Uciążliwy proces "DDB7CA10.exe" (log) (backdoor.ag

[michmarmik (Junak)]

Witam!

mam taki problem dotyczacy takiego procesu “DDB7CA10.exe”."zamula"mi kompa(procek ok60%i20-30uzycie pamieci) i w zaden sposob nie potrafie okreslic co to za proces i gdzie sie uruchamia znalazlem tplik o tej nazwie w "C:\WINDOWS\system32\DDB7CA10.exe"ale po usunieciu i tak sie “tworzy” z powrotem.

daje log z HJT juz z wylaczonym procesem.

Logfile of HijackThis v1.99.1 Scan saved at 22:30:38, on 2007-05-01 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe E:\Programy\BearShare\BearShare.exe C:\Program Files\PLANET WL-8310\WLANPRO.exe C:\WINDOWS\System32\taskmgr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\MYIE2\MyIE.exe C:\Program Files\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\PROGRAMY\FLASHGET\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - E:\PROGRAMY\FLASHGET\getflash.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\PROGRAMY\FLASHGET\fgiebar.dll O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [bearShare] “E:\Programy\BearShare\BearShare.exe” /pause O4 - Global Startup: PLANET WL-8310 Configuration Utility.lnk = C:\Program Files\PLANET WL-8310\WLANPRO.exe O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - E:\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - E:\Programy\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRAMY\FLASHGET\flashget.exe O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRAMY\FLASHGET\flashget.exe O12 - Plugin for .3gp: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll O12 - Plugin for .amr: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

a i jeszcze jedna dziwna rzecz.po kazdym ponownym uruchomieniu suystemu zegar cofa mi sie o rowno dwa lata.

mam:Microsoft Windows XP Home Edition, wersja 5.1.2600 (WinXP Retail)+Service Pack. 1

[Joan (Joan Sunshine)]

F2 - REG:system.ini: UserInit=userinit.exe

usun wpis

daj loga z silentrunners

Skan AVG AntySpyware 7.5 po update, wklej raport.

[michmarmik (Junak)]

F2 - REG:system.ini: UserInit=userinit.exe

usuniete.

dysk przeskanowany ale bez aktualizacji skanera(nie chcial sie polaczyc)znalazl jakies"dziadostwo"wszysko usunolem,dam raport i loga,w pozniejszym terminie, bo spalil mi sie monitor mysle ze juz dzis go naprawie

Złączono Posta : 04.05.2007 (Pią) 15:58

Ok monitor juz dziala

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Cmaudio” = “RunDll32 cmicnfg.cpl,CMICtrlWnd” [MS] “BearShare” = ““E:\Programy\BearShare\BearShare.exe” /pause” [“Free Peers, Inc.”] “!AVG Anti-Spyware” = ““C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized” [“Anti-Malware Development a.s.”] HKLM\Software\Microsoft\Active Setup\Installed Components\ >{26923b43-4d38-484f-9b9e-de460746276c}(Default) = “Internet Explorer” \StubPath = “C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE” [MS] >{881dd1c5-3dcf-431b-b061-f3f88e8be88a}(Default) = “Outlook Express” \StubPath = “C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}(Default) = (no title provided) -> {HKLM…CLSID} = “IeCatch5 Class” \InProcServer32(Default) = “E:\PROGRAMY\FLASHGET\jccatch.dll” [“FlashGet”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” [“Sun Microsystems, Inc.”] {F156768E-81EF-470C-9057-481BA8380DBA}(Default) = (no title provided) -> {HKLM…CLSID} = “gFlash Class” \InProcServer32(Default) = “E:\PROGRAMY\FLASHGET\getflash.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Programy\WinRAR\rarext.dll” [null data] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] “{0E6C58A9-F592-4862-B35F-CA45E24003B3}” = “CloneCD” -> {HKLM…CLSID} = “CloneCD Shell Extension” \InProcServer32(Default) = “C:\Program Files\Elaborate Bytes\CloneCD\ElbyVCDShell.dll” [“Elaborate Bytes”] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” -> {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll” [“Alcohol Soft Development Team”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“Anti-Malware Development a.s.”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Programy\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Programy\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Programy\WinRAR\rarext.dll” [null data] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegistryTools” = (REG_DWORD) hex:0x00000000 {Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\ACD Wallpaper.cmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\ACD Wallpaper.cmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\RESOUR~1\SCREEN~1\Helios.scr” [null data] Startup items in “Właściciel” & “All Users” startup folders: ------------------------------------------------------------ C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart “PLANET WL-8310 Configuration Utility” -> shortcut to: “C:\Program Files\PLANET WL-8310\WLANPRO.exe” [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 16 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{E0E899AB-F487-11D5-8D29-0050BA6940E3}” = “FlashGet Bar” -> {HKLM…CLSID} = “FlashGet Bar” \InProcServer32(Default) = “E:\PROGRAMY\FLASHGET\fgiebar.dll” [“Amaze Soft”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{BF1CED2C-4B3F-4079-A330-864EDA5A4CFF}(Default) = “Protection Bar” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\Program Files\QualityCodec\iesplugin.dll” [file not found] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.5.0_10” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_10” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll” [“Sun Microsystems, Inc.”] {85D1F590-48F4-11D9-9669-0800200C9A66}\ “MenuText” = “Uninstall BitDefender Online Scanner v8” “Exec” = “%windir%\bdoscandel.exe” [null data] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ “ButtonText” = “FlashGet” “MenuText” = “&FlashGet” “Exec” = “E:\PROGRAMY\FLASHGET\flashget.exe” [“FlashGet.com”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\System32\Ati2evxx.exe” [“ATI Technologies Inc.”] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe” [“Anti-Malware Development a.s.”] LexBce Server, LexBceS, “C:\WINDOWS\system32\LEXBCES.EXE” [“Lexmark International, Inc.”] StyleXPService, StyleXPService, ““C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe”” [empty string] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Lexmark Network Port\Driver = “LEXLMPM.DLL” [“Lexmark International, Inc.”] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 63072542 seconds. ---------- (total run time: 63074107 seconds)

--------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 19:41:56 2007-05-02 + Scan result: HKLM\SOFTWARE\Classes\CLSID{bf1ced2c-4b3f-4079-a330-864eda5a4cff} -> Adware.Generic : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP64\A0074114.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP64\A0074156.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP64\A0074173.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP65\A0074217.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP66\A0074236.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP66\A0074251.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP67\A0074263.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP67\A0075263.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP67\A0075681.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP68\A0075697.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP68\A0075742.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP68\A0075755.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP69\A0075811.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0075857.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0075898.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0075912.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0075930.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0075945.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0075971.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0076971.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0076981.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0076998.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077076.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077114.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077132.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077141.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077179.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077188.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077222.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077231.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077243.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077256.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077318.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077328.exe -> Backdoor.Agent.ahj : Cleaned. C:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP70\A0077338.exe -> Backdoor.Agent.ahj : Cleaned. C:\WINDOWS\system32\DDB7CA10.exe -> Backdoor.Agent.ahj : Cleaned. D:\WINDOWS.000\antyvirk.exe -> Heuristic.Win32.Dialer : Cleaned. E:\System Volume Information_restore{26F68D24-2C1D-4F1F-9EBE-013FDD32F973}\RP62\A0069661.exe -> Heuristic.Win32.Dialer : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@2o7[2].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@heavycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@4.adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@ads.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@ad.adocean[2].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@gde.adocean[2].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@idg.adocean[2].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@my.adocean[2].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@com[1].txt -> TrackingCookie.Com : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@media.fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@hit.gemius[2].txt -> TrackingCookie.Gemius : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@searchportal.information[1].txt -> TrackingCookie.Information : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@revenue[2].txt -> TrackingCookie.Revenue : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Documents and Settings\Właściciel\Cookies\właściciel@zedo[1].txt -> TrackingCookie.Zedo : Cleaned. ::Report end

No dobra wiem juz ze mam backdoor.agent. ale jak to cholerstwo usunać??

[Gutek]

Jak uzyskać dostęp do folderu System Volume Information

http://support.microsoft.com/kb/309531/PL/

[michmarmik (Junak)]

Czasem mozna zapomniec o prostych rzeczach

chyba z wirusami spokoj.

A macie jakies pomysly co do tego zegara(caly czas sie cofa o dwa lata!)?

[adam9870]

Spróbuj ustawić czas spod wiersza polecenia (start -> uruchom -> cmd) za pomocą poleceń date i time , a jeśli to nie pomoże, ustaw czas w BIOSie.

[michmarmik (Junak)]

Juz probowalem ustawiac w biosie i z wiersza i za kazdym razem sie przestawia(mam2005-05-05).bateria raczej ok.jakies sugestie?

[qrczak13]

A jak wyłączysz automatyczną synchronizacje z serwerem to też?

bateria raczej ok

A kiedy wymieniałeś?

[michmarmik (Junak)]

Automatyczna synchronizacja jest caly czas wylaczona.

Baterie nigdy nie wymienialem ale wydaje mi sie ze jak by byla padnieta to by sie zegarek calkiem zerowal a nie cofaj o dwa lata,no i by sie bios rezetowal…

p.s. uciazliwy proces DDB7CA10.exe powrocił

przywracanie systemu wyłączone, System Volume Information puste…

[Joan (Joan Sunshine)]

Przeskanuj jeszcze SUPERAntiSpyware Free Edition i wklej nowe logi

[michmarmik (Junak)]

Przeskanowałem.znalazlo tylko Trojan.LZX32 i Worm.Rbot Variant

LOG

Logfile of HijackThis v1.99.1 Scan saved at 21:59:33, on 2005-05-06 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE E:\Programy\BearShare\BearShare.exe C:\WINDOWS\System32\DDB7CA10.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\PLANET WL-8310\WLANPRO.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\taskmgr.exe C:\Program Files\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\PROGRAMY\FLASHGET\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - E:\PROGRAMY\FLASHGET\getflash.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\PROGRAMY\FLASHGET\fgiebar.dll O4 - HKLM…\Run: [bearShare] “E:\Programy\BearShare\BearShare.exe” /pause O4 - HKCU…\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - Global Startup: PLANET WL-8310 Configuration Utility.lnk = C:\Program Files\PLANET WL-8310\WLANPRO.exe O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - E:\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - E:\Programy\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRAMY\FLASHGET\flashget.exe O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRAMY\FLASHGET\flashget.exe O12 - Plugin for .3gp: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll O12 - Plugin for .amr: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

i

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SUPERAntiSpyware” = “C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe” [“SUPERAntiSpyware.com”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “BearShare” = ““E:\Programy\BearShare\BearShare.exe” /pause” [“Free Peers, Inc.”] HKLM\Software\Microsoft\Active Setup\Installed Components\ >{26923b43-4d38-484f-9b9e-de460746276c}(Default) = “Internet Explorer” \StubPath = “C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE” [MS] >{881dd1c5-3dcf-431b-b061-f3f88e8be88a}(Default) = “Outlook Express” \StubPath = “C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}(Default) = (no title provided) -> {HKLM…CLSID} = “IeCatch5 Class” \InProcServer32(Default) = “E:\PROGRAMY\FLASHGET\jccatch.dll” [“FlashGet”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” [“Sun Microsystems, Inc.”] {F156768E-81EF-470C-9057-481BA8380DBA}(Default) = (no title provided) -> {HKLM…CLSID} = “gFlash Class” \InProcServer32(Default) = “E:\PROGRAMY\FLASHGET\getflash.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Programy\WinRAR\rarext.dll” [null data] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] “{0E6C58A9-F592-4862-B35F-CA45E24003B3}” = “CloneCD” -> {HKLM…CLSID} = “CloneCD Shell Extension” \InProcServer32(Default) = “C:\Program Files\Elaborate Bytes\CloneCD\ElbyVCDShell.dll” [“Elaborate Bytes”] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” -> {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll” [“Alcohol Soft Development Team”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}” = (no title provided) -> {HKLM…CLSID} = “SABShellExecuteHook Class” \InProcServer32(Default) = “C:\Program Files\SUPERAntiSpyware\SASSEH.DLL” [“SuperAdBlocker.com”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> !SASWinLogon\DLLName = “C:\Program Files\SUPERAntiSpyware\SASWINLO.dll” [“SUPERAntiSpyware.com”] <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Programy\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Programy\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Programy\WinRAR\rarext.dll” [null data] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegistryTools” = (REG_DWORD) hex:0x00000000 {Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\RESOUR~1\SCREEN~1\Helios.scr” [null data] Startup items in “Właściciel” & “All Users” startup folders: ------------------------------------------------------------ C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart “PLANET WL-8310 Configuration Utility” -> shortcut to: “C:\Program Files\PLANET WL-8310\WLANPRO.exe” [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 16 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{E0E899AB-F487-11D5-8D29-0050BA6940E3}” = “FlashGet Bar” -> {HKLM…CLSID} = “FlashGet Bar” \InProcServer32(Default) = “E:\PROGRAMY\FLASHGET\fgiebar.dll” [“Amaze Soft”] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.5.0_10” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_10” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll” [“Sun Microsystems, Inc.”] {85D1F590-48F4-11D9-9669-0800200C9A66}\ “MenuText” = “Uninstall BitDefender Online Scanner v8” “Exec” = “%windir%\bdoscandel.exe” [null data] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ “ButtonText” = “FlashGet” “MenuText” = “&FlashGet” “Exec” = “E:\PROGRAMY\FLASHGET\flashget.exe” [“FlashGet.com”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\System32\Ati2evxx.exe” [“ATI Technologies Inc.”] LexBce Server, LexBceS, “C:\WINDOWS\system32\LEXBCES.EXE” [“Lexmark International, Inc.”] StyleXPService, StyleXPService, ““C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe”” [empty string] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Lexmark Network Port\Driver = “LEXLMPM.DLL” [“Lexmark International, Inc.”] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 438 seconds. ---------- (total run time: 2095 seconds)

a proces nadal jest…

[Joan (Joan Sunshine)]

Ściągasz narzędzie KillBox, zaznaczasz Delete on Reboot, potem klikasz All Files i wklejasz do pola Full Path of File to Delete ścieżkę:

C:\WINDOWS\System32\DDB7CA10.exe

Klikasz X i reset sysa.

Daj nowe logi

[squeet]

Baterie nigdy nie wymienialem ale wydaje mi sie ze jak by byla padnieta to by sie zegarek calkiem zerowal a nie cofaj o dwa lata,no i by sie bios rezetowal…

No nie do końca. Gdy bateria padnie, to gdy komputer jest wyłączony, nie ma elementu podtrzymującego ustawienia. Często słaba bateryjka = właśnie cofający się czas.

Jeśli nie wymieniałeś nigdy, to zrób to. Nie zaszkodzi, a operacja nie jest droga (kilka złotych na baterię).

[michmarmik (Junak)]

Nie wiem czy jest sens dawac nowe logi jak i tak pliczek "DDB7CA10.exe

" tworzy sie ponownie za kazdym usunieciem(ręcznie czy tez killbox’em).czy dac logi??

co do bateri to squeet ma racje.wymienic nie zaszkodzi:)

[Gutek]

Daj log z Combofix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[michmarmik (Junak)]

“Waciciel” - 2005-05-07 16:50:24 Dodatek Service Pack. 1 ComboFix 07-05.07.3.V - Running from: “F:” (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\7017A074.EXE C:\WINDOWS\system32\7017A074.dll C:\DOCUME~1\LOCALS~1.ZAR\DANEAP~1\netmon\log.txt C:\DOCUME~1\LOCALS~1.ZAR\DANEAP~1\netmon\domains.txt C:\DOCUME~1\LOCALS~1.ZAR\DANEAP~1\netmon C:\Program Files\Common Files{D4559~1 C:\Program Files\Common Files{D4559~2 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\C\WINDOWS\system32\WNSXS~1 ((((((((((((((((((((((((((((((( Files Created from 2005-04-07 to 2005-05-07 )))))))))))))))))))))))))))))))))) (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\7017A074.EXE C:\WINDOWS\system32\7017A074.dll C:\DOCUME~1\LOCALS~1.ZAR\DANEAP~1\netmon\log.txt C:\DOCUME~1\LOCALS~1.ZAR\DANEAP~1\netmon\domains.txt C:\DOCUME~1\LOCALS~1.ZAR\DANEAP~1\netmon C:\Program Files\Common Files{D4559~1 C:\Program Files\Common Files{D4559~2 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\C\WINDOWS\system32\WNSXS~1 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\C\WINDOWS\system32\WNSXS~1 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\C\WINDOWS\system32\WNSXS~1 C:\qoobox\purity\C\WINDOWS\system32\WNSXS~1\W?nSxS ((((((((((((((((((((((((((((((( Files Created from 2005-04-07 to 2005-05-07 )))))))))))))))))))))))))))))))))) 2005-05-31 00:58 28,160 --a------ C:\WINDOWS\system32\drivers\ATITool.sys 2005-05-31 00:58 28,160 --a------ C:\WINDOWS\system32\drivers\ATITool.sys 2005-05-07 06:38 73,728 --a------ C:\KillBox.exe 2005-05-07 06:38 73,728 --a------ C:\KillBox.exe 2005-05-07 06:38 2005-05-07 06:38 2005-05-06 20:44 2005-05-06 20:44 2005-05-06 20:44 2005-05-06 20:44 2005-05-06 20:44 2005-05-06 20:44 2005-05-06 07:30 14,075 --a------ C:\WINDOWS\system32\DDB7CA10.exe 2005-05-06 07:30 14,075 --a------ C:\WINDOWS\system32\DDB7CA10.exe 2005-04-28 15:26 2005-04-28 15:26 2005-04-28 14:43 218,112 --a------ C:\Program Files\HijackThis.exe 2005-04-28 14:43 218,112 --a------ C:\Program Files\HijackThis.exe 2005-04-27 18:43 0 --a------ C:\WINDOWS\system32\SBRC.dat 2005-04-27 18:43 0 --a------ C:\WINDOWS\system32\SBRC.dat 2005-04-27 18:43 0 --a------ C:\WINDOWS\system32\SBFC.dat 2005-04-27 18:43 0 --a------ C:\WINDOWS\system32\SBFC.dat 2005-04-25 22:36 0 --a------ C:\WINDOWS\PowerReg.dat 2005-04-25 22:36 0 --a------ C:\WINDOWS\PowerReg.dat 2005-04-25 22:36 0 --a------ C:\CONFIG.SYS 2005-04-25 22:36 0 --a------ C:\CONFIG.SYS 2005-04-25 22:35 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2005-04-25 22:35 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2005-04-25 16:30 11,329 --a------ C:\WINDOWS\system32\2F072152.DLL 2005-04-25 16:30 11,329 --a------ C:\WINDOWS\system32\2F072152.DLL (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-04 19:35:50 -------- d-----w C:\Program Files\Canon 2007-05-01 08:40:52 -------- d-----w C:\Program Files\backups 2007-04-25 05:02:06 -------- d-----w C:\Program Files\Media Player Classic 2007-04-24 21:14:04 464 ----a-w C:\WINDOWS\system32\xvidcore.dll 2007-04-24 21:14:04 464 ----a-w C:\WINDOWS\system32\DivX.dll 2007-04-19 16:31:30 51,202 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-19 16:31:30 358,536 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-03 19:35:30 -------- d-----w C:\Program Files\illiminable 2007-03-20 18:33:18 -------- d-----w C:\Program Files\MYIE2 2007-03-17 09:18:52 -------- d-----w C:\Program Files\SkanerOnline 2007-03-15 18:30:06 -------- d-----w C:\Program Files\Common Files\Canon 2007-02-16 14:13:20 1,241 ----a-w C:\WINDOWS\unins002.dat 2007-02-08 18:25:56 110,592 ----a-w C:\WINDOWS\system32\duninstall.exe 2007-02-05 16:08:54 -------- d-----w C:\Program Files\DAEMON Tools 2007-02-05 16:06:54 639,224 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-02-01 17:22:40 4 ----a-w C:\WINDOWS\system32\proc-220146841.bin 2007-01-24 18:02:18 7,064 ----a-w C:\WINDOWS\unins000.dat 2007-01-24 18:02:06 669,002 ----a-w C:\WINDOWS\unins000.exe 2007-01-19 09:01:52 -------- d-----w C:\Program Files\Winamp 2007-01-19 07:40:42 89,088 ----a-w C:\WINDOWS\system32\SkanerOnlineUninstall.exe 2007-01-05 16:07:08 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-01-05 16:07:08 221,184 ----a-w C:\WINDOWS\system32\UAService7.exe 2006-12-31 20:34:40 52,736 ----a-w C:\WINDOWS\ipuninst.exe 2006-11-13 16:51:48 1,430 ----a-w C:\WINDOWS\system32\tmp.reg 2006-11-12 19:00:58 -------- d-----w C:\Program Files\Alcohol Soft 2006-10-23 19:18:46 239 ----a-w C:\WINDOWS_system.dat 2006-10-07 19:55:20 445 ----a-w C:\WINDOWS\EntPack.dat 2006-10-02 16:11:16 8,464 ----a-w C:\WINDOWS\system32\sporder.dll 2006-10-02 15:24:48 -------- d-----w C:\Program Files\TGTSoft 2006-09-11 14:54:48 -------- d-----w C:\Program Files\Elaborate Bytes 2006-09-05 15:31:06 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll 2006-09-05 15:31:06 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll 2006-09-05 15:31:06 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll 2006-09-04 19:47:30 807 ----a-w C:\WINDOWS\unins001.dat 2006-08-22 09:03:02 -------- d-----w C:\Program Files\Real Alternative 2006-08-05 13:26:16 -------- d-----w C:\Program Files\ACD Systems 2006-08-04 21:22:38 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll 2006-08-04 21:22:00 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll 2006-08-04 21:21:12 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2006-08-04 21:21:04 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2006-08-04 21:21:00 755,200 ----a-w C:\WINDOWS\system32\ir50_32.dll 2006-08-04 21:19:34 155,648 ----a-w C:\WINDOWS\system32\xvidvfw.dll 2006-08-04 21:19:04 626,688 ----a-w C:\WINDOWS\system32\xvid.dll 2006-08-04 20:31:08 -------- d-----w C:\Program Files\Przeglądarka migawek 2006-08-04 20:22:58 2,560 ----a-w C:\WINDOWS_MSRSTRT.EXE 2006-08-03 22:23:38 1,167 ----a-w C:\WINDOWS\system32\zdy899e9.sys 2006-08-03 22:23:06 -------- d-----w C:\Program Files\Common Files\iokz 2006-08-01 20:00:14 -------- d-----w C:\Program Files\Common Files\ACD Systems 2006-07-30 14:27:04 451,072 ----a-w C:\WINDOWS\Radeon Omega Drivers v3.8.252 Uninstall.exe 2006-07-30 14:19:00 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2006-07-13 17:44:44 29,184 ----a-w C:\WINDOWS\system32\AH6XL32.dll 2006-07-12 19:27:34 90,240 ----a-w C:\WINDOWS\system32\drivers\sptd3181.sys 2006-07-12 19:03:54 3,399 ----a-w C:\WINDOWS\system32\sdbackup.reg 2006-06-18 13:54:08 36,864 ----a-w C:\WINDOWS\system32\frapsvid.dll 2006-06-06 17:26:06 796,672 ----a-w C:\WINDOWS\GPInstall.exe 2006-06-06 17:25:38 -------- d-----w C:\Program Files\ATITool 2006-05-24 23:22:06 53,248 ----a-w C:\WINDOWS\bdoscandel.exe 2006-05-14 18:44:14 12,288 ----a-w C:\WINDOWS\d3dx.dat 2006-05-03 16:54:10 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2006-05-03 16:51:00 258,048 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2006-05-03 16:50:42 1,540,608 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2006-05-03 16:45:36 114,688 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2006-05-03 16:45:22 77,824 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2006-05-03 16:45:14 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2006-05-03 16:45:08 41,984 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2006-05-03 16:44:56 61,440 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2006-05-03 16:43:46 413,696 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2006-05-03 16:43:14 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2006-05-03 16:35:26 2,693,280 ----a-w C:\WINDOWS\system32\ati3duag.dll 2006-05-03 16:29:14 1,408,000 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2006-05-03 16:21:20 6,684,672 ----a-w C:\WINDOWS\system32\atioglx1.dll 2006-05-03 16:18:04 5,033,984 ----a-w C:\WINDOWS\system32\atioglxx.dll 2006-05-03 16:15:58 151,552 ----a-w C:\WINDOWS\system32\atikvmag.dll 2006-05-03 16:15:10 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2006-05-03 16:12:26 286,720 ----a-w C:\WINDOWS\system32\ATIDEMGR.dll 2006-05-03 16:09:20 282,624 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2006-04-28 20:05:14 127,614 ----a-w C:\WINDOWS\system32\atiicdxx.dat 2006-04-16 19:20:00 -------- d-----w C:\Program Files\directx 2006-04-11 16:05:54 -------- d–h--w C:\Program Files\WindowsUpdate 2006-04-11 14:40:50 -------- d-----w C:\Program Files\Common Files\NSV 2006-03-18 18:20:54 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2006-03-15 19:01:10 -------- d-----w C:\Program Files\Common Files\EasyInfo 2006-03-03 10:31:26 1,047,552 ----a-w C:\WINDOWS\system32\OICDataPacketLib.dll 2006-02-22 07:15:00 380,928 ----a-w C:\WINDOWS\system32\atiicdxx.dll 2006-02-22 07:13:56 6,144 ----a-w C:\WINDOWS\system32\atiicdxx.sys 2006-02-22 07:13:48 348,160 ----a-w C:\WINDOWS\system32\aticds10.dll 2006-02-22 00:05:00 61,440 ----a-w C:\WINDOWS\system32\atiphexx.exe 2006-02-22 00:05:00 36,864 ----a-w C:\WINDOWS\system32\atiiprxx.exe 2006-02-22 00:05:00 344,064 ----a-w C:\WINDOWS\system32\atiptaxx.exe 2006-02-22 00:05:00 274,432 ----a-w C:\WINDOWS\system32\atipdsxx.dll 2006-02-22 00:05:00 2,060,288 ----a-w C:\WINDOWS\system32\atipuixx.dll 2006-02-22 00:05:00 139,264 ----a-w C:\WINDOWS\system32\atiprbxx.exe 2006-02-22 00:05:00 114,688 ----a-w C:\WINDOWS\system32\atippaxx.dll 2006-02-22 00:05:00 1,830,912 ----a-w C:\WINDOWS\system32\atiadaxx.exe 2006-02-16 17:42:18 13,365 ----a-w C:\WINDOWS\system32\drivers\mdc8021x.sys 2006-02-16 17:35:22 -------- d-----w C:\Program Files\ffdshow 2006-02-16 17:07:44 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2006-02-15 20:16:22 61,440 ----a-w C:\WINDOWS\system32\madCHook.dll 2006-02-15 16:13:22 222 ----a-w C:\AUTOEXEC.BAT 2006-02-14 20:49:52 1,668 --sh–r C:\MSDOS.SYS 2006-02-14 20:45:58 10,443 --sh–w C:\SUHDLOG.DAT 2006-02-07 13:53:00 61,440 ----a-w C:\WINDOWS\system32\mp4_vcodec.dll 2006-01-09 11:27:00 679,936 ----a-w C:\WINDOWS\system32\fun_mp4_enc.dll 2005-12-30 18:13:16 -------- d-----w C:\Program Files\Common Files\Nero 2005-12-30 18:10:54 -------- d-----w C:\Program Files\Common Files\Ahead 2005-12-15 18:42:12 9,600 ----a-r C:\WINDOWS\system32\drivers\vmnetadapter.sys 2005-12-15 18:42:12 5,120 ----a-r C:\WINDOWS\system32\vnetinst.dll 2005-12-15 18:42:12 10,240 ----a-r C:\WINDOWS\system32\drivers\vmnet.sys 2005-12-10 19:36:54 -------- d-----w C:\Program Files\Common Files\DirectX 2005-12-08 19:12:16 -------- d-----w C:\Program Files\AV VCS 3.0 2005-11-29 14:17:56 2,067,140 ----a-r C:\WINDOWS\system32\avcodec.dll 2005-11-03 11:01:10 6,144 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2005-10-26 19:12:50 20,640 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys 2005-10-21 17:47:02 -------- d-----w C:\Program Files\Common Files\Siemens AG Shared 2005-10-08 22:05:16 23,600 ----a-w C:\WINDOWS\system32\drivers\TVICHW32.SYS 2005-09-26 15:15:12 -------- d-----w C:\Program Files\Gadu-Gadu 2005-09-16 15:35:32 -------- d-----w C:\Program Files\Lavasoft 2005-09-16 14:39:50 -------- d-----w C:\Program Files\PLANET WL-8310 2005-09-16 14:26:26 -------- d-----w C:\Program Files\C-Media 3D Audio 2005-09-16 14:19:28 -------- d–h--w C:\Program Files\InstallShield Installation Information 2005-09-16 14:18:34 -------- d-----w C:\Program Files\Common Files\InstallShield 2005-09-16 14:12:12 -------- d-----w C:\Program Files\microsoft frontpage 2005-09-16 14:09:52 -------- d-----w C:\Program Files\Common Files\MSSoap 2005-09-16 14:09:46 -------- d-----w C:\Program Files\Movie Maker 2005-09-16 14:08:08 -------- d-----w C:\Program Files\MSN Gaming Zone 2005-09-16 14:07:42 -------- d-----w C:\Program Files\Windows NT 2005-09-16 14:02:58 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2005-07-22 17:57:48 62,672 ----a-w C:\WINDOWS\system32\dxdllreg.exe 2005-07-21 11:33:30 2,846,720 ----a-w C:\WINDOWS\system32\NCTAudioCompress3.dll 2005-07-19 15:53:48 249,856 ----a-w C:\WINDOWS\system32\NCTQuickTimeFile.dll 2005-07-08 16:31:48 495,104 ----a-w C:\WINDOWS\system32\NCTVideoCoreM.dll 2005-07-02 14:33:18 520,192 ----a-w C:\WINDOWS\system32\AVmmfecd.exe 2005-07-01 16:09:00 215,552 ----a-w C:\WINDOWS\system32\NCTWMVFile.dll 2005-06-29 14:28:40 188,416 ----a-w C:\WINDOWS\system32\NCTVideoFile.dll 2005-06-07 16:11:26 382,464 ----a-w C:\WINDOWS\system32\NCTAVIFile.dll 2005-06-01 10:16:22 778,240 ----a-w C:\WINDOWS\system32\NCTAudioCompress2.dll 2005-06-01 10:11:04 877,568 ----a-w C:\WINDOWS\system32\NCTAudioFile2.dll 2005-05-26 13:34:52 2,297,552 ----a-w C:\WINDOWS\system32\d3dx9_26.dll 2005-05-25 13:24:00 764,416 ----a-w C:\WINDOWS\system32\NCTRMFile.dll 2005-05-07 15:16:54 1 ----a-w C:\WINDOWS\system32\index.dat 2005-04-14 17:07:48 780,288 ----a-w C:\WINDOWS\system32\NCTVideoCompress.dll 2005-03-11 21:48:14 109,568 ------w C:\WINDOWS\system32\pxinsi64.exe 2005-03-11 21:48:14 108,544 ------w C:\WINDOWS\system32\pxcpyi64.exe 2005-03-11 21:28:34 151,552 ------w C:\WINDOWS\system32\pxwma.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] “{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}”=“E:\PROGRAMY\FLASHGET\jccatch.dll” “{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}”=“C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” “{F156768E-81EF-470C-9057-481BA8380DBA}”=“E:\PROGRAMY\FLASHGET\getflash.dll” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “BearShare”="“E:\Programy\BearShare\BearShare.exe” /pause" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “SUPERAntiSpyware”=“C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe” [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”=“C:\Program Files\SUPERAntiSpyware\SASSEH.DLL” HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify!SASWinLogon HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^all users.windows^menu start^programy^autostart^uninstall.exe C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Uninstall.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg!avg anti-spyware “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\atipta atiptaxx.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cmaudio RunDll32 cmicnfg.cpl,CMICtrlWnd HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\daemon tools “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\daemon tools-1033 “C:\Program Files\D-Tools\daemon.exe” -lang 1033 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\new.net startup rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stylexp C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2005-05-07 17:19:52 Windows 5.1.2600 Dodatek Service Pack. 1 FAT scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2005-05-07 17:19:58 C:\ComboFix-quarantined-files.txt … 2005-05-07 17:20

[Gutek]

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

Files to delete: C:\WINDOWS\system32\DDB7CA10.exe C:\WINDOWS\system32\2F072152.DLL C:\WINDOWS\system32\7017A074.EXE C:\WINDOWS\system32\7017A074.dll Folders to delete: C:\PROGRA~1\NEWDOT~1 C:\DOCUME~1\LOCALS~1.ZAR\DANEAP~1\netmon C:\Program Files\Common Files{D4559~1 C:\Program Files\Common Files{D4559~2 C:\qoobox\purity\C\WINDOWS\system32\WNSXS~1

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po tym nowe logi

[michmarmik (Junak)]

Log z Avenger’a

Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\kdpubiiy ******************* Script file located at: ??\C:\fkivmrqr.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\DDB7CA10.exe deleted successfully. File C:\WINDOWS\system32\2F072152.DLL deleted successfully. File C:\WINDOWS\system32\7017A074.EXE not found! Deletion of file C:\WINDOWS\system32\7017A074.EXE failed! Could not process line: C:\WINDOWS\system32\7017A074.EXE Status: 0xc0000034 File C:\WINDOWS\system32\7017A074.dll not found! Deletion of file C:\WINDOWS\system32\7017A074.dll failed! Could not process line: C:\WINDOWS\system32\7017A074.dll Status: 0xc0000034 Folder C:\PROGRA~1\NEWDOT~1 not found! Deletion of folder C:\PROGRA~1\NEWDOT~1 failed! Could not process line: C:\PROGRA~1\NEWDOT~1 Status: 0xc0000034 Folder C:\DOCUME~1\LOCALS~1.ZAR\DANEAP~1\netmon not found! Deletion of folder C:\DOCUME~1\LOCALS~1.ZAR\DANEAP~1\netmon failed! Could not process line: C:\DOCUME~1\LOCALS~1.ZAR\DANEAP~1\netmon Status: 0xc0000034 Folder C:\Program Files\Common Files{D4559~1 not found! Deletion of folder C:\Program Files\Common Files{D4559~1 failed! Could not process line: C:\Program Files\Common Files{D4559~1 Status: 0xc0000034 Folder C:\Program Files\Common Files{D4559~2 not found! Deletion of folder C:\Program Files\Common Files{D4559~2 failed! Could not process line: C:\Program Files\Common Files{D4559~2 Status: 0xc0000034 Folder C:\qoobox\purity\C\WINDOWS\system32\WNSXS~1 deleted successfully. Completed script processing. ******************* Finished! Terminate.

ComboFix

“Waciciel” - 2005-05-07 17:54:51 Dodatek Service Pack. 1 ComboFix 07-05.07.3.V - Running from: “F:” ((((((((((((((((((((((((((((((( Files Created from 2005-04-07 to 2005-05-07 )))))))))))))))))))))))))))))))))) 2005-05-31 00:58 28,160 --a------ C:\WINDOWS\system32\drivers\ATITool.sys 2005-05-07 17:50 2005-05-07 17:19 49,152 --a------ C:\WINDOWS\nircmd.exe 2005-05-07 06:38 73,728 --a------ C:\KillBox.exe 2005-05-07 06:38 2005-05-06 20:44 2005-05-06 20:44 2005-05-06 20:44 2005-04-28 15:26 2005-04-28 14:43 218,112 --a------ C:\Program Files\HijackThis.exe 2005-04-27 18:43 0 --a------ C:\WINDOWS\system32\SBRC.dat 2005-04-27 18:43 0 --a------ C:\WINDOWS\system32\SBFC.dat 2005-04-25 22:36 0 --a------ C:\WINDOWS\PowerReg.dat 2005-04-25 22:36 0 --a------ C:\CONFIG.SYS 2005-04-25 22:35 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-04 19:35:50 -------- d-----w C:\Program Files\Canon 2007-05-01 08:40:52 -------- d-----w C:\Program Files\backups 2007-04-25 05:02:06 -------- d-----w C:\Program Files\Media Player Classic 2007-04-24 21:14:04 464 ----a-w C:\WINDOWS\system32\xvidcore.dll 2007-04-24 21:14:04 464 ----a-w C:\WINDOWS\system32\DivX.dll 2007-04-19 16:31:30 51,202 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-19 16:31:30 358,536 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-03 19:35:30 -------- d-----w C:\Program Files\illiminable 2007-03-20 18:33:18 -------- d-----w C:\Program Files\MYIE2 2007-03-17 09:18:52 -------- d-----w C:\Program Files\SkanerOnline 2007-03-15 18:30:06 -------- d-----w C:\Program Files\Common Files\Canon 2007-02-16 14:13:20 1,241 ----a-w C:\WINDOWS\unins002.dat 2007-02-08 18:25:56 110,592 ----a-w C:\WINDOWS\system32\duninstall.exe 2007-02-05 16:08:54 -------- d-----w C:\Program Files\DAEMON Tools 2007-02-05 16:06:54 639,224 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-02-01 17:22:40 4 ----a-w C:\WINDOWS\system32\proc-220146841.bin 2007-01-24 18:02:18 7,064 ----a-w C:\WINDOWS\unins000.dat 2007-01-24 18:02:06 669,002 ----a-w C:\WINDOWS\unins000.exe 2007-01-19 09:01:52 -------- d-----w C:\Program Files\Winamp 2007-01-19 07:40:42 89,088 ----a-w C:\WINDOWS\system32\SkanerOnlineUninstall.exe 2007-01-05 16:07:08 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-01-05 16:07:08 221,184 ----a-w C:\WINDOWS\system32\UAService7.exe 2006-12-31 20:34:40 52,736 ----a-w C:\WINDOWS\ipuninst.exe 2006-11-13 16:51:48 1,430 ----a-w C:\WINDOWS\system32\tmp.reg 2006-11-12 19:00:58 -------- d-----w C:\Program Files\Alcohol Soft 2006-10-23 19:18:46 239 ----a-w C:\WINDOWS_system.dat 2006-10-07 19:55:20 445 ----a-w C:\WINDOWS\EntPack.dat 2006-10-02 16:11:16 8,464 ----a-w C:\WINDOWS\system32\sporder.dll 2006-10-02 15:24:48 -------- d-----w C:\Program Files\TGTSoft 2006-09-11 14:54:48 -------- d-----w C:\Program Files\Elaborate Bytes 2006-09-05 15:31:06 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll 2006-09-05 15:31:06 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll 2006-09-05 15:31:06 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll 2006-09-04 19:47:30 807 ----a-w C:\WINDOWS\unins001.dat 2006-08-22 09:03:02 -------- d-----w C:\Program Files\Real Alternative 2006-08-05 13:26:16 -------- d-----w C:\Program Files\ACD Systems 2006-08-04 21:22:38 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll 2006-08-04 21:22:00 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll 2006-08-04 21:21:12 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2006-08-04 21:21:04 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2006-08-04 21:21:00 755,200 ----a-w C:\WINDOWS\system32\ir50_32.dll 2006-08-04 21:19:34 155,648 ----a-w C:\WINDOWS\system32\xvidvfw.dll 2006-08-04 21:19:04 626,688 ----a-w C:\WINDOWS\system32\xvid.dll 2006-08-04 20:31:08 -------- d-----w C:\Program Files\Przeglądarka migawek 2006-08-04 20:22:58 2,560 ----a-w C:\WINDOWS_MSRSTRT.EXE 2006-08-03 22:23:38 1,167 ----a-w C:\WINDOWS\system32\zdy899e9.sys 2006-08-03 22:23:06 -------- d-----w C:\Program Files\Common Files\iokz 2006-08-01 20:00:14 -------- d-----w C:\Program Files\Common Files\ACD Systems 2006-07-30 14:27:04 451,072 ----a-w C:\WINDOWS\Radeon Omega Drivers v3.8.252 Uninstall.exe 2006-07-30 14:19:00 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2006-07-13 17:44:44 29,184 ----a-w C:\WINDOWS\system32\AH6XL32.dll 2006-07-12 19:27:34 90,240 ----a-w C:\WINDOWS\system32\drivers\sptd3181.sys 2006-07-12 19:03:54 3,399 ----a-w C:\WINDOWS\system32\sdbackup.reg 2006-06-18 13:54:08 36,864 ----a-w C:\WINDOWS\system32\frapsvid.dll 2006-06-06 17:26:06 796,672 ----a-w C:\WINDOWS\GPInstall.exe 2006-06-06 17:25:38 -------- d-----w C:\Program Files\ATITool 2006-05-24 23:22:06 53,248 ----a-w C:\WINDOWS\bdoscandel.exe 2006-05-14 18:44:14 12,288 ----a-w C:\WINDOWS\d3dx.dat 2006-05-03 16:54:10 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2006-05-03 16:51:00 258,048 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2006-05-03 16:50:42 1,540,608 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2006-05-03 16:45:36 114,688 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2006-05-03 16:45:22 77,824 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2006-05-03 16:45:14 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2006-05-03 16:45:08 41,984 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2006-05-03 16:44:56 61,440 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2006-05-03 16:43:46 413,696 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2006-05-03 16:43:14 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2006-05-03 16:35:26 2,693,280 ----a-w C:\WINDOWS\system32\ati3duag.dll 2006-05-03 16:29:14 1,408,000 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2006-05-03 16:21:20 6,684,672 ----a-w C:\WINDOWS\system32\atioglx1.dll 2006-05-03 16:18:04 5,033,984 ----a-w C:\WINDOWS\system32\atioglxx.dll 2006-05-03 16:15:58 151,552 ----a-w C:\WINDOWS\system32\atikvmag.dll 2006-05-03 16:15:10 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2006-05-03 16:12:26 286,720 ----a-w C:\WINDOWS\system32\ATIDEMGR.dll 2006-05-03 16:09:20 282,624 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2006-04-28 20:05:14 127,614 ----a-w C:\WINDOWS\system32\atiicdxx.dat 2006-04-16 19:20:00 -------- d-----w C:\Program Files\directx 2006-04-11 16:05:54 -------- d–h--w C:\Program Files\WindowsUpdate 2006-04-11 14:40:50 -------- d-----w C:\Program Files\Common Files\NSV 2006-03-18 18:20:54 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2006-03-15 19:01:10 -------- d-----w C:\Program Files\Common Files\EasyInfo 2006-03-03 10:31:26 1,047,552 ----a-w C:\WINDOWS\system32\OICDataPacketLib.dll 2006-02-22 07:15:00 380,928 ----a-w C:\WINDOWS\system32\atiicdxx.dll 2006-02-22 07:13:56 6,144 ----a-w C:\WINDOWS\system32\atiicdxx.sys 2006-02-22 07:13:48 348,160 ----a-w C:\WINDOWS\system32\aticds10.dll 2006-02-22 00:05:00 61,440 ----a-w C:\WINDOWS\system32\atiphexx.exe 2006-02-22 00:05:00 36,864 ----a-w C:\WINDOWS\system32\atiiprxx.exe 2006-02-22 00:05:00 344,064 ----a-w C:\WINDOWS\system32\atiptaxx.exe 2006-02-22 00:05:00 274,432 ----a-w C:\WINDOWS\system32\atipdsxx.dll 2006-02-22 00:05:00 2,060,288 ----a-w C:\WINDOWS\system32\atipuixx.dll 2006-02-22 00:05:00 139,264 ----a-w C:\WINDOWS\system32\atiprbxx.exe 2006-02-22 00:05:00 114,688 ----a-w C:\WINDOWS\system32\atippaxx.dll 2006-02-22 00:05:00 1,830,912 ----a-w C:\WINDOWS\system32\atiadaxx.exe 2006-02-16 17:42:18 13,365 ----a-w C:\WINDOWS\system32\drivers\mdc8021x.sys 2006-02-16 17:35:22 -------- d-----w C:\Program Files\ffdshow 2006-02-16 17:07:44 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2006-02-15 20:16:22 61,440 ----a-w C:\WINDOWS\system32\madCHook.dll 2006-02-15 16:13:22 222 ----a-w C:\AUTOEXEC.BAT 2006-02-14 20:49:52 1,668 --sh–r C:\MSDOS.SYS 2006-02-14 20:45:58 10,443 --sh–w C:\SUHDLOG.DAT 2006-02-07 13:53:00 61,440 ----a-w C:\WINDOWS\system32\mp4_vcodec.dll 2006-01-09 11:27:00 679,936 ----a-w C:\WINDOWS\system32\fun_mp4_enc.dll 2005-12-30 18:13:16 -------- d-----w C:\Program Files\Common Files\Nero 2005-12-30 18:10:54 -------- d-----w C:\Program Files\Common Files\Ahead 2005-12-15 18:42:12 9,600 ----a-r C:\WINDOWS\system32\drivers\vmnetadapter.sys 2005-12-15 18:42:12 5,120 ----a-r C:\WINDOWS\system32\vnetinst.dll 2005-12-15 18:42:12 10,240 ----a-r C:\WINDOWS\system32\drivers\vmnet.sys 2005-12-10 19:36:54 -------- d-----w C:\Program Files\Common Files\DirectX 2005-12-08 19:12:16 -------- d-----w C:\Program Files\AV VCS 3.0 2005-11-29 14:17:56 2,067,140 ----a-r C:\WINDOWS\system32\avcodec.dll 2005-11-03 11:01:10 6,144 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2005-10-26 19:12:50 20,640 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys 2005-10-21 17:47:02 -------- d-----w C:\Program Files\Common Files\Siemens AG Shared 2005-10-08 22:05:16 23,600 ----a-w C:\WINDOWS\system32\drivers\TVICHW32.SYS 2005-09-26 15:15:12 -------- d-----w C:\Program Files\Gadu-Gadu 2005-09-16 15:35:32 -------- d-----w C:\Program Files\Lavasoft 2005-09-16 14:39:50 -------- d-----w C:\Program Files\PLANET WL-8310 2005-09-16 14:26:26 -------- d-----w C:\Program Files\C-Media 3D Audio 2005-09-16 14:19:28 -------- d–h--w C:\Program Files\InstallShield Installation Information 2005-09-16 14:18:34 -------- d-----w C:\Program Files\Common Files\InstallShield 2005-09-16 14:12:12 -------- d-----w C:\Program Files\microsoft frontpage 2005-09-16 14:09:52 -------- d-----w C:\Program Files\Common Files\MSSoap 2005-09-16 14:09:46 -------- d-----w C:\Program Files\Movie Maker 2005-09-16 14:08:08 -------- d-----w C:\Program Files\MSN Gaming Zone 2005-09-16 14:07:42 -------- d-----w C:\Program Files\Windows NT 2005-09-16 14:02:58 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2005-07-22 17:57:48 62,672 ----a-w C:\WINDOWS\system32\dxdllreg.exe 2005-07-21 11:33:30 2,846,720 ----a-w C:\WINDOWS\system32\NCTAudioCompress3.dll 2005-07-19 15:53:48 249,856 ----a-w C:\WINDOWS\system32\NCTQuickTimeFile.dll 2005-07-08 16:31:48 495,104 ----a-w C:\WINDOWS\system32\NCTVideoCoreM.dll 2005-07-02 14:33:18 520,192 ----a-w C:\WINDOWS\system32\AVmmfecd.exe 2005-07-01 16:09:00 215,552 ----a-w C:\WINDOWS\system32\NCTWMVFile.dll 2005-06-29 14:28:40 188,416 ----a-w C:\WINDOWS\system32\NCTVideoFile.dll 2005-06-07 16:11:26 382,464 ----a-w C:\WINDOWS\system32\NCTAVIFile.dll 2005-06-01 10:16:22 778,240 ----a-w C:\WINDOWS\system32\NCTAudioCompress2.dll 2005-06-01 10:11:04 877,568 ----a-w C:\WINDOWS\system32\NCTAudioFile2.dll 2005-05-26 13:34:52 2,297,552 ----a-w C:\WINDOWS\system32\d3dx9_26.dll 2005-05-25 13:24:00 764,416 ----a-w C:\WINDOWS\system32\NCTRMFile.dll 2005-05-07 15:16:54 1 ----a-w C:\WINDOWS\system32\index.dat 2005-04-14 17:07:48 780,288 ----a-w C:\WINDOWS\system32\NCTVideoCompress.dll 2005-03-11 21:48:14 109,568 ------w C:\WINDOWS\system32\pxinsi64.exe 2005-03-11 21:48:14 108,544 ------w C:\WINDOWS\system32\pxcpyi64.exe 2005-03-11 21:28:34 151,552 ------w C:\WINDOWS\system32\pxwma.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] “{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}”=“E:\PROGRAMY\FLASHGET\jccatch.dll” “{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}”=“C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” “{F156768E-81EF-470C-9057-481BA8380DBA}”=“E:\PROGRAMY\FLASHGET\getflash.dll” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “BearShare”="“E:\Programy\BearShare\BearShare.exe” /pause" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “SUPERAntiSpyware”=“C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe” [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”=“C:\Program Files\SUPERAntiSpyware\SASSEH.DLL” HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify!SASWinLogon HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^all users.windows^menu start^programy^autostart^uninstall.exe C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Uninstall.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg!avg anti-spyware “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\atipta atiptaxx.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cmaudio RunDll32 cmicnfg.cpl,CMICtrlWnd HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\daemon tools “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\daemon tools-1033 “C:\Program Files\D-Tools\daemon.exe” -lang 1033 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\new.net startup rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stylexp C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2005-05-07 17:56:41 Windows 5.1.2600 Dodatek Service Pack. 1 FAT scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2005-05-07 17:56:47 C:\ComboFix2.txt … 2005-05-07 17:20 C:\ComboFix-quarantined-files.txt … 2005-05-07 17:56

[Gutek]

Aj nie dodałem klucza do Avengera, otwórz notatnik i wklej:

Otwórz Notatnik i wklej w nim to:

Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup]

Plik >>> Zapisz jako >>> Ustaw rozszerzenie z TXT na Wszystkie pliki >>> zapisz pod nazwą FIX.REG >>> kliknij podwójnie zrobiony plik i potwierdź >>> reset kompa

Powinno być Ok

[michmarmik (Junak)]

OK zrobiene.procesu juz nie ma.mam nadzieje ze juz nie bedzie. wielkie dzieki! ale jak by co to jeszcze napisze