Problem:Trojan.Win32.bho.q, not-a-virus:AdWare.Win32.Virtum

Kamelio · 24 Kwiecień 2007 17:22

Witam

Gutek · 24 Kwiecień 2007 17:42

usuń wpisy HJT

Daj log z Combofix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Kamelio · 24 Kwiecień 2007 19:01

Usunąłem wpisy z HijackThis, a tu log z Comfix:

“Kamil” - 07-04-24 20:27:32 Dodatek Service Pack 2 ComboFix 07-04-25.1V - Running from: “D:” (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\efcdcyy.dll C:\WINDOWS\system32\efcywwx.dll C:\WINDOWS\system32\mljkjjj.dll C:\WINDOWS\system32\rqrqpqn.dll C:\WINDOWS\system32\rqrrpnl.dll C:\WINDOWS\system32\ayadd.bak1 C:\WINDOWS\system32\ayadd.ini2 C:\WINDOWS\system32\ayadd.tmp C:\WINDOWS\system32\ddaya.dll C:\WINDOWS\system32\efcdbcd.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\ipwindows\ipwins.dll C:\Program Files\ipwindows\ipwins.exe C:\Program Files\ipwindows\UnInstall.exe C:\WINDOWS\system32\bund1\temp.txt C:\WINDOWS\hosts C:\Program Files\ipwindows C:\WINDOWS\system32\bund1 ((((((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\nm -------\NwSapAgent -------\LEGACY_NWSAPAGENT ((((((((((((((((((((((((((((((( Files Created from 2007-03-24 to 2007-04-24 )))))))))))))))))))))))))))))))))) 2007-04-23 19:26 266,930 --a------ C:\WINDOWS\system32\vtutu.dll 2007-04-23 18:56 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-04-23 18:56 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-04-23 18:54 2007-04-23 18:54 2007-04-23 18:53 3,152,160 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-04-23 18:53 18,464 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-04-23 18:48 2007-04-23 17:19 492,104 —hs---- C:\WINDOWS\system32\acbeg.bak2 2007-04-23 17:18 492,131 —hs---- C:\WINDOWS\system32\acbeg.ini2 2007-04-22 23:01 2007-04-22 21:06 491,891 —hs---- C:\WINDOWS\system32\acbeg.bak1 2007-04-22 20:53 2007-04-16 22:33 2007-04-16 22:33 2007-04-15 21:28 2007-04-15 15:51 2007-04-13 16:24 2007-03-29 18:47 99,328 --a------ C:\WINDOWS\system32\srusd.dll 2007-03-29 18:47 71,680 --a------ C:\WINDOWS\system32\fnfilter.dll 2007-03-29 18:47 6,912 --a------ C:\WINDOWS\system32\drivers\serscan.sys 2007-03-24 13:02 2007-03-24 10:54 2007-03-24 08:49 465,869 —hs---- C:\WINDOWS\system32\mlnmp.bak1 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-24 20:47 -------- d-------- C:\Program Files\kalendarz xp 2007-04-24 16:43 -------- d-------- C:\Program Files\odkurzacz 2007-04-24 16:40 -------- d-------- C:\Program Files\eraser 2007-04-24 13:47 -------- d-------- C:\Program Files\mozilla thunderbird 2007-04-22 22:54 -------- d-------- C:\Program Files\opera 2007-04-22 22:28 -------- d-------- C:\Program Files\dap 2007-04-21 22:44 -------- d-------- C:\Program Files\jetaudio 2007-04-16 21:42 -------- d-------- C:\Program Files\spamihilator 2007-04-11 16:32 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\skype 2007-03-29 11:01 5326 --a------ C:\WINDOWS\mozver.dat 2007-03-28 18:10 -------- d-------- C:\Program Files\quicktime 2007-03-28 18:10 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\deepburner 2007-03-28 18:10 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\bittorrent 2007-03-25 10:50 83000 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-25 10:50 469050 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-24 13:02 -------- d-------- C:\Program Files\skype 2007-03-21 22:08 -------- d-------- C:\Program Files\edgard 2007-03-17 17:35 10 --a------ C:\WINDOWS\popcinfo.dat 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-15 12:50 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\gretech 2007-03-15 12:49 -------- d-------- C:\Program Files\gretech 2007-03-14 17:45 -------- d-------- C:\Program Files\ivo 2007-03-10 22:13 -------- d-------- C:\Program Files\vanbasco’s karaoke player 2007-03-10 22:13 -------- d-------- C:\Program Files\switch off 2007-03-10 22:13 -------- d-------- C:\Program Files\real alternative 2007-03-10 22:13 -------- d-------- C:\Program Files\messenger 2007-03-10 22:13 -------- d-------- C:\Program Files\gadu-gadu 2007-03-09 20:52 200768 --a------ C:\WINDOWS\system32\klogon.dll 2007-03-08 21:19 -------- d-------- C:\Program Files\flvplayer 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-05 21:44 -------- d-------- C:\Program Files\subedit-player 2007-03-03 21:39 110360 --a------ C:\WINDOWS\system32\drivers\kl1.sys 2007-03-01 23:55 -------- d-------- C:\Program Files\total video converter 2007-03-01 20:26 -------- d-------- C:\Program Files\bitcomet 2007-03-01 20:26 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\utorrent 2007-02-28 14:32 2560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-02-28 11:09 -------- d-------- C:\Program Files\bt engine 2007-02-27 10:28 -------- d-------- C:\Program Files\smartdraw 7 2007-02-20 19:48 0 --a------ C:\WINDOWS\nsreg.dat 2007-02-17 22:38 249347 --a------ C:\WINDOWS\alcohol_toolbar_uninstaller_4859.exe 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll 2007-01-24 16:27 255848 --a------ C:\WINDOWS\system32\xactengine2_6.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll {52D06F97-5511-43FA-8FDA-C481864FD26E} C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll {B6F49926-BFDC-4631-832A-AC9B17C912B5} C:\WINDOWS\system32\gebca.dll [x] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “IgfxTray”=“C:\WINDOWS\system32\igfxtray.exe” “DAEMON Tools”="“C:\Program Files\DAEMON Tools\daemon.exe” -lang 1045" “AVP”="“C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe”" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “Gadwin PrintScreen 3.5”=“C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash” “Eraser”=“C:\Program Files\Eraser\eraser.exe -hide” “SpeedX”=“C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe” “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” “thebat_startup”=“C:\Program Files\The Bat!\thebat.exe /minimize” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSetTaskBar”=dword:00000000 “NoSetFolders”=dword:00000000 “Noclose”=dword:00000000 “NoFavoritesMenu”=dword:00000000 “NoRecentDocsMenu”=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] “UPnPMonitor”="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebca [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] “appinit_dlls”=“C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll” HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ backup-20070424-201126-186 O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file) backup-20070424-201126-469 O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm backup-20070424-201126-552 O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi … jhtml?p=ZN Contents of the ‘Scheduled Tasks’ folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-04-24 20:50:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-24 20:51:04 - machine was rebooted C:\ComboFix-quarantined-files.txt … 07-04-24 20:51

Gutek · 24 Kwiecień 2007 19:19

Użyj VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone i po ym daj nowy log z Combo

Kamelio · 24 Kwiecień 2007 20:59

Zrobione, Combo log:

“Kamil” - 07-04-24 22:44:29 Dodatek Service Pack 2 ComboFix 07-04-25.1V - Running from: “C:\Documents and Settings\Kamil” ((((((((((((((((((((((((((((((( Files Created from 2007-03-24 to 2007-04-24 )))))))))))))))))))))))))))))))))) 2007-04-24 20:51 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-04-23 19:26 266,930 --a------ C:\WINDOWS\system32\vtutu.dll 2007-04-23 18:56 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-04-23 18:56 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-04-23 18:54 2007-04-23 18:54 2007-04-23 18:53 3,261,472 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-04-23 18:53 23,840 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-04-23 18:48 2007-04-23 17:19 492,104 —hs---- C:\WINDOWS\system32\acbeg.bak2 2007-04-23 17:18 492,131 —hs---- C:\WINDOWS\system32\acbeg.ini2 2007-04-22 23:01 2007-04-22 21:06 491,891 —hs---- C:\WINDOWS\system32\acbeg.bak1 2007-04-22 20:53 2007-04-16 22:33 2007-04-16 22:33 2007-04-15 21:28 2007-04-15 15:51 2007-04-13 16:24 2007-03-29 18:47 99,328 --a------ C:\WINDOWS\system32\srusd.dll 2007-03-29 18:47 71,680 --a------ C:\WINDOWS\system32\fnfilter.dll 2007-03-29 18:47 6,912 --a------ C:\WINDOWS\system32\drivers\serscan.sys 2007-03-24 13:02 2007-03-24 10:54 2007-03-24 08:49 465,869 —hs---- C:\WINDOWS\system32\mlnmp.bak1 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-24 22:46 -------- d-------- C:\Program Files\kalendarz xp 2007-04-24 16:43 -------- d-------- C:\Program Files\odkurzacz 2007-04-24 16:40 -------- d-------- C:\Program Files\eraser 2007-04-24 13:47 -------- d-------- C:\Program Files\mozilla thunderbird 2007-04-22 22:54 -------- d-------- C:\Program Files\opera 2007-04-22 22:28 -------- d-------- C:\Program Files\dap 2007-04-21 22:44 -------- d-------- C:\Program Files\jetaudio 2007-04-16 21:42 -------- d-------- C:\Program Files\spamihilator 2007-04-11 16:32 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\skype 2007-03-29 11:01 5326 --a------ C:\WINDOWS\mozver.dat 2007-03-28 18:10 -------- d-------- C:\Program Files\quicktime 2007-03-28 18:10 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\deepburner 2007-03-28 18:10 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\bittorrent 2007-03-25 10:50 83000 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-25 10:50 469050 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-24 13:02 -------- d-------- C:\Program Files\skype 2007-03-21 22:08 -------- d-------- C:\Program Files\edgard 2007-03-17 17:35 10 --a------ C:\WINDOWS\popcinfo.dat 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-15 12:50 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\gretech 2007-03-15 12:49 -------- d-------- C:\Program Files\gretech 2007-03-14 17:45 -------- d-------- C:\Program Files\ivo 2007-03-10 22:13 -------- d-------- C:\Program Files\vanbasco’s karaoke player 2007-03-10 22:13 -------- d-------- C:\Program Files\switch off 2007-03-10 22:13 -------- d-------- C:\Program Files\real alternative 2007-03-10 22:13 -------- d-------- C:\Program Files\messenger 2007-03-10 22:13 -------- d-------- C:\Program Files\gadu-gadu 2007-03-09 20:52 200768 --a------ C:\WINDOWS\system32\klogon.dll 2007-03-08 21:19 -------- d-------- C:\Program Files\flvplayer 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-05 21:44 -------- d-------- C:\Program Files\subedit-player 2007-03-03 21:39 110360 --a------ C:\WINDOWS\system32\drivers\kl1.sys 2007-03-01 23:55 -------- d-------- C:\Program Files\total video converter 2007-03-01 20:26 -------- d-------- C:\Program Files\bitcomet 2007-03-01 20:26 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\utorrent 2007-02-28 14:32 2560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-02-28 11:09 -------- d-------- C:\Program Files\bt engine 2007-02-27 10:28 -------- d-------- C:\Program Files\smartdraw 7 2007-02-20 19:48 0 --a------ C:\WINDOWS\nsreg.dat 2007-02-17 22:38 249347 --a------ C:\WINDOWS\alcohol_toolbar_uninstaller_4859.exe 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll 2007-01-24 16:27 255848 --a------ C:\WINDOWS\system32\xactengine2_6.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll {52D06F97-5511-43FA-8FDA-C481864FD26E} C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “IgfxTray”=“C:\WINDOWS\system32\igfxtray.exe” “DAEMON Tools”="“C:\Program Files\DAEMON Tools\daemon.exe” -lang 1045" “AVP”="“C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe”" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “Gadwin PrintScreen 3.5”=“C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash” “Eraser”=“C:\Program Files\Eraser\eraser.exe -hide” “SpeedX”=“C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe” “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” “thebat_startup”=“C:\Program Files\The Bat!\thebat.exe /minimize” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSetTaskBar”=dword:00000000 “NoSetFolders”=dword:00000000 “Noclose”=dword:00000000 “NoFavoritesMenu”=dword:00000000 “NoRecentDocsMenu”=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] “UPnPMonitor”="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] “appinit_dlls”=“C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll” HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 Contents of the ‘Scheduled Tasks’ folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-04-24 22:51:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-24 22:51:53 C:\ComboFix-quarantined-files.txt … 07-04-24 22:51 C:\ComboFix2.txt … 07-04-24 20:51

Gutek · 24 Kwiecień 2007 21:27

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\nircmd.exe

C:\WINDOWS\system32\vtutu.dll

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

Kamelio · 25 Kwiecień 2007 06:01

Dzięki za żetelną pomoc , wszytsko hula ok .

adam9870 · 25 Kwiecień 2007 08:05

Proszę wkleić nowy log z Combo.

Kamelio · 25 Kwiecień 2007 10:36

Log combo:

“Kamil” - 07-04-25 12:24:51 Dodatek Service Pack 2 ComboFix 07-04-25.4V - Running from: “C:\Documents and Settings\Kamil” ((((((((((((((((((((((((((((((( Files Created from 2007-03-25 to 2007-04-25 )))))))))))))))))))))))))))))))))) 2007-04-25 07:31 2007-04-23 18:56 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-04-23 18:56 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-04-23 18:54 2007-04-23 18:54 2007-04-23 18:53 30,240 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-04-23 18:53 3,377,952 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-04-23 18:48 2007-04-23 17:19 492,104 —hs---- C:\WINDOWS\system32\acbeg.bak2 2007-04-23 17:18 492,131 —hs---- C:\WINDOWS\system32\acbeg.ini2 2007-04-22 23:01 2007-04-22 21:06 491,891 —hs---- C:\WINDOWS\system32\acbeg.bak1 2007-04-22 20:53 2007-04-16 22:33 2007-04-16 22:33 2007-04-15 21:28 2007-04-15 15:51 2007-04-13 16:24 2007-03-29 18:47 99,328 --a------ C:\WINDOWS\system32\srusd.dll 2007-03-29 18:47 71,680 --a------ C:\WINDOWS\system32\fnfilter.dll 2007-03-29 18:47 6,912 --a------ C:\WINDOWS\system32\drivers\serscan.sys (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-25 12:29 -------- d-------- C:\Program Files\kalendarz xp 2007-04-25 08:19 -------- d-------- C:\Program Files\eraser 2007-04-24 16:43 -------- d-------- C:\Program Files\odkurzacz 2007-04-24 13:47 -------- d-------- C:\Program Files\mozilla thunderbird 2007-04-22 22:54 -------- d-------- C:\Program Files\opera 2007-04-22 22:28 -------- d-------- C:\Program Files\dap 2007-04-21 22:44 -------- d-------- C:\Program Files\jetaudio 2007-04-16 21:42 -------- d-------- C:\Program Files\spamihilator 2007-04-11 16:32 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\skype 2007-03-29 11:01 5326 --a------ C:\WINDOWS\mozver.dat 2007-03-28 18:10 -------- d-------- C:\Program Files\quicktime 2007-03-28 18:10 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\deepburner 2007-03-28 18:10 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\bittorrent 2007-03-25 10:50 83000 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-25 10:50 469050 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-24 13:02 -------- d-------- C:\Program Files\skype 2007-03-24 13:02 -------- d-------- C:\Program Files\Common Files\skype 2007-03-24 10:54 -------- d-------- C:\Program Files\hexelon max 6 2007-03-24 08:49 465869 —hs---- C:\WINDOWS\system32\mlnmp.bak1 2007-03-21 22:08 -------- d-------- C:\Program Files\edgard 2007-03-17 17:35 10 --a------ C:\WINDOWS\popcinfo.dat 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-15 12:50 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\gretech 2007-03-15 12:49 -------- d-------- C:\Program Files\gretech 2007-03-14 17:45 -------- d-------- C:\Program Files\ivo 2007-03-10 22:13 -------- d-------- C:\Program Files\vanbasco’s karaoke player 2007-03-10 22:13 -------- d-------- C:\Program Files\switch off 2007-03-10 22:13 -------- d-------- C:\Program Files\real alternative 2007-03-10 22:13 -------- d-------- C:\Program Files\messenger 2007-03-10 22:13 -------- d-------- C:\Program Files\gadu-gadu 2007-03-09 20:52 200768 --a------ C:\WINDOWS\system32\klogon.dll 2007-03-08 21:19 -------- d-------- C:\Program Files\flvplayer 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-05 21:44 -------- d-------- C:\Program Files\subedit-player 2007-03-03 21:39 110360 --a------ C:\WINDOWS\system32\drivers\kl1.sys 2007-03-01 23:55 -------- d-------- C:\Program Files\total video converter 2007-03-01 20:26 -------- d-------- C:\Program Files\bitcomet 2007-03-01 20:26 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\utorrent 2007-02-28 14:32 2560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-02-28 11:09 -------- d-------- C:\Program Files\bt engine 2007-02-27 10:28 -------- d-------- C:\Program Files\smartdraw 7 2007-02-20 19:48 0 --a------ C:\WINDOWS\nsreg.dat 2007-02-17 22:38 249347 --a------ C:\WINDOWS\alcohol_toolbar_uninstaller_4859.exe 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll {52D06F97-5511-43FA-8FDA-C481864FD26E} C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “IgfxTray”=“C:\WINDOWS\system32\igfxtray.exe” “DAEMON Tools”="“C:\Program Files\DAEMON Tools\daemon.exe” -lang 1045" “AVP”="“C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe”" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “Gadwin PrintScreen 3.5”=“C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash” “Eraser”=“C:\Program Files\Eraser\eraser.exe -hide” “SpeedX”=“C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe” “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” “thebat_startup”=“C:\Program Files\The Bat!\thebat.exe /minimize” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSetTaskBar”=dword:00000000 “NoSetFolders”=dword:00000000 “Noclose”=dword:00000000 “NoFavoritesMenu”=dword:00000000 “NoRecentDocsMenu”=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] “UPnPMonitor”="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] “appinit_dlls”=“C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll” HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 Contents of the ‘Scheduled Tasks’ folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-04-25 12:32:15 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-25 12:32:30 C:\ComboFix-quarantined-files.txt … 07-04-25 12:32 C:\ComboFix2.txt … 07-04-24 22:51 C:\ComboFix3.txt … 07-04-24 20:51

adam9870 · 25 Kwiecień 2007 10:43

Ściągnij program KillBox, zaznacz Delete on reboot , w polu full path of file wklej ścieżki:

C:\WINDOWS\system32\acbeg.bak2

C:\WINDOWS\system32\acbeg.ini2

C:\WINDOWS\system32\acbeg.bak1

C:\WINDOWS\system32\mlnmp.bak1

Po wklejeniu każdej ścieżki z osobna kliknij na czerwonego iksa, ale dopiero po wklejeniu ostatniej zgódź się na restart.

Po wykonaniu możesz wkleić dla pewności nowy log z Combo.

Kamelio · 25 Kwiecień 2007 11:14

log:

“Kamil” - 07-04-25 13:01:41 Dodatek Service Pack 2 ComboFix 07-04-25.4V - Running from: “C:\Documents and Settings\Kamil” ((((((((((((((((((((((((((((((( Files Created from 2007-03-25 to 2007-04-25 )))))))))))))))))))))))))))))))))) 2007-04-25 12:32 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-04-25 07:31 2007-04-23 18:56 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-04-23 18:56 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-04-23 18:54 2007-04-23 18:54 2007-04-23 18:53 33,312 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-04-23 18:53 3,449,632 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-04-23 18:48 2007-04-23 17:18 492,131 —hs---- C:\WINDOWS\system32\acbeg.ini2 2007-04-22 23:01 2007-04-22 21:06 491,891 —hs---- C:\WINDOWS\system32\acbeg.bak1 2007-04-22 20:53 2007-04-16 22:33 2007-04-16 22:33 2007-04-15 21:28 2007-04-15 15:51 2007-04-13 16:24 2007-03-29 18:47 99,328 --a------ C:\WINDOWS\system32\srusd.dll 2007-03-29 18:47 71,680 --a------ C:\WINDOWS\system32\fnfilter.dll 2007-03-29 18:47 6,912 --a------ C:\WINDOWS\system32\drivers\serscan.sys (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-25 13:08 -------- d-------- C:\Program Files\kalendarz xp 2007-04-25 12:55 -------- d-------- C:\Program Files\eraser 2007-04-24 16:43 -------- d-------- C:\Program Files\odkurzacz 2007-04-24 13:47 -------- d-------- C:\Program Files\mozilla thunderbird 2007-04-22 22:54 -------- d-------- C:\Program Files\opera 2007-04-22 22:28 -------- d-------- C:\Program Files\dap 2007-04-21 22:44 -------- d-------- C:\Program Files\jetaudio 2007-04-16 21:42 -------- d-------- C:\Program Files\spamihilator 2007-04-11 16:32 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\skype 2007-03-29 11:01 5326 --a------ C:\WINDOWS\mozver.dat 2007-03-28 18:10 -------- d-------- C:\Program Files\quicktime 2007-03-28 18:10 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\deepburner 2007-03-28 18:10 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\bittorrent 2007-03-25 10:50 83000 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-25 10:50 469050 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-24 13:02 -------- d-------- C:\Program Files\skype 2007-03-24 13:02 -------- d-------- C:\Program Files\Common Files\skype 2007-03-24 10:54 -------- d-------- C:\Program Files\hexelon max 6 2007-03-24 08:49 465869 —hs---- C:\WINDOWS\system32\mlnmp.bak1 2007-03-21 22:08 -------- d-------- C:\Program Files\edgard 2007-03-17 17:35 10 --a------ C:\WINDOWS\popcinfo.dat 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-15 12:50 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\gretech 2007-03-15 12:49 -------- d-------- C:\Program Files\gretech 2007-03-14 17:45 -------- d-------- C:\Program Files\ivo 2007-03-10 22:13 -------- d-------- C:\Program Files\vanbasco’s karaoke player 2007-03-10 22:13 -------- d-------- C:\Program Files\switch off 2007-03-10 22:13 -------- d-------- C:\Program Files\real alternative 2007-03-10 22:13 -------- d-------- C:\Program Files\messenger 2007-03-10 22:13 -------- d-------- C:\Program Files\gadu-gadu 2007-03-09 20:52 200768 --a------ C:\WINDOWS\system32\klogon.dll 2007-03-08 21:19 -------- d-------- C:\Program Files\flvplayer 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-05 21:44 -------- d-------- C:\Program Files\subedit-player 2007-03-03 21:39 110360 --a------ C:\WINDOWS\system32\drivers\kl1.sys 2007-03-01 23:55 -------- d-------- C:\Program Files\total video converter 2007-03-01 20:26 -------- d-------- C:\Program Files\bitcomet 2007-03-01 20:26 -------- d-------- C:\DOCUME~1\Kamil\DANEAP~1\utorrent 2007-02-28 14:32 2560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-02-28 11:09 -------- d-------- C:\Program Files\bt engine 2007-02-27 10:28 -------- d-------- C:\Program Files\smartdraw 7 2007-02-20 19:48 0 --a------ C:\WINDOWS\nsreg.dat 2007-02-17 22:38 249347 --a------ C:\WINDOWS\alcohol_toolbar_uninstaller_4859.exe 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll {52D06F97-5511-43FA-8FDA-C481864FD26E} C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “IgfxTray”=“C:\WINDOWS\system32\igfxtray.exe” “DAEMON Tools”="“C:\Program Files\DAEMON Tools\daemon.exe” -lang 1045" “AVP”="“C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe”" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “Gadwin PrintScreen 3.5”=“C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash” “Eraser”=“C:\Program Files\Eraser\eraser.exe -hide” “SpeedX”=“C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe” “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” “thebat_startup”=“C:\Program Files\The Bat!\thebat.exe /minimize” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSetTaskBar”=dword:00000000 “NoSetFolders”=dword:00000000 “Noclose”=dword:00000000 “NoFavoritesMenu”=dword:00000000 “NoRecentDocsMenu”=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] “UPnPMonitor”="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] “appinit_dlls”=“C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll” HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 Contents of the ‘Scheduled Tasks’ folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-04-25 13:11:41 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-25 13:12:08 C:\ComboFix-quarantined-files.txt … 07-04-25 13:12 C:\ComboFix2.txt … 07-04-25 12:32 C:\ComboFix3.txt … 07-04-24 22:51

Gutek · 25 Kwiecień 2007 14:11

jeszcze usuń oraz po wszystkim C:!KillBox i będzie Ok

Kamelio · 25 Kwiecień 2007 15:20

Dzięki Wielkie za pomoc!

PS. Mam jeszcze laptopa podłączonego pod to samo gniazdo do sieci za pomocą switcha. Nie mam na nim zainstalowanego jeszcze Kaspersky, tylko poprzedni program antywirusowy, który nie wykrywał tych niechcianych połączeń na moim kompie stacjonarnym. Mam pytanie: Czy najpierw zainstalować nowy program antywirusowy i gdyby sie coś działo to zrobić log z HijackThis, czy zrobić go już teraz i dołączyć do tematu, gdyż jest duże prawdopodobieństwo, że mój komp stacjonarny zainfekował laptopa??

Gutek · 25 Kwiecień 2007 15:23

Wrzuć logi z HJT + Silent z laptopa

Kamelio · 25 Kwiecień 2007 15:37

Co to znaczy “Silent z laptopa”??

Log z HJT

Logfile of HijackThis v1.99.1 Scan saved at 17:32:00, on 2007-04-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\acer\epm\epm-dm.exe C:\Program Files\Lexmark 3300 Series\lxccmon.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Spamihilator\spamihilator.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Kalendarz XP\Kalendarz.exe C:\Program Files\OpenOffice.ux.pl 2.0.2\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.0.2\program\soffice.BIN C:\Acer\eManager\anbmServ.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\lxcccoms.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp\winamp.exe C:\Documents and Settings\Marta\Pulpit\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM…\Run: [epm-dm] c:\acer\epm\epm-dm.exe O4 - HKLM…\Run: [lxccmon.exe] “C:\Program Files\Lexmark 3300 Series\lxccmon.exe” O4 - HKLM…\Run: [FaxCenterServer] “C:\Program Files\Lexmark Fax Solutions\fm3032.exe” /s O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16 O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKCU…\Run: [spamihilator] “C:\Program Files\Spamihilator\spamihilator.exe” O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - Startup: OpenOffice.ux.pl 2.0.2.lnk = C:\Program Files\OpenOffice.ux.pl 2.0.2\program\quickstart.exe O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

adam9870 · 25 Kwiecień 2007 15:44

Log czysty.

To znaczy, że masz wkleić komplet logów (hijack + silent) z laptopa, ponieważ napisałeś:

Kamelio · 25 Kwiecień 2007 16:03

log z Silent:

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Spamihilator” = ““C:\Program Files\Spamihilator\spamihilator.exe”” [“Michel Krämer”] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “updateMgr” = “c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9” [“Adobe Systems Incorporated”] “Odkurzacz-MCD” = “C:\Program Files\Odkurzacz\odk_mcd.exe” [“Franmo Software”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “epm-dm” = “c:\acer\epm\epm-dm.exe” [“Acer Inc”] “lxccmon.exe” = ““C:\Program Files\Lexmark 3300 Series\lxccmon.exe”” [“Lexmark International, Inc.”] “FaxCenterServer” = ““C:\Program Files\Lexmark Fax Solutions\fm3032.exe” /s” [null data] “nod32kui” = ““C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE” ["Eset "] “LXCCCATS” = “rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16” [MS] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “WinampAgent” = “C:\Program Files\Winamp\winampa.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Spybot - Search & Destroy\SDHelper.dll” [“Safer Networking Limited”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{2F603045-309F-11CF-9774-0020AFD0CFF6}” = “Synaptics Control Panel” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Synaptics\SynTP\SynTPCpl.dll” [“Synaptics, Inc.”] “{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0}” = “EPM-PO Shell Extension” -> {HKLM…CLSID} = “EPM-PO Shell Extensions” \InProcServer32(Default) = “epm-po.dll” [“Acer Labs USA”] “{23170F69-40C1-278A-1000-000100020000}” = “7-Zip Shell Extension” -> {HKLM…CLSID} = “7-Zip Shell Extension” \InProcServer32(Default) = “C:\Program Files\7-Zip\7-zip.dll” [“Igor Pavlov”] “{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}” = “OpenOffice.org Column Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{087B3AE3-E237-4467-B8DB-5A38AB959AC9}” = “OpenOffice.org Infotip Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{63542C48-9552-494A-84F7-73AA6A7C99C1}” = “OpenOffice.org Property Sheet Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{3B092F0C-7696-40E3-A80F-68D74DA84210}” = “OpenOffice.org Thumbnail Viewer” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{23F0DC38-DC86-49D6-81EC-40C54A204212}” = “ZEN Nano Plus Media Explorer” -> {HKLM…CLSID} = “ZEN Nano Plus Media Explorer” \InProcServer32(Default) = “D:\Gry\mateusz\zen\ZEN Nano Plus Media Explorer\CTMvnsu.dll” [“Creative Technology Ltd”] “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” = “NOD32 Context Menu Shell Extension” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> igfxcui\DLLName = “igfxdev.dll” [“Intel Corporation”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}(Default) = “OpenOffice.org Column Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ 7-Zip(Default) = “{23170F69-40C1-278A-1000-000100020000}” -> {HKLM…CLSID} = “7-Zip Shell Extension” \InProcServer32(Default) = “C:\Program Files\7-Zip\7-zip.dll” [“Igor Pavlov”] NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip(Default) = “{23170F69-40C1-278A-1000-000100020000}” -> {HKLM…CLSID} = “7-Zip Shell Extension” \InProcServer32(Default) = “C:\Program Files\7-Zip\7-zip.dll” [“Igor Pavlov”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Marta\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\sspipes.scr” [MS] Startup items in “Marta” & “All Users” startup folders: ------------------------------------------------------- C:\Documents and Settings\Marta\Menu Start\Programy\Autostart “OpenOffice.ux.pl 2.0.2” -> shortcut to: “C:\Program Files\OpenOffice.ux.pl 2.0.2\program\quickstart.exe” [null data] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Kalendarz XP” -> shortcut to: “C:\Program Files\Kalendarz XP\Kalendarz.exe” [null data] “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\system32\wshbth.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 22 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}” -> {HKLM…CLSID} = “Java Plug-in 1.6.0_01” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll” [“Sun Microsystems, Inc.”] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Bluetooth Support Service, BthServ, “C:\WINDOWS\system32\svchost.exe -k bthsvcs” {“C:\WINDOWS\System32\bthserv.dll” [MS]} Creative Service for CDROM Access, Creative Service for CDROM Access, “C:\WINDOWS\system32\CTsvcCDA.exe” [“Creative Technology Ltd”] lxcc_device, lxcc_device, “C:\WINDOWS\system32\lxcccoms.exe -service” [“Lexmark International, Inc.”] NOD32 Kernel Service, NOD32krn, ““C:\Program Files\Eset\nod32krn.exe”” ["Eset "] Notebook Manager Service, anbmService, “C:\Acer\eManager\anbmServ.exe” [“OSA Technologies Inc.”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ 3300 Series Port\Driver = “lxcclmpm.DLL” [“Lexmark International, Inc.”] Lexmark Print-2-Fax Port\Driver = “LXPRMON.DLL” [null data] Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] Microsoft Shared Fax Monitor\Driver = “FXSMON.DLL” [MS] PDFCreator\Driver = “pdfcmnnt.dll” [null data] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 70 seconds. ---------- (total run time: 149 seconds)

adam9870 · 25 Kwiecień 2007 17:09

Log czysty.

Na koniec możesz przeskanować system którymś z tych skanerów on-line:

http://www.ewido.net/en/onlinescan/

http://www.kaspersky.pl/virusscanner.html

Kamelio · 25 Kwiecień 2007 18:09

Jeszcze raz DZIĘKI

Złączono Posta : 26.04.2007 (Czw) 10:52

Mam jeszcze pytanie. Wczoraj użyłem skanera ewido i wykrył mi taki plik “TrackingCookie.Gemius”. Usunąłem go, a dzisiaj po kolejnym odpaleniu skanera ewido, wyżej wymieniony plik znowu był na kompie. CO to może być?