Po wznowieniu ze stanu chibernacji wirusy

[daniel105 (Daniello Daniel)]

Cześć, mam problem, gdy wznowiłem ze stanu chibernacji nagle powyskakiwały mi jakies błedy, same otwierały sie jakies strony internetowe. Wszystko wyczysciłem F-secure antivirus 2006 po oczyszczeniu wszystko było dobrze, po restarcie komputera wszystko grało jak powinno. Ale znowu z chibernowałem i gdy wznowiłem to znowu pojawiły sie te syfy.

Bardzo prosze o pomoc daje wam logi z hijackthis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:32:35, on 2007-12-21

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

d:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE

d:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe

d:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE

d:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe

d:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\oodag.exe

d:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE

C:\WINDOWS\system32\svchost.exe

d:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe

d:\Program Files\F-Secure Internet Security\Common\FCH32.EXE

d:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE

d:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe

d:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe

d:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

D:\Program Files\Hmonitor\hmonitor.exe

D:\Program Files\F-Secure Internet Security\Common\FSM32.EXE

C:\FRAPS\FRAPS.EXE

D:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe

D:\Program Files\Gadu-Gadu\gg.exe

D:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe

D:\Program Files\Launchy\Launchy.exe

d:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe

d:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe

d:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm … Ojg5&lid=2

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: BDEX System - {4DD1180E-8EEE-4801-AB5D-05CC3DFE3AF0} - C:\WINDOWS\ttvbonkog.dll

O2 - BHO: MPBarOpener Class - {8FD66659-A7AF-4641-9999-C56607D3A0AB} - C:\Program Files\Mpire\Mpire Plugin\MPBand.dll

O3 - Toolbar: The leosrv - {A3B1F7ED-8EDA-410F-8CB9-F6AFD8301B7C} - (no file)

O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon

O4 - HKLM…\Run: [hmonitor] D:\Program Files\Hmonitor\hmonitor.exe

O4 - HKLM…\Run: [F-Secure Manager] “d:\Program Files\F-Secure Internet Security\Common\FSM32.EXE” /splash

O4 - HKLM…\Run: [F-Secure TNB] “d:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe” /CHECKALL /WAITFORSW

O4 - HKLM…\Run: [F-Secure Startup Wizard] “d:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE” /reboot

O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [Fraps] C:\FRAPS\FRAPS.EXE

O4 - HKCU…\Run: [Gadwin PrintScreen] “d:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe” /nosplash

O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)

O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)

O4 - HKUS\S-1-5-18…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime (User ‘SYSTEM’)

O4 - HKUS.DEFAULT…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime (User ‘Default user’)

O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = D:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe

O4 - Global Startup: Launchy.lnk = D:\Program Files\Launchy\Launchy.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: &Zablokuj to okienko - d:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Osłona programu IE - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - d:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll

O9 - Extra ‘Tools’ menuitem: Osłona programu IE… - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - d:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O17 - HKLM\System\CCS\Services\Tcpip…{6A4AA827-19A9-409C-9CC3-BC47B0D91B92}: NameServer = 194.204.152.34 217.98.63.164

O20 - AppInit_DLLs:

O21 - SSODL: xcvwer - {33A6DB78-5A1A-438E-8294-1C546FD8EBDC} - C:\WINDOWS\xcvwer.dll

O21 - SSODL: hjoqor - {5953221B-2914-4D74-BBE2-3FD065BF518A} - C:\WINDOWS\hjoqor.dll

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - e:\Program Files\Ares\chatServer.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - d:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - d:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe

O23 - Service: fsbwsys - F-Secure Corp. - d:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - d:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - d:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–

End of file - 7121 bytes

[Maciej13 (Maciej13 13)]

Użyj SmitFraudFix z opcji 2 w Trybie Awaryjnym.

Po pracy pokaż nowe logi z: Hijack This + Silent Runners + ComboFix + SmitFraudFix.

[daniel105 (Daniello Daniel)]

tu jest log z Hijack This :

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:14:23, on 2007-12-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe d:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE d:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe d:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE d:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe d:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\HPZipm12.exe d:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE C:\WINDOWS\system32\svchost.exe d:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe d:\Program Files\F-Secure Internet Security\Common\FCH32.EXE d:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE d:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe d:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe d:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe D:\Program Files\Hmonitor\hmonitor.exe D:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\FRAPS\FRAPS.EXE D:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe D:\Program Files\Launchy\Launchy.exe d:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe d:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe d:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe C:\WINDOWS\system32\wuauclt.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe D:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: BDEX System - {4DD1180E-8EEE-4801-AB5D-05CC3DFE3AF0} - C:\WINDOWS\ttvbonkog.dll (file missing) O2 - BHO: MPBarOpener Class - {8FD66659-A7AF-4641-9999-C56607D3A0AB} - C:\Program Files\Mpire\Mpire Plugin\MPBand.dll O3 - Toolbar: The leosrv - {A3B1F7ED-8EDA-410F-8CB9-F6AFD8301B7C} - (no file) O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [hmonitor] D:\Program Files\Hmonitor\hmonitor.exe O4 - HKLM…\Run: [F-Secure Manager] “d:\Program Files\F-Secure Internet Security\Common\FSM32.EXE” /splash O4 - HKLM…\Run: [F-Secure TNB] “d:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe” /CHECKALL /WAITFORSW O4 - HKLM…\Run: [F-Secure Startup Wizard] “d:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE” /reboot O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Fraps] C:\FRAPS\FRAPS.EXE O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime (User ‘Default user’) O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = D:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe O4 - Global Startup: Launchy.lnk = D:\Program Files\Launchy\Launchy.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &Zablokuj to okienko - d:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Osłona programu IE - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - d:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra ‘Tools’ menuitem: Osłona programu IE… - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - d:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O17 - HKLM\System\CCS\Services\Tcpip…{6A4AA827-19A9-409C-9CC3-BC47B0D91B92}: NameServer = 194.204.152.34 217.98.63.164 O20 - AppInit_DLLs: O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - e:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - d:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - d:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - d:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - d:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - d:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe – End of file - 6737 bytes

[daniel105 (Daniello Daniel)]

tu z cobofixa

ComboFix 07-12-21.4 - GiyxDaniello 2007-12-21 11:24:31.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.197 [GMT 1:00] Running from: D:\z neta\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-21 to 2007-12-21 ))))))))))))))))))))))))))))))) . 2007-12-21 10:38 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-21 10:38 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-21 10:38 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-12-21 10:38 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-21 10:38 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-21 10:38 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-20 14:14 . 2005-08-29 15:12 70,864 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys 2007-12-20 14:14 . 2005-08-29 15:12 33,584 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys 2007-12-20 14:10 . 2007-12-20 14:10 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.116-4476822L.exe 2007-12-19 16:29 . 2000-10-10 13:01 198,656 --a------ C:\WINDOWS\system32\comdlg32.ocx 2007-12-19 16:29 . 2000-05-17 09:52 187,392 --a------ C:\WINDOWS\system32\JPGUtils.dll 2007-12-19 16:29 . 2007-12-20 15:39 24 --a------ C:\WINDOWS\LogonStudio.ini 2007-12-19 16:23 . 2007-12-19 16:23 2007-12-19 16:23 . 2007-12-19 16:23 2007-12-19 16:23 . 2007-12-19 16:55 163,712 --a------ C:\WINDOWS\system32\drivers\vidstub.sys 2007-12-19 16:11 . 2007-12-19 16:11 2007-12-19 16:05 . 2007-12-19 16:05 2,182,656 --a------ C:\WINDOWS\system32\kernel1.exe 2007-12-19 16:05 . 2007-12-01 11:32 211 --ahs---- C:\BOOT.BKK 2007-12-18 14:01 . 2007-12-18 14:01 2007-12-18 14:01 . 2007-12-18 14:01 2007-12-15 23:12 . 2007-12-15 23:12 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-12-14 15:24 . 2007-09-27 13:39 113,608 --------- C:\WINDOWS\hpoins07.dat.temp 2007-12-14 15:24 . 2005-05-24 09:22 21,124 --------- C:\WINDOWS\hpomdl07.dat.temp 2007-12-13 19:25 . 2007-12-13 19:26 2007-12-13 19:24 . 2007-12-13 19:24 2007-12-12 17:32 . 2007-12-12 19:57 2007-12-12 17:32 . 2007-12-12 19:56 2007-12-11 15:06 . 2007-12-11 15:06 2007-12-10 17:38 . 2007-12-10 17:38 19,632 --a------ C:\Documents and Settings\GiyxDaniello\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-12-01 12:23 . 2007-12-01 12:23 2007-12-01 10:48 . 2007-12-01 10:48 2007-12-01 10:44 . 2007-12-12 20:40 2007-11-30 22:44 . 2007-12-01 09:34 2007-11-30 22:44 . 2007-11-30 23:33 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-11-27 18:40 . 2000-05-22 22:58 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx 2007-11-27 18:15 . 2006-04-05 08:09 66,560 --a------ C:\WINDOWS\MOTA113.exe 2007-11-27 18:14 . 2007-11-27 18:14 2007-11-27 18:14 . 2004-05-11 08:14 719,872 --a------ C:\WINDOWS\system32\devil.dll 2007-11-27 18:14 . 2006-05-11 18:32 502,784 --a------ C:\WINDOWS\x2.64.exe 2007-11-27 18:14 . 2006-12-12 14:15 471,552 --a------ C:\WINDOWS\system32\Smab.dll 2007-11-27 18:14 . 2006-11-12 13:44 306,688 --a------ C:\WINDOWS\system32\avisynth.dll 2007-11-27 18:14 . 2005-11-10 13:16 240,128 --a------ C:\WINDOWS\system32\x.264.exe 2007-11-27 18:14 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe 2007-11-27 18:14 . 2005-02-06 00:00 92,672 -r-hs---- C:\WINDOWS\system32\RLVorbisDec.ax 2007-11-27 18:14 . 2004-01-03 00:08 70,656 --a------ C:\WINDOWS\system32\yv12vfw.dll 2007-11-27 18:14 . 2004-01-03 00:08 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll 2007-11-27 18:14 . 2005-07-11 12:31 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll 2007-11-27 18:12 . 2006-09-12 12:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax 2007-11-27 18:12 . 2007-03-14 20:45 9,292 —h----- C:\WINDOWS\super.chm 2007-11-26 18:26 . 2007-12-19 19:42 2007-11-26 17:23 . 2007-11-26 17:23 2007-11-26 17:23 . 2007-11-26 17:23 2007-11-23 16:36 . 2007-11-23 16:36 139,008 --a------ C:\WINDOWS\system32\guard32.dll 2007-11-22 18:39 . 2007-11-22 18:39 2007-11-21 19:37 . 2005-12-11 01:53 720,412 --a------ C:\WINDOWS\system32\MGB_ScreenSaver.scr 2007-11-21 19:37 . 2005-09-21 05:42 382,976 --a------ C:\WINDOWS\system32\Vista.scr 2007-11-21 19:37 . 2006-02-26 20:43 19,968 --a------ C:\WINDOWS\system32\reico.exe 2007-11-21 19:36 . 2004-09-04 06:45 172,032 --a------ C:\WINDOWS\system32\LClock.cpl 2007-11-21 19:36 . 2004-12-19 23:00 111,104 --a------ C:\WINDOWS\system32\Uharc.exe 2007-11-21 19:36 . 2005-05-18 11:43 81,920 --a------ C:\WINDOWS\system32\closeapp.exe 2007-11-21 19:35 . 2004-09-03 23:43 199 --a------ C:\WINDOWS\system32\paypal.url 2007-11-21 19:35 . 2006-05-17 04:46 104 --a------ C:\WINDOWS\system32\winx.url . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-21 10:15 --------- d-----w C:\Documents and Settings\GiyxDaniello\Dane aplikacji\Launchy 2007-12-21 09:53 --------- d—a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-12-21 09:41 --------- d-----w C:\Documents and Settings\GiyxDaniello\Dane aplikacji\F-Secure 2007-12-20 18:35 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-12-20 16:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-12-20 13:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\F-Secure 2007-12-19 15:55 --------- d-----w C:\Documents and Settings\GiyxDaniello\Dane aplikacji\Azureus 2007-12-19 15:30 5,488,128 ----a-w C:\WINDOWS\system32\logonuiX.exe 2007-12-12 16:30 --------- d-----w C:\Program Files\Windows Media Bonus Pack for Windows XP 2007-12-02 18:34 --------- d-----w C:\Documents and Settings\Marta\Dane aplikacji\Launchy 2007-12-01 11:35 225,280 ----a-w C:\Program Files\Uninstall My Global Search Bar.dll 2007-12-01 10:03 --------- d-----w C:\Documents and Settings\GiyxDaniello\Dane aplikacji\Comodo 2007-12-01 10:02 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Comodo 2007-11-29 15:42 --------- d-----w C:\Documents and Settings\Marta\Dane aplikacji\Comodo 2007-11-28 15:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\fssg 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-09 18:47 --------- d-----w C:\Program Files\SimTractor 3.5 2007-11-05 18:31 --------- d-----w C:\Documents and Settings\GiyxDaniello\Dane aplikacji\ViStart 2007-11-02 18:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\GoldWaveCDDB 2007-11-02 17:39 --------- d-----w C:\Documents and Settings\GiyxDaniello\Dane aplikacji\AccurateRip 2007-11-01 19:46 --------- d-----w C:\Program Files\Neostrada TP 2007-11-01 11:01 --------- d-----w C:\Documents and Settings\Marta\Dane aplikacji\Gadu-Gadu 2007-10-30 21:34 --------- d-----w C:\Program Files\Thomson 2007-10-30 13:57 81,984 ----a-w C:\WINDOWS\system32\bdod.bin 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 14:38 --------- d-----w C:\Program Files\Common Files\BitDefender 2007-10-27 10:13 --------- d-----w C:\Documents and Settings\GiyxDaniello\Dane aplikacji\RaimaRadio 2007-10-26 12:50 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-10-25 13:23 --------- d-----w C:\Program Files\Common Files\DirectX 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-24 17:17 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-24 12:57 --------- d-----w C:\Documents and Settings\GiyxDaniello\Dane aplikacji\ABBYY 2007-10-22 16:27 --------- d-----w C:\Documents and Settings\GiyxDaniello\Dane aplikacji\Ashampoo 2007-10-22 14:51 --------- d-----w C:\Documents and Settings\GiyxDaniello\Dane aplikacji\atitray 2007-10-02 14:17 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll 2007-09-28 14:22 139,264 ----a-w C:\WINDOWS\system32\hpzjrd01.dll 2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe 2006-05-03 10:06 163,328 --sh–r C:\WINDOWS\system32\flvDX.dll 2007-02-21 11:47 31,744 --sh–r C:\WINDOWS\system32\msfDX.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE~\Browser Helper Objects{4DD1180E-8EEE-4801-AB5D-05CC3DFE3AF0}] C:\WINDOWS\ttvbonkog.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{8FD66659-A7AF-4641-9999-C56607D3A0AB}] 2007-09-13 07:54 86016 --a------ C:\Program Files\Mpire\Mpire Plugin\MPBand.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44] “Fraps”=“C:\FRAPS\FRAPS.EXE” [2007-03-16 04:58] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-01-26 11:38] “hmonitor”=“D:\Program Files\Hmonitor\hmonitor.exe” [2003-03-11 10:32] “F-Secure Manager”=“d:\Program Files\F-Secure Internet Security\Common\FSM32.exe” [2005-06-02 23:37] “F-Secure TNB”=“d:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe” [2005-07-18 15:51] “F-Secure Startup Wizard”=“d:\Program Files\F-Secure Internet Security\FSGUI\FSSW.exe” [2005-08-23 14:38] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2004-08-25 13:25] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ F-Secure Anti-Virus 2006.lnk - D:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe [2007-12-20 14:10:14] Launchy.lnk - D:\Program Files\Launchy\Launchy.exe [2007-10-07 15:22:54] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoLowDiscSpaceChecks”= 000000000000f03f [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] “UIHost”=“C:\WINDOWS\system32\logonuiX.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”= R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-08-29 15:12] R1 atitray;atitray;d:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2007-10-16 09:42] R2 BackWeb Plug-in - 4476822;F-Secure Anti-Virus 2006;d:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE [2007-12-20 14:10] R2 F-Secure Filter;F-Secure File System Filter;d:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 16:14] R2 F-Secure Gatekeeper;F-Secure Gatekeeper;d:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSgk.sys [2007-12-20 15:41] R2 F-Secure Recognizer;F-Secure File System Recognizer;d:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2004-06-01 10:03] R2 hmonitor;hmonitor;C:\WINDOWS\system32\drivers\hmonitor.sys [2003-02-04 12:01] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05] S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 09:47] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{21DB17A7-9EB9-0768-D9C5-22A71AD280F1}] C:\WINDOWS\system32:svchost.exe . Contents of the ‘Scheduled Tasks’ folder “2007-12-18 15:43:37 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job” - C:\Program Files\Apple Software Update\SoftwareUpdate.exe “2007-12-21 08:15:24 C:\WINDOWS\Tasks\Scheduled scanning task.job” - d:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=d:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-21 11:25:40 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-21 11:26:36 C:\ComboFix2.txt … 2007-12-21 11:02 . 2007-12-12 13:40:47 — E O F — tu z : “Silent Runners.vbs”, revision 55, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Fraps” = “C:\FRAPS\FRAPS.EXE” [“Beepa P/L”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “SpeedTouch USB Diagnostics” = ““C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon” [“THOMSON Telecom Belgium”] “hmonitor” = “D:\Program Files\Hmonitor\hmonitor.exe” [“AB Software”] “F-Secure Manager” = ““d:\Program Files\F-Secure Internet Security\Common\FSM32.EXE” /splash” [“F-Secure Corporation”] “F-Secure TNB” = ““d:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe” /CHECKALL /WAITFORSW” [“F-Secure Corporation”] “F-Secure Startup Wizard” = ““d:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE” /reboot” [“F-Secure Corporation”] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}(Default) = “IE7 Uninstall Stub” \StubPath = “C:\WINDOWS\system32\ieudinit.exe” [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {4DD1180E-8EEE-4801-AB5D-05CC3DFE3AF0}(Default) = (no title provided) -> {HKLM…CLSID} = “BDEX System” \InProcServer32(Default) = “C:\WINDOWS\ttvbonkog.dll” [file not found] {8FD66659-A7AF-4641-9999-C56607D3A0AB}(Default) = (no title provided) -> {HKLM…CLSID} = “MPBarOpener Class” \InProcServer32(Default) = “C:\Program Files\Mpire\Mpire Plugin\MPBand.dll” [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” -> {HKLM…CLSID} = “SimpleShlExt Class” \InProcServer32(Default) = “C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll” [empty string] “{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}” = “jetAudio” -> {HKLM…CLSID} = “JetFlExt Class” \InProcServer32(Default) = “d:\Program Files\JetAudio\JetFlExt.dll” [“COWON America”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{AD392E40-428C-459F-961E-9B147782D099}” = “UltraISO” -> {HKLM…CLSID} = “UIContextMenu Class” \InProcServer32(Default) = “e:\Program Files\UltraISO\isoshell.dll” [“EZB Systems, Inc.”] “{950FF917-7A57-46BC-8017-59D9BF474000}” = “Shell Extension for CDRW” -> {HKLM…CLSID} = “Shell Extension for CDRW” \InProcServer32(Default) = “C:\Program Files\Ahead\InCD\incdshx.dll” [“Nero AG”] “{2B3453E4-49DF-11D3-8229-0080BE509050}” = “GMail Drive” -> {HKLM…CLSID} = “GMail Drive” \InProcServer32(Default) = “C:\WINDOWS\system32\ShellExt\GMailFS.dll” [“Bjarke Viksoe”] “{2B3453E4-49DF-11D3-8229-0080BE509052}” = “GMailFS Property Sheet” -> {HKLM…CLSID} = “GMailFS Property Sheet” \InProcServer32(Default) = “C:\WINDOWS\system32\ShellExt\GMailFS.dll” [“Bjarke Viksoe”] “{2B3453E4-49DF-11D3-8229-0080BE509054}” = “GMailFS Drop Handler” -> {HKLM…CLSID} = “GMailFS Drop Handler” \InProcServer32(Default) = “C:\WINDOWS\system32\ShellExt\GMailFS.dll” [“Bjarke Viksoe”] “{2B3453E4-49DF-11D3-8229-0080BE509056}” = “GMailFS Context Menu” -> {HKLM…CLSID} = “GMailFS Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\ShellExt\GMailFS.dll” [“Bjarke Viksoe”] “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” = “UnlockerShellExtension” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “d:\Program Files\Unlocker\UnlockerCOM.dll” [null data] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}” = “Wyślij na Fotosik.pl” -> {HKLM…CLSID} = “Wyślij na Fotosik.pl” \InProcServer32(Default) = “e:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL” [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS\system32\WPDShServiceObj.dll” [MS] HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\ <> “BootExecute” = “autocheck autochk *”|“OODBS” [“O&O Software GmbH”] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “E:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\SOFTWARE\Classes*\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ jetAudio(Default) = “{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}” -> {HKLM…CLSID} = “JetFlExt Class” \InProcServer32(Default) = “d:\Program Files\JetAudio\JetFlExt.dll” [“COWON America”] UltraISO(Default) = “{AD392E40-428C-459F-961E-9B147782D099}” -> {HKLM…CLSID} = “UIContextMenu Class” \InProcServer32(Default) = “e:\Program Files\UltraISO\isoshell.dll” [“EZB Systems, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] {D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}(Default) = “{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}” -> {HKLM…CLSID} = “Wyślij na Fotosik.pl” \InProcServer32(Default) = “e:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL” [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ FineReader8(Default) = “{F7091C74-EBB1-49D7-94C7-FE4886CCC18D}” -> {HKLM…CLSID} = “FineReader8ExplorerContextMenuHandler” \InProcServer32(Default) = “D:\Program Files\ABBYY FineReader 8.0 Professional Edition\FECMenu.dll” [“ABBYY Software”] jetAudio(Default) = “{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}” -> {HKLM…CLSID} = “JetFlExt Class” \InProcServer32(Default) = “d:\Program Files\JetAudio\JetFlExt.dll” [“COWON America”] UltraISO(Default) = “{AD392E40-428C-459F-961E-9B147782D099}” -> {HKLM…CLSID} = “UIContextMenu Class” \InProcServer32(Default) = “e:\Program Files\UltraISO\isoshell.dll” [“EZB Systems, Inc.”] UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “d:\Program Files\Unlocker\UnlockerCOM.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” -> {HKLM…CLSID} = “UnlockerShellExtension” \InProcServer32(Default) = “d:\Program Files\Unlocker\UnlockerCOM.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoLowDiscSpaceChecks” = (REG_BINARY) hex:00 00 00 00 00 00 F0 3F {unrecognized setting} HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\ “NoFindFiles” = (REG_DWORD) dword:0x00000001 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “GiyxDaniello” & “All Users” startup folders: -------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “F-Secure Anti-Virus 2006” -> shortcut to: “D:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe -startup” [“F-Secure Internet Security 2005”] “Launchy” -> shortcut to: “D:\Program Files\Launchy\Launchy.exe” [“Code Jelly”] Enabled Scheduled Tasks: ------------------------ “AppleSoftwareUpdate” -> launches: “C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task” [“Apple Inc.”] “Scheduled scanning task” -> launches: "d:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exe /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=d:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt " [“F-Secure Corporation”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID{942EFF30-F610-413E-854B-DDDEA0E78A1E}(Default) = “Mpire Bar” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\Program Files\Mpire\Mpire Plugin\MPBand.dll” [null data] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {300DB664-75B5-47C0-8B45-A44ACCF73C00}\ “ButtonText” = “Osłona programu IE” “MenuText” = “Osłona programu IE…” “CLSIDExtension” = “{0928F506-07E8-470c-979D-147C296D4879}” -> {HKLM…CLSID} = “F-Secure IE Shield COM button” \InProcServer32(Default) = “d:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll” [“F-Secure Corporation”] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ “MenuText” = “@xpsp3res.dll,-20001” “Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] F-Secure Anti-Virus 2006, BackWeb Plug-in - 4476822, “d:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE” [“F-Secure Internet Security 2005”] F-Secure Anti-Virus Firewall Daemon, FSDFWD, ““d:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe”” [“F-Secure Corporation”] F-Secure Management Agent, FSMA, ““d:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE”” [“F-Secure Corporation”] fsbwsys, fsbwsys, ““d:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe”” [“F-Secure Corp.”] FSGKHS, F-Secure Gatekeeper Handler Starter, ““d:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe”” [“F-Secure Corporation”] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe”” [MS] O&O Defrag, O&O Defrag, “C:\WINDOWS\system32\oodag.exe” [“O&O Software GmbH”] Pml Driver HPZ12, Pml Driver HPZ12, “C:\WINDOWS\system32\HPZipm12.exe” [“HP”] Windows Driver Foundation - User-mode Driver Framework, WudfSvc, “C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup” {“C:\WINDOWS\System32\WUDFSvc.dll” [MS]} Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ HP Standard TCP/IP Port\Driver = “HpTcpMon.dll” [“Hewlett Packard”] hpzlnt12\Driver = “hpzlnt12.dll” [“HP”] ---------- (launch time: 2007-12-21 11:30:11) <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 22 seconds. ---------- (total run time: 88 seconds)

[Gutek]

Pobierz program SDFix

[daniel105 (Daniello Daniel)]

oto raport :

SDFix: Version 1.119 Run by GiyxDaniello on 2007-12-22 at 14:30 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\DOCUME~1\GIYXDA~1\Pulpit\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-22 14:35:04 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] “s1”=dword:cb9f94f0 “s2”=dword:36c5ea43 “h0”=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] “p0”=“d:\Program Files\DAEMON Tools” “h0”=dword:00000000 “khjeh”=hex:bc,d0,06,73,e9,b7,18,90,18,84,56,fb,67,78,8b,58,fe,bd,8e,a6,ea,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] “a0”=hex:20,01,00,00,71,dc,c4,c0,be,3c,f2,6d,51,5f,4d,48,af,43,03,45,d7,… “khjeh”=hex:f6,0a,e0,f8,c3,70,6e,0c,6b,cb,06,52,9d,df,3c,3b,5b,90,01,02,54,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] “khjeh”=hex:53,69,c8,55,d6,03,97,35,19,ea,9c,aa,1b,ec,46,76,c2,ab,d6,42,00,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] “p0”=“d:\Program Files\DAEMON Tools” “h0”=dword:00000000 “khjeh”=hex:bc,d0,06,73,e9,b7,18,90,18,84,56,fb,67,78,8b,58,fe,bd,8e,a6,ea,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] “a0”=hex:20,01,00,00,71,dc,c4,c0,be,3c,f2,6d,51,5f,4d,48,af,43,03,45,d7,… “khjeh”=hex:f6,0a,e0,f8,c3,70,6e,0c,6b,cb,06,52,9d,df,3c,3b,5b,90,01,02,54,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] “khjeh”=hex:53,69,c8,55,d6,03,97,35,19,ea,9c,aa,1b,ec,46,76,c2,ab,d6,42,00,… scanning hidden registry entries … [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System] “OODEFRAG08.00.00.01WORKSTATION”=“774900F3C68F42DFA193BC064F76683BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933BA7FD869164D67948EDD5E5BE2F6E667A2D97226D213B555447DAA5BA46DBA59AB979AABA11B6006CC3AA69FA960E0CCEA1AAC1D79B065A6D222FD8962156FC147AA29589D24DC143BC8A126F41BAA0662A52AEC33038C2809691BBA6BD857F545B3EE078CDBB9AEEF2CA10EC35946BFF11765BEB50E4534E280A0BBFD9DE4BEEFF93EE608923052A2624F83AE6FD0C3DEC2F9DFB6D232054F363C1A0D2CE0E80563FA67607748F87A8CE2F70398BBDEDFA516E41FB5C7D8337E342ABD2FE341B3FEA0BB18A0652319712BA13F724AE21E5EFEA08DFB507467F1DE02EBB85D9E237DB9DDE8873A570D7B8BF61B001727BB2F8AAE53D2E91C364C29FEA6BB10D6E9326909BC89CC9D5FB679B8FBA70E02C87F24ED75C7069AE1EC14BC2E9293451798E4BC3467FA810856FDE580B36FD4CC594A7F2E50E9401B593321FA7851CA2BCAF33D2247F31575AF3A43785251FDC46D92C96AC2305E0D3730D2B68C88CA1A0C76940DB3BBEB8ABDDDDAE7171CE59E8D22F74BD947CB535445BBC0D54C2C4E405B0CB117299F9C9CB07A88760B743C2F36F627B66F647B9EC30D2B3B045BA370A8B600C4694B75908CB146CBB11776EF1BF708DB3E058C2C8FB83C096947EC48F7659AF2FA91547D5ED6C0D672C0170D37732A301F91FDB322F5EEEF0CE36D9A76B3D8B83296E96DAB824E3786E6DDE901A28000CEEF391085BE7084CD2ADEDBE47BC7163702DC8F871276F5FA827D8D0283AFF9608BA1C35C54A43FE593EDA4995D25EA840047359D26757BB1121DA25C5890B137D209F059B923FB5F203CB2FC3E657BEB44B5542C253C975D16D6F7C0A6319F0E3739DF4634B47B98D45EE40CC530F38F00AD0684B76F7C09153B81763A549DF331ECFBFDD057E244B8DD4159DF5FDFE76E21090F4A67BF8F19CCD35B20EDEA49BA5456F0DEBE39E957B6F0883D063140CAFC3F440E31DC22AE81ABDC2A282D455213A1A36ED16CE340DA41D451E33D38D51EADB2790B31C6E74668FDEDE06970F9C236AEDAAACA6007AFA18955F23D4554567F7DC36D7F545AF80BD6C8A88CA8B9ED103E3C960B63C38C2909C45D4E2D106C815A6C7D6EF99F6D3C9254C5E41F1B955013739A434312400EC8DF04F20DD31AA7923399083656684570F632A65BAD2C387FA2EAF129110CAFD0A9788FD3708D05869CD03B5F9FA79643539A69B5049B31ED31F2761665220DC0EB04EDC5BCE75527F2E8D99C9FD8C273D660A7DCB34048D94AD094DC35AECC47B2223CFA8F40757A435A9B6C029FFE7A2D1A40D157E6AAD3DD58F6A12C4DB6AA4D020ADD4521E89BDD51989E739229E8C80FF86B10” [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00 scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Wed 3 May 2006 163,328 …SHR — “C:\WINDOWS\system32\flvDX.dll” Wed 21 Feb 2007 31,744 …SHR — “C:\WINDOWS\system32\msfDX.dll” Wed 10 Oct 2007 0 A.SH. — “C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp” Finished! I był jeszcze jeden nawszelki wypade pokaże wam : catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-22 14:35:04 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] “s1”=dword:cb9f94f0 “s2”=dword:36c5ea43 “h0”=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] “p0”=“d:\Program Files\DAEMON Tools” “h0”=dword:00000000 “khjeh”=hex:bc,d0,06,73,e9,b7,18,90,18,84,56,fb,67,78,8b,58,fe,bd,8e,a6,ea,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] “a0”=hex:20,01,00,00,71,dc,c4,c0,be,3c,f2,6d,51,5f,4d,48,af,43,03,45,d7,… “khjeh”=hex:f6,0a,e0,f8,c3,70,6e,0c,6b,cb,06,52,9d,df,3c,3b,5b,90,01,02,54,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] “khjeh”=hex:53,69,c8,55,d6,03,97,35,19,ea,9c,aa,1b,ec,46,76,c2,ab,d6,42,00,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] “p0”=“d:\Program Files\DAEMON Tools” “h0”=dword:00000000 “khjeh”=hex:bc,d0,06,73,e9,b7,18,90,18,84,56,fb,67,78,8b,58,fe,bd,8e,a6,ea,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] “a0”=hex:20,01,00,00,71,dc,c4,c0,be,3c,f2,6d,51,5f,4d,48,af,43,03,45,d7,… “khjeh”=hex:f6,0a,e0,f8,c3,70,6e,0c,6b,cb,06,52,9d,df,3c,3b,5b,90,01,02,54,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] “khjeh”=hex:53,69,c8,55,d6,03,97,35,19,ea,9c,aa,1b,ec,46,76,c2,ab,d6,42,00,… scanning hidden registry entries … [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System] “OODEFRAG08.00.00.01WORKSTATION”=“774900F3C68F42DFA193BC064F76683BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933BA7FD869164D67948EDD5E5BE2F6E667A2D97226D213B555447DAA5BA46DBA59AB979AABA11B6006CC3AA69FA960E0CCEA1AAC1D79B065A6D222FD8962156FC147AA29589D24DC143BC8A126F41BAA0662A52AEC33038C2809691BBA6BD857F545B3EE078CDBB9AEEF2CA10EC35946BFF11765BEB50E4534E280A0BBFD9DE4BEEFF93EE608923052A2624F83AE6FD0C3DEC2F9DFB6D232054F363C1A0D2CE0E80563FA67607748F87A8CE2F70398BBDEDFA516E41FB5C7D8337E342ABD2FE341B3FEA0BB18A0652319712BA13F724AE21E5EFEA08DFB507467F1DE02EBB85D9E237DB9DDE8873A570D7B8BF61B001727BB2F8AAE53D2E91C364C29FEA6BB10D6E9326909BC89CC9D5FB679B8FBA70E02C87F24ED75C7069AE1EC14BC2E9293451798E4BC3467FA810856FDE580B36FD4CC594A7F2E50E9401B593321FA7851CA2BCAF33D2247F31575AF3A43785251FDC46D92C96AC2305E0D3730D2B68C88CA1A0C76940DB3BBEB8ABDDDDAE7171CE59E8D22F74BD947CB535445BBC0D54C2C4E405B0CB117299F9C9CB07A88760B743C2F36F627B66F647B9EC30D2B3B045BA370A8B600C4694B75908CB146CBB11776EF1BF708DB3E058C2C8FB83C096947EC48F7659AF2FA91547D5ED6C0D672C0170D37732A301F91FDB322F5EEEF0CE36D9A76B3D8B83296E96DAB824E3786E6DDE901A28000CEEF391085BE7084CD2ADEDBE47BC7163702DC8F871276F5FA827D8D0283AFF9608BA1C35C54A43FE593EDA4995D25EA840047359D26757BB1121DA25C5890B137D209F059B923FB5F203CB2FC3E657BEB44B5542C253C975D16D6F7C0A6319F0E3739DF4634B47B98D45EE40CC530F38F00AD0684B76F7C09153B81763A549DF331ECFBFDD057E244B8DD4159DF5FDFE76E21090F4A67BF8F19CCD35B20EDEA49BA5456F0DEBE39E957B6F0883D063140CAFC3F440E31DC22AE81ABDC2A282D455213A1A36ED16CE340DA41D451E33D38D51EADB2790B31C6E74668FDEDE06970F9C236AEDAAACA6007AFA18955F23D4554567F7DC36D7F545AF80BD6C8A88CA8B9ED103E3C960B63C38C2909C45D4E2D106C815A6C7D6EF99F6D3C9254C5E41F1B955013739A434312400EC8DF04F20DD31AA7923399083656684570F632A65BAD2C387FA2EAF129110CAFD0A9788FD3708D05869CD03B5F9FA79643539A69B5049B31ED31F2761665220DC0EB04EDC5BCE75527F2E8D99C9FD8C273D660A7DCB34048D94AD094DC35AECC47B2223CFA8F40757A435A9B6C029FFE7A2D1A40D157E6AAD3DD58F6A12C4DB6AA4D020ADD4521E89BDD51989E739229E8C80FF86B10” [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00 scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0

[Gutek]

Powinno być Ok

[daniel105 (Daniello Daniel)]

dzięki wszystkim już jest dobrze i Wesołych Świąt wszystkim.