Tak jak już napisalem w temacie mam peoblem z jakimś rootkitem. Ostrzeżenia Avasta zaczęły mi wyskakiwać podczas oglądania filmu i nie mam bladego pojęcia skąd to się mogło wziąć. Użyłem ComboFix i usunął (chyba) wszystkie pliki .dll któe były zainfekowane ale pewny nie jestem:
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
c:\windows\system32\ljJCrOFY.dll
c:\windows\system32\rucoaocr.ini
c:\windows\system32\xxjromne.dll
c:\windows\system32\YFOrCJjl.ini
c:\windows\system32\YFOrCJjl.ini2
Chwilowo nic mi nie wyje ale nie wiem czy za chwilę znowu się nie zacznie. Reszta loga ze skanowania:
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"$Volumouse$"="d:\downloads\volumouse\volumouse.exe" [2008-08-02 30208]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-23 136600]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-09-09 c:\windows\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Mati\Menu Start\Programy\Autostart\
Daemon Tools Updater.exe [2008-08-03 28012]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Mati^Menu Start^Programy^Autostart^Daemon Tools Updater.exe]
path=c:\documents and settings\Mati\Menu Start\Programy\Autostart\Daemon Tools Updater.exe
backup=c:\windows\pss\Daemon Tools Updater.exeStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrialReset
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
--a------ 2008-08-14 06:58 611712 c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-10-01 12:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-09-03 06:04 133104 c:\documents and settings\Mati\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 07:38 241664 c:\program files\HP\hpcoretech\hpcmpmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-02-18 18:55 49152 c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2004-03-04 16:46 172032 c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
--a------ 2004-06-03 00:50 204800 c:\program files\Microsoft IntelliPoint\point32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 18:57 289576 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-07-30 16:17 21738792 c:\program files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-11-09 20:47 1410296 d:\gry\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-07-09 15:16 36352 c:\program files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2008-06-19 15:20 57344 c:\windows\ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"O&O Defrag"=2 (0x2)
"MDM"=2 (0x2)
"iPod Service"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"aawservice"=2 (0x2)
"PSI_SVC_2"=2 (0x2)
"nlsvc"=2 (0x2)
"mi-raysat_3dsMax2009_32"=2 (0x2)
"gusvc"=3 (0x3)
"Autodesk Licensing Service"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Gry\\World in Conflict\\wic.exe"=
"d:\\Gry\\World in Conflict\\wic_online.exe"=
"d:\\Gry\\World in Conflict\\wic_ds.exe"=
"d:\\Gry\\CallofDuty 4\\iw3mp.exe"=
"d:\\Gry\\Xfire\\xfire.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
"c:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"=
"d:\\Gry\\Assassins Creed\\AssassinsCreed_Dx9.exe"=
"d:\\Gry\\Assassins Creed\\AssassinsCreed_Dx10.exe"=
"d:\\Gry\\Assassins Creed\\AssassinsCreed_Launcher.exe"=
"d:\\Gry\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"d:\\Gry\\Battlefield 2\\BF2.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"=
"d:\\Gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Autodesk\\3ds Max 2009\\3dsmax.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"e:\\Gry\\WWP\\wwp.exe"=
"d:\\Gry\\far cry 2\\bin\\FarCry2.exe"=
"d:\\Gry\\far cry 2\\bin\\FC2Launcher.exe"=
"d:\\Gry\\far cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"d:\\Gry\\CoD WaW full\\CoDWaWmp.exe"=
"d:\\Gry\\CoD WaW full\\CoDWaW.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Gry\\RD GRiD\\GRID.exe"=
"d:\\Gry\\legendary\\Binaries\\Legendary.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
R0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys [2008-06-10 150568]
R1 appdrv01;Application Driver (01);c:\windows\system32\Drivers\appdrv01.sys [2008-09-06 2915944]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-08-22 110160]
R1 nltdi;nltdi;\??\c:\windows\system32\drivers\nltdi.sys [2007-04-23 81688]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};\??\c:\program files\CyberLink\PowerDVD8\[u]0[/u]00.fcl [2008-02-01 16:24:04 41456]
R2 adfs;adfs;c:\windows\system32\drivers\adfs.sys [2008-08-14 74720]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-08-22 20560]
R2 port_nt;port_nt;\??\c:\windows\system32\drivers\port_nt.sys [2008-09-06 3608]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2008-07-02 89600]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113 PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\l1e51x86.sys [2008-08-07 36864]
S2 appdrvrem01;Application Driver Auto Removal Service (01);c:\windows\System32\appdrvrem01.exe svc []
S4 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;"c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe" [2008-03-09 65536]
S4 PSI_SVC_2;Protexis Licensing V2;"c:\program files\Common Files\Protexis\License Service\PsiService_2.exe" [2007-07-24 185632]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{37dae1d5-a8c8-11dd-8ee7-002215571ed5}]
\Shell\AutoRun\command - G:\Launcher.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f966d9f3-8654-11dd-8e5f-001947a6b0dc}]
\Shell\AutoRun\command - H:\Autoplay.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f966d9f7-8654-11dd-8e5f-001947a6b0dc}]
\Shell\AutoRun\command - G:\Autoplay.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f966d9fd-8654-11dd-8e5f-001947a6b0dc}]
\Shell\AutoRun\command - G:\Autoplay.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f9bce762-865e-11dd-8e61-001947a6b0dc}]
\Shell\AutoRun\command - G:\Autoplay.exe
.
Zawartość folderu 'Zaplanowane zadania'
2008-11-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2008-11-26 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-09-17 16:35]
2008-11-25 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Mati\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-09-03 06:04]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
BHO-{49582D01-5592-4E9A-B672-FBABAB3B9A2C} - c:\windows\system32\ddcDuRJY.dll
BHO-{49660D70-410B-4A38-88D8-53D43D127422} - c:\windows\system32\ljJCrOFY.dll
ShellExecuteHooks-{49582D01-5592-4E9A-B672-FBABAB3B9A2C} - c:\windows\system32\ddcDuRJY.dll
Notify-ddcDuRJY - ddcDuRJY.dll
MSConfigStartUp-PhoneDaemon - c:\documents and settings\Mati\Pulpit\iPhone_PC_Suite(dobreprogramy.pl)\PhoneDaemon.exe
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-26 17:05:22
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\[u]0[/u]00.fcl"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(1248)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Czas ukończenia: 2008-11-26 17:07:47 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2008-11-26 16:07:45
Przed: 7 345 750 016 bajtów wolnych
Po: 7,468,339,200 bajtów wolnych
315 --- E O F --- 2008-08-18 07:07:07
proszę o jak najszybszą odpowiedź z wiadomych przyczyn ;]