Problem z Win32:ConHook-CA [Trj]

[BloodAris (Agaszcz24)]

Witam mam straszny problem z tym koniem trojańskim niemoge go usunać a ciagle zaraża nowe pliki prosze pomużcie.

[Gutek]

Daj logi z HJT + Silenta - viewtopic.php?f=16&t=36654

[BloodAris (Agaszcz24)]

Logfile of HijackThis v1.99.1 Scan saved at 18:52:13, on 2007-12-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe G:\Avast\aswUpdSv.exe G:\Avast\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\UAService7.exe G:\Avast\ashDisp.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE G:\Avast\ashMaiSv.exe G:\Avast\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Opera\Opera.exe G:\Avast\ashSimpl.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Documents and Settings\BloodAngel\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Ulubione O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {AEBF6926-DBA6-4100-A838-1CED0169AB78} - C:\WINDOWS\system32\gebbbba.dll O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O4 - HKLM…\Run: [avast!] G:\Avast\ashDisp.exe O4 - HKLM…\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent O4 - HKLM…\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe O4 - HKLM…\Run: [ZoneAlarm Client] “G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [startCCC] “C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” O4 - HKLM…\Run: [QuickTime Task] “G:\Program Files\Quic\QTTask.exe” -atboottime O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [DAEMON Tools Pro Agent] “G:\Program Files\DAEMON Tools Pro\DTProAgent.exe” O4 - Startup: The Matrix_ Path of Neo Registration.lnk = C:\Documents and Settings\BloodAngel\Ustawienia lokalne\Temp{270FFF70-EF56-4021-9416-F66D4E34C1A0}{E571E8B1-9771-465D-9DE0-3BA2D1BDAE99}\ATR1.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://G:\Office\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra ‘Tools’ menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: gebbbba - C:\WINDOWS\SYSTEM32\gebbbba.dll O20 - Winlogon Notify: ssqopqn - ssqopqn.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - G:\Avast\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - G:\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - G:\Avast\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - G:\Avast\ashWebSv.exe" /service (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - G:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - G:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

[BloodAris (Agaszcz24)]

“Silent Runners.vbs”, revision 55, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “DAEMON Tools Pro Agent” = ““G:\Program Files\DAEMON Tools Pro\DTProAgent.exe”” [file not found] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “avast!” = “G:\Avast\ashDisp.exe” [“ALWIL Software”] “BluetoothAuthenticationAgent” = “rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent” [MS] “HydraVisionDesktopManager” = “C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe” [“ATI Technologies Inc.”] “ZoneAlarm Client” = ““G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe”” [“Zone Labs, LLC”] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “RTHDCPL” = “RTHDCPL.EXE” [“Realtek Semiconductor Corp.”] “Alcmtr” = “ALCMTR.EXE” [“Realtek Semiconductor Corp.”] “StartCCC” = ““C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe”” [null data] “QuickTime Task” = ““G:\Program Files\Quic\QTTask.exe” -atboottime” [“Apple Inc.”] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}(Default) = “IE7 Uninstall Stub” \StubPath = “C:\WINDOWS\system32\ieudinit.exe” [MS] >{26923b43-4d38-484f-9b9e-de460746276c}(Default) = “Internet Explorer” \StubPath = “C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE” [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AEBF6926-DBA6-4100-A838-1CED0169AB78}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\gebbbba.dll” [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” -> {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll” [“Alcohol Soft Development Team”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “G:\Avast\ashShell.dll” [“ALWIL Software”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “G:\Office\Office10\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “G:\Office\Office10\msohev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}” = “NeroCoverEd Live Icons” -> {HKLM…CLSID} = “NeroCoverEdLiveIcons Class” \InProcServer32(Default) = “G:\Nero 7\Nero CoverDesigner\CoverEdExtension.dll” [“Nero AG”] “{23170F69-40C1-278A-1000-000100020000}” = “7-Zip Shell Extension” -> {HKLM…CLSID} = “7-Zip Shell Extension” \InProcServer32(Default) = “g:\Program Files\7-Zip\7-zip.dll” [“Igor Pavlov”] “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” = “PowerISO” -> {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “G:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] “{D9872D13-7651-4471-9EEE-F0A00218BEBB}” = “Multiscan” -> {HKLM…CLSID} = “ZLAVShExt Class” \InProcServer32(Default) = “G:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll” [“Zone Labs, LLC”] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” -> {HKLM…CLSID} = “SimpleShlExt Class” \InProcServer32(Default) = “C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll” [empty string] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{AEBF6926-DBA6-4100-A838-1CED0169AB78}” = “*o” (unwritable string) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\gebbbba.dll” [null data] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] <> gebbbba\DLLName = “gebbbba.dll” [null data] <> ssqopqn\DLLName = “ssqopqn.dll” [file not found] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\SOFTWARE\Classes*\shellex\ContextMenuHandlers\ 7-Zip(Default) = “{23170F69-40C1-278A-1000-000100020000}” -> {HKLM…CLSID} = “7-Zip Shell Extension” \InProcServer32(Default) = “g:\Program Files\7-Zip\7-zip.dll” [“Igor Pavlov”] avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “G:\Avast\ashShell.dll” [“ALWIL Software”] Cover Designer(Default) = “{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}” -> {HKLM…CLSID} = “NeroCoverEdContextMenu Class” \InProcServer32(Default) = “G:\Nero 7\Nero CoverDesigner\CoverEdExtension.dll” [“Nero AG”] PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” -> {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “G:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] ZLAVShExt(Default) = “{D9872D13-7651-4471-9EEE-F0A00218BEBB}” -> {HKLM…CLSID} = “ZLAVShExt Class” \InProcServer32(Default) = “G:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll” [“Zone Labs, LLC”] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip(Default) = “{23170F69-40C1-278A-1000-000100020000}” -> {HKLM…CLSID} = “7-Zip Shell Extension” \InProcServer32(Default) = “g:\Program Files\7-Zip\7-zip.dll” [“Igor Pavlov”] PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” -> {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “G:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “G:\Avast\ashShell.dll” [“ALWIL Software”] PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” -> {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “G:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] ZLAVShExt(Default) = “{D9872D13-7651-4471-9EEE-F0A00218BEBB}” -> {HKLM…CLSID} = “ZLAVShExt Class” \InProcServer32(Default) = “G:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll” [“Zone Labs, LLC”] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoLowDiskSpaceChecks” = (REG_DWORD) dword:0x00000001 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “NoInternetOpenWith” = (REG_DWORD) dword:0x00000001 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\BloodAngel\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “BloodAngel” & “All Users” startup folders: ------------------------------------------------------------ C:\Documents and Settings\BloodAngel\Menu Start\Programy\Autostart “The Matrix_ Path of Neo Registration” -> shortcut to: “C:\Documents and Settings\BloodAngel\Ustawienia lokalne\Temp{270FFF70-EF56-4021-9416-F66D4E34C1A0}{E571E8B1-9771-465D-9DE0-3BA2D1BDAE99}\ATR1.exe /remind /language=PLK /PRNM=“The Matrix: Path of Neo” /PRMP=“MPON” /SKUN=“PCXX” /GTYP=“ACTN”” [file not found] Enabled Scheduled Tasks: ------------------------ “HPpromotions journeysoftware” -> launches: “C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N “journeysoftware” -r” [“hp”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\system32\wshbth.dll” [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 19 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ “{0D704FAD-66E9-4F0A-BFED-4F665770DDB3}” = (no title provided) -> {HKLM…CLSID} = “&Tłumaczenie” \InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID{175556B1-4D91-4E9A-9C4B-D6888D5DEE6C}(Default) = “&Ramka Tłumaczenia” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] HKLM\SOFTWARE\Classes\CLSID{D553F157-2AB0-4B46-98D2-7BA7CA418491}(Default) = “&Słownik Podręczny” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.5.0_11” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_11” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll” [“Sun Microsystems, Inc.”] {B46B0919-62BA-4D99-A5C4-916B57A6805C}\ “MenuText” = “@C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103” “CLSIDExtension” = “{B46B0919-62BA-4D99-A5C4-916B57A6805C}” -> {HKLM…CLSID} = “InternetTranslatorProperties Class” \InProcServer32(Default) = “C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll” [“Techland”] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ “MenuText” = “@xpsp3res.dll,-20001” “Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] avast! Antivirus, avast! Antivirus, ““G:\Avast\ashServ.exe”” [“ALWIL Software”] avast! iAVS4 Control Service, aswUpdSv, ““G:\Avast\aswUpdSv.exe”” [“ALWIL Software”] avast! Mail Scanner, avast! Mail Scanner, ““G:\Avast\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““G:\Avast\ashWebSv.exe” /service” [“ALWIL Software”] Bluetooth Support Service, BthServ, “C:\WINDOWS\system32\svchost.exe -k bthsvcs” {“C:\WINDOWS\System32\bthserv.dll” [MS]} Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe”” [MS] Pml Driver HPZ12, Pml Driver HPZ12, “C:\WINDOWS\system32\HPZipm12.exe” [“HP”] SecuROM User Access Service (V7), UserAccess7, “C:\WINDOWS\system32\UAService7.exe” [“Sony DADC Austria AG.”] StarWind iSCSI Service, StarWindService, “C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe” [“Rocket Division Software”] StyleXPService, StyleXPService, ““C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe”” [empty string] TrueVector Internet Monitor, vsmon, “C:\WINDOWS\system32\ZONELABS\vsmon.exe -service” [“Zone Labs, LLC”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ HP Standard TCP/IP Port\Driver = “HpTcpMon.dll” [“Hewlett Packard”] Language Monitor\Driver = “hpz3l3xu.dll” [“Hewlett-Packard Company”] ---------- (launch time: 2007-12-13 18:56:39) <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 70 seconds. ---------- (total run time: 121 seconds)

[Gutek]

O2 - BHO: (no name) - {AEBF6926-DBA6-4100-A838-1CED0169AB78} - C:\WINDOWS\system32\gebbbba.dll O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O20 - Winlogon Notify: gebbbba - C:\WINDOWS\SYSTEM32\gebbbba.dll O20 - Winlogon Notify: ssqopqn - ssqopqn.dll (file missing)

usuń wpisy HJT

Użyj VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone.

Daj log z ComboFix

[BloodAris (Agaszcz24)]

Nie moge usunąć

O2 - BHO: (no name) - {AEBF6926-DBA6-4100-A838-1CED0169AB78} - C:\WINDOWS\system32\gebbbba.dll

O20 - Winlogon Notify: gebbbba - C:\WINDOWS\SYSTEM32\gebbbba.dll

VundoFix=0

Trojan.Vundo Removal Tool=0

VirtumundoBeGone.=0

Nic nie znalazły.

Podaje log z ComboFix

“BloodAris” - 2007-12-14 18:02:07 - ComboFix 07-06-27.7 - Dodatek Service Pack 2 ((((((((((((((((((((((((( Files Created from 2007-11-14 to 2007-12-14 ))))))))))))))))))))))))))))))) 2007-12-14 18:01 2007-12-12 22:09 2007-12-12 22:08 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-12 22:08 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-12 22:08 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-12 22:08 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-12 22:08 2007-12-12 22:06 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-12 16:29 37,376 --a------ C:\WINDOWS\system32\gebbbba.dll.vir 2007-11-27 16:08 2007-11-25 15:03 2007-11-18 09:32 2007-11-18 09:32 2007-11-18 09:25 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-18 09:18 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll 2007-11-18 09:18 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-11-18 09:18 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2007-11-18 09:18 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-11-18 09:18 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2007-11-18 09:18 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-11-18 09:18 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-11-18 09:18 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll 2007-11-18 09:18 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-12-13 20:59:50 12 ----a-w C:\WINDOWS\bthservsdp.dat 2007-12-12 22:09:56 79,188 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-12-12 22:09:56 457,678 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-12-04 14:56:02 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55:46 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53:40 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51:52 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49:02 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04:28 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54:04 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-18 09:18:52 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys 2007-11-13 10:25:56 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-30 19:28:02 -------- d-----w C:\Program Files\Common Files\Skype 2007-10-30 17:15:36 -------- d-----w C:\DOCUME~1\BLOODA~1\DANEAP~1\OpenOffice.org2 2007-10-30 17:14:34 -------- d-----w C:\Program Files\OpenOffice.org 2.3 2007-10-29 22:44:30 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-26 17:15:58 -------- d-----w C:\Program Files\Common Files\YDP 2007-10-21 15:54:58 -------- d-----w C:\DOCUME~1\BLOODA~1\DANEAP~1\TwoWorldsCP 2007-10-21 11:59:48 0 ----a-w C:\WINDOWS\ativpsrm.bin 2007-10-20 06:01:32 227,328 ------w C:\WINDOWS\system32\wmasf.dll 2007-10-20 00:56:16 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-10-20 00:56:04 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-10-20 00:56:04 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-10-20 00:54:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-10-20 00:54:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-10-19 13:37:48 -------- d-----w C:\Program Files\Apple Software Update 2007-10-18 21:19:14 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-10-18 09:03:08 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-10-18 09:03:08 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-10-18 09:03:08 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-10-18 09:03:08 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-10-18 09:03:08 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-10-18 09:03:08 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-09-29 04:21:30 9,854,976 ----a-w C:\WINDOWS\system32\atioglx2.dll 2007-09-29 04:07:24 356,352 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2007-09-29 04:06:18 268,800 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2007-09-29 03:58:36 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2007-09-29 03:58:24 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2007-09-29 03:58:16 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2007-09-29 03:58:08 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2007-09-29 03:57:56 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2007-09-29 03:56:34 483,328 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2007-09-29 03:55:44 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2007-09-29 03:49:20 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2007-09-29 03:47:40 172,032 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2007-09-29 03:47:28 3,130,720 ----a-w C:\WINDOWS\system32\ati3duag.dll 2007-09-29 03:36:26 1,593,600 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2007-09-29 03:36:06 972,072 ----a-w C:\WINDOWS\system32\ativva6x.dat 2007-09-29 03:36:06 3,107,788 ----a-w C:\WINDOWS\system32\ativva5x.dat 2007-09-29 03:23:24 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll 2007-09-29 03:22:10 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll 2007-09-29 03:20:16 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2007-09-29 03:14:16 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2007-09-28 21:05:00 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2007-09-27 14:20:18 16,844,800 ----a-w C:\WINDOWS\RTHDCPL.exe 2007-09-26 19:34:02 28 ----a-w C:\WINDOWS\kmcdfa2200.dat 2007-09-22 18:59:36 42,720 ----a-w C:\DOCUME~1\BLOODA~1\DANEAP~1\GDIPFONTCACHEV1.DAT ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 01:56] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 03:23] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“G:\Avast\ashDisp.exe” [2007-12-04 13:00] “BluetoothAuthenticationAgent”=“bthprops.cpl” [2004-08-04 00:44 C:\WINDOWS\system32\bthprops.cpl] “HydraVisionDesktopManager”=“C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe” [2003-09-15 21:00] “ZoneAlarm Client”=“G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-03-09 01:02] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” [2006-12-15 03:23] “RTHDCPL”=“RTHDCPL.EXE” [2007-09-27 14:20 C:\WINDOWS\RTHDCPL.exe] “StartCCC”=“C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” [2006-11-10 12:35] “QuickTime Task”=“G:\Program Files\Quic\QTTask.exe” [2007-06-29 06:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoLowDiskSpaceChecks”=1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Image Zone Fast Start.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Image Zone Fast Start.lnk backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Live! Cam Manager] C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CreativeTaskScheduler] “C:\Program Files\Creative\Shared Files\CTSched.exe” /logon [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DefragTaskBar] “G:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] G:\PROGRAMY\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] “m:\steam\steam.exe” -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “NBService”=3 (0x3) “BlueSoleil Hid Service”=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs BthServ Contents of the ‘Scheduled Tasks’ folder 2007-12-14 16:00:02 C:\WINDOWS\tasks\HPpromotions journeysoftware.job ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-14 18:03:27 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services{00001000-0000-1000-8000-00805f9b34fb}] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services{00001115-0000-1000-8000-00805f9b34fb}] Files hidden from API: C:\WINDOWS\BĄbelki.bmp C:\WINDOWS\Indiaäski pled.bmp C:\WINDOWS\system32\Pokaľ kanay.scf Completion time: 2007-12-14 18:04:27 C:\ComboFix2.txt … 2007-06-27 15:03 — E O F —

[Gutek]

Wklej do Notatnika:

File:: C:\WINDOWS\system32\gebbbba.dll.vir

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo

[BloodAris (Agaszcz24)]

Wykonane

Jak narazie niepojawia się żadna informacja o dalszym infekowaniu plików

nowy log

“BloodAris” - 2007-12-15 13:39:41 - ComboFix 07-06-27.7 - Dodatek Service Pack 2 ((((((((((((((((((((((((( Files Created from 2007-11-15 to 2007-12-15 ))))))))))))))))))))))))))))))) 2007-12-14 18:01 2007-12-12 22:09 2007-12-12 22:08 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-12 22:08 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-12 22:08 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-12 22:08 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-12 22:08 2007-12-12 22:06 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-12 16:29 37,376 --a------ C:\WINDOWS\system32\gebbbba.dll.vir 2007-11-27 16:08 2007-11-25 15:03 2007-11-18 09:32 2007-11-18 09:32 2007-11-18 09:25 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-18 09:18 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll 2007-11-18 09:18 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-11-18 09:18 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2007-11-18 09:18 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-11-18 09:18 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2007-11-18 09:18 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-11-18 09:18 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-11-18 09:18 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll 2007-11-18 09:18 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-12-15 13:31:40 12 ----a-w C:\WINDOWS\bthservsdp.dat 2007-12-12 22:09:56 79,188 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-12-12 22:09:56 457,678 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-12-04 14:56:02 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55:46 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53:40 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51:52 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49:02 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04:28 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54:04 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-18 09:18:52 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys 2007-11-13 10:25:56 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-30 19:28:02 -------- d-----w C:\Program Files\Common Files\Skype 2007-10-30 17:15:36 -------- d-----w C:\DOCUME~1\BLOODA~1\DANEAP~1\OpenOffice.org2 2007-10-30 17:14:34 -------- d-----w C:\Program Files\OpenOffice.org 2.3 2007-10-29 22:44:30 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-26 17:15:58 -------- d-----w C:\Program Files\Common Files\YDP 2007-10-21 15:54:58 -------- d-----w C:\DOCUME~1\BLOODA~1\DANEAP~1\TwoWorldsCP 2007-10-21 11:59:48 0 ----a-w C:\WINDOWS\ativpsrm.bin 2007-10-20 06:01:32 227,328 ------w C:\WINDOWS\system32\wmasf.dll 2007-10-20 00:56:16 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-10-20 00:56:04 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-10-20 00:56:04 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-10-20 00:54:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-10-20 00:54:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-10-19 13:37:48 -------- d-----w C:\Program Files\Apple Software Update 2007-10-18 21:19:14 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-10-18 09:03:08 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-10-18 09:03:08 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-10-18 09:03:08 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-10-18 09:03:08 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-10-18 09:03:08 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-10-18 09:03:08 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-09-29 04:21:30 9,854,976 ----a-w C:\WINDOWS\system32\atioglx2.dll 2007-09-29 04:07:24 356,352 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2007-09-29 04:06:18 268,800 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2007-09-29 03:58:36 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2007-09-29 03:58:24 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2007-09-29 03:58:16 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2007-09-29 03:58:08 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2007-09-29 03:57:56 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2007-09-29 03:56:34 483,328 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2007-09-29 03:55:44 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2007-09-29 03:49:20 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2007-09-29 03:47:40 172,032 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2007-09-29 03:47:28 3,130,720 ----a-w C:\WINDOWS\system32\ati3duag.dll 2007-09-29 03:36:26 1,593,600 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2007-09-29 03:36:06 972,072 ----a-w C:\WINDOWS\system32\ativva6x.dat 2007-09-29 03:36:06 3,107,788 ----a-w C:\WINDOWS\system32\ativva5x.dat 2007-09-29 03:23:24 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll 2007-09-29 03:22:10 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll 2007-09-29 03:20:16 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2007-09-29 03:14:16 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2007-09-28 21:05:00 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2007-09-27 14:20:18 16,844,800 ----a-w C:\WINDOWS\RTHDCPL.exe 2007-09-26 19:34:02 28 ----a-w C:\WINDOWS\kmcdfa2200.dat 2007-09-22 18:59:36 42,720 ----a-w C:\DOCUME~1\BLOODA~1\DANEAP~1\GDIPFONTCACHEV1.DAT ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 01:56] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 03:23] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“G:\Avast\ashDisp.exe” [2007-12-04 13:00] “BluetoothAuthenticationAgent”=“bthprops.cpl” [2004-08-04 00:44 C:\WINDOWS\system32\bthprops.cpl] “HydraVisionDesktopManager”=“C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe” [2003-09-15 21:00] “ZoneAlarm Client”=“G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-03-09 01:02] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” [2006-12-15 03:23] “RTHDCPL”=“RTHDCPL.EXE” [2007-09-27 14:20 C:\WINDOWS\RTHDCPL.exe] “StartCCC”=“C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” [2006-11-10 12:35] “QuickTime Task”=“G:\Program Files\Quic\QTTask.exe” [2007-06-29 06:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44] “DAEMON Tools Pro Agent”=“G:\Program Files\DAEMON Tools Pro\DTProAgent.exe” [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoLowDiskSpaceChecks”=1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Image Zone Fast Start.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Image Zone Fast Start.lnk backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Live! Cam Manager] C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CreativeTaskScheduler] “C:\Program Files\Creative\Shared Files\CTSched.exe” /logon [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DefragTaskBar] “G:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] G:\PROGRAMY\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] “m:\steam\steam.exe” -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “NBService”=3 (0x3) “BlueSoleil Hid Service”=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs BthServ Contents of the ‘Scheduled Tasks’ folder 2007-12-15 12:00:02 C:\WINDOWS\tasks\HPpromotions journeysoftware.job ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-15 13:40:46 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services{00001000-0000-1000-8000-00805f9b34fb}] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services{00001115-0000-1000-8000-00805f9b34fb}] Files hidden from API: C:\WINDOWS\BĄbelki.bmp C:\WINDOWS\Indiaäski pled.bmp C:\WINDOWS\system32\Pokaľ kanay.scf Completion time: 2007-12-15 13:41:40 C:\ComboFix3.txt … 2007-12-14 18:04 — E O F —