Trojan.WINd32.dailer....Zbot, virtumpondem

system · 26 Listopad 2007 13:02

Logfile of HijackThis v1.99.1 Scan saved at 13:01:57, on 2007-11-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe D:\Mozilla Firefox\firefox.exe C:\Documents and Settings\Wronx\Pulpit\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/pl/ý R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system32\ntos.exe, O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\jtufzwsp.dll (file missing) O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [GrooveMonitor] “C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” O4 - HKLM…\Run: [symantec PIF AlertEng] “C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” /a /m “C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll” O4 - HKLM…\Run: [AVP] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe” O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [bitComet] “F:\Program Files\BitComet\BitComet.exe” /tray O4 - HKCU…\Run: [ares] “D:\Program Files\Ares\Ares.exe” -h O4 - HKCU…\Run: [userinit] C:\WINDOWS\system32\ntos.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - F:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - d:\Program Files\Ares\chatServer.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

ComboFix 07-11-19.4 - Wronx 2007-11-26 13:48:53.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.131 [GMT 1:00] Running from: C:\Documents and Settings\Wronx\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Documents and Settings\All Users\Menu Start\Live Safety Center.lnk C:\Documents and Settings\All Users\Menu Start\Online Security Guide.lnk C:\Documents and Settings\Wronx\Ulubione\Online Security Guide.lnk C:\WINDOWS\system32\jtufzwsp.dllbox C:\WINDOWS\system32\srqss.ini C:\WINDOWS\system32\srqss.ini2 C:\WINDOWS\system32\ssqrs.dll C:\WINDOWS\system32\wsnpoem C:\WINDOWS\system32\xbpkxbhp.ini2 C:\WINDOWS\system32\xbpkxbhp.tmp . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((( Files Created from 2007-10-26 to 2007-11-26 ))))))))))))))))))))))))))))))) . 2007-11-26 13:07 90,112 --a------ C:\WINDOWS\system32\RegDACL.exe 2007-11-26 13:07 53,248 --a------ C:\WINDOWS\system32\process.exe 2007-11-26 13:07 4,096 --a------ C:\WINDOWS\system32\reboot.exe 2007-11-25 16:51 79,936 --a------ C:\WINDOWS\system32\eoevhlib.dll 2007-11-24 13:09 82,061 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-11-24 13:09 81,549 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-11-24 13:08 2007-11-24 13:08 2007-11-24 13:08 1,211,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-24 13:08 19,028 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-11-24 13:08 16,928 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-11-24 13:08 3,536 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2007-11-24 12:30 776,012 —hs---- C:\WINDOWS\system32\ddhwbbqu.ini 2007-11-22 16:00 79,936 --a------ C:\WINDOWS\system32\csjftekt.dll 2007-11-21 14:29 80,960 --a------ C:\WINDOWS\system32\ecwopsmp.dll 2007-11-21 13:22 80,960 --a------ C:\WINDOWS\system32\eoyuimjn.dll 2007-11-20 19:12 143 --a------ C:\WINDOWS\system32\mcrh.tmp 2007-11-12 15:16 2007-11-11 16:40 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-11-10 14:38 2007-11-10 14:38 2007-11-09 14:07 2007-11-09 14:07 2007-11-09 14:06 2007-11-09 14:05 2007-11-08 18:37 2007-11-08 18:37 2007-11-08 16:48 2007-11-08 12:33 2007-11-04 18:11 2007-10-27 12:44 68,456 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-24 12:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2007-11-19 07:47 83,008 ----a-w C:\WINDOWS\system32\yxrvxvyg.dll 2007-11-17 12:12 65,536 ----a-w C:\WINDOWS\IFinst27.exe 2007-11-09 22:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2007-11-08 15:48 --------- d-----w C:\Program Files\Lavasoft 2007-11-03 16:29 --------- d-----w C:\Documents and Settings\Wronx\Dane aplikacji\GanymedeNet 2007-10-31 13:02 --------- d-----w C:\Program Files\Ganymede 2007-10-24 10:37 --------- d-----w C:\Program Files\Microsoft.NET 2007-10-24 10:18 --------- d-----w C:\Program Files\MSBuild 2007-10-24 10:18 --------- d-----w C:\Program Files\Microsoft Works 2007-10-23 22:11 --------- d-----w C:\Program Files\Nero 2007-10-23 22:11 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-23 22:11 --------- d-----w C:\Documents and Settings\Wronx\Dane aplikacji\Ahead 2007-10-21 10:12 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-11 13:42 8,925 ----a-w C:\clean.bat 2007-10-11 07:55 347 ----a-w C:\run2.reg 2007-10-07 18:03 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-07 18:03 --------- d-----w C:\Program Files\123MP3Wav 2007-10-07 10:44 --------- d-----w C:\Program Files\AviSynth 2.5 2007-10-05 21:07 --------- d-----w C:\Documents and Settings\Wronx\Dane aplikacji\Gadu-Gadu 2007-10-03 12:17 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-10-03 12:17 --------- d–h--r C:\Documents and Settings\Wronx\Dane aplikacji\SecuROM 2007-09-26 19:22 --------- d-----w C:\Documents and Settings\Wronx\Dane aplikacji\AdobeUM 2007-09-26 19:20 --------- d-----w C:\Program Files\Common Files\Adobe 2007-09-26 06:15 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-09-26 06:14 --------- d-----w C:\Program Files\Winamp 2006-05-03 09:06 163,328 --sh–r C:\WINDOWS\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh–r C:\WINDOWS\system32\msfDX.dll . ((((((((((((((((((((((((((((( snapshot@2007-11-26_13.35.24.32 ))))))))))))))))))))))))))))))))))))))))) . - 2007-11-26 12:23:04 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-11-26 12:41:45 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-11-26 12:23:04 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2007-11-26 12:41:45 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2007-11-26 12:41:45 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{27c0db70-32d1-4914-a8f4-fe7e0e0a17ec}] 2007-11-25 16:51 79936 --a------ C:\WINDOWS\system32\eoevhlib.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“D:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 09:39] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 13:00] “BitComet”=“F:\Program Files\BitComet\BitComet.exe” [2007-09-10 13:33] “ares”=“D:\Program Files\Ares\Ares.exe” [2007-05-04 02:32] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NeroCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-04 13:00 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2006-10-22 11:22 C:\WINDOWS\system32\nwiz.exe] “SoundMan”=“SOUNDMAN.EXE” [2003-08-05 06:59 C:\WINDOWS\SOUNDMAN.EXE] “NvMediaCenter”=“RUNDLL32.exe” [2004-08-04 13:00 C:\WINDOWS\system32\rundll32.exe] “GrooveMonitor”=“C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” [2006-10-26 23:47] “Symantec PIF AlertEng”=“C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” [2007-03-12 18:30] “AVP”=“C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe” [2007-06-28 12:51] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 13:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jtufzwsp] C:\WINDOWS\system32\klogon.dll 2007-06-28 12:51 206088 C:\WINDOWS\system32\klogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winosz32] R1 ISODrive;ISO DVD/CD-ROM Device Driver;??\C:\Program Files\UltraISO\drivers\ISODrive.sys R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys S3 tcpip_patcher;tcpip_patcher;??\D:\Program Files\Ares\tcpip_patcher.sys . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-26 13:50:23 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-26 13:51:01 . — E O F —

Gutek · 26 Listopad 2007 17:59

Wklej do Notatnika:

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo

system · 27 Listopad 2007 15:45

ComboFix 07-11-19.4 - Wronx 2007-11-27 16:36:35.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.25 [GMT 1:00] Running from: C:\Documents and Settings\Wronx\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Wronx\Pulpit\CFScript.txt * Created a new restore point FILE C:\WINDOWS\IFinst27.exe C:\WINDOWS\system32\csjftekt.dll C:\WINDOWS\system32\ddhwbbqu.ini C:\WINDOWS\system32\ecwopsmp.dll C:\WINDOWS\system32\eoevhlib.dll C:\WINDOWS\system32\eoyuimjn.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\yxrvxvyg.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\IFinst27.exe C:\WINDOWS\system32\csjftekt.dll C:\WINDOWS\system32\ddhwbbqu.ini C:\WINDOWS\system32\ecwopsmp.dll C:\WINDOWS\system32\eoyuimjn.dll . ((((((((((((((((((((((((( Files Created from 2007-10-27 to 2007-11-27 ))))))))))))))))))))))))))))))) . 2007-11-27 15:15 2007-11-27 15:13 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys 2007-11-27 15:13 10,592 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.cat 2007-11-27 15:13 705 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.inf 2007-11-26 18:51 10,740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2007-11-26 17:11 2007-11-12 15:16 2007-11-10 14:38 2007-11-10 14:38 2007-11-09 14:07 2007-11-09 14:07 2007-11-09 14:06 2007-11-09 14:05 2007-11-08 18:37 2007-11-08 18:37 2007-11-08 16:48 2007-11-08 12:33 2007-11-04 18:11 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 09:31 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2007-11-27 09:31 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2007-11-27 09:31 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-11-24 12:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2007-11-09 22:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2007-11-08 15:48 --------- d-----w C:\Program Files\Lavasoft 2007-11-03 16:29 --------- d-----w C:\Documents and Settings\Wronx\Dane aplikacji\GanymedeNet 2007-10-31 13:02 --------- d-----w C:\Program Files\Ganymede 2007-10-24 10:37 --------- d-----w C:\Program Files\Microsoft.NET 2007-10-24 10:18 --------- d-----w C:\Program Files\MSBuild 2007-10-24 10:18 --------- d-----w C:\Program Files\Microsoft Works 2007-10-23 22:11 --------- d-----w C:\Program Files\Nero 2007-10-23 22:11 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-23 22:11 --------- d-----w C:\Documents and Settings\Wronx\Dane aplikacji\Ahead 2007-10-21 10:12 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-11 13:42 8,925 ----a-w C:\clean.bat 2007-10-11 07:55 347 ----a-w C:\run2.reg 2007-10-07 18:03 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-07 18:03 --------- d-----w C:\Program Files\123MP3Wav 2007-10-07 10:44 --------- d-----w C:\Program Files\AviSynth 2.5 2007-10-05 21:07 --------- d-----w C:\Documents and Settings\Wronx\Dane aplikacji\Gadu-Gadu 2007-10-03 12:17 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-10-03 12:17 --------- d–h--r C:\Documents and Settings\Wronx\Dane aplikacji\SecuROM 2006-05-03 09:06 163,328 --sh–r C:\WINDOWS\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh–r C:\WINDOWS\system32\msfDX.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“D:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 09:39] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 13:00] “SpybotSD TeaTimer”=“C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe” [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NeroCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-04 13:00 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2006-10-22 11:22 C:\WINDOWS\system32\nwiz.exe] “SoundMan”=“SOUNDMAN.EXE” [2003-08-05 06:59 C:\WINDOWS\SOUNDMAN.EXE] “NvMediaCenter”=“RUNDLL32.exe” [2004-08-04 13:00 C:\WINDOWS\system32\rundll32.exe] “GrooveMonitor”=“C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” [2006-10-26 23:47] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2007-03-14 19:10] “Symantec PIF AlertEng”=“C:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” [2007-03-12 18:30] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 13:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jtufzwsp] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winosz32] *Newly Created Service* - COMHOST . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-27 16:40:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-27 16:42:01 - machine was rebooted C:\ComboFix2.txt … 2007-11-26 13:51 . — E O F —

Gutek · 28 Listopad 2007 00:08

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.