Proszę o sprawdzenie loga-podejrzane procesy

_ro · 16 Październik 2007 19:54

Zauważyłem kilka podejrzanych procesów. Dlatego proszę o sprawdzenie loga:

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:55:56, on 2007-10-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe E:\Program Files\Azureus\Azureus.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\Program Files\Winamp\winamp.exe C:\Program Files\Microsoft Office\OFFICE11\FRONTPG.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe E:\Program Files\totalcmd\TOTALCMD.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: ads_optimizer - {26E45419-7205-4fac-BBFE-174BC7337A79} - C:\WINDOWS\system32\nss505.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM…\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM…\Run: [soundMAX] “C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” /tray O4 - HKLM…\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [Device Detector] DevDetect.exe -autorun O4 - HKLM…\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O17 - HKLM\System\CS1\Services\Tcpip…{0666E7A5-B956-48F9-9282-6A31D4059065}: NameServer = 212.85.112.32,193.110.121.20 O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe – End of file - 4782 bytes

Gutek · 16 Październik 2007 21:14

Daj log z ComboFix

_ro · 19 Październik 2007 11:32

* Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\nss505.dll . ((((((((((((((((((((((((( Files Created from 2007-09-17 to 2007-10-17 ))))))))))))))))))))))))))))))) . 2007-10-17 07:29 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-16 21:41 2007-10-16 21:39 2007-10-16 21:39 2007-10-16 21:39 2007-10-15 13:05 79,832 --a------ C:\WINDOWS\system32\adssite-remove.exe 2007-10-15 13:05 40,733 --a------ C:\WINDOWS\system32\rightonadz-uninst.exe 2007-10-14 21:25 2007-10-14 18:02 2007-10-14 14:27 2007-10-14 11:50 2007-10-14 10:33 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-10-14 10:33 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-10-14 10:33 15,104 --a–c— C:\WINDOWS\system32\dllcache\usbscan.sys 2007-10-14 10:33 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-10-12 08:05 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-10-12 00:12 2007-10-12 00:11 2007-10-11 23:21 2007-10-11 23:13 2007-10-11 23:13 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2007-10-11 21:59 1,156 --a------ C:\WINDOWS\mozver.dat 2007-10-11 21:57 2007-10-11 21:57 0 --a------ C:\WINDOWS\nsreg.dat 2007-10-11 21:52 2007-10-11 21:50 2007-10-11 21:50 180,224 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2007-10-11 21:50 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-10-11 21:48 11,264 -ra------ C:\WINDOWS\system32\drivers\EIO.sys 2007-10-10 12:24 63,488 --a------ C:\WINDOWS\system32\gzmrotate.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-16 21:13 --------- d-----w C:\Documents and Settings\Arek\Dane aplikacji\Azureus 2007-10-12 06:18 --------- d-----w C:\Program Files\Java 2007-10-11 21:48 --------- d-----w C:\Documents and Settings\Arek\Dane aplikacji\LimeWire 2007-10-11 21:22 --------- d-----w C:\Documents and Settings\Arek\Dane aplikacji\Winamp 2007-10-11 21:21 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-11 20:47 --------- d-----w C:\Program Files\Winamp Toolbar 2007-10-11 20:47 --------- d-----w C:\Program Files\Winamp Remote 2007-10-11 20:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2007-10-11 20:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2007-10-11 20:46 --------- d-----w C:\Program Files\Common Files\Java 2007-10-11 20:44 --------- d-----w C:\Program Files\Realtek 2007-10-11 20:35 --------- d-----w C:\Program Files\Analog Devices 2007-10-11 20:29 --------- d-----w C:\Program Files\Intel 2007-10-11 20:17 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-11 20:15 --------- d-----w C:\Program Files\Usługi online 2007-10-11 19:48 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-07-29 16:51 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-07-25 14:24 1,559,040 ----a-w C:\WINDOWS\system32\xvidcore.dll 2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] “{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}”= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\CLSID{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] “{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}”= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\CLSID{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SoundMAXPnP”=“C:\Program Files\Analog Devices\Core\smax4pnp.exe” [2006-05-01 12:07] “SoundMAX”=“C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” [2006-04-10 09:19] “JMB36X Configure”=“C:\WINDOWS\system32\JMRaidTool.exe” [2006-06-02 10:45] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-02-13 15:05] “nwiz”=“nwiz.exe” [2006-02-13 15:05 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-02-13 15:05] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2002-01-01 22:04] “Device Detector”=“DevDetect.exe” [] “MSConfig”=“C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe” [2004-08-04 00:44] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] “E:\Program Files\BearShare\BearShare.exe” /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] “E:\Program Files\Gadu-Gadu\gg.exe” /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] “C:\Program Files\Winamp Remote\bin\OrbTray.exe” /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza] “E:\Program Files\Shareaza\Shareaza.exe” -tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] “E:\Program Files\Winamp\winampa.exe” R0 JGOGO;JMicron Hot-Plug Driver;C:\WINDOWS\system32\DRIVERS\JGOGO.sys R0 JRAID;JRAID;C:\WINDOWS\system32\DRIVERS\jraid.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{4eeb9561-feee-11d5-bb2f-00173185abfc}] Auto\command - G:\activexdebugger32.exe f AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f explore\Command - G:\activexdebugger32.exe f open\Command - G:\activexdebugger32.exe f [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{7c864ded-0d42-11d6-a03c-806d6172696f}] AutoRun\command - D:\ASUSACPI.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-17 07:31:27 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-17 7:31:48 - machine was rebooted . — E O F —