Trojan Adclicker

system · 15 Sierpień 2007 18:57

Dzisiaj wieczorem , mój Antyvirus Norton wykrył Trojana Adclickera , niestety, nie można go ani usuąc ani ominąc. Oto logi z HiJackThis

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:57:02, on 2007-08-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\program files\steam\steam.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {6db9a274-983e-4a67-b92c-f28eaa01ee7a} - C:\WINDOWS\system32\kbdext.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {8a121b63-f422-46a9-a081-099981510d26} - C:\WINDOWS\system32\kbdext.dll O2 - BHO: (no name) - {9dafc1d8-9bce-4d9a-8bf7-f239d9e93275} - C:\WINDOWS\system32\kbdext.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll (file missing) O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmp24.tmp.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [ccApp] “C:\Program Files\Common Files\Symantec Shared\ccApp.exe” O4 - HKLM…\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [intelliPoint] “C:\Program Files\Microsoft IntelliPoint\ipoint.exe” O4 - HKLM…\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime O4 - HKLM…\Run: [!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized O4 - HKCU…\Run: [steam] “c:\program files\steam\steam.exe” -silent O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\kbdext.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\kbdext.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso … 6245665859 O17 - HKLM\System\CCS\Services\Tcpip…{08FC8263-5A69-41A7-891F-A6F3AF3818D5}: NameServer = 194.204.152.34,194.204.159.1 O17 - HKLM\System\CS1\Services\Tcpip…{08FC8263-5A69-41A7-891F-A6F3AF3818D5}: NameServer = 194.204.152.34,194.204.159.1 O17 - HKLM\System\CS2\Services\Tcpip…{08FC8263-5A69-41A7-891F-A6F3AF3818D5}: NameServer = 194.204.152.34,194.204.159.1 O20 - AppInit_DLLs: c:\windows\system32\gebccdb.dll O20 - Winlogon Notify: kbdext - C:\WINDOWS\SYSTEM32\kbdext.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe – End of file - 9409 bytes

Proszę o szybką pomoc

jessica · 15 Sierpień 2007 19:41

Jeśli nie masz jakiegoś narzędzia usuwającego, to ściągnij OTMoveIt

Do pola Paste List of Files/Folders to be Moved wklej poniższe ścieżki:

Następnie wciśnij przycisk MoveIt!

Pojawi się komunikat, że jest potrzebny restart do usunięcia podanych plików/folderów- wciśnij Yes.

Po restarcie usuń ręcznie folder C:** _OTMoveIt** (Prawoklik >>> Usuń >>> Opróżnij Kosz).

Potem te w/w wpisy sfiksuj w Hijacku:

>>Hijack>>scan(Do a system scan only)>>zaznacz je >> Fix checked.

Potem daj tu log z Hijacka oraz log z ComboFixa :

http://forum.dobreprogramy.pl/viewtopic.php?t=36654(na dole tej strony z linku) -

Log wklej na http://wklej.org/, a w poście daj tylko link.

jessi

system · 15 Sierpień 2007 21:06

http://wklej.org/id/dac3e15d21

Tu sa logi do hijacka i Combofixa

jessica · 15 Sierpień 2007 23:14

Do pola Paste List of Files/Folders to be Moved wklej poniższe ścieżki:

C:\WINDOWS\system32\mljgfcd.dll C:\WINDOWS\system32\pmkjggd.dll C:\WINDOWS\system32\mllmnom.dll C:\WINDOWS\system32\mlljjkl.dll C:\WINDOWS\system32\jkhfgef.dll C:\WINDOWS\system32\ddabcyx.dll C:\WINDOWS\system32\ddcyaby.dll C:\WINDOWS\system32\sstqqnm.dll C:\WINDOWS\system32\ssqpqpm.dll C:\WINDOWS\system32\ssqrqrq.dll C:\WINDOWS\system32\jkkjkkh.dll C:\WINDOWS\system32\awvtqqo.dll C:\WINDOWS\system32\mljjkkh.dll C:\WINDOWS\system32\pmnligh.dll C:\WINDOWS\system32\pmnnkkk.dll C:\WINDOWS\system32\awtqpnl.dll C:\WINDOWS\system32\jkkjhed.dll C:\WINDOWS\system32\ssqropo.dll C:\WINDOWS\system32\awvvvwu.dll C:\WINDOWS\system32\gebyvus.dll C:\FOUND.003 C:\FOUND.002 C:\WINDOWS\system32\mljjgdc.dll C:\WINDOWS\system32\geedcyx.dll C:\WINDOWS\system32\pmkjjig.dll C:\WINDOWS\system32\geebyaw.dll C:\WINDOWS\system32\gebyyxv.dll C:\WINDOWS\system32\ssqpqrp.dll C:\WINDOWS\system32\jkkjgee.dll C:\WINDOWS\system32\gebywvt.dll C:\WINDOWS\system32\ddababy.dll C:\WINDOWS\system32\mlljiig.dll C:\WINDOWS\system32\pmkhhfe.dll C:\WINDOWS\system32\geebxxw.dll C:\WINDOWS\system32\pbOi0lQr.exe C:\WINDOWS\Tasks\At1.job C:\WINDOWS\Tasks\At2.job C:\WINDOWS\Tasks\At3.job C:\WINDOWS\Tasks\At4.job C:\WINDOWS\Tasks\At5.job C:\WINDOWS\Tasks\At6.job C:\WINDOWS\Tasks\At7.job C:\WINDOWS\Tasks\At8.job C:\WINDOWS\Tasks\At9.job C:\WINDOWS\Tasks\At10.job C:\WINDOWS\Tasks\At11.job C:\WINDOWS\Tasks\At12.job C:\WINDOWS\Tasks\At13.job C:\WINDOWS\Tasks\At14.job C:\WINDOWS\Tasks\At15.job C:\WINDOWS\Tasks\At16.job C:\WINDOWS\Tasks\At17.job C:\WINDOWS\Tasks\At18.job C:\WINDOWS\Tasks\At19.job C:\WINDOWS\Tasks\At20.job C:\WINDOWS\Tasks\At21.job C:\WINDOWS\Tasks\At22.job C:\WINDOWS\Tasks\At23.job C:\WINDOWS\Tasks\At24.job

Następnie wciśnij przycisk MoveIt!

Pojawi się komunikat, że jest potrzebny restart do usunięcia podanych plików/folderów- wciśnij Yes.

Po restarcie usuń ręcznie folder C:** _OTMoveIt** (Prawoklik >>> Usuń >>> Opróżnij Kosz).

Te w/w wpisy sfiksuj w Hijacku:

>>Hijack>>scan(Do a system scan only)>>zaznacz je >> Fix checked.

Potem daj nowy log z ComboFixa.

jessi

system · 16 Sierpień 2007 13:34

Combofix

ComboFix 07-07-30.2 - “Jan” 2007-08-16 15:29:10.3 [GMT 2:00] - FAT32 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.Prawda ((((((((((((((((((((((((( Files Created from 2007-07-16 to 2007-08-16 ))))))))))))))))))))))))))))))) 2007-08-15 18:43 13,380 --a------ C:\WINDOWS\system32\mljgfcd.dll 2007-08-12 16:22 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-08-05 18:23 2007-08-05 18:23 2007-08-05 17:49 2007-08-05 17:49 2007-08-04 20:05 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-08-04 20:05 2007-08-04 18:42 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-08-04 18:30 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-08-04 18:30 2007-08-04 18:30 2007-08-04 18:14 2007-08-04 17:46 2007-08-01 20:23 2007-07-30 21:02 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-30 16:10 2007-07-30 14:53 2007-07-27 15:19 2007-07-16 23:36 2007-07-16 20:08 2007-07-16 20:08 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2060-08-18 19:02 1496064 --------- C:\WINDOWS\system32\CC3250MT.DLL 2060-08-18 18:40 909824 --------- C:\WINDOWS\system32\CP3245MT.DLL 2060-08-18 18:40 24064 --------- C:\WINDOWS\system32\BORLNDMM.DLL 2007-08-05 17:49 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-08-04 20:13 67078 --a------ C:\WINDOWS\system32\perfc015.dat 2007-08-04 20:13 435978 --a------ C:\WINDOWS\system32\perfh015.dat 2007-07-26 17:03 682232 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-07-15 23:21 --------- d-------- C:\Program Files\HTV 2007-07-09 14:57 0 --a------ C:\WINDOWS\nsreg.dat 2007-07-08 18:32 --------- d-------- C:\DOCUME~1\Jan\DANEAP~1\Google 2007-07-08 18:31 --------- d-------- C:\Program Files\Octoshape Streaming Services 2007-07-08 18:29 --------- d-------- C:\Program Files\Google 2007-07-04 23:37 --------- d-------- C:\Program Files\mIRC 2007-07-02 21:07 --------- d-------- C:\DOCUME~1\Jan\DANEAP~1\Ventrilo 2007-07-02 21:06 --------- d-------- C:\Program Files\VentriloMIX 2007-07-02 19:56 --------- d-------- C:\Program Files\Gadu-Gadu 2007-07-02 19:31 --------- d-------- C:\Program Files\Steam ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-02-01 21:05] “Resume copy”=“copyfstq.exe” [2005-07-26 02:04 C:\WINDOWS\copyfstq.exe] “Cmaudio”=“cmicnfg.cpl” [] “RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2003-10-31 19:42] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2004-08-26 12:18] “HydraVisionDesktopManager”=“C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe” [2003-09-15 21:00] “TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2006-04-09 19:05] “IntelliPoint”=“C:\Program Files\Microsoft IntelliPoint\ipoint.exe” [2006-07-08 01:15] “WheelMouse”=“C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe” [2003-12-22 01:32] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2005-02-01 22:23] “!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2007-06-11 11:25] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Steam”=“c:\program files\steam\steam.exe” [2007-07-02 19:35] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2006-02-17 15:03] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “”= “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Color Calibration.lnk] backup=C:\WINDOWS\pss\Color Calibration.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^MagicTune3.5.lnk] backup=C:\WINDOWS\pss\MagicTune3.5.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^NaturalColorLoad.lnk] backup=C:\WINDOWS\pss\NaturalColorLoad.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services] “C:\Program Files\Octoshape Streaming Services\Jan\OctoshapeClient.exe” -inv:bootrun [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe R0 uagp35;Filtr AGPv3.5 firmy Microsoft;C:\WINDOWS\system32\DRIVERS\uagp35.sys R1 SSHDRV65;SSHDRV65;??\C:\WINDOWS\system32\drivers\SSHDRV65.sys R3 cmuda;C-Media WDM Audio Interface;C:\WINDOWS\system32\drivers\cmuda.sys R3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet;C:\WINDOWS\system32\DRIVERS\fetnd5.sys R3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys S3 dtscsi;dtscsi;C:\WINDOWS\system32\Drivers\dtscsi.sys S3 MagicTune;MagicTune;C:\WINDOWS\system32\drivers\MTiCtwl.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{3a745588-af00-11db-be2c-000b6ac3a474}] AutoRun\command- F:\DTE_Privacy_launcher.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{a6494b9f-f3be-11db-9352-000b6ac3a474}] AutoRun\command- H:\USBNB.exe Contents of the ‘Scheduled Tasks’ folder 2007-08-15 19:03:32 C:\WINDOWS\Tasks\Norton AntiVirus - Skanuj komputer - Jan.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-16 15:30:50 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\H a r m o n o g r a m a u t o m a t y c z n e j u s Bu g i L i v e U p d a t e] “ImagePath”="“C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe”" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\helpsvc] “ServiceDll”="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HidServ] “ServiceDll”="%SystemRoot%\System32\hidserv.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HidUsb] “ImagePath”=“system32\DRIVERS\hidusb.sys” [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hpn] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTP] “ImagePath”=“System32\Drivers\HTTP.sys” [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTPFilter] “ServiceDll”="%SystemRoot%\System32\w3ssl.dll" Completion time: 2007-08-16 15:32:48 C:\ComboFix-quarantined-files.txt … 2007-08-16 15:32 C:\ComboFix3.txt … 2007-07-30 21:07 C:\ComboFix2.txt … 2007-08-15 23:03 — E O F —

jessica · 16 Sierpień 2007 14:00

Jeszcze jedna sierotka została.

Do pola Paste List of Files/Folders to be Moved wklej poniższe ścieżki:

Następnie wciśnij przycisk MoveIt!

Pojawi się komunikat, że jest potrzebny restart do usunięcia podanych plików/folderów- wciśnij Yes.

Po restarcie usuń ręcznie folder C:** _OTMoveIt** (Prawoklik >>> Usuń >>> Opróżnij Kosz).

I nowy log z ComboFixa.

jessi

system · 16 Sierpień 2007 14:17

ComboFix 07-07-30.2 - “Jan” 2007-08-16 16:13:20.4 [GMT 2:00] - FAT32 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.Prawda ((((((((((((((((((((((((( Files Created from 2007-07-16 to 2007-08-16 ))))))))))))))))))))))))))))))) 2007-08-12 16:22 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-08-05 18:23 2007-08-05 18:23 2007-08-05 17:49 2007-08-05 17:49 2007-08-04 20:05 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-08-04 20:05 2007-08-04 18:42 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-08-04 18:30 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-08-04 18:30 2007-08-04 18:30 2007-08-04 18:14 2007-08-04 17:46 2007-08-01 20:23 2007-07-30 21:02 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-30 16:10 2007-07-30 14:53 2007-07-27 15:19 2007-07-16 23:36 2007-07-16 20:08 2007-07-16 20:08 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2060-08-18 19:02 1496064 --------- C:\WINDOWS\system32\CC3250MT.DLL 2060-08-18 18:40 909824 --------- C:\WINDOWS\system32\CP3245MT.DLL 2060-08-18 18:40 24064 --------- C:\WINDOWS\system32\BORLNDMM.DLL 2007-08-05 17:49 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-08-04 20:13 67078 --a------ C:\WINDOWS\system32\perfc015.dat 2007-08-04 20:13 435978 --a------ C:\WINDOWS\system32\perfh015.dat 2007-07-26 17:03 682232 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-07-15 23:21 --------- d-------- C:\Program Files\HTV 2007-07-09 14:57 0 --a------ C:\WINDOWS\nsreg.dat 2007-07-08 18:32 --------- d-------- C:\DOCUME~1\Jan\DANEAP~1\Google 2007-07-08 18:31 --------- d-------- C:\Program Files\Octoshape Streaming Services 2007-07-08 18:29 --------- d-------- C:\Program Files\Google 2007-07-04 23:37 --------- d-------- C:\Program Files\mIRC 2007-07-02 21:07 --------- d-------- C:\DOCUME~1\Jan\DANEAP~1\Ventrilo 2007-07-02 21:06 --------- d-------- C:\Program Files\VentriloMIX 2007-07-02 19:56 --------- d-------- C:\Program Files\Gadu-Gadu 2007-07-02 19:31 --------- d-------- C:\Program Files\Steam ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-02-01 21:05] “Resume copy”=“copyfstq.exe” [2005-07-26 02:04 C:\WINDOWS\copyfstq.exe] “Cmaudio”=“cmicnfg.cpl” [] “RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2003-10-31 19:42] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2004-08-26 12:18] “HydraVisionDesktopManager”=“C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe” [2003-09-15 21:00] “TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2006-04-09 19:05] “IntelliPoint”=“C:\Program Files\Microsoft IntelliPoint\ipoint.exe” [2006-07-08 01:15] “WheelMouse”=“C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe” [2003-12-22 01:32] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2005-02-01 22:23] “!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2007-06-11 11:25] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Steam”=“c:\program files\steam\steam.exe” [2007-07-02 19:35] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2006-02-17 15:03] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “”= “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Color Calibration.lnk] backup=C:\WINDOWS\pss\Color Calibration.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^MagicTune3.5.lnk] backup=C:\WINDOWS\pss\MagicTune3.5.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^NaturalColorLoad.lnk] backup=C:\WINDOWS\pss\NaturalColorLoad.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services] “C:\Program Files\Octoshape Streaming Services\Jan\OctoshapeClient.exe” -inv:bootrun [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe R0 uagp35;Filtr AGPv3.5 firmy Microsoft;C:\WINDOWS\system32\DRIVERS\uagp35.sys R1 SSHDRV65;SSHDRV65;??\C:\WINDOWS\system32\drivers\SSHDRV65.sys R3 cmuda;C-Media WDM Audio Interface;C:\WINDOWS\system32\drivers\cmuda.sys R3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet;C:\WINDOWS\system32\DRIVERS\fetnd5.sys R3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys S3 dtscsi;dtscsi;C:\WINDOWS\system32\Drivers\dtscsi.sys S3 MagicTune;MagicTune;C:\WINDOWS\system32\drivers\MTiCtwl.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{3a745588-af00-11db-be2c-000b6ac3a474}] AutoRun\command- F:\DTE_Privacy_launcher.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{a6494b9f-f3be-11db-9352-000b6ac3a474}] AutoRun\command- H:\USBNB.exe Contents of the ‘Scheduled Tasks’ folder 2007-08-15 19:03:32 C:\WINDOWS\Tasks\Norton AntiVirus - Skanuj komputer - Jan.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-16 16:15:18 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\H a r m o n o g r a m a u t o m a t y c z n e j u s Bu g i L i v e U p d a t e] “ImagePath”="“C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe”" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\helpsvc] “ServiceDll”="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HidServ] “ServiceDll”="%SystemRoot%\System32\hidserv.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HidUsb] “ImagePath”=“system32\DRIVERS\hidusb.sys” [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hpn] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTP] “ImagePath”=“System32\Drivers\HTTP.sys” [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTPFilter] “ServiceDll”="%SystemRoot%\System32\w3ssl.dll" Completion time: 2007-08-16 16:16:16 C:\ComboFix-quarantined-files.txt … 2007-08-16 16:16 C:\ComboFix3.txt … 2007-08-15 23:03 C:\ComboFix2.txt … 2007-08-16 15:32 — E O F —

jessica · 16 Sierpień 2007 14:26

Tym razem nie widzę w logu już nic podejrzanego.

Mam nadzieję, że to koniec kłopotów z tym “wirusem”.

jessi

system · 16 Sierpień 2007 15:09

Dziekuję Ci bardzo za pomoc , jestem Ci wdzięczny :*