Trojan-PSW.Win32.PdPinch.gen w aplikacji CSRSS.exe + log

MBI · 18 Czerwiec 2007 18:56

Wykonałem Logo zgodnie z instrukcją programem HijackThis v2.0.0 (BETA)

Dodam że jestem nowicjuszem i robie to pierwszy raz. Chodzi mi o to że mogę posiadać tego wirusa: http://wirusy.antivirenkit.pl/pl/opis/T … h.gen.html ale tej aplikacji “CSRSS.exe” nie mogę wyłączyć nawet w trybie awaryjnym. Usunąć konkretnie tego pliku też nie mogę. Uruchomić też nie.

Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 20:53:39, on 2007-06-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\WZCBDL Service\WZCBDLS.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\D-Link\Air Utility\AirCFG.exe C:\WINDOWS\system32\devldr32.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\Karol\Pulpit\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O4 - HKLM…\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM…\Run: [Jet Detection] “C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe” O4 - HKLM…\Run: [ZoneAlarm Client] “C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab O17 - HKLM\System\CCS\Services\Tcpip…{0E4D44EB-9BCB-4703-88F3-C162AC2E58BC}: NameServer = 62.233.128.17,87.204.28.12 O17 - HKLM\System\CS1\Services\Tcpip…{0E4D44EB-9BCB-4703-88F3-C162AC2E58BC}: NameServer = 62.233.128.17,87.204.28.12 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe – End of file - 6196 bytes

Gutek · 18 Czerwiec 2007 18:59

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

Optymalizacja XP: http://forum.dobreprogramy.pl/viewtopic.php?t=76580

MBI · 18 Czerwiec 2007 19:34

Post odświeżający temat.

qrczak13 · 18 Czerwiec 2007 19:51

Możesz dać dla pewności log z ComboFix.

MBI · 18 Czerwiec 2007 20:08

ComboFix 07-06-13.7 - C:\Documents and Settings\Karol\Pulpit\ComboFix.exe “Karol” - 2007-06-19 21:57:14 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-05-19 to 2007-06-19 ))))))))))))))))))))))))))))))) 2007-06-19 21:56 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-19 20:41 1,048,576 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-06-19 20:41 2007-06-19 20:41 2007-06-19 20:41 2007-06-19 20:41 2007-06-19 20:41 2007-06-19 20:41 2007-06-19 20:41 2007-06-18 16:14 228,937 --a------ C:\WINDOWS\Alcohol_Toolbar_Uninstaller_3448.exe 2007-06-18 16:14 2007-06-18 15:42 2007-06-18 15:37 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-06-10 23:48 2007-06-08 21:57 12,664 --ah----- C:\WINDOWS\system32\mlfcache.dat 2007-06-08 15:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys 2007-06-07 09:00 2007-06-01 16:30 2007-05-24 21:19 98,304 --a------ C:\WINDOWS\W2BNEUnin.exe 2007-05-24 21:19 20,307 --a------ C:\WINDOWS\W2BNEUnin.dat 2007-05-24 21:19 2,829 --a------ C:\WINDOWS\W2BNEUnin.pif 2007-05-19 14:46 2007-05-19 14:01 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-19 18:34:47 -------- d-----w C:\Program Files\WZCBDL Service 2007-06-19 18:31:44 -------- d-----w C:\Program Files\Gadu-Gadu 2007-06-19 13:35:25 -------- d-----w C:\Program Files\mIRC 2007-06-18 23:11:10 -------- d-----w C:\Program Files\GameSpy Arcade 2007-06-18 13:55:50 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-06-11 13:04:25 -------- d-----w C:\Program Files\SkanerOnline 2007-05-19 10:28:07 -------- d-----w C:\Program Files\Winamp 2007-05-14 20:32:53 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Skype 2007-05-14 20:12:02 -------- d-----w C:\Program Files\Skype 2007-05-14 20:11:46 -------- d-----w C:\Program Files\Common Files\Skype 2007-05-13 17:28:51 -------- d-----w C:\Program Files\PhotoFiltre 2007-04-30 21:53:07 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\MusicIP 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-30 08:36:20 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-30 08:36:20 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-30 08:16:02 23,016 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-30 08:15:28 -------- d-----w C:\Program Files\Messenger 2007-04-30 08:11:03 24 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-0000000C-00001102-00000002-80271102}.dat 2007-04-30 08:11:03 24 ----a-w C:\WINDOWS\system32\DVCState-{00000002-00000000-0000000C-00001102-00000002-80271102}.dat 2007-04-29 21:46:33 -------- d-----w C:\Program Files\Gronzo 2007-04-29 17:17:50 1,286 ----a-w C:\WINDOWS\mozver.dat 2007-04-29 07:53:10 -------- d-----w C:\Program Files\Spyware Doctor 2007-04-28 20:27:30 4,212 —ha-w C:\WINDOWS\system32\zllictbl.dat 2007-04-28 17:01:17 5 --sha-w C:\WINDOWS\system32\bbfbade_d.dll 2007-04-28 17:01:11 -------- d-----w C:\Program Files\RegSupreme Pro 2007-04-28 16:26:09 83,536 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys 2007-04-28 16:25:59 59,984 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys 2007-04-28 16:24:54 26,064 ----a-w C:\WINDOWS\system32\drivers\kcom.sys 2007-04-28 16:24:45 52,304 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-04-28 16:24:43 39,248 ----a-w C:\WINDOWS\system32\drivers\ikfileflt.sys 2007-04-28 16:21:56 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\PC Tools 2007-04-28 13:54:36 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Lavasoft 2007-04-28 13:54:21 -------- d-----w C:\Program Files\Lavasoft 2007-04-28 10:17:49 -------- d-----w C:\Program Files\jv16 PowerTools 2007-04-27 21:11:48 -------- d-----w C:\Program Files\Creative 2007-04-27 21:10:04 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-04-27 20:14:56 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Gadu-Gadu 2007-04-27 20:10:38 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-27 20:10:34 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-27 19:57:19 0 ----a-w C:\WINDOWS\nsreg.dat 2007-04-27 19:35:00 -------- d-----w C:\Program Files\Ashampoo 2007-04-27 19:20:29 -------- d-----w C:\Program Files\Alwil Software 2007-04-27 19:16:16 -------- d-----w C:\Program Files\NIOC Service 2007-04-27 19:16:04 -------- d-----w C:\Program Files\D-Link 2007-04-27 18:43:42 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-27 18:42:43 0 --sha-r C:\MSDOS.SYS 2007-04-27 18:42:43 0 --sha-r C:\IO.SYS 2007-04-27 18:42:43 0 ----a-w C:\CONFIG.SYS 2007-04-27 18:42:43 0 ----a-w C:\AUTOEXEC.BAT 2007-04-27 18:40:08 -------- d–h--w C:\Program Files\WindowsUpdate 2007-04-27 18:40:02 -------- d-----w C:\Program Files\Usługi online 2007-04-27 18:38:46 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-27 18:38:32 -------- d-----w C:\Program Files\Movie Maker 2007-04-27 18:36:00 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-04-27 18:35:48 -------- d-----w C:\Program Files\Windows NT ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489}=C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll [2007-06-18 16:14] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “D-Link Air Utility”=“C:\Program Files\D-Link\Air Utility\AirCFG.exe” [2003-06-26 18:13] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] “nwiz”=“nwiz.exe” [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] “WINDVDPatch”=“CTHELPER.EXE” [2002-07-02 17:56 C:\WINDOWS\system32\CTHELPER.EXE] “Jet Detection”=“C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe” [2001-11-29 01:00] “ZoneAlarm Client”=“C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-03-09 00:02] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 01:44] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-04-25 17:27] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-08-04 00:55] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice] ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-19 22:00:14 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-06-19 22:02:29 — E O F — ((((((((((((((((((((((((( Files Created from 2007-05-19 to 2007-06-19 ))))))))))))))))))))))))))))))) No new files created in this timespan (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-19 18:34:47 -------- d-----w C:\Program Files\WZCBDL Service 2007-06-19 18:31:44 -------- d-----w C:\Program Files\Gadu-Gadu 2007-06-19 13:35:25 -------- d-----w C:\Program Files\mIRC 2007-06-18 23:11:10 -------- d-----w C:\Program Files\GameSpy Arcade 2007-06-18 13:55:50 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-06-11 13:04:25 -------- d-----w C:\Program Files\SkanerOnline 2007-05-19 10:28:07 -------- d-----w C:\Program Files\Winamp 2007-05-14 20:32:53 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Skype 2007-05-14 20:12:02 -------- d-----w C:\Program Files\Skype 2007-05-14 20:11:46 -------- d-----w C:\Program Files\Common Files\Skype 2007-05-13 17:28:51 -------- d-----w C:\Program Files\PhotoFiltre 2007-04-30 21:53:07 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\MusicIP 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-30 08:36:20 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-30 08:36:20 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-30 08:16:02 23,016 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-30 08:15:28 -------- d-----w C:\Program Files\Messenger 2007-04-30 08:11:03 24 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-0000000C-00001102-00000002-80271102}.dat 2007-04-30 08:11:03 24 ----a-w C:\WINDOWS\system32\DVCState-{00000002-00000000-0000000C-00001102-00000002-80271102}.dat 2007-04-29 21:46:33 -------- d-----w C:\Program Files\Gronzo 2007-04-29 17:17:50 1,286 ----a-w C:\WINDOWS\mozver.dat 2007-04-29 07:53:10 -------- d-----w C:\Program Files\Spyware Doctor 2007-04-28 20:27:30 4,212 —ha-w C:\WINDOWS\system32\zllictbl.dat 2007-04-28 17:01:17 5 --sha-w C:\WINDOWS\system32\bbfbade_d.dll 2007-04-28 17:01:11 -------- d-----w C:\Program Files\RegSupreme Pro 2007-04-28 16:26:09 83,536 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys 2007-04-28 16:25:59 59,984 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys 2007-04-28 16:24:54 26,064 ----a-w C:\WINDOWS\system32\drivers\kcom.sys 2007-04-28 16:24:45 52,304 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-04-28 16:24:43 39,248 ----a-w C:\WINDOWS\system32\drivers\ikfileflt.sys 2007-04-28 16:21:56 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\PC Tools 2007-04-28 13:54:36 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Lavasoft 2007-04-28 13:54:21 -------- d-----w C:\Program Files\Lavasoft 2007-04-28 10:17:49 -------- d-----w C:\Program Files\jv16 PowerTools 2007-04-27 21:11:48 -------- d-----w C:\Program Files\Creative 2007-04-27 21:10:04 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-04-27 20:14:56 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Gadu-Gadu 2007-04-27 20:10:38 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-27 20:10:34 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-27 19:57:19 0 ----a-w C:\WINDOWS\nsreg.dat 2007-04-27 19:35:00 -------- d-----w C:\Program Files\Ashampoo 2007-04-27 19:20:29 -------- d-----w C:\Program Files\Alwil Software 2007-04-27 19:16:16 -------- d-----w C:\Program Files\NIOC Service 2007-04-27 19:16:04 -------- d-----w C:\Program Files\D-Link 2007-04-27 18:43:42 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-27 18:42:43 0 --sha-r C:\MSDOS.SYS 2007-04-27 18:42:43 0 --sha-r C:\IO.SYS 2007-04-27 18:42:43 0 ----a-w C:\CONFIG.SYS 2007-04-27 18:42:43 0 ----a-w C:\AUTOEXEC.BAT 2007-04-27 18:40:08 -------- d–h--w C:\Program Files\WindowsUpdate 2007-04-27 18:40:02 -------- d-----w C:\Program Files\Usługi online 2007-04-27 18:38:46 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-27 18:38:32 -------- d-----w C:\Program Files\Movie Maker 2007-04-27 18:36:00 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-04-27 18:35:48 -------- d-----w C:\Program Files\Windows NT

Złączono Posta : 18.06.2007 (Pon) 22:11

ComboFix 07-06-13.7 - C:\Documents and Settings\Karol\Pulpit\ComboFix.exe “Karol” - 2007-06-19 21:57:14 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-05-19 to 2007-06-19 ))))))))))))))))))))))))))))))) 2007-06-19 21:56 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-19 20:41 1,048,576 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-06-19 20:41 2007-06-19 20:41 2007-06-19 20:41 2007-06-19 20:41 2007-06-19 20:41 2007-06-19 20:41 2007-06-19 20:41 2007-06-18 16:14 228,937 --a------ C:\WINDOWS\Alcohol_Toolbar_Uninstaller_3448.exe 2007-06-18 16:14 2007-06-18 15:42 2007-06-18 15:37 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-06-10 23:48 2007-06-08 21:57 12,664 --ah----- C:\WINDOWS\system32\mlfcache.dat 2007-06-08 15:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys 2007-06-07 09:00 2007-06-01 16:30 2007-05-24 21:19 98,304 --a------ C:\WINDOWS\W2BNEUnin.exe 2007-05-24 21:19 20,307 --a------ C:\WINDOWS\W2BNEUnin.dat 2007-05-24 21:19 2,829 --a------ C:\WINDOWS\W2BNEUnin.pif 2007-05-19 14:46 2007-05-19 14:01 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-19 18:34:47 -------- d-----w C:\Program Files\WZCBDL Service 2007-06-19 18:31:44 -------- d-----w C:\Program Files\Gadu-Gadu 2007-06-19 13:35:25 -------- d-----w C:\Program Files\mIRC 2007-06-18 23:11:10 -------- d-----w C:\Program Files\GameSpy Arcade 2007-06-18 13:55:50 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-06-11 13:04:25 -------- d-----w C:\Program Files\SkanerOnline 2007-05-19 10:28:07 -------- d-----w C:\Program Files\Winamp 2007-05-14 20:32:53 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Skype 2007-05-14 20:12:02 -------- d-----w C:\Program Files\Skype 2007-05-14 20:11:46 -------- d-----w C:\Program Files\Common Files\Skype 2007-05-13 17:28:51 -------- d-----w C:\Program Files\PhotoFiltre 2007-04-30 21:53:07 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\MusicIP 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-30 08:36:20 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-30 08:36:20 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-30 08:16:02 23,016 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-30 08:15:28 -------- d-----w C:\Program Files\Messenger 2007-04-30 08:11:03 24 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-0000000C-00001102-00000002-80271102}.dat 2007-04-30 08:11:03 24 ----a-w C:\WINDOWS\system32\DVCState-{00000002-00000000-0000000C-00001102-00000002-80271102}.dat 2007-04-29 21:46:33 -------- d-----w C:\Program Files\Gronzo 2007-04-29 17:17:50 1,286 ----a-w C:\WINDOWS\mozver.dat 2007-04-29 07:53:10 -------- d-----w C:\Program Files\Spyware Doctor 2007-04-28 20:27:30 4,212 —ha-w C:\WINDOWS\system32\zllictbl.dat 2007-04-28 17:01:17 5 --sha-w C:\WINDOWS\system32\bbfbade_d.dll 2007-04-28 17:01:11 -------- d-----w C:\Program Files\RegSupreme Pro 2007-04-28 16:26:09 83,536 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys 2007-04-28 16:25:59 59,984 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys 2007-04-28 16:24:54 26,064 ----a-w C:\WINDOWS\system32\drivers\kcom.sys 2007-04-28 16:24:45 52,304 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-04-28 16:24:43 39,248 ----a-w C:\WINDOWS\system32\drivers\ikfileflt.sys 2007-04-28 16:21:56 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\PC Tools 2007-04-28 13:54:36 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Lavasoft 2007-04-28 13:54:21 -------- d-----w C:\Program Files\Lavasoft 2007-04-28 10:17:49 -------- d-----w C:\Program Files\jv16 PowerTools 2007-04-27 21:11:48 -------- d-----w C:\Program Files\Creative 2007-04-27 21:10:04 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-04-27 20:14:56 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Gadu-Gadu 2007-04-27 20:10:38 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-27 20:10:34 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-27 19:57:19 0 ----a-w C:\WINDOWS\nsreg.dat 2007-04-27 19:35:00 -------- d-----w C:\Program Files\Ashampoo 2007-04-27 19:20:29 -------- d-----w C:\Program Files\Alwil Software 2007-04-27 19:16:16 -------- d-----w C:\Program Files\NIOC Service 2007-04-27 19:16:04 -------- d-----w C:\Program Files\D-Link 2007-04-27 18:43:42 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-27 18:42:43 0 --sha-r C:\MSDOS.SYS 2007-04-27 18:42:43 0 --sha-r C:\IO.SYS 2007-04-27 18:42:43 0 ----a-w C:\CONFIG.SYS 2007-04-27 18:42:43 0 ----a-w C:\AUTOEXEC.BAT 2007-04-27 18:40:08 -------- d–h--w C:\Program Files\WindowsUpdate 2007-04-27 18:40:02 -------- d-----w C:\Program Files\Usługi online 2007-04-27 18:38:46 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-27 18:38:32 -------- d-----w C:\Program Files\Movie Maker 2007-04-27 18:36:00 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-04-27 18:35:48 -------- d-----w C:\Program Files\Windows NT ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489}=C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll [2007-06-18 16:14] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “D-Link Air Utility”=“C:\Program Files\D-Link\Air Utility\AirCFG.exe” [2003-06-26 18:13] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] “nwiz”=“nwiz.exe” [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] “WINDVDPatch”=“CTHELPER.EXE” [2002-07-02 17:56 C:\WINDOWS\system32\CTHELPER.EXE] “Jet Detection”=“C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe” [2001-11-29 01:00] “ZoneAlarm Client”=“C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-03-09 00:02] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 01:44] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-04-25 17:27] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-08-04 00:55] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice] ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-19 22:00:14 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-06-19 22:02:29 — E O F — ((((((((((((((((((((((((( Files Created from 2007-05-19 to 2007-06-19 ))))))))))))))))))))))))))))))) No new files created in this timespan (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-19 18:34:47 -------- d-----w C:\Program Files\WZCBDL Service 2007-06-19 18:31:44 -------- d-----w C:\Program Files\Gadu-Gadu 2007-06-19 13:35:25 -------- d-----w C:\Program Files\mIRC 2007-06-18 23:11:10 -------- d-----w C:\Program Files\GameSpy Arcade 2007-06-18 13:55:50 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-06-11 13:04:25 -------- d-----w C:\Program Files\SkanerOnline 2007-05-19 10:28:07 -------- d-----w C:\Program Files\Winamp 2007-05-14 20:32:53 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Skype 2007-05-14 20:12:02 -------- d-----w C:\Program Files\Skype 2007-05-14 20:11:46 -------- d-----w C:\Program Files\Common Files\Skype 2007-05-13 17:28:51 -------- d-----w C:\Program Files\PhotoFiltre 2007-04-30 21:53:07 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\MusicIP 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-30 08:36:20 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-30 08:36:20 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-30 08:16:02 23,016 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-30 08:15:28 -------- d-----w C:\Program Files\Messenger 2007-04-30 08:11:03 24 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-0000000C-00001102-00000002-80271102}.dat 2007-04-30 08:11:03 24 ----a-w C:\WINDOWS\system32\DVCState-{00000002-00000000-0000000C-00001102-00000002-80271102}.dat 2007-04-29 21:46:33 -------- d-----w C:\Program Files\Gronzo 2007-04-29 17:17:50 1,286 ----a-w C:\WINDOWS\mozver.dat 2007-04-29 07:53:10 -------- d-----w C:\Program Files\Spyware Doctor 2007-04-28 20:27:30 4,212 —ha-w C:\WINDOWS\system32\zllictbl.dat 2007-04-28 17:01:17 5 --sha-w C:\WINDOWS\system32\bbfbade_d.dll 2007-04-28 17:01:11 -------- d-----w C:\Program Files\RegSupreme Pro 2007-04-28 16:26:09 83,536 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys 2007-04-28 16:25:59 59,984 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys 2007-04-28 16:24:54 26,064 ----a-w C:\WINDOWS\system32\drivers\kcom.sys 2007-04-28 16:24:45 52,304 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-04-28 16:24:43 39,248 ----a-w C:\WINDOWS\system32\drivers\ikfileflt.sys 2007-04-28 16:21:56 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\PC Tools 2007-04-28 13:54:36 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Lavasoft 2007-04-28 13:54:21 -------- d-----w C:\Program Files\Lavasoft 2007-04-28 10:17:49 -------- d-----w C:\Program Files\jv16 PowerTools 2007-04-27 21:11:48 -------- d-----w C:\Program Files\Creative 2007-04-27 21:10:04 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-04-27 20:14:56 -------- d-----w C:\DOCUME~1\Karol\DANEAP~1\Gadu-Gadu 2007-04-27 20:10:38 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-27 20:10:34 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-27 19:57:19 0 ----a-w C:\WINDOWS\nsreg.dat 2007-04-27 19:35:00 -------- d-----w C:\Program Files\Ashampoo 2007-04-27 19:20:29 -------- d-----w C:\Program Files\Alwil Software 2007-04-27 19:16:16 -------- d-----w C:\Program Files\NIOC Service 2007-04-27 19:16:04 -------- d-----w C:\Program Files\D-Link 2007-04-27 18:43:42 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-27 18:42:43 0 --sha-r C:\MSDOS.SYS 2007-04-27 18:42:43 0 --sha-r C:\IO.SYS 2007-04-27 18:42:43 0 ----a-w C:\CONFIG.SYS 2007-04-27 18:42:43 0 ----a-w C:\AUTOEXEC.BAT 2007-04-27 18:40:08 -------- d–h--w C:\Program Files\WindowsUpdate 2007-04-27 18:40:02 -------- d-----w C:\Program Files\Usługi online 2007-04-27 18:38:46 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-27 18:38:32 -------- d-----w C:\Program Files\Movie Maker 2007-04-27 18:36:00 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-04-27 18:35:48 -------- d-----w C:\Program Files\Windows NT

qrczak13 · 18 Czerwiec 2007 20:38

Usuń pliki.

Przeskanuj na http://www.virustotal.com/vt/ i wklej raport po skanowaniu.

MBI · 18 Czerwiec 2007 20:57

Complete scanning result of “bbfbade_d.dll”, received in VirusTotal at 06.18.2007, 22:50:26 (CET).

Antivirus Version Update Result

AhnLab-V3 2007.6.16.0 06.18.2007 no virus found

AntiVir 7.4.0.32 06.18.2007 no virus found

Authentium 4.93.8 06.18.2007 no virus found

Avast 4.7.997.0 06.18.2007 no virus found

AVG 7.5.0.467 06.18.2007 no virus found

BitDefender 7.2 06.18.2007 no virus found

CAT-QuickHeal 9.00 06.18.2007 no virus found

ClamAV devel-20070416 06.18.2007 no virus found

DrWeb 4.33 06.18.2007 no virus found

eSafe 7.0.15.0 06.17.2007 no virus found

eTrust-Vet 30.7.3726 06.18.2007 no virus found

Ewido 4.0 06.18.2007 no virus found

FileAdvisor 1 06.18.2007 no virus found

Fortinet 2.85.0.0 06.18.2007 no virus found

F-Prot 4.3.2.48 06.18.2007 no virus found

F-Secure 6.70.13030.0 06.18.2007 no virus found

Ikarus T3.1.1.8 06.18.2007 no virus found

Kaspersky 4.0.2.24 06.18.2007 no virus found

McAfee 5055 06.18.2007 no virus found

Microsoft 1.2607 06.18.2007 no virus found

NOD32v2 2337 06.18.2007 no virus found

Norman 5.80.02 06.18.2007 no virus found

Panda 9.0.0.4 06.18.2007 no virus found

Prevx1 V2 06.18.2007 no virus found

Sophos 4.18.0 06.12.2007 no virus found

Sunbelt 2.2.907.0 06.16.2007 no virus found

Symantec 10 06.18.2007 no virus found

TheHacker 6.1.6.134 06.18.2007 no virus found

VBA32 3.12.0.2 06.15.2007 no virus found

VirusBuster 4.3.23:9 06.18.2007 no virus found

Webwasher-Gateway 6.0.1 06.18.2007 no virus found

qrczak13 · 18 Czerwiec 2007 21:49

To jest czysto.