Witam serdecznie!
W systemie pojawił się jakiś wirus tzn. m.in. przeglądarka przekierowuje na stronę z programem antywirusowym, na pulpicie pojawił się komunikat: WARNING dangerous spyware. Zamieszczam loga z ComboFix
Bardzo prosze analizę i pomoc. Z góry dziękuję, pozdrawiam!
ComboFix 08-12-01.03 - x 2008-12-02 21:19:16.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.433 [GMT 1:00]
Uruchomiony z: c:\documents and settings\x\Pulpit\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\docume~1\x\USTAWI~1\Temp\tmp1.tmp
c:\docume~1\x\USTAWI~1\Temp\tmp2.tmp
c:\windows\system32\ddcYoLEW.dll
c:\windows\system32\edytjprw.ini
c:\windows\system32\ggwewtxd.dll
c:\windows\system32\mlJDvTkH.dll
c:\windows\system32\oxrjez.dll
c:\windows\system32\WELoYcdd.ini
c:\windows\system32\WELoYcdd.ini2
c:\windows\system32\wrpjtyde.dll
c:\windows\Tasks\lzvyfvsu.job
.
((((((((((((((((((((((((( Pliki utworzone od 2008-11-02 do 2008-12-02 )))))))))))))))))))))))))))))))
.
2008-12-02 20:14 . 2008-12-02 20:14
2008-12-02 20:11 . 2008-12-02 20:11
2008-12-02 19:55 . 2008-12-02 19:55
2008-12-02 18:41 . 2008-12-02 21:18 4,785 --a------ c:\windows\system32\warning.gif
2008-12-02 18:41 . 2008-12-02 21:18 1,349 --a------ c:\windows\system32\ahtn.htm
2008-12-02 18:40 . 2008-12-02 18:40 38,400 --a------ c:\windows\system32\urqOffEX.dll
2008-12-02 18:40 . 2008-11-27 13:19 32,256 --a------ c:\windows\system32\frmwrk32.exe
2008-12-02 18:40 . 2008-12-02 18:41 1 --a------ c:\windows\system32\uniq.tll
2008-12-02 18:40 . 2008-12-02 18:40 1 --a------ c:\windows\system32\test.ttt
2008-11-28 20:17 . 2008-11-28 20:17
2008-11-28 20:17 . 2008-11-28 20:17 4,350,416 --a------ c:\program files\gg77.exe
2008-11-26 10:58 . 2008-11-26 10:58 297,697 --a------ c:\windows\system32\SpywareRemover.exe
2008-11-22 23:06 . 2008-11-22 23:06
2008-11-22 22:13 . 2008-11-22 22:14
2008-11-13 19:55 . 2008-10-24 12:10 453,632 -----c— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-03 18:24 . 2008-11-03 18:24
2008-11-03 18:24 . 2008-11-03 18:24 940,794 --a------ c:\windows\system32\LoopyMusic.wav
2008-11-03 18:24 . 2008-11-03 18:24 146,650 --a------ c:\windows\system32\BuzzingBee.wav
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-02 19:10 23,335,936 ----a-w c:\program files\ess_trial_nt32_plk.msi
2008-12-02 17:46 --------- d-----w c:\program files\eMule
2008-11-28 17:57 --------- d-----w c:\program files\Yahoo!
2008-11-19 15:04 --------- d-----w c:\documents and settings\x\Dane aplikacji\Image Zone Express
2008-11-04 20:01 --------- d-----w c:\documents and settings\x\Dane aplikacji\U3
2008-10-24 21:38 --------- d-----w c:\program files\MSXML 4.0
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-06 15:08 --------- d-----w c:\program files\AVS4YOU
2008-10-06 15:07 --------- d—a-w c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-10-06 15:07 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2008-10-06 15:06 --------- d-----w c:\program files\Common Files\AVSMedia
2008-10-06 14:49 --------- d-----w c:\documents and settings\x\Dane aplikacji\CyberLink
2008-10-06 14:48 --------- d-----w c:\documents and settings\x\Dane aplikacji\AVS4YOU
2008-10-06 14:48 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\AVS4YOU
2008-10-06 14:39 --------- d-----w c:\program files\AskSearch
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 15:40 1,846,272 ----a-w c:\windows\system32\win32k.sys
2008-09-04 16:46 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2004-10-01 13:00 40,960 ----a-w c:\program files\Uninstall_CDS.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
2008-12-02 18:40 38400 --a------ c:\windows\system32\urqOffEX.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\ctfmon.exe” [2004-08-03 15360]
“swg”=“c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2008-05-23 68856]
“AdobeUpdater”=“c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe” [2007-03-01 2321600]
“RealAV.exe”=“c:\program files\RealAV\RealAV.exe” [2008-12-02 2573312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“avast!”=“c:\progra~1\ALWILS~1\Avast4\ashDisp.exe” [2008-11-26 81000]
“ATIPTA”=“c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-02-01 339968]
“ATICCC”=“c:\program files\ATI Technologies\ATI.ACE\cli.exe” [2005-02-01 32768]
“RemoteControl”=“c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” [2003-12-08 32768]
“NeroFilterCheck”=“c:\windows\system32\NeroCheck.exe” [2001-07-09 155648]
“Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2008-01-11 39792]
“HP Software Update”=“c:\program files\HP\HP Software Update\HPWuSchd2.exe” [2005-05-11 49152]
“SunJavaUpdateSched”=“c:\program files\Java\jre1.6.0_06\bin\jusched.exe” [2008-03-25 144784]
“REGSHAVE”=“c:\program files\REGSHAVE\REGSHAVE.EXE” [2002-02-04 53248]
“SpywareCleaner”=“c:\windows\system32\SpywareRemover.exe” [2008-11-26 297697]
“SoundMan”=“SOUNDMAN.EXE” [2008-05-08 c:\windows\soundman.exe]
“Framework Windows”=“frmwrk32.exe” [2008-11-27 c:\windows\system32\frmwrk32.exe]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2004-08-03 15360]
“ATICCC”=“c:\program files\ATI Technologies\ATI.ACE\cli.exe” [2005-02-01 32768]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-02-01 32768]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]
Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - c:\program files\SAGEM WiFi manager\WLANUTL.exe [2008-05-09 950272]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
“{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}”= “c:\windows\system32\urqOffEX.dll” [2008-12-02 38400]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqOffEX]
2008-12-02 18:40 38400 c:\windows\system32\urqOffEX.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
“AppInit_DLLs”=oxrjez.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
“UpdatesDisableNotify”=dword:00000001
“AntiVirusOverride”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hposid01.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe”=
“c:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe”=
“c:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe”=
“c:\Program Files\eMule\emule.exe”=
R0 uagp35;Filtr AGPv3.5 firmy Microsoft;c:\windows\system32\DRIVERS\uagp35.sys [2008-05-08 44672]
R0 viamraid;viamraid;c:\windows\system32\DRIVERS\viamraid.sys [2005-06-20 60928]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-05-08 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-05-08 20560]
R2 bgsvcgen;B’s Recorder GOLD Library General Service;c:\windows\system32\bgsvcgen.exe [2008-08-27 86016]
R3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet;c:\windows\system32\DRIVERS\fetnd5.sys [2008-05-08 27165]
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\DRIVERS\WlanBZXP.sys [2008-05-09 450560]
R3 ZDPSp50;ZDPSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\ZDPSp50.sys [2008-05-09 17664]
S3 MRVW225;802.11g/b Wireless LAN Dirver for Windows XP;c:\windows\system32\DRIVERS\MRVW225.sys [2008-05-08 299904]
S3 PCANDIS5;PCANDIS5 Protocol Driver;??\c:\windows\system32\PCANDIS5.SYS []
S3 ZDCndis5;ZDCndis5 Protocol Driver;??\c:\windows\system32\ZDCndis5.SYS []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{c211d2f0-269a-11dd-9dda-0060b30761b0}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Zawartość folderu ‘Zaplanowane zadania’
2008-11-30 c:\windows\Tasks\WebReg psc 1500 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2005-05-11 23:21]
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
-
-
BHO-{BE977F94-EB43-4E93-B07F-0A771BF12B80} - c:\windows\system32\ddcYoLEW.dll
BHO-{cf809a94-ad65-47ee-93c3-36c934c91e20} - c:\windows\system32\oxrjez.dll
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-02 21:21:04
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
-
-
-
-
-
-
- > ‘winlogon.exe’(812)
-
-
-
-
-
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\urqOffEX.dll
.
Czas ukończenia: 2008-12-02 21:22:03
ComboFix-quarantined-files.txt 2008-12-02 20:21:59
Przed: 26,070,728,704 bajtów wolnych
Po: 26,064,261,120 bajtów wolnych
173 — E O F — 2008-11-13 20:18:44