Video ActiveX Object

SEDNO · 22 Sierpień 2007 10:09

Witam

Ten temat moze juz dawno zostal zapomniny, ale zeby nie tworzyc nowego wpisze sie tu.

Ja tez zlapalem trojana w Video ActiveX Object.

Prosze o pomoc.

Oto moje loga:

HijackThis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:48:06, on 2007-08-22 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\DOCUME~1\KWIATEK\USTAWI~1\Temp\RarSFX0\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {5DDE5591-A8AB-4897-93EF-1E4E943F85A7} - C:\Program Files\Video ActiveX Access\iesplg.dll (file missing) O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb106\Dealio.dll O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb106\Dealio.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Protection Bar - {CC18AE76-7E65-4258-A193-9EA0C52DA6B8} - C:\Program Files\Video ActiveX Access\iesbpl.dll (file missing) O4 - HKLM…\Run: [JMB36X Configure] C:\WINDOWS\System32\JMRaidTool.exe boot O4 - HKLM…\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime -Delay O4 - HKLM…\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM…\Run: [iSUSScheduler] “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [au] C:\Program Files\Dealio\DealioAU.exe O4 - HKLM…\Run: [LogonStudio] “C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe” /RANDOM O4 - HKLM…\Run: [mkstray] D:\Program Files\mks_vir_2007\bin\mkstray.exe O4 - HKLM…\Run: [mks_mail] D:\Program Files\mks_vir_2007\bin\mks_mail.exe O4 - HKLM…\Run: [MKSRegmon] D:\Program Files\mks_vir_2007\bin\mksregmon.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [sIDEBAR] “C:\Program Files\Desktop Sidebar\dsidebar.exe” O4 - HKLM…\Policies\Explorer\Run: [user32.dll] C:\Program Files\Video ActiveX Access\iesmn.exe O4 - HKLM…\Policies\Explorer\Run: [rare] C:\Program Files\Video ActiveX Access\imsmain.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Download All with Rapidshare Downloader - C:\DOCUME~1\KWIATEK\USTAWI~1\Temp\RarSFX0\jc_all.htm O8 - Extra context menu item: &Download with Rapidshare Downloader - C:\DOCUME~1\KWIATEK\USTAWI~1\Temp\RarSFX0\jc_link.htm O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra ‘Tools’ menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: d:\program files\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: d:\program files\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: d:\program files\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: d:\program files\mks_vir_2007\bin\mkslsp.dll O22 - SharedTaskScheduler: falsism - {6e886df7-914d-48f0-86b3-a5cf24385361} - C:\WINDOWS\system32\fwrkqfl.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MksFwall - MKS Sp z o.o. - D:\Program Files\mks_vir_2007\bin\MksFwall.exe O23 - Service: MksPC - Unknown owner - D:\Program Files\mks_vir_2007\bin\MksPC.exe O23 - Service: MksUpdate - MKS Sp. z o. o. - D:\Program Files\mks_vir_2007\bin\mksupdate.exe O23 - Service: mks_vir file monitor (MksVirMonSvc) - Unknown owner - D:\Program Files\mks_vir_2007\bin\mksvirmonsvc.exe O23 - Service: MkS_Scan - Unknown owner - D:\Program Files\mks_vir_2007\bin\mks_scan.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe – End of file - 7266 bytes

Silent Runners “Silent Runners.vbs”, revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Gadu-Gadu” = ““D:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] “SIDEBAR” = ““C:\Program Files\Desktop Sidebar\dsidebar.exe”” [“Idea2”] HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++} “user32.dll” = “C:\Program Files\Video ActiveX Access\iesmn.exe” [file not found] “rare” = “C:\Program Files\Video ActiveX Access\imsmain.exe” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “JMB36X Configure” = “C:\WINDOWS\System32\JMRaidTool.exe boot” [“JMicron Technology Corp.”] “WooCnxMon” = “C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [empty string] “SpeedTouch USB Diagnostics” = ““C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon” [“THOMSON Telecom Belgium”] “WOOWATCH” = “C:\PROGRA~1\NEOSTR~1\Watch.exe” [“France Télécom R&D”] “WOOTASKBARICON” = “C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [“France Télécom R&D”] “ATICCC” = ““C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime -Delay” [null data] “ISUSPM Startup” = “C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup” [“InstallShield Software Corporation”] “ISUSScheduler” = ““C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start” [“InstallShield Software Corporation”] “(Default)” = “(empty string)” [file not found] “RTHDCPL” = “RTHDCPL.EXE” [“Realtek Semiconductor Corp.”] “Alcmtr” = “ALCMTR.EXE” [“Realtek Semiconductor Corp.”] “WinampAgent” = “C:\Program Files\Winamp\winampa.exe” [null data] “au” = “C:\Program Files\Dealio\DealioAU.exe” [“Vendio Services, Inc.”] “LogonStudio” = ““C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe” /RANDOM” [“Stardock and Luca Saggese”] “mkstray” = “D:\Program Files\mks_vir_2007\bin\mkstray.exe” [“MKS Sp z o.o.”] “mks_mail” = “D:\Program Files\mks_vir_2007\bin\mks_mail.exe” [“MkS Sp. z o.o.”] “MKSRegmon” = “D:\Program Files\mks_vir_2007\bin\mksregmon.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}(Default) = “flashget urlcatch” -> {HKLM…CLSID} = “FGCatchUrl” \InProcServer32(Default) = “C:\DOCUME~1\KWIATEK\USTAWI~1\Temp\RarSFX0\jccatch.dll” [“www.rapidshare.com”] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}(Default) = “BitComet ClickCapture” -> {HKLM…CLSID} = “BitComet Helper” \InProcServer32(Default) = “D:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll” [“BitComet”] {45AD732C-2CE2-4666-B366-B2214AD57A49}(Default) = “Idea2 SidebarBrowserMonitor Class” -> {HKLM…CLSID} = “Idea2 SidebarBrowserMonitor Class” \InProcServer32(Default) = “C:\Program Files\Desktop Sidebar\sbhelp.dll” [“Idea2”] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}(Default) = (no title provided) -> {HKLM…CLSID} = “Megaupload Toolbar” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” ["MEGAUPLOAD "] {5DDE5591-A8AB-4897-93EF-1E4E943F85A7}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Video ActiveX Access\iesplg.dll” [file not found] {6A87B991-A31F-4130-AE72-6D0C294BF082}(Default) = (no title provided) -> {HKLM…CLSID} = “DealioBHO Class” \InProcServer32(Default) = “C:\Program Files\Dealio\kb106\Dealio.dll” [“Vendio Services, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “D:\PROGRA~1\MICROS~1\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “D:\PROGRA~1\MICROS~1\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” -> {HKLM…CLSID} = “SimpleShlExt Class” \InProcServer32(Default) = “C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll” [empty string] “{950FF917-7A57-46BC-8017-59D9BF474000}” = “Shell Extension for CDRW” -> {HKLM…CLSID} = “Shell Extension for CDRW” \InProcServer32(Default) = “C:\Program Files\Ahead\InCD\incdshx.dll” [“Nero AG”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] “{A5110426-177D-4e08-AB3F-785F10B4439C}” = “Sony Ericsson File Manager” -> {HKLM…CLSID} = “Sony Ericsson File Manager” \InProcServer32(Default) = “C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll” [“Sony Ericsson Mobile Communications AB”] “{F2185E5D-720E-4956-90D9-75F6AC141575}” = “Idea2 SidebarIconHandler Class” -> {HKLM…CLSID} = “SidebarIconHandler Class” \InProcServer32(Default) = “C:\Program Files\Desktop Sidebar\sbhelp.dll” [“Idea2”] “{00020000-0000-1011-8004-0000C06B5161}” = “WIBU-SYSTEMS Shell Extension” -> {HKLM…CLSID} = “WIBU-SYSTEMS Shell Extension” \InProcServer32(Default) = “C:\Program Files\WIBU-SYSTEMS\System\WibuShellExt.dll” [“WIBU-SYSTEMS AG”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\ <> “{6e886df7-914d-48f0-86b3-a5cf24385361}” = “falsism” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\fwrkqfl.dll” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {00020000-0000-1011-8004-0000C06B5161}(Default) = (no title provided) -> {HKLM…CLSID} = “WIBU-SYSTEMS Shell Extension” \InProcServer32(Default) = “C:\Program Files\WIBU-SYSTEMS\System\WibuShellExt.dll” [“WIBU-SYSTEMS AG”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ MkS_Vir(Default) = “{E64226E0-9DA1-479E-8265-8D65BA327BD4}” -> {HKLM…CLSID} = “MkS_Vir Shell Extension” \InProcServer32(Default) = “D:\Program Files\mks_vir_2007\bin\mksshell.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ MkS_Vir(Default) = “{E64226E0-9DA1-479E-8265-8D65BA327BD4}” -> {HKLM…CLSID} = “MkS_Vir Shell Extension” \InProcServer32(Default) = “D:\Program Files\mks_vir_2007\bin\mksshell.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\KWIATEK\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\logon.scr” [MS] Startup items in “KWIATEK” & “All Users” startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] Enabled Scheduled Tasks: ------------------------ “WebReg 20070818151904” -> launches: "d:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe /TaskName 20070818151904 /N “psc 1300 series” /M Q3501A /S MY44MDF3TB9F /AP 303 /F /T " [“Hewlett-Packard Co.”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: D:\Program Files\mks_vir_2007\bin\mkslsp.dll [null data], 01 - 03, 25 %SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 09 - 24 %SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}” -> {HKLM…CLSID} = “Dealio” \InProcServer32(Default) = “C:\Program Files\Dealio\kb106\Dealio.dll” [“Vendio Services, Inc.”] “{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}” -> {HKLM…CLSID} = “Megaupload Toolbar” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” ["MEGAUPLOAD "] “{CC18AE76-7E65-4258-A193-9EA0C52DA6B8}” -> {HKLM…CLSID} = “Protection Bar” \InProcServer32(Default) = “C:\Program Files\Video ActiveX Access\iesbpl.dll” [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}” = (no title provided) -> {HKLM…CLSID} = “Dealio” \InProcServer32(Default) = “C:\Program Files\Dealio\kb106\Dealio.dll” [“Vendio Services, Inc.”] “{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}” = (no title provided) -> {HKLM…CLSID} = “Megaupload Toolbar” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” ["MEGAUPLOAD "] “{CC18AE76-7E65-4258-A193-9EA0C52DA6B8}” = (no title provided) -> {HKLM…CLSID} = “Protection Bar” \InProcServer32(Default) = “C:\Program Files\Video ActiveX Access\iesbpl.dll” [file not found] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {5C4C24D0-28B6-4B6B-B70F-E09848367F10}(Default) = (no title provided) -> {HKLM…CLSID} = “Dealio” \InProcServer32(Default) = “C:\Program Files\Dealio\kb106\Dealio.dll” [“Vendio Services, Inc.”] HKLM\Software\Classes\CLSID{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}(Default) = “Volet Wanadoo” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\audience\audience.dll” [empty string] HKLM\Software\Classes\CLSID{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}(Default) = “ToolBand Class” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\audience\audience.dll” [empty string] HKLM\Software\Classes\CLSID{5BF498C0-931E-4A4F-B33F-456D07137EAA}(Default) = “Volet Wanadoo” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\audience\audience.dll” [empty string] HKLM\Software\Classes\CLSID{CC18AE76-7E65-4258-A193-9EA0C52DA6B8}(Default) = “Protection Bar” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\Program Files\Video ActiveX Access\iesbpl.dll” [file not found] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {09FE188B-6E85-479E-9411-51FB2220DF80}\ “ButtonText” = “Subscribe in Desktop Sidebar” “MenuText” = “Subscribe in Desktop Sidebar” “CLSIDExtension” = “{45AD732C-2CE2-4666-B366-B2214AD57A49}” -> {HKLM…CLSID} = “Idea2 SidebarBrowserMonitor Class” \InProcServer32(Default) = “C:\Program Files\Desktop Sidebar\sbhelp.dll” [“Idea2”] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {E908B145-C847-4E85-B315-07E2E70DECF8}\ “ButtonText” = “Dealio” “CLSIDExtension” = “{9F038672-0425-4792-BC9C-36DE3308E8AA}” -> {HKLM…CLSID} = “DealioToolbarHelper Class” \InProcServer32(Default) = “C:\Program Files\Dealio\kb106\Dealio.dll” [“Vendio Services, Inc.”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{08C06D61-F1F3-4799-86F8-BE1A89362C85}” = (no title provided) -> {HKLM…CLSID} = “Search Class” \InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL” [empty string] HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ <> “Tabs” = “C:\Documents and Settings\KWIATEK\Dane aplikacji\MEGAUPLOADTOOLBAR\tabwelcome.html” [null data] All Non-Disabled Services (Display Name, Service Name, Path {Service DLL}): --------------------------------------------------------------------------- Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\System32\Ati2evxx.exe” [“ATI Technologies Inc.”] InstallDriver Table Manager, IDriverT, ““C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe”” [“Macrovision Corporation”] Karta wydajności WMI, WmiApSrv, “C:\WINDOWS\System32\wbem\wmiapsrv.exe” [MS] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE”” [MS] MkS_Scan, MkS_Scan, “D:\Program Files\mks_vir_2007\bin\mks_scan.exe” [empty string] mks_vir file monitor, MksVirMonSvc, “D:\Program Files\mks_vir_2007\bin\mksvirmonsvc.exe” [null data] MksFwall, MksFwall, ““D:\Program Files\mks_vir_2007\bin\MksFwall.exe”” [“MKS Sp z o.o.”] MksPC, MksPC, ““D:\Program Files\mks_vir_2007\bin\MksPC.exe”” [null data] MksUpdate, MksUpdate, ““D:\Program Files\mks_vir_2007\bin\mksupdate.exe”” [“MKS Sp. z o. o.”] Office Source Engine, ose, “C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE” [MS] Portable Media Serial Number Service, WmdmPmSN, “C:\WINDOWS\System32\svchost.exe -k netsvcs” {“C:\WINDOWS\System32\mspmsnsv.dll” [MS]} StarWind iSCSI Service, StarWindService, “C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe” [“Rocket Division Software”] Usługa administracyjna Menedżera dysków logicznych, dmadmin, “C:\WINDOWS\System32\dmadmin.exe /com” [“Microsoft Corp., Veritas Software”] Usługa dostarczania sieci, xmlprov, “C:\WINDOWS\System32\svchost.exe -k netsvcs” {“C:\WINDOWS\System32\xmlprov.dll” [MS]} Usługa stanu ASP.NET, aspnet_state, “C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe” [MS] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt10\Driver = “hpzsnt10.dll” [“HP”] Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- (launch time: 2007-08-22 10:48:11) <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 68 seconds. ---------- (total run time: 87 seconds)

Gutek · 22 Sierpień 2007 12:56

Proszę nie podpinaj się pod cudzy temat - wątek wydzielam

Na początek automat - użyj SmitFraudFix wybierz opcji nr 2 , oczywiście w trybie awaryjnym i po tym log z ComboFix - opis w temacie przyklejonym

SEDNO · 29 Sierpień 2007 08:53

Nie Silent Runners, nie HijackThis, wyczyścił zarazka SmitfraudFix :mrgreen:

Tyle rymów, a teraz poważnie

Użyłem SmitfraudFix’a i najwyraźniej załatwił sprawę, bo alert o zabezpieczeniach windows’a zniknął. Na wszelki wypadek jednak wklejam raporcik z SmitfraudFix’a:

SmitFraudFix v2.217 Scan done at 10:37:23,64, 2007-08-29 Run from C:\Documents and Settings\KWIATEK\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] “{6e886df7-914d-48f0-86b3-a5cf24385361}”=“falsism” [HKEY_CLASSES_ROOT\CLSID{6e886df7-914d-48f0-86b3-a5cf24385361}\InProcServer32] @=“C:\WINDOWS\system32\fwrkqfl.dll” [HKEY_LOCAL_MACHINE\Software\Classes\CLSID{6e886df7-914d-48f0-86b3-a5cf24385361}\InProcServer32] @=“C:\WINDOWS\system32\fwrkqfl.dll” »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri C:\WINDOWS\system32\fwrkqfl.dll - Hoax.Win32.Renos.gen.o C:\WINDOWS\system32\fwrkqfl.dll - Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\DOCUME~1\ALLUSE~1\MENUST~1\Online Security Guide.url Deleted C:\DOCUME~1\ALLUSE~1\MENUST~1\Security Troubleshooting.url Deleted C:\DOCUME~1\KWIATEK\Ulubione\Online Security Test.url Deleted C:\Program Files\VirusProtectPro 3.7\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» End ComboFix nie używałem, bo podany link wygasł lub jest błędny, a pozatym najwyraźniej wirus usunięty, więc uznałem, że nie ma potrzeby szukania ComboFix’a (no chyba, że się mylę). Dziękuję i pozdrawiam

Gutek · 29 Sierpień 2007 16:16

Miałeś VirusProtectPro - daj log z DSS, jest do pobrania na dole tam gdzi był combo

SEDNO · 8 Wrzesień 2007 09:29

w końcu udało mi się pobrać ComboFix, a więc wklejam log:

ComboFix 07-08-30.3 - “KWIATEK” 2007-09-08 11:15:58.1 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1788 [GMT 2:00] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\KWIATEK\DANEAP~1\macromedia\Flash Player#SharedObjects\UW7JL6RF\www.broadcaster.com C:\DOCUME~1\KWIATEK\DANEAP~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys#www.broadcaster.com ((((((((((((((((((((((((( Files Created from 2007-08-08 to 2007-09-08 ))))))))))))))))))))))))))))))) 2007-09-08 11:14 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-09-04 20:59 2007-09-04 20:58 2007-08-29 10:37 3,168 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-29 10:29 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-29 10:29 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-29 10:29 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-22 12:36 2007-08-22 10:56 2007-08-22 10:17 2007-08-17 18:03 2007-08-10 11:49 2007-08-08 17:13 2007-08-08 13:40 1,034,752 --a–c— C:\WINDOWS\system32\dllcache\explorer.exe 2007-08-08 13:40 1,034,752 --a------ C:\WINDOWS\explorer.exe 2007-08-08 13:27 2007-08-08 13:23 2007-08-08 13:20 2007-08-08 13:11 187,392 --a------ C:\WINDOWS\system32\JPGUtils.dll 2007-08-08 13:11 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-08 11:14 --------- d-------- C:\Program Files\Neostrada TP 2007-09-08 11:01 5782528 --a------ C:\WINDOWS\system32\logonuiX.exe 2007-09-08 00:24 --------- d-------- C:\DOCUME~1\KWIATEK\DANEAP~1\Desktop Sidebar 2007-09-02 00:20 --------- d-------- C:\DOCUME~1\KWIATEK\DANEAP~1\MegauploadToolbar 2007-08-20 12:42 --------- d-------- C:\Program Files\Xilisoft 2007-08-14 16:20 12464 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-08-08 17:19 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-08-04 18:18 --------- d-------- C:\Program Files\Thoosje Sidebar V2.0 2007-08-03 14:10 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Age of Empires 3 2007-08-02 09:06 --------- d-------- C:\Program Files\MegauploadToolbar 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-19 12:24 --------- d-------- C:\Program Files\RadioComm 2007-07-19 12:19 --------- d-------- C:\Program Files\WIBUKEY 2007-07-19 12:19 --------- d-------- C:\Program Files\WIBU-SYSTEMS 2007-07-16 23:02 --------- d-------- C:\Program Files\Screenshot Pilot 2007-07-16 19:54 --------- d-------- C:\Program Files\Dealio 2007-07-16 19:53 --------- d-------- C:\Program Files\FDRLab 2007-07-12 13:57 --------- d-------- C:\Program Files\IrfanView 2007-07-12 13:51 --------- d-------- C:\Program Files\Google 2007-07-10 21:36 --------- d-------- C:\Program Files\Winamp 2007-07-09 21:07 524288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-07-09 21:07 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-07-09 21:07 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-07-09 21:07 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-07-09 21:05 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-07-09 21:05 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-07-09 21:05 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-07-09 21:05 740442 --a------ C:\WINDOWS\system32\DivX.dll 2007-07-09 21:05 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-07-09 21:05 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll 2007-07-09 21:05 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-07-09 21:05 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll 2007-07-09 21:05 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-07-09 21:05 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-07-09 21:05 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-07-09 21:05 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-07-09 21:05 124472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2007-07-09 21:05 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2007-07-06 13:44 319 --a------ C:\drmHeader.bin 2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-20 20:46 266088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-06-20 20:45 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2004-10-01 15:00 40960 --a------ C:\Program Files\Uninstall_CDS.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “JMB36X Configure”=“C:\WINDOWS\System32\JMRaidTool.exe” [2006-06-29 04:07] “WooCnxMon”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [2003-10-16 18:07] “SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-01-26 11:38] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2003-10-16 18:07] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [2003-10-16 18:07] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2006-01-02 17:41] “ISUSPM Startup”=“C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe” [2004-06-16 06:03] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2004-06-16 06:03] “RTHDCPL”=“RTHDCPL.EXE” [2006-04-17 09:34 C:\WINDOWS\RTHDCPL.exe] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-19 11:39] “au”=“C:\Program Files\Dealio\DealioAU.exe” [2007-06-27 12:46] “LogonStudio”=“C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe” [2002-09-03 18:38] “mkstray”=“D:\Program Files\mks_vir_2007\bin\mkstray.exe” [2007-08-08 17:30] “mks_mail”=“D:\Program Files\mks_vir_2007\bin\mks_mail.exe” [2007-05-24 05:06] “MKSRegmon”=“D:\Program Files\mks_vir_2007\bin\mksregmon.exe” [2007-05-24 05:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44] “Gadu-Gadu”=“D:\Program Files\Gadu-Gadu\gg.exe” [2006-10-10 17:51] “SIDEBAR”=“C:\Program Files\Desktop Sidebar\dsidebar.exe” [2006-07-09 21:58] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MkS_Scan] @=“service” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Image Zone - szybkie uruchamianie.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Image Zone - szybkie uruchamianie.lnk backup=C:\WINDOWS\pss\HP Image Zone - szybkie uruchamianie.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^KWIATEK^Menu Start^Programy^Autostart^Xfire.lnk] path=C:\Documents and Settings\KWIATEK\Menu Start\Programy\Autostart\Xfire.lnk backup=C:\WINDOWS\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] “d:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] “C:\Program Files\lg_fwupdate\fwupdate.exe” blrun [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] D:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “Pml Driver HPZ12”=3 (0x3) “mnmsrvc”=3 (0x3) “LightScribeService”=2 (0x2) “InCDsrv”=2 (0x2) “ATI Smart”=2 (0x2) R0 JGOGO;JMicron Hot-Plug Driver;C:\WINDOWS\system32\DRIVERS\JGOGO.sys R0 JRAID;JRAID;C:\WINDOWS\system32\DRIVERS\jraid.sys R0 mksidsa;mksidsa;C:\WINDOWS\system32\mksidsa.sys R1 mksfwallt;mksfwallt;??\C:\WINDOWS\system32\mksfwallt.sys S2 MksFwall;MksFwall;“D:\Program Files\mks_vir_2007\bin\MksFwall.exe” S2 MksPC;MksPC;“D:\Program Files\mks_vir_2007\bin\MksPC.exe” S2 MksUpdate;MksUpdate;“D:\Program Files\mks_vir_2007\bin\mksupdate.exe” S2 Vcs;Vcs support;??\C:\WINDOWS\System32\Drivers\Vcs.sys S2 WIBUKEY;WIBU-KEY Kernel Driver;C:\WINDOWS\system32\DRIVERS\Wibukey.sys S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys S3 mksfwallf;mksfwallf;??\C:\WINDOWS\system32\mksfwallf.sys S3 mksidsf;mksidsf;??\C:\WINDOWS\system32\mksidsf.sys S3 MksMonEn;MksMonEn;??\D:\Program Files\mks_vir_2007\bin\MksMonEn.sys S3 MksMonEv;MksMonEv;??\D:\Program Files\mks_vir_2007\bin\MksMonEv.sys S3 MksMonFd;MksMonFd;??\D:\Program Files\mks_vir_2007\bin\MksMonFd.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- G:\autorun.exe install\command- G:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{7e384340-4cdb-11dc-93a2-000e50aef27d}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command- Recycled\ctfmon.exe *Newly Created Service* - CATCHME Contents of the ‘Scheduled Tasks’ folder 2007-09-01 13:58:09 C:\WINDOWS\Tasks\WebReg 20070901155808.job - d:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-08 11:17:02 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-09-08 11:17:16 C:\ComboFix-quarantined-files.txt … 2007-09-08 11:17 — E O F —

na wszelki wypadek użyłem też dss:

Deckard’s System Scanner v20070905.67 Run by KWIATEK on 2007-09-08 11:23:02 Computer is in Normal Mode. -------------------------------------------------------------------------------- – System Restore -------------------------------------------------------------- Failed to create restore point; System Restore is disabled (service is not running). Backed up registry hives. Performed disk cleanup. – HijackThis (run as KWIATEK.exe) --------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:23:35, on 2007-09-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Program Files\mks_vir_2007\bin\MksFwall.exe C:\WINDOWS\system32\Ati2evxx.exe D:\Program Files\mks_vir_2007\bin\MksPC.exe C:\WINDOWS\Explorer.EXE D:\Program Files\mks_vir_2007\bin\mksupdate.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Winamp\winampa.exe D:\Program Files\mks_vir_2007\bin\mkstray.exe D:\Program Files\mks_vir_2007\bin\mks_mail.exe D:\Program Files\mks_vir_2007\bin\mksregmon.exe D:\Program Files\mks_vir_2007\bin\mksvirmonsvc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Documents and Settings\KWIATEK\Pulpit\dss.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\KWIATEK.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\DOCUME~1\KWIATEK\USTAWI~1\Temp\RarSFX0\jccatch.dll (file missing) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb106\Dealio.dll O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb106\Dealio.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM…\Run: [JMB36X Configure] C:\WINDOWS\System32\JMRaidTool.exe boot O4 - HKLM…\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime -Delay O4 - HKLM…\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM…\Run: [iSUSScheduler] “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [au] C:\Program Files\Dealio\DealioAU.exe O4 - HKLM…\Run: [LogonStudio] “C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe” /RANDOM O4 - HKLM…\Run: [mkstray] D:\Program Files\mks_vir_2007\bin\mkstray.exe O4 - HKLM…\Run: [mks_mail] D:\Program Files\mks_vir_2007\bin\mks_mail.exe O4 - HKLM…\Run: [MKSRegmon] D:\Program Files\mks_vir_2007\bin\mksregmon.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [sIDEBAR] “C:\Program Files\Desktop Sidebar\dsidebar.exe” O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Download All with Rapidshare Downloader - C:\DOCUME~1\KWIATEK\USTAWI~1\Temp\RarSFX0\jc_all.htm O8 - Extra context menu item: &Download with Rapidshare Downloader - C:\DOCUME~1\KWIATEK\USTAWI~1\Temp\RarSFX0\jc_link.htm O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra ‘Tools’ menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: d:\program files\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: d:\program files\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: d:\program files\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: d:\program files\mks_vir_2007\bin\mkslsp.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MksFwall - MKS Sp z o.o. - D:\Program Files\mks_vir_2007\bin\MksFwall.exe O23 - Service: MksPC - Unknown owner - D:\Program Files\mks_vir_2007\bin\MksPC.exe O23 - Service: MksUpdate - MKS Sp. z o. o. - D:\Program Files\mks_vir_2007\bin\mksupdate.exe O23 - Service: mks_vir file monitor (MksVirMonSvc) - Unknown owner - D:\Program Files\mks_vir_2007\bin\mksvirmonsvc.exe O23 - Service: MkS_Scan - Unknown owner - D:\Program Files\mks_vir_2007\bin\mks_scan.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe – End of file - 7688 bytes – File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL “%1”,%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser “%1”,%* – Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 JGOGO (JMicron Hot-Plug Driver) - c:\windows\system32\drivers\jgogo.sys R0 JRAID - c:\windows\system32\drivers\jraid.sys R0 mksidsa - c:\windows\system32\mksidsa.sys R1 mksfwallt - c:\windows\system32\mksfwallt.sys R2 atksgt - c:\windows\system32\drivers\atksgt.sys R2 lirsgt - c:\windows\system32\drivers\lirsgt.sys R2 Vcs (Vcs support) - c:\windows\system32\drivers\vcs.sys R2 WIBUKEY (WIBU-KEY Kernel Driver) - c:\windows\system32\drivers\wibukey.sys R3 mksfwallf - c:\windows\system32\mksfwallf.sys R3 mksidsf - c:\windows\system32\mksidsf.sys R3 MksMonEn - d:\program files\mks_vir_2007\bin\mksmonen.sys R3 MksMonEv - d:\program files\mks_vir_2007\bin\mksmonev.sys R3 MksMonFd - d:\program files\mks_vir_2007\bin\mksmonfd.sys S3 catchme - c:\docume~1\kwiatek\ustawi~1\temp\catchme.sys (file missing) – Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 MksFwall - “d:\program files\mks_vir_2007\bin\mksfwall.exe” R2 MksPC - “d:\program files\mks_vir_2007\bin\mkspc.exe” R2 MksUpdate - “d:\program files\mks_vir_2007\bin\mksupdate.exe” R2 MksVirMonSvc (mks_vir file monitor) - d:\program files\mks_vir_2007\bin\mksvirmonsvc.exe S3 MkS_Scan - d:\program files\mks_vir_2007\bin\mks_scan.exe – Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: RTL8187_Wireless Device ID: USB\VID_0BDA&PID_8187\0015AF03AEFC Manufacturer: Name: RTL8187_Wireless PNP Device ID: USB\VID_0BDA&PID_8187\0015AF03AEFC Service: – Scheduled Tasks ------------------------------------------------------------- 2007-09-01 15:58:09 436 --a------ C:\WINDOWS\Tasks\WebReg 20070901155808.job – Files created between 2007-08-08 and 2007-09-08 ----------------------------- 2007-08-29 10:37:26 3168 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-29 10:29:53 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-29 10:29:53 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-29 10:29:52 53248 --a------ C:\WINDOWS\system32\Process.exe http://www.beyondlogic.org; Command Line Process Utility> 2007-08-22 12:36:16 0 d-------- C:\Program Files\WORMS3D 2007-08-22 10:47:07 0 d–hs---- C:\WINDOWS\CSC 2007-08-22 10:17:59 0 d-------- C:\Program Files\Trend Micro 2007-08-17 18:03:55 0 d-------- C:\Program Files\SimTractor 3.5 2007-08-10 11:46:23 0 d-------- C:\Program Files\Common Files\Adobe 2007-08-08 13:27:54 0 d-------- C:\VTPFiles 2007-08-08 13:20:01 0 d-------- C:\Program Files\Common Files\Stardock 2007-08-08 13:11:13 187392 --a------ C:\WINDOWS\system32\JPGUtils.dll 2007-08-08 13:11:13 0 d-------- C:\Program Files\WinCustomize – Find3M Report --------------------------------------------------------------- 2007-09-08 11:23:00 0 d-------- C:\Documents and Settings\KWIATEK\Dane aplikacji\Desktop Sidebar 2007-09-08 11:21:30 5782528 --a------ C:\WINDOWS\system32\logonuiX.exe 2007-09-08 11:14:57 0 d-------- C:\Program Files\Neostrada TP 2007-09-04 20:59:12 0 d-------- C:\Documents and Settings\KWIATEK\Dane aplikacji\CyberLink 2007-09-02 00:20:48 0 d-------- C:\Documents and Settings\KWIATEK\Dane aplikacji\MegauploadToolbar 2007-08-20 12:42:28 0 d-------- C:\Program Files\Xilisoft 2007-08-10 11:49:03 0 d-------- C:\Documents and Settings\KWIATEK\Dane aplikacji\AdobeUM 2007-08-10 11:47:44 0 d-------- C:\Documents and Settings\KWIATEK\Dane aplikacji\Adobe 2007-08-10 11:46:23 0 d-------- C:\Program Files\Common Files 2007-08-08 17:19:09 0 d–h----- C:\Program Files\InstallShield Installation Information 2007-08-08 17:13:14 0 d-------- C:\Documents and Settings\KWIATEK\Dane aplikacji\Lavasoft 2007-08-08 13:23:58 0 d-------- C:\Documents and Settings\KWIATEK\Dane aplikacji\ViStart 2007-08-04 18:18:46 0 d-------- C:\Program Files\Thoosje Sidebar V2.0 2007-08-02 09:06:38 0 d-------- C:\Program Files\MegauploadToolbar 2007-07-19 12:24:35 0 d-------- C:\Program Files\RadioComm 2007-07-19 12:19:58 0 d-------- C:\Program Files\WIBU-SYSTEMS 2007-07-19 12:19:58 0 d-------- C:\Program Files\WIBUKEY 2007-07-16 23:02:54 0 d-------- C:\Program Files\Screenshot Pilot 2007-07-16 19:54:14 0 d-------- C:\Program Files\Dealio 2007-07-16 19:53:45 0 d-------- C:\Program Files\FDRLab 2007-07-12 13:57:36 0 d-------- C:\Program Files\IrfanView 2007-07-12 13:51:24 0 d-------- C:\Program Files\Google 2007-07-10 21:36:48 0 d-------- C:\Program Files\Winamp 2007-07-10 20:44:52 8192 --a------ C:\WINDOWS\d3dx.dat 2007-07-09 21:07:50 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-07-09 21:05:58 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-07-09 21:05:58 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-07-09 21:05:54 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-07-09 21:05:54 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-07-09 21:05:54 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-07-09 21:05:54 740442 --a------ C:\WINDOWS\system32\DivX.dll 2007-07-09 21:05:28 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2007-07-06 13:44:58 319 --a------ C:\drmHeader.bin 2007-06-20 16:08:04 439538 --a------ C:\WINDOWS\system32\perfh015.dat 2007-06-20 16:08:04 68554 --a------ C:\WINDOWS\system32\perfc015.dat – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “JMB36X Configure”=“C:\WINDOWS\System32\JMRaidTool.exe” [2006-06-29 04:07] “WooCnxMon”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [2003-10-16 18:07] “SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-01-26 11:38] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2003-10-16 18:07] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [2003-10-16 18:07] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2006-01-02 17:41] “ISUSPM Startup”=“C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe” [2004-06-16 06:03] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2004-06-16 06:03] “RTHDCPL”=“RTHDCPL.EXE” [2006-04-17 09:34 C:\WINDOWS\RTHDCPL.exe] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-19 11:39] “au”=“C:\Program Files\Dealio\DealioAU.exe” [2007-06-27 12:46] “LogonStudio”=“C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe” [2002-09-03 18:38] “mkstray”=“D:\Program Files\mks_vir_2007\bin\mkstray.exe” [2007-08-08 17:30] “mks_mail”=“D:\Program Files\mks_vir_2007\bin\mks_mail.exe” [2007-05-24 05:06] “MKSRegmon”=“D:\Program Files\mks_vir_2007\bin\mksregmon.exe” [2007-05-24 05:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44] “Gadu-Gadu”=“D:\Program Files\Gadu-Gadu\gg.exe” [2006-10-10 17:51] “SIDEBAR”=“C:\Program Files\Desktop Sidebar\dsidebar.exe” [2006-07-09 21:58] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MkS_Scan] @=“service” [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @=“Service” [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @=“Volume shadow copy” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Image Zone - szybkie uruchamianie.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Image Zone - szybkie uruchamianie.lnk backup=C:\WINDOWS\pss\HP Image Zone - szybkie uruchamianie.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^KWIATEK^Menu Start^Programy^Autostart^Xfire.lnk] path=C:\Documents and Settings\KWIATEK\Menu Start\Programy\Autostart\Xfire.lnk backup=C:\WINDOWS\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] “d:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] “C:\Program Files\lg_fwupdate\fwupdate.exe” blrun [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] D:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “Pml Driver HPZ12”=3 (0x3) “mnmsrvc”=3 (0x3) “LightScribeService”=2 (0x2) “InCDsrv”=2 (0x2) “ATI Smart”=2 (0x2) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- G:\autorun.exe install\command- G:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{7e384340-4cdb-11dc-93a2-000e50aef27d}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command- Recycled\ctfmon.exe – End of Deckard’s System Scanner: finished at 2007-09-08 11:24:05 ------------

Gutek · 8 Wrzesień 2007 16:26

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

SEDNO · 8 Wrzesień 2007 16:55

zrobione…

adam9870 · 8 Wrzesień 2007 17:19

W takim razie wykonaj i wklej dla pewności nowy log z ComboFix.

SEDNO · 8 Wrzesień 2007 23:04

ComboFix 07-08-30.3 - “KWIATEK” 2007-09-09 0:58:50.3 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1794 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-08-08 to 2007-09-08 ))))))))))))))))))))))))))))))) 2007-09-08 11:18 2007-09-08 11:14 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-09-04 20:59 2007-09-04 20:58 2007-08-29 10:37 3,168 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-29 10:29 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-29 10:29 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-29 10:29 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-22 12:36 2007-08-22 10:56 2007-08-22 10:17 2007-08-17 18:03 2007-08-10 11:49 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-09 00:53 --------- d-------- C:\DOCUME~1\KWIATEK\DANEAP~1\Desktop Sidebar 2007-09-08 18:53 --------- d-------- C:\Program Files\Neostrada TP 2007-09-08 18:52 5782528 --a------ C:\WINDOWS\system32\logonuiX.exe 2007-09-02 00:20 --------- d-------- C:\DOCUME~1\KWIATEK\DANEAP~1\MegauploadToolbar 2007-08-20 12:42 --------- d-------- C:\Program Files\Xilisoft 2007-08-14 16:20 12464 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-08-08 17:19 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-08-08 17:13 --------- d-------- C:\DOCUME~1\KWIATEK\DANEAP~1\Lavasoft 2007-08-08 13:23 --------- d-------- C:\DOCUME~1\KWIATEK\DANEAP~1\ViStart 2007-08-08 13:20 --------- d-------- C:\Program Files\Common Files\Stardock 2007-08-08 13:11 --------- d-------- C:\Program Files\WinCustomize 2007-08-04 18:18 --------- d-------- C:\Program Files\Thoosje Sidebar V2.0 2007-08-03 14:10 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Age of Empires 3 2007-08-02 09:06 --------- d-------- C:\Program Files\MegauploadToolbar 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-19 12:24 --------- d-------- C:\Program Files\RadioComm 2007-07-19 12:19 --------- d-------- C:\Program Files\WIBUKEY 2007-07-19 12:19 --------- d-------- C:\Program Files\WIBU-SYSTEMS 2007-07-16 23:02 --------- d-------- C:\Program Files\Screenshot Pilot 2007-07-16 19:54 --------- d-------- C:\Program Files\Dealio 2007-07-16 19:53 --------- d-------- C:\Program Files\FDRLab 2007-07-12 13:57 --------- d-------- C:\Program Files\IrfanView 2007-07-12 13:51 --------- d-------- C:\Program Files\Google 2007-07-10 21:36 --------- d-------- C:\Program Files\Winamp 2007-07-09 21:07 524288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-07-09 21:07 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-07-09 21:07 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-07-09 21:07 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-07-09 21:05 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-07-09 21:05 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-07-09 21:05 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-07-09 21:05 740442 --a------ C:\WINDOWS\system32\DivX.dll 2007-07-09 21:05 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-07-09 21:05 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll 2007-07-09 21:05 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-07-09 21:05 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll 2007-07-09 21:05 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-07-09 21:05 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-07-09 21:05 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-07-09 21:05 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-07-09 21:05 124472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2007-07-09 21:05 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2007-07-06 13:44 319 --a------ C:\drmHeader.bin 2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-20 20:46 266088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-06-20 20:45 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2007-06-13 15:23 1034752 --a------ C:\WINDOWS\explorer.exe 2004-10-01 15:00 40960 --a------ C:\Program Files\Uninstall_CDS.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “JMB36X Configure”=“C:\WINDOWS\System32\JMRaidTool.exe” [2006-06-29 04:07] “WooCnxMon”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [2003-10-16 18:07] “SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-01-26 11:38] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2003-10-16 18:07] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [2003-10-16 18:07] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2006-01-02 17:41] “ISUSPM Startup”=“C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe” [2004-06-16 06:03] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2004-06-16 06:03] “RTHDCPL”=“RTHDCPL.EXE” [2006-04-17 09:34 C:\WINDOWS\RTHDCPL.exe] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-19 11:39] “au”=“C:\Program Files\Dealio\DealioAU.exe” [2007-06-27 12:46] “LogonStudio”=“C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe” [2002-09-03 18:38] “mkstray”=“D:\Program Files\mks_vir_2007\bin\mkstray.exe” [2007-08-08 17:30] “mks_mail”=“D:\Program Files\mks_vir_2007\bin\mks_mail.exe” [2007-05-24 05:06] “MKSRegmon”=“D:\Program Files\mks_vir_2007\bin\mksregmon.exe” [2007-05-24 05:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44] “Gadu-Gadu”=“D:\Program Files\Gadu-Gadu\gg.exe” [2006-10-10 17:51] “SIDEBAR”=“C:\Program Files\Desktop Sidebar\dsidebar.exe” [2006-07-09 21:58] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MkS_Scan] @=“service” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Image Zone - szybkie uruchamianie.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Image Zone - szybkie uruchamianie.lnk backup=C:\WINDOWS\pss\HP Image Zone - szybkie uruchamianie.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^KWIATEK^Menu Start^Programy^Autostart^Xfire.lnk] path=C:\Documents and Settings\KWIATEK\Menu Start\Programy\Autostart\Xfire.lnk backup=C:\WINDOWS\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] “d:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] “C:\Program Files\lg_fwupdate\fwupdate.exe” blrun [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] D:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “Pml Driver HPZ12”=3 (0x3) “mnmsrvc”=3 (0x3) “LightScribeService”=2 (0x2) “InCDsrv”=2 (0x2) “ATI Smart”=2 (0x2) R0 JGOGO;JMicron Hot-Plug Driver;C:\WINDOWS\system32\DRIVERS\JGOGO.sys R0 JRAID;JRAID;C:\WINDOWS\system32\DRIVERS\jraid.sys R0 mksidsa;mksidsa;C:\WINDOWS\system32\mksidsa.sys R1 mksfwallt;mksfwallt;??\C:\WINDOWS\system32\mksfwallt.sys S2 MksFwall;MksFwall;“D:\Program Files\mks_vir_2007\bin\MksFwall.exe” S2 MksPC;MksPC;“D:\Program Files\mks_vir_2007\bin\MksPC.exe” S2 MksUpdate;MksUpdate;“D:\Program Files\mks_vir_2007\bin\mksupdate.exe” S2 Vcs;Vcs support;??\C:\WINDOWS\System32\Drivers\Vcs.sys S2 WIBUKEY;WIBU-KEY Kernel Driver;C:\WINDOWS\system32\DRIVERS\Wibukey.sys S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys S3 mksfwallf;mksfwallf;??\C:\WINDOWS\system32\mksfwallf.sys S3 mksidsf;mksidsf;??\C:\WINDOWS\system32\mksidsf.sys S3 MksMonEn;MksMonEn;??\D:\Program Files\mks_vir_2007\bin\MksMonEn.sys S3 MksMonEv;MksMonEv;??\D:\Program Files\mks_vir_2007\bin\MksMonEv.sys S3 MksMonFd;MksMonFd;??\D:\Program Files\mks_vir_2007\bin\MksMonFd.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- G:\autorun.exe install\command- G:\autorun.exe Contents of the ‘Scheduled Tasks’ folder 2007-09-08 13:58:04 C:\WINDOWS\Tasks\WebReg 20070908155803.job - d:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-09 00:59:45 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-09-09 1:00:06 C:\ComboFix-quarantined-files.txt … 2007-09-09 01:00 C:\ComboFix2.txt … 2007-09-08 11:19 C:\ComboFix3.txt … 2007-09-08 11:17 — E O F —

Gutek · 9 Wrzesień 2007 02:01

Już powinno być OK

SEDNO · 9 Wrzesień 2007 08:01

dzięki i pozdrawiam