159,744 | ---- | M] () -- C:\Program Files\SubEdit-Player\codec\MatroskaSplitter\mmfinfo.dll

MOD - [2008-02-28 01:15:28 | 000,115,200 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\lxdxdrpp.dll

MOD - [2001-10-28 16:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll



[color=#E56717]========== Win32 Services (SafeList) ==========[/color]


SRV - [2012-03-07 00:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)

SRV - [2012-02-15 13:45:12 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2008-02-28 01:53:25 | 000,594,600 | ---- | M] ( ) [Disabled | Stopped] -- C:\WINDOWS\system32\lxdxcoms.exe -- (lxdx_device)

SRV - [2008-02-28 01:53:22 | 000,098,984 | ---- | M] () [Disabled | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe -- (lxdxCATSCustConnectService)



[color=#E56717]========== Driver Services (SafeList) ==========[/color]


DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Rts5161ccid.sys -- (USBCCID)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Rts516xIR.sys -- (Rts516xIR)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)

DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)

DRV - File not found [Kernel | System | Stopped] -- -- (Changer)

DRV - File not found [Kernel | On_Demand | Unknown] -- -- (ax7ta62x)

DRV - [2012-04-03 20:46:54 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)

DRV - [2012-03-07 00:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)

DRV - [2012-03-07 00:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)

DRV - [2012-03-07 00:02:00 | 000,035,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)

DRV - [2012-03-07 00:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)

DRV - [2012-03-07 00:01:39 | 000,095,704 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)

DRV - [2012-03-07 00:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)

DRV - [2012-03-06 23:58:29 | 000,024,920 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)

DRV - [2011-01-07 16:23:03 | 000,279,712 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)

DRV - [2011-01-07 16:23:02 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2010-09-22 20:19:02 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\taphss.sys -- (taphss)

DRV - [2009-12-02 18:40:48 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)

DRV - [2009-06-19 16:18:24 | 000,169,216 | ---- | M] (SMI) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SMIksdrv.sys -- (usbsmi)

DRV - [2009-05-12 02:49:26 | 000,056,480 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)

DRV - [2009-04-23 10:54:36 | 000,814,592 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAU32.sys -- (CnxtHdAudService)

DRV - [2008-11-21 18:36:46 | 000,160,256 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTS5121.sys -- (RSUSBSTOR)

DRV - [2008-11-17 07:23:16 | 003,636,864 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32) Intel(R)

DRV - [2008-10-23 13:49:18 | 000,187,392 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)

DRV - [2008-04-15 13:00:00 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)

DRV - [2008-03-14 21:23:12 | 000,169,008 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2007-12-10 12:21:26 | 000,539,640 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)

DRV - [2007-11-27 15:40:38 | 000,074,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)

DRV - [2007-11-21 10:51:30 | 000,879,624 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)

DRV - [2007-06-29 11:38:30 | 000,156,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)

DRV - [2007-03-31 12:02:40 | 000,055,352 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid)

DRV - [2007-03-23 09:50:08 | 000,037,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)

DRV - [2006-09-28 13:10:52 | 000,011,648 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)

DRV - [2006-04-01 16:16:44 | 000,162,176 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\V0260Vid.sys -- (V0260VID)

DRV - [2004-07-14 11:54:42 | 000,676,864 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)

DRV - [2003-08-21 15:56:36 | 000,025,520 | ---- | M] (Ahead Software AG) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\incdrm.sys -- (incdrm)



[color=#E56717]========== Standard Registry (SafeList) ==========[/color]



[color=#E56717]========== Internet Explorer ==========[/color]


IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&affID=110482&mntrId=c46a76e100000000000000262204fc92

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


[color=#E56717]========== FireFox ==========[/color]


FF - prefs.js..browser.search.defaultenginename: "Web Search..."

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://www.google.pl/firefox/"

FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.9.0.12758

FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.2.0185

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906

FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0



FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)


FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2012-04-03 19:51:19 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012-03-18 13:32:16 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012-04-03 17:02:15 | 000,000,000 | ---D | M]


[2009-12-02 17:09:04 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\ZIBI\Dane aplikacji\Mozilla\Extensions

[2012-04-03 20:34:37 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\ZIBI\Dane aplikacji\Mozilla\Firefox\Profiles\1pyv7mkx.default\extensions

[2012-04-03 20:34:37 | 000,000,000 | ---D | M] (WiseConvert Community Toolbar) -- C:\Documents and Settings\ZIBI\Dane aplikacji\Mozilla\Firefox\Profiles\1pyv7mkx.default\extensions\{ebd898f8-fcf6-4694-bc3b-eabc7271eeb1}

[2012-01-05 22:10:16 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Documents and Settings\ZIBI\Dane aplikacji\Mozilla\Firefox\Profiles\1pyv7mkx.default\extensions\en-GB@dictionaries.addons.mozilla.org

[2012-03-02 17:36:26 | 000,000,000 | ---D | M] (Babylon) -- C:\Documents and Settings\ZIBI\Dane aplikacji\Mozilla\Firefox\Profiles\1pyv7mkx.default\extensions\ffxtlbr@babylon.com

[2010-12-22 16:28:21 | 000,000,000 | ---D | M] (AnchorFree Toolbar) -- C:\Documents and Settings\ZIBI\Dane aplikacji\Mozilla\Firefox\Profiles\1pyv7mkx.default\extensions\toolbar@ask.com

[2009-12-02 18:41:39 | 000,002,055 | ---- | M] () -- C:\Documents and Settings\ZIBI\Dane aplikacji\Mozilla\Firefox\Profiles\1pyv7mkx.default\searchplugins\daemon-search.xml

[2011-11-09 09:36:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2012-02-25 19:14:14 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2012-03-18 13:32:15 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011-02-02 20:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012-02-21 10:10:45 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml

[2012-03-02 17:36:21 | 000,002,288 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml

[2012-02-21 10:10:45 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml

[2012-02-21 10:10:45 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml

[2012-02-21 10:10:45 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml

[2012-02-21 10:10:45 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml

[2012-02-21 10:10:45 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml


O1 HOSTS File: ([2008-04-15 13:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)

O2 - BHO: (My Global Search Bar BHO) - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Help the General-Search Project) - {CA4520F3-AE13-4FB1-A513-58E23991C86D} - C:\Documents and Settings\ZIBI\Dane aplikacji\Media Finder\Extensions\gencrawler_gc.dll ()

O2 - BHO: (AnchorFree Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Search-Results)

O3 - HKLM\..\Toolbar: (My Global Search Bar) - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search)

O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)

O3 - HKLM\..\Toolbar: (AnchorFree Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Search-Results)

O3 - HKCU\..\Toolbar\ShellBrowser: (AnchorFree Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Search-Results)

O3 - HKCU\..\Toolbar\WebBrowser: (My Global Search Bar) - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search)

O3 - HKCU\..\Toolbar\WebBrowser: (AnchorFree Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Search-Results)

O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKCU..\Run: [MwdThypg] C:\Documents and Settings\ZIBI\Ustawienia lokalne\Dane aplikacji\eqpsywmc\mwdthypg.exe File not found

O4 - HKCU..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()

O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10p_Plugin.exe (Adobe Systems, Inc.)

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Download with &Media Finder - C:\Program Files\Media Finder\hook.html File not found

O8 - Extra context menu item: Wyślij do interfejsu Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E160A386-CCAD-4D07-9649-6A1F387AA031}: DhcpNameServer = 194.168.4.100 194.168.8.100

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Documents and Settings\ZIBI\Ustawienia lokalne\Dane aplikacji\eqpsywmc\mwdthypg.exe) - C:\Documents and Settings\ZIBI\Ustawienia lokalne\Dane aplikacji\eqpsywmc\mwdthypg.exe File not found

O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\ZIBI\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\ZIBI\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009-12-02 16:53:50 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [NTFS]

O33 - MountPoints2\{2038c05f-5ff2-11df-8449-00262204fc92}\Shell\AutoRun\command - "" = mh.exe

O33 - MountPoints2\{2038c05f-5ff2-11df-8449-00262204fc92}\Shell\open\Command - "" = mh.exe

O33 - MountPoints2\{d3212000-f010-11de-8356-00262204fc92}\Shell\AutoRun\command - "" = Zbyszek\Fortux.exe

O33 - MountPoints2\{d3212000-f010-11de-8356-00262204fc92}\Shell\explore\Command - "" = Zbyszek\Fortux.exe

O33 - MountPoints2\{d3212000-f010-11de-8356-00262204fc92}\Shell\open\Command - "" = Zbyszek\Fortux.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*


[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]


[2012-04-03 20:46:13 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2012-04-03 20:45:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ZIBI\Dane aplikacji\Malwarebytes

[2012-04-03 20:45:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Malwarebytes' Anti-Malware

[2012-04-03 20:45:35 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2012-04-03 20:45:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes

[2012-04-03 20:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012-04-03 20:26:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Dane aplikacji\Adobe

[2012-04-03 20:08:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\DAEMON Tools Lite

[2012-04-03 20:08:02 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite

[2012-04-03 19:51:20 | 000,612,184 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys

[2012-04-03 16:22:49 | 000,000,000 | ---D | C] -- C:\Program Files\SkanerOnline

[2012-04-02 21:59:23 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\ZIBI\Recent

[2012-04-02 21:27:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ZIBI\Dane aplikacji\BabylonToolbar

[2012-04-02 21:20:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ZIBI\Ustawienia lokalne\Dane aplikacji\eqpsywmc

[2012-03-31 19:39:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ZIBI\Pulpit\Filmik

[2012-03-20 20:58:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ZIBI\Pulpit\Goon.2011.BRRIP.XviD {1337x}-Hiest

[2012-03-16 18:29:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\A1F4

[2012-03-14 14:19:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ZIBI\Moje dokumenty\BearShare

[2012-03-06 19:57:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ZIBI\Moje dokumenty\FIFA 12

[2012-03-06 19:33:18 | 000,000,000 | ---D | C] -- C:\Program Files\FIFA 12

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->]


[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]


[2012-04-03 20:46:54 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2012-04-03 20:46:08 | 000,093,608 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001

[2012-04-03 20:45:36 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes Anti-Malware.lnk

[2012-04-03 20:12:36 | 000,235,931 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml

[2012-04-03 20:12:30 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012-04-03 20:12:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012-04-03 20:11:27 | 000,120,368 | -H-- | M] () -- C:\Documents and Settings\ZIBI\IrhKB23

[2012-04-03 20:08:11 | 000,001,613 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\DAEMON Tools Lite.lnk

[2012-04-03 20:05:37 | 000,002,267 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk

[2012-04-03 19:51:20 | 000,002,645 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT

[2012-04-01 22:11:58 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2012-03-31 21:37:19 | 000,090,624 | ---- | M] () -- C:\Documents and Settings\ZIBI\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012-03-30 22:34:09 | 000,093,608 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat

[2012-03-25 13:08:52 | 003,148,854 | ---- | M] () -- C:\Documents and Settings\ZIBI\Pulpit\cos.bmp

[2012-03-25 09:04:10 | 000,503,308 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat

[2012-03-25 09:04:10 | 000,443,922 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012-03-25 09:04:10 | 000,090,490 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat

[2012-03-25 09:04:10 | 000,072,180 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2012-03-13 17:22:03 | 000,046,550 | ---- | M] () -- C:\Documents and Settings\ZIBI\Pulpit\zdj.JPG

[2012-03-07 00:15:19 | 000,041,184 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr

[2012-03-07 00:15:14 | 000,201,352 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe

[2012-03-07 00:03:51 | 000,612,184 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys

[2012-03-07 00:03:38 | 000,337,880 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys

[2012-03-07 00:02:00 | 000,035,672 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys

[2012-03-07 00:01:53 | 000,053,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys

[2012-03-07 00:01:39 | 000,095,704 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys

[2012-03-07 00:01:35 | 000,089,048 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys

[2012-03-07 00:01:30 | 000,020,696 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys

[2012-03-06 23:58:29 | 000,024,920 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys

[2012-03-06 19:54:54 | 000,000,728 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\FIFA 12.lnk

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->]


[color=#E56717]========== Files Created - No Company Name ==========[/color]


[2012-04-03 20:45:36 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes Anti-Malware.lnk

[2012-04-03 20:08:11 | 000,001,613 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\DAEMON Tools Lite.lnk

[2012-04-03 20:06:24 | 000,120,368 | -H-- | C] () -- C:\Documents and Settings\ZIBI\IrhKB23

[2012-03-25 13:08:52 | 003,148,854 | ---- | C] () -- C:\Documents and Settings\ZIBI\Pulpit\cos.bmp

[2012-03-13 17:22:01 | 000,046,550 | ---- | C] () -- C:\Documents and Settings\ZIBI\Pulpit\zdj.JPG

[2012-03-06 19:54:54 | 000,000,734 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\FIFA 12.lnk

[2012-03-06 19:54:54 | 000,000,728 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\FIFA 12.lnk

[2012-01-10 19:42:00 | 000,000,072 | ---- | C] () -- C:\WINDOWS\VcncDll.INI

[2012-01-10 19:40:23 | 000,000,021 | ---- | C] () -- C:\WINDOWS\SWCNC.INI

[2011-12-19 17:33:57 | 000,716,813 | ---- | C] () -- C:\WINDOWS\unins000.exe

[2011-12-19 12:20:20 | 000,329,570 | ---- | C] () -- C:\WINDOWS\unins000.dat

[2011-01-07 16:23:03 | 000,279,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys

[2011-01-07 16:23:02 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys

[2010-12-31 20:05:45 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\cd.dat

[2010-10-20 15:37:02 | 000,122,884 | ---- | C] () -- C:\WINDOWS\UnGins.exe

[2010-10-08 17:12:27 | 000,164,864 | ---- | C] () -- C:\WINDOWS\System32\UNWISE.EXE

[2010-10-08 17:12:27 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\hlduinst.exe

[2010-10-08 17:10:50 | 000,126,704 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE

[2010-09-01 17:41:44 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdxvs.dll

[2010-09-01 17:41:42 | 000,360,448 | ---- | C] () -- C:\WINDOWS\System32\lxdxcoin.dll

[2010-09-01 17:41:11 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lxdxcaps.dll

[2010-09-01 17:41:10 | 000,782,336 | ---- | C] () -- C:\WINDOWS\System32\lxdxdrs.dll

[2010-09-01 17:41:10 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdxcnv4.dll

[2010-09-01 17:39:25 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\lxdxrwrd.ini

[2010-09-01 17:39:08 | 000,438,272 | ---- | C] ( ) -- C:\WINDOWS\System32\LXDXhcp.dll

[2010-09-01 17:39:08 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxinpa.dll

[2010-09-01 17:39:08 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\LXDXinst.dll

[2010-09-01 17:39:08 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxiesc.dll

[2010-09-01 17:39:07 | 001,105,920 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxserv.dll

[2010-09-01 17:39:07 | 000,843,776 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxusb1.dll

[2010-09-01 17:39:07 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxpmui.dll

[2010-09-01 17:39:07 | 000,569,344 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxlmpm.dll

[2010-09-01 17:39:07 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxprox.dll

[2010-09-01 17:39:06 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxhbn3.dll

[2010-09-01 17:39:06 | 000,320,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxih.exe

[2010-09-01 17:39:05 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdxgrd.dll

[2010-09-01 17:39:04 | 000,851,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxcomc.dll

[2010-09-01 17:39:04 | 000,594,600 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxcoms.exe

[2010-09-01 17:39:04 | 000,376,832 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxcomm.dll

[2010-09-01 17:39:04 | 000,365,224 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxcfg.exe

[2010-08-05 22:23:53 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2010-06-07 23:23:51 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll

[2010-04-20 18:56:42 | 000,000,831 | ---- | C] () -- C:\WINDOWS\ldp.INI


[color=#E56717]========== Alternate Data Streams ==========[/color]


@Alternate Data Stream - 55920 bytes -> C:\Documents and Settings\All Users\Pulpit:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM


< End of report >

krzych5610 · 4 Kwiecień 2012 08:32

Sprawdź z wykorzystaniem CCE.

Sprawdź komputer z poziomu CCE.

Możesz skorzystać z trybu czyszczenia i naprawy dysku z wykorzystaniem Killswitch i Quick Repair

Pobierz skaner CCE, w twoim przypadku wersja 32 z http://forums.comodo.com/polski-polish/ … #msg573032
Wypakuj pobrany skaner do np. D:\CCE
Odszukaj na liście programów - KillSwitch.exe
Wyłącz, gdy jest taka możliwość, zainstalowanego antywirusa
Uruchom KillSiwch.exe. Jak będą problemy to w trybie agresywnym - Shift + KillSwitch.exe
Poczekaj na wykonanie analizy
Procesy nieprawidłowe zostaną wskazane kolorem czerwonym.
Mogą się też pokazać procesy wskazane kolorem szarym, te nie mają znaczenia.
Sposób postępowania z KillSwitch - http://forums.comodo.com/polski-polish/ … #msg572843
wykonaj czynności wg tego zalecenia

Pomocną funkcją jest również ukrycie bezpiecznych wpisów, aby łatwiej operować tymi niebezpiecznymi “View> Hide Safe Processes”.

Po zakończeniu procedury przez Killswitch uruchom Quick Repair i wykonaj zaleconą naprawę
Skanowania z poziomu CCE - aktywacja normalna cce.exe , aktywacja agresywna shift + cce.exe
Patrz wykonywanie skanowania - http://forums.comodo.com/polski-polish/ … #msg572836
Po zakończonym skanowaniu pojawia się raport. W raporcie standardową opcją jest CLEAN. To jest menu rozwiane, można wybrać inne polecenia.

roobal · 4 Kwiecień 2012 15:47

zjesion , zgodnie z regulaminem, który zaakceptowałeś podczas rejestracji, proszę dokonać zmiany tytułu na taki, który wstępnie opisze problem, w przeciwnym razie temat wyląduje w koszu.

zjesion · 4 Kwiecień 2012 16:11

Niestety nie mogę otworzyć linków które mi podałeś (klikam na link > przeglądarka próbuje otworzyć stronę > i wyskakuje komunikat “błąd wczytywania strony”)

Tak jakbym nie mógł połączyć się z ftp (chyba).

Jeszcze powiem że zanim zgłosiłem problem na forum skanowałem avastem dyski po ponownym uruchomieniu i w zasadzie wszystkie zainfekowane pliki zostały usunięte (avast nie potrafił ich naprawić). I teraz wyskakują komunikaty o włożeniu płyty Windowsa XP SP 3 w celu naprawienia błędów. Klikam “Anuluj” gdyż nie mam jej na dysku a Deamona nie mogę otworzyć żeby skorzystać z obrazu.

W procesach jeszcze wyskakuje coś dziwnego “Sf.bin” (pojawia się i znika)

– Dodane 07.04.2012 (So) 13:29 –

Witam,

nie mogłem już nic zrobić i musiałem sformatować dysk. Postawiłem system dzięki znajomym (długa historia więc nie będę wygłaszał jej tutaj).

Przeskanowałem system skanerami online (mks, panda i kaspersky o ile się nie mylę), wszystkie poinfekowane pliki (było ich około 300) powyżucałem łącznie z całymi aplikacjami w których siedziały.

Nie chcę teraz ryzykować infekcji (bo być może już jest) więc proszę o sprawdzenie Loga ponieważ muszę wejść na konto bankowe. Nie wiem tylko od jakiego programu zacząć.

Za wszelką pomoc szczerze dziękuję.

Pozdrawiam