Przy starcie otwiera okno ekploratora WinXP

danielsan · 11 Grudzień 2007 16:47

logi

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:06:18, on 2007-12-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe C:\Program Files\Softwin\BitDefender10\bdagent.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\DOCUME~1\DiG\USTAWI~1\Temp\RtkBtMnt.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\Program Files\Softwin\BitDefender10\vsserv.exe C:\PROGRA~1\Softwin\BITDEF~1\bdlite.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM…\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM…\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM…\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [iAAnotif] “C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe” O4 - HKLM…\Run: [bDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe O4 - HKLM…\Run: [bDAgent] “C:\Program Files\Softwin\BitDefender10\bdagent.exe” O4 - HKCU…\Run: [wsctf.exe] wsctf.exe O4 - HKCU…\Run: [EXPLORER.EXE] EXPLORER.EXE O4 - HKCU…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKCU…\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra ‘Tools’ menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows … 7059838687 O17 - HKLM\System\CCS\Services\Tcpip…{7499267E-A4FD-48D6-BA61-8FF4709305AB}: NameServer = 80.244.140.241 80.244.128.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe – End of file - 5372 bytes

silent runner

“Silent Runners.vbs”, revision 54, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “wsctf.exe” = “wsctf.exe” [file not found] “EXPLORER.EXE” = “EXPLORER.EXE” [MS] “DAEMON Tools” = ““C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033” [“DT Soft Ltd.”] “SpybotSD TeaTimer” = “C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe” [“Safer Networking Limited”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SpeedTouch USB Diagnostics” = ““C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon” [“THOMSON Telecom Belgium”] “IgfxTray” = “C:\WINDOWS\system32\igfxtray.exe” [“Intel Corporation”] “HotKeysCmds” = “C:\WINDOWS\system32\hkcmd.exe” [“Intel Corporation”] “Persistence” = “C:\WINDOWS\system32\igfxpers.exe” [“Intel Corporation”] “AzMixerSel” = “C:\Program Files\Realtek\InstallShield\AzMixerSel.exe” [“Realtek Semiconductor Corp.”] “RTHDCPL” = “RTHDCPL.EXE” [“Realtek Semiconductor Corp.”] “Alcmtr” = “ALCMTR.EXE” [“Realtek Semiconductor Corp.”] “IAAnotif” = ““C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe”” [“Intel Corporation”] “BDMCon” = “C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe” [“SOFTWIN S.R.L.”] “BDAgent” = ““C:\Program Files\Softwin\BitDefender10\bdagent.exe”” [“SOFTWIN S.R.L.”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}(Default) = “flashget urlcatch” -> {HKLM…CLSID} = “FGCatchUrl” \InProcServer32(Default) = “C:\Program Files\FlashGet\jccatch.dll” [“www.flashget.com”] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = “Spybot-S&D IE Protection” \InProcServer32(Default) = “C:\PROGRA~1\SPYBOT~1\SDHelper.dll” [“Safer Networking Limited”] {F156768E-81EF-470C-9057-481BA8380DBA}(Default) = (no title provided) -> {HKLM…CLSID} = “FlashGet GetFlash Class” \InProcServer32(Default) = “C:\Program Files\FlashGet\getflash.dll” [“www.flashget.com”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ <> “AppInit_DLLs” = “sockspy.dll” [null data] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ <> “Userinit” = “userinit.exe,EXPLORER.EXE” [MS], [MS] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> igfxcui\DLLName = “igfxdev.dll” [“Intel Corporation”] HKLM\SOFTWARE\Classes*\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\DiG\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\logon.scr” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ “ButtonText” = “FlashGet” “MenuText” = “FlashGet” “Exec” = “C:\Program Files\FlashGet\FlashGet.exe” [“FlashGet.com”] {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\ “MenuText” = “Spybot - Search & Destroy Configuration” “CLSIDExtension” = “{53707962-6F74-2D53-2644-206D7942484F}” -> {HKLM…CLSID} = “Spybot-S&D IE Protection” \InProcServer32(Default) = “C:\PROGRA~1\SPYBOT~1\SDHelper.dll” [“Safer Networking Limited”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ BitDefender Communicator, XCOMM, ““C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe” /service” [“SOFTWIN S.R.L”] BitDefender Desktop Update Service, LIVESRV, ““C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe” /service” [“SOFTWIN S.R.L.”] BitDefender Virus Shield, VSSERV, ““C:\Program Files\Softwin\BitDefender10\vsserv.exe” /service” [“SOFTWIN S.R.L.”] Intel® Matrix Storage Event Monitor, IAANTMON, “C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe” [“Intel Corporation”] ---------- (launch time: 2007-12-12 17:41:24) <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 14 seconds. ---------- (total run time: 46 seconds)

bitdefender wykryl wczesniej jakieegos trojana w plike explorer.exe, ale nie zdolal go wyleczyc,

teraz tego trojana nie znajduje

pr0ton · 11 Grudzień 2007 18:39

Wg. tego: viewtopic.php?t=163316

To wirusy. Ten drugi proces jest odpowiedzialny za otwieranie explorera przy starcie.

Postąp wg. instrukcji w podanym linku, bo problem jest identyczny. Jak chcesz najpierw pliki przeskanuj na: http://www.virustotal.com/pl/

Dodatkowo:

Przez wielu ten proces uważany jest za szpiega od Realtek’a (od karty dźwiękowej)

Usun przez Fix checked w HJ, ręcznie, lub w KillBox’ie

Na koniec potraktuj system najnowszymi wersjami programów:

Ccleaner

AVG Anti-Spyware (dawne Ewido)

ComboFix (daj tu loga), info w przyklejonym temacie tego działu.

Chyba tyle, pozdrawiam

Leon1 · 11 Grudzień 2007 18:59

Dodatkowo

Otwórz notatnik i wklej do niego:

Windows Registry Editor Version 5.00


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"Userinit"="C:\WINDOWS\system32\userinit.exe,"

zapisz jako plik.reg >> wszystkie pliki >> scal z rejestrem >> restart

danielsan · 11 Grudzień 2007 19:08

log z combofix

ComboFix 07-12-12.2 - DiG 2007-12-12 19:56:40.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1468 [GMT 1:00] Running from: D:\instalki\ComboFix.exe * Created a new restore point . The following files were disabled during the run: C:\WINDOWS\system32\sockspy.dll ((((((((((((((((((((((((( Files Created from 2007-11-12 to 2007-12-12 ))))))))))))))))))))))))))))))) . 2007-12-12 18:13 . 2007-12-12 19:50 2007-12-12 18:13 . 2007-12-12 18:13 2007-12-12 18:13 . 2007-12-12 18:21 2007-12-12 18:13 . 2007-12-12 18:13 2007-12-12 18:13 . 2006-05-25 14:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll 2007-12-12 18:13 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll 2007-12-12 18:13 . 2005-08-26 00:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll 2007-12-12 18:13 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll 2007-12-12 18:13 . 2006-06-19 12:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll 2007-12-12 17:06 . 2007-12-12 17:06 2007-12-12 16:19 . 2007-12-12 16:19 2007-12-12 16:15 . 2007-12-12 16:15 2007-12-11 22:40 . 2007-12-11 22:40 2007-12-11 22:40 . 2007-12-11 22:41 2007-12-11 22:35 . 2007-12-11 22:35 2007-12-11 22:35 . 2007-12-11 22:35 2007-12-11 22:35 . 2007-12-11 22:38 2007-12-11 22:35 . 2007-12-11 22:35 2007-12-11 22:05 . 2007-12-11 22:21 2007-12-11 22:04 . 2007-12-11 22:22 2007-12-11 20:39 . 2007-12-12 18:37 2007-12-11 00:03 . 2007-12-12 19:56 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2007-12-11 00:01 . 2007-12-11 21:18 2007-12-10 22:42 . 2007-12-10 22:42 1,412 --a------ C:\WINDOWS\bestplayer.ini 2007-12-10 22:42 . 2007-12-10 22:42 29 --a------ C:\WINDOWS\bestplayer.bpp 2007-12-10 22:42 . 2007-12-10 22:42 0 --a------ C:\WINDOWS\bestplayer.bbt 2007-12-10 22:02 . 2007-12-10 22:02 2007-12-10 22:01 . 2007-12-10 22:02 2007-12-10 22:01 . 2007-12-10 22:01 2007-12-10 21:41 . 2007-12-10 21:41 2007-12-10 21:41 . 2007-07-28 09:56 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2007-12-10 21:41 . 2007-07-28 09:56 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-12-10 21:41 . 2007-07-28 09:56 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2007-12-07 21:39 . 2006-06-27 05:40 12,800 -----c— C:\WINDOWS\system32\dllcache\WgaTray.exe 2007-12-07 21:39 . 2006-06-27 05:40 3,584 -----c— C:\WINDOWS\system32\dllcache\WgaLogon.dll 2007-12-07 21:38 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2007-12-07 21:38 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2007-12-07 21:38 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2007-12-07 21:38 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2007-12-07 21:38 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2007-12-06 22:01 . 2007-12-06 22:01 2007-12-06 22:01 . 2007-12-10 23:21 1,911 --a------ C:\WINDOWS\wincmd.ini 2007-12-06 22:01 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\UC.PIF 2007-12-06 22:01 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\RAR.PIF 2007-12-06 22:01 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-12-06 22:01 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-12-06 22:01 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-12-06 22:01 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\LHA.PIF 2007-12-06 22:01 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\ARJ.PIF 2007-12-06 22:01 . 2007-12-10 22:56 190 --a------ C:\WINDOWS\wcx_ftp.ini 2007-12-06 21:47 . 2007-12-06 21:47 2007-12-06 20:52 . 2007-12-06 20:52 2007-12-06 20:41 . 2007-12-06 20:41 2007-12-06 19:51 . 2007-12-06 19:51 2007-12-06 19:43 . 2007-12-06 19:43 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-12-06 19:22 . 2007-12-06 19:22 2007-12-06 18:41 . 2007-12-06 18:41 2007-12-06 17:29 . 2007-12-12 16:49 2007-12-04 22:57 . 2007-01-25 05:44 290,304 --a------ C:\WINDOWS\system32\drivers\tifm21.sys 2007-12-04 22:37 . 2007-12-04 22:57 2007-12-04 22:37 . 2007-12-04 22:37 2007-12-04 22:28 . 2007-12-04 22:53 2007-12-04 22:13 . 2007-07-26 16:15 53,248 --a------ C:\WINDOWS\system32\CSVer.dll 2007-12-04 21:36 . 2007-12-04 21:36 2007-12-04 21:36 . 2007-12-04 21:36 2007-12-04 21:36 . 2007-04-11 15:49 126,976 --a------ C:\WINDOWS\system32\Imsmudlg.exe 2007-12-04 19:39 . 2007-02-16 15:46 160,256 -ra------ C:\WINDOWS\system32\drivers\b57xp32.sys 2007-12-04 19:39 . 2007-02-16 15:46 160,256 --a–c— C:\WINDOWS\system32\dllcache\b57xp32.sys 2007-12-04 19:19 . 2007-12-04 19:19 2007-12-03 19:31 . 2004-08-03 23:08 26,496 --a–c— C:\WINDOWS\system32\dllcache\usbstor.sys 2007-12-02 16:53 . 2007-12-02 16:53 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2007-12-02 16:53 . 2007-12-02 16:53 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2007-12-02 16:45 . 2007-12-02 16:45 2007-12-02 16:41 . 2004-08-04 00:44 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax 2007-12-02 16:41 . 2004-08-04 00:44 130,048 --a–c— C:\WINDOWS\system32\dllcache\ksproxy.ax 2007-12-02 16:41 . 2004-08-03 23:08 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-12-02 16:41 . 2004-08-03 23:08 60,288 --a–c— C:\WINDOWS\system32\dllcache\drmk.sys 2007-12-02 16:41 . 2004-08-04 00:44 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-12-02 16:41 . 2004-08-04 00:44 4,096 --a–c— C:\WINDOWS\system32\dllcache\ksuser.dll 2007-12-02 16:37 . 2007-12-02 16:37 2007-12-02 16:00 . 2005-11-17 15:36 8,064 --a------ C:\WINDOWS\system32\drivers\flash.sys 2007-12-02 15:56 . 2007-12-02 15:56 2007-12-02 15:43 . 2007-12-02 15:43 2007-12-02 00:06 . 2007-12-02 00:04 180,224 --a------ C:\WINDOWS\system32\igfxres.dll 2007-12-01 23:59 . 2007-12-06 19:51 2007-12-01 23:59 . 2007-12-04 21:36 2007-12-01 23:59 . 2007-12-01 23:59 2007-12-01 23:50 . 2007-12-01 23:50 2007-12-01 23:40 . 2007-12-01 23:40 2007-12-01 23:06 . 2007-12-01 23:06 2007-12-01 23:06 . 2007-12-04 22:38 2007-12-01 23:06 . 2007-12-04 22:37 2007-12-01 23:06 . 2003-12-08 11:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys 2007-12-01 23:06 . 2003-12-08 11:53 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys 2007-12-01 23:06 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll 2007-12-01 23:06 . 2003-12-08 11:53 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys 2007-12-01 23:06 . 2003-12-08 11:53 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys 2007-11-30 20:59 . 2007-11-30 20:59 1,548,288 --a------ C:\WINDOWS\system32\sfcfiles.dll 2007-11-30 20:58 . 2007-11-30 20:58 991,744 --a------ C:\WINDOWS\system32\syssetup.dll 2007-11-30 20:58 . 2007-03-21 12:58 304,920 --a------ C:\WINDOWS\system32\drivers\iaStor.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-02 15:37 315,392 ----a-w C:\WINDOWS\HideWin.exe 2007-12-01 23:04 910,464 ----a-w C:\WINDOWS\system32\igmedkrn.dll 2007-12-01 23:04 57,344 ----a-w C:\WINDOWS\system32\igxprd32.dll 2007-12-01 23:04 527,128 ----a-w C:\WINDOWS\system32\igfxcfg.exe 2007-12-01 23:04 5,760,096 ----a-w C:\WINDOWS\system32\drivers\igxpmp32.sys 2007-12-01 23:04 47,616 ----a-w C:\WINDOWS\system32\igfxsrvc.dll 2007-12-01 23:04 400,152 ----a-w C:\WINDOWS\system32\igxpun.exe 2007-12-01 23:04 319,456 ----a-w C:\WINDOWS\system32\difxapi.dll 2007-12-01 23:04 3,293,184 ----a-w C:\WINDOWS\system32\igfxress.dll 2007-12-01 23:04 252,696 ----a-w C:\WINDOWS\system32\igfxsrvc.exe 2007-12-01 23:04 24,576 ----a-w C:\WINDOWS\system32\igfxexps.dll 2007-12-01 23:04 204,800 ----a-w C:\WINDOWS\system32\igfxpph.dll 2007-12-01 23:04 204,800 ----a-w C:\WINDOWS\system32\igfxdev.dll 2007-12-01 23:04 204,800 ----a-w C:\WINDOWS\system32\igfxCoIn_v4820.dll 2007-12-01 23:04 2,681,344 ----a-w C:\WINDOWS\system32\igxpdx32.dll 2007-12-01 23:04 2,383,872 ----a-w C:\WINDOWS\system32\ig4icd32.dll 2007-12-01 23:04 170,776 ----a-w C:\WINDOWS\system32\igfxzoom.exe 2007-12-01 23:04 166,680 ----a-w C:\WINDOWS\system32\igfxext.exe 2007-12-01 23:04 162,584 ----a-w C:\WINDOWS\system32\hkcmd.exe 2007-12-01 23:04 150,528 ----a-w C:\WINDOWS\system32\igxpgd32.dll 2007-12-01 23:04 142,104 ----a-w C:\WINDOWS\system32\igfxtray.exe 2007-12-01 23:04 138,008 ----a-w C:\WINDOWS\system32\igfxpers.exe 2007-12-01 23:04 135,168 ----a-w C:\WINDOWS\system32\igfxdo.dll 2007-12-01 23:04 102,400 ----a-w C:\WINDOWS\system32\hccutils.dll 2007-12-01 23:04 1,717,920 ----a-w C:\WINDOWS\system32\igxpdv32.dll 2007-12-01 23:04 1,576,960 ----a-w C:\WINDOWS\system32\ig4dev32.dll 2007-12-01 21:46 --------- d-----w C:\Program Files\microsoft frontpage 2007-12-01 21:43 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2007-08-16 12:24] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-03-23 12:06] “IgfxTray”=“C:\WINDOWS\system32\igfxtray.exe” [2007-12-02 00:04] “HotKeysCmds”=“C:\WINDOWS\system32\hkcmd.exe” [2007-12-02 00:04] “Persistence”=“C:\WINDOWS\system32\igfxpers.exe” [2007-12-02 00:04] “AzMixerSel”=“C:\Program Files\Realtek\InstallShield\AzMixerSel.exe” [2005-06-12 10:51] “RTHDCPL”=“RTHDCPL.EXE” [2007-05-29 07:32 C:\WINDOWS\RTHDCPL.exe] “IAAnotif”=“C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe” [2007-03-21 13:00] “BDMCon”=“C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe” [2007-04-02 16:48] “BDAgent”=“C:\Program Files\Softwin\BitDefender10\bdagent.exe” [2007-03-26 15:49] “TrojanScanner”=“C:\Program Files\Trojan Remover\Trjscan.exe” [2007-12-10 18:59] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-03 23:44] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=sockspy.dll R1 bdftdif;BitDefender Firewall TDI Filter;??\C:\Program Files\Common Files\Softwin\BitDefender Firewall\bdftdif.sys R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys S3 flash;flash;??\C:\WINDOWS\system32\drivers\flash.sys *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-12 19:57:26 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-12 19:58:02

Monczkin · 11 Grudzień 2007 19:13

pr0ton

Tutaj nie mam miejsca na chyba, etc.

jak nie wiesz, nie pisz. To nie jest miejsce do uczenia

Gutek · 11 Grudzień 2007 19:18

Pobierz program SDFix

danielsan · 11 Grudzień 2007 19:31

log z SDfix

SDFix: Version 1.118 Run by DiG on 2007-12-12 at 20:26 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-12 20:28:17 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] “s1”=dword:2df9c43f “s2”=dword:110480d0 “h0”=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] “p0”=“C:\Program Files\DAEMON Tools” “h0”=dword:00000000 “khjeh”=hex:25,16,0c,3e,74,33,57,2a,52,cf,94,3c,73,06,ca,a9,9b,2e,27,6c,fd,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] “a0”=hex:20,01,00,00,aa,92,40,a6,f3,5c,97,49,fe,dc,92,ee,da,e9,c4,23,8c,… “khjeh”=hex:9d,63,4e,0f,03,27,62,38,b9,cb,0c,0d,b9,da,ed,7a,94,1d,9f,20,48,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] “khjeh”=hex:bc,95,7c,c3,39,51,1d,48,54,24,3c,ce,fa,46,4a,87,54,9b,4a,aa,4a,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] “p0”=“C:\Program Files\DAEMON Tools” “h0”=dword:00000000 “khjeh”=hex:25,16,0c,3e,74,33,57,2a,52,cf,94,3c,73,06,ca,a9,9b,2e,27,6c,fd,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] “a0”=hex:20,01,00,00,aa,92,40,a6,f3,5c,97,49,fe,dc,92,ee,da,e9,c4,23,8c,… “khjeh”=hex:9d,63,4e,0f,03,27,62,38,b9,cb,0c,0d,b9,da,ed,7a,94,1d,9f,20,48,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] “khjeh”=hex:bc,95,7c,c3,39,51,1d,48,54,24,3c,ce,fa,46,4a,87,54,9b,4a,aa,4a,… scanning hidden registry entries … [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,… scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Finished!

Gutek · 11 Grudzień 2007 20:42

Nic nie widać czysto