hjack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:30, on 2008-07-03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\EVEREST Home Edition\everest.bin
D:\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=488
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM…\Run: [bDMCon] “C:\Program Files\Softwin\BitDefender10\bdmcon.exe” /reg
O4 - HKLM…\Run: [bDAgent] “C:\Program Files\Softwin\BitDefender10\bdagent.exe”
O4 - HKLM…\Run: [ZoneAlarm Client] “D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe”
O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU…\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)
O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)
O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)
O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
–
End of file - 3577 bytes
____________________________________________________________________________
COMBOFIX:
ComboFix 08-07-02.5 - fredi 2008-07-03 19:49:52.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.473 [GMT 2:00]
Running from: C:\Documents and Settings\fredi\Pulpit\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\amvo1.dll
D:\Autorun.inf
E:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 )))))))))))))))))))))))))))))))
.
2008-07-03 19:38 . 2004-03-17 14:36 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-07-03 19:37 . 2008-07-03 19:38
2008-07-03 19:22 . 2008-07-03 19:22
2008-07-03 18:06 . 2008-07-03 18:06
2008-07-03 18:06 . 2008-07-03 18:06
2008-07-03 18:06 . 2008-07-03 19:39
2008-07-03 13:26 . 2008-06-27 13:00 110,443 -r-hs---- C:\r.cmd
2008-07-03 13:22 . 2004-08-03 23:08 26,496 --a–c— C:\WINDOWS\system32\dllcache\usbstor.sys
2008-07-03 13:11 . 2008-07-03 13:11 0 --a------ C:\WINDOWS\nsreg.dat
2008-07-03 13:06 . 2008-07-03 19:26 906 --a------ C:\WINDOWS\VPlayer.INI
2008-07-03 13:06 . 2008-07-03 19:26 45 --a------ C:\WINDOWS\VplayerINI.vpl
2008-07-03 12:44 . 2008-07-03 17:59 114,611 -r-hs---- C:\xmnm2.cmd
2008-07-03 12:41 . 2008-07-03 19:51 452,640 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-03 12:41 . 2008-07-03 18:17 8,024 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-03 12:39 . 2008-07-03 12:39
2008-07-03 12:38 . 2008-07-03 12:38
2008-07-03 12:37 . 2008-07-03 19:50
2008-07-03 12:36 . 2008-07-03 12:36
2008-07-03 12:33 . 2008-07-03 12:33
2008-07-03 12:33 . 2008-07-03 12:33
2008-07-03 12:32 . 2008-07-03 12:33
2008-07-03 12:32 . 2008-05-24 11:32 107,966 -r-hs---- C:\qa8sywva.cmd
2008-07-03 00:39 . 2008-07-03 01:50
2008-07-03 00:39 . 2008-07-03 00:39
2008-07-03 00:39 . 2008-07-02 23:58
2008-07-03 00:39 . 2008-07-03 18:27
2008-07-03 00:39 . 2008-07-03 00:39
2008-07-03 00:39 . 2008-07-03 01:50
2008-07-03 00:39 . 2008-07-03 13:45
2008-07-03 00:39 . 2008-07-03 18:17
2008-07-03 00:23 . 2008-07-03 00:23
2008-07-03 00:23 . 2008-07-03 19:51
2008-07-03 00:23 . 2008-07-03 00:23
2008-07-03 00:23 . 2008-07-03 00:23
2008-07-03 00:07 . 2008-07-03 19:51
2008-07-03 00:07 . 2008-07-03 00:07
2008-07-03 00:07 . 2008-07-03 00:07
2008-07-03 00:07 . 2008-07-03 00:07 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-07-03 00:05 . 2001-07-22 00:23 1,875,968 --a–c— C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-07-03 00:04 . 2001-10-26 19:28 13,463,552 --a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-07-03 00:03 . 2004-08-04 01:44 2,134,528 --a–c— C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-07-03 00:02 . 2008-07-03 00:02 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-07-03 00:02 . 2008-07-03 00:02 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-07-03 00:02 . 2008-07-03 00:02 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-07-03 00:02 . 2008-07-03 00:02 2,596 --a------ C:\WINDOWS\system32\CONFIG.NT
2008-07-03 00:02 . 2008-07-03 00:02 0 --a------ C:\WINDOWS\control.ini
2008-07-03 00:01 . 2008-07-03 00:02
2008-07-03 00:01 . 2001-07-22 04:53 4,399,505 --a–c— C:\WINDOWS\system32\dllcache\nls302en.lex
2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\cdplayer.exe.manifest
2008-07-03 00:01 . 2008-07-03 00:01 488 -rah----- C:\WINDOWS\system32\WindowsLogon.manifest
2008-07-03 00:01 . 2008-07-03 00:01 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-03 17:49 81,984 ----a-w C:\WINDOWS\system32\bdod.bin
2008-07-02 21:34 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-02 21:32 --------- d-----w C:\Program Files\Usługi online
.
((((((((((((((((((((((((((((( snapshot@2008-07-03_13.16.45,96 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-03 10:41:13 2,048 --s-a-w C:\WINDOWS\bootstat.dat
-
2008-07-03 16:18:09 2,048 --s-a-w C:\WINDOWS\bootstat.dat
-
2004-10-27 13:21:36 138,240 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\Hdaudbus.sys
-
2004-10-27 13:21:30 145,920 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\Hdaudio.sys
-
2001-08-23 19:03:54 25,434 ----a-w C:\WINDOWS\OPTIONS\CABS\RTL8139.SYS
-
2001-09-19 16:03:48 38,238 ----a-w C:\WINDOWS\OPTIONS\CABS\RTLSETN5.EXE
-
2007-12-04 00:33:16 682,496 ----a-w C:\WINDOWS\system32\divx.dll
-
2001-08-23 19:03:54 25,434 -c–a-w C:\WINDOWS\system32\dllcache\rtl8139.sys
-
2007-11-29 21:28:24 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
-
2004-10-27 13:21:36 138,240 ------w C:\WINDOWS\system32\drivers\Hdaudbus.sys
-
2004-10-27 13:21:30 145,920 ------w C:\WINDOWS\system32\drivers\Hdaudio.sys
- 2004-08-03 22:31:34 20,992 ----a-w C:\WINDOWS\system32\drivers\RTL8139.sys
-
2001-08-23 19:03:54 25,434 ----a-w C:\WINDOWS\system32\drivers\RTL8139.sys
-
2004-08-03 21:08:48 26,496 ----a-w C:\WINDOWS\system32\drivers\USBSTOR.SYS
-
2007-12-24 11:49:52 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
-
2004-10-27 13:21:28 25,088 ------w C:\WINDOWS\system32\HdAProp.dll
-
2004-10-27 13:21:30 61,952 ------w C:\WINDOWS\system32\HdAShCut.exe
-
2004-10-27 13:21:14 5,120 ------w C:\WINDOWS\system32\HdAudRes.dll
-
2008-03-25 03:21:18 2,889,088 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
-
2008-03-25 03:21:20 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
-
2008-07-03 11:29:55 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
-
2003-08-02 07:50:34 356,352 ----a-w C:\WINDOWS\system32\mkxds.dll
-
2002-10-04 22:04:18 45,056 ----a-w C:\WINDOWS\system32\ogg.dll
-
2002-10-06 17:42:58 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll
- 2008-07-02 22:29:52 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-07-03 17:40:01 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-07-02 22:29:53 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
- 2008-07-03 17:40:01 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
- 2008-07-02 22:29:53 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-07-03 17:40:01 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-07-02 22:29:53 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat
-
2008-07-03 17:40:01 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat
-
2007-11-29 21:30:28 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
-
2004-08-03 22:31:34 20,992 ----a-w C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\RTL8139.sys
-
2007-09-04 15:56:10 164,352 ----a-w C:\WINDOWS\system32\unrar.dll
-
2002-10-04 22:04:26 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll
-
2002-10-04 22:04:26 921,600 ----a-w C:\WINDOWS\system32\VorbisEnc.dll
-
2007-07-25 12:24:30 1,559,040 ----a-w C:\WINDOWS\system32\xvidcore.dll
-
2007-03-10 10:51:50 282,624 ----a-w C:\WINDOWS\system32\xvidvfw.dll
-
2004-01-25 15:18:44 217,088 ----a-w C:\WINDOWS\system32\yv12vfw.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 01:44 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“BDMCon”=“C:\Program Files\Softwin\BitDefender10\bdmcon.exe” [2007-04-02 16:48 290816]
“BDAgent”=“C:\Program Files\Softwin\BitDefender10\bdagent.exe” [2007-03-26 15:49 69632]
“ZoneAlarm Client”=“D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-11-14 16:05 919016]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 01:44 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
“AppInit_DLLs”=sockspy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
“VIDC.YV12”= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
“UpdatesDisableNotify”=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
“DisableMonitoring”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
R3 EverestDriver;Lavalys EVEREST Kernel Driver;D:\EVEREST Home Edition\kerneld.wnt [2005-08-18 00:00]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{487c4d42-48f1-11dd-b03d-001d6089f083}]
\Shell\AutoRun\command - H:\r.cmd
\Shell\explore\Command - H:\r.cmd
\Shell\open\Command - H:\r.cmd
*Newly Created Service* - EVERESTDRIVER
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-03 19:51:51
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
“ImagePath”="??\D:\EVEREST Home Edition\kerneld.wnt"
.
Completion time: 2008-07-03 19:52:46
ComboFix-quarantined-files.txt 2008-07-03 17:52:40
ComboFix2.txt 2008-07-03 11:17:03
Pre-Run: 18,938,429,440 bajtów wolnych
Post-Run: 18,924,392,448 bajtów wolnych
175