Zamula komp/ po wirusie

everic2 · 17 Sierpień 2007 05:32

Logi:

Logfile of HijackThis v1.99.1 Scan saved at 07:30:35, on 2007-08-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Razer\Diamondback\razerhid.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Razer\Diamondback\razertra.exe C:\Program Files\Razer\Diamondback\razerofa.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\foobar2000\foobar2000.exe C:\Documents and Settings\Marcin\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O4 - HKLM…\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM…\Run: [autoclk] autoclk.exe O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM…\Run: [updReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM…\Run: [Jet Detection] “C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe” O4 - HKLM…\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run O4 - HKLM…\Run: [Zone Labs Client] “C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKLM…\Run: [AtiPTA] atiptaxx.exe O4 - HKLM…\Run: [Dimondback] C:\Program Files\Razer\Diamondback\razerhid.exe O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “E:\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKCU…\Run: [steam] “e:\gry\steam\steam.exe” -silent O4 - Global Startup: Action Manager 32.lnk = C:\Program Files\ScannerU\AM32.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc … oscan8.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{6130A7DF-42DB-4869-AEE7-16957F0F36B7}: NameServer = 194.204.152.34 217.98.63.164 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

“Silent Runners.vbs”, revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Gadu-Gadu” = ““E:\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] “DAEMON Tools” = ““C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033” [file not found] “Steam” = ““e:\gry\steam\steam.exe” -silent” [“Valve Corporation”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “WooCnxMon” = “C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [empty string] “autoclk” = “autoclk.exe” [file not found] “WOOWATCH” = “C:\PROGRA~1\NEOSTR~1\Watch.exe” [“France Télécom R&D”] “WOOTASKBARICON” = “C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [“France Télécom R&D”] “UpdReg” = “C:\WINDOWS\UpdReg.EXE” [“Creative Technology Ltd.”] “Jet Detection” = ““C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe”” [empty string] “CTStartup” = “C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run” [“Creative Technology Ltd.”] “Zone Labs Client” = ““C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe”” [“Zone Labs, LLC”] “AtiPTA” = “atiptaxx.exe” [“ATI Technologies, Inc.”] “Dimondback” = “C:\Program Files\Razer\Diamondback\razerhid.exe” [empty string] “QuickTime Task” = ““C:\Program Files\QuickTime\QTTask.exe” -atboottime” [“Apple Inc.”] “svchost” = “C:\DOCUME~1\Marcin\USTAWI~1\Temp\cookies\svchost.exe” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx” [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{3028902F-6374-48b2-8DC6-9725E775B926}” = “IE Microsoft AutoComplete” -> {HKLM…CLSID} = “IE Microsoft AutoComplete” \InProcServer32(Default) = “C:\WINDOWS\system32\browseui.dll” [MS] “{EFA24E62-B078-11d0-89E4-00C04FC9E26E}” = “History Band” -> {HKLM…CLSID} = “History Band” \InProcServer32(Default) = “C:\WINDOWS\system32\shdocvw.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Startup items in “Marcin” & “All Users” startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Action Manager 32” -> shortcut to: “C:\Program Files\ScannerU\AM32.exe” [null data] “Adobe Gamma Loader” -> shortcut to: “C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe” [“Adobe Systems, Inc.”] “DSLMON” -> shortcut to: “C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W” [empty string] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l” [MS] Enabled Scheduled Tasks: ------------------------ “AppleSoftwareUpdate” -> launches: “C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task” [“Apple Inc.”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 26 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}(Default) = “Volet Wanadoo” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\audience\audience.dll” [empty string] HKLM\Software\Classes\CLSID{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}(Default) = “ToolBand Class” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\audience\audience.dll” [empty string] HKLM\Software\Classes\CLSID{5BF498C0-931E-4A4F-B33F-456D07137EAA}(Default) = “Volet Wanadoo” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\audience\audience.dll” [empty string] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {85D1F590-48F4-11D9-9669-0800200C9A66}\ “MenuText” = “Uninstall BitDefender Online Scanner v8” “Exec” = “%windir%\bdoscandel.exe” [null data] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{08C06D61-F1F3-4799-86F8-BE1A89362C85}” = (no title provided) -> {HKLM…CLSID} = “Search Class” \InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL” [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] Creative Service for CDROM Access, Creative Service for CDROM Access, “C:\WINDOWS\system32\CTsvcCDA.exe” [“Creative Technology Ltd”] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe”” [MS] TrueVector Internet Monitor, vsmon, “C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service” [“Zone Labs, LLC”] Usługa Pomocnik IPv6, 6to4, “C:\WINDOWS\system32\svchost.exe -k netsvcs” {“C:\WINDOWS\System32\6to4svc.dll” [MS]} WMDM PMSP Service, WMDM PMSP Service, “C:\WINDOWS\system32\MsPMSPSv.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ HPLJ1018LM\Driver = “ZLhp1018.DLL” [“Zenographics, Inc.”] ---------- (launch time: 2007-08-17 07:08:33) <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 90 seconds, including 11 seconds for message boxes)

ComboFix 07-08-14.4 - “Marcin” 2007-08-17 7:18:39.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.313 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\nm ((((((((((((((((((((((((( Files Created from 2007-07-17 to 2007-08-17 ))))))))))))))))))))))))))))))) 2007-08-17 07:16 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-17 06:58 2007-08-17 06:45 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-08-17 06:45 2007-08-17 06:45 2007-08-17 06:45 2007-08-17 06:45 2007-08-17 06:45 2007-08-17 06:45 2007-08-17 06:45 2007-08-17 06:04 2007-08-17 06:04 2007-08-15 23:35 121,856 --a------ C:\WINDOWS\system32\MadCHook.dll 2007-08-07 18:34 2007-08-07 18:29 2007-08-07 18:29 2007-08-07 18:28 2007-08-07 18:28 2007-07-21 15:37 2007-07-20 06:21 2007-07-18 22:07 2007-07-18 22:06 974,848 --a–c— C:\WINDOWS\system32\dllcache\dxdiag.exe 2007-07-18 22:06 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys 2007-07-18 22:06 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2007-07-18 22:06 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys 2007-07-18 22:06 46,592 --a------ C:\WINDOWS\system32\dxdllreg.exe 2007-07-18 22:06 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll 2007-07-18 22:06 31,744 --a–c— C:\WINDOWS\system32\dllcache\pid.dll 2007-07-18 22:06 292,864 --a–c— C:\WINDOWS\system32\dllcache\ddraw.dll 2007-07-18 22:06 24,064 --a–c— C:\WINDOWS\system32\dllcache\ddrawex.dll 2007-07-18 22:06 18,944 --a------ C:\WINDOWS\system32\encapi.dll 2007-07-18 22:06 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys 2007-07-18 22:06 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys 2007-07-18 22:06 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys 2007-07-18 22:06 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys 2007-07-18 22:06 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys 2007-07-18 22:06 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys 2007-07-18 22:06 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys 2007-07-18 22:06 1,769,472 --a------ C:\WINDOWS\system32\dxdiagn.dll 2007-07-18 22:06 1,703,936 --a------ C:\WINDOWS\system32\d3d9.dll 2007-07-18 22:01 77,312 --a------ C:\WINDOWS\system32\gcdef.dll 2007-07-18 22:01 733,696 --a------ C:\WINDOWS\system32\qedwipes.dll 2007-07-18 22:01 72,704 --a------ C:\WINDOWS\system32\dsdmoprp.dll 2007-07-18 22:01 619,008 --a------ C:\WINDOWS\system32\dx7vb.dll 2007-07-18 22:01 60,928 --a------ C:\WINDOWS\system32\dpnhupnp.dll 2007-07-18 22:01 57,856 --a------ C:\WINDOWS\system32\dpwsockx.dll 2007-07-18 22:01 563,200 --a------ C:\WINDOWS\system32\qedit.dll 2007-07-18 22:01 51,200 --a------ C:\WINDOWS\system32\wstdecod.dll 2007-07-18 22:01 42,768 --a------ C:\WINDOWS\system32\dpwsock.dll 2007-07-18 22:01 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-07-18 22:01 386,048 --a------ C:\WINDOWS\system32\qdvd.dll 2007-07-18 22:01 367,616 --a------ C:\WINDOWS\system32\dsound.dll 2007-07-18 22:01 35,328 --a------ C:\WINDOWS\system32\pid.dll 2007-07-18 22:01 35,328 --a------ C:\WINDOWS\system32\mciqtz32.dll 2007-07-18 22:01 35,328 --a------ C:\WINDOWS\system32\dpnhpast.dll 2007-07-18 22:01 279,040 --a------ C:\WINDOWS\system32\qdv.dll 2007-07-18 22:01 237,568 --a------ C:\WINDOWS\system32\qasf.dll 2007-07-18 22:01 204,288 --a------ C:\WINDOWS\system32\mswebdvd.dll 2007-07-18 22:01 192,512 --a------ C:\WINDOWS\system32\qcap.dll 2007-07-18 22:01 19,456 --a------ C:\WINDOWS\system32\dswave.dll 2007-07-18 22:01 181,760 --a------ C:\WINDOWS\system32\dsdmo.dll 2007-07-18 22:01 17,408 --a------ C:\WINDOWS\system32\msyuv.dll 2007-07-18 22:01 14,336 --a------ C:\WINDOWS\system32\msdmo.dll 2007-07-18 22:01 1,431,552 --a------ C:\WINDOWS\system32\msvidctl.dll 2007-07-18 22:01 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll 2007-07-18 22:01 1,290,752 --a------ C:\WINDOWS\system32\quartz.dll 2007-07-18 22:01 1,227,264 --a------ C:\WINDOWS\system32\dx8vb.dll 2007-07-18 22:01 2007-07-18 22:00 83,456 --a–c— C:\WINDOWS\system32\dllcache\dpvsetup.exe 2007-07-18 22:00 83,456 --a------ C:\WINDOWS\system32\dpvsetup.exe 2007-07-18 22:00 825,344 --a–c— C:\WINDOWS\system32\dllcache\d3dim700.dll 2007-07-18 22:00 825,344 --a------ C:\WINDOWS\system32\d3dim700.dll 2007-07-18 22:00 82,432 --a–c— C:\WINDOWS\system32\dllcache\dmscript.dll 2007-07-18 22:00 82,432 --a------ C:\WINDOWS\system32\dmscript.dll 2007-07-18 22:00 8,192 --a–c— C:\WINDOWS\system32\dllcache\d3d8thk.dll 2007-07-18 22:00 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll 2007-07-18 22:00 77,312 --a–c— C:\WINDOWS\system32\dllcache\gcdef.dll 2007-07-18 22:00 733,696 --a–c— C:\WINDOWS\system32\dllcache\qedwipes.dll 2007-07-18 22:00 72,704 --a–c— C:\WINDOWS\system32\dllcache\dsdmoprp.dll 2007-07-18 22:00 70,656 --a–c— C:\WINDOWS\system32\dllcache\amstream.dll 2007-07-18 22:00 70,656 --a------ C:\WINDOWS\system32\amstream.dll 2007-07-18 22:00 7,552 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys 2007-07-18 22:00 62,464 --a–c— C:\WINDOWS\system32\dllcache\dpnmodem.dll 2007-07-18 22:00 62,464 --a------ C:\WINDOWS\system32\dpnmodem.dll 2007-07-18 22:00 619,008 --a–c— C:\WINDOWS\system32\dllcache\dx7vb.dll 2007-07-18 22:00 61,952 --a–c— C:\WINDOWS\system32\dllcache\dpnwsock.dll 2007-07-18 22:00 61,952 --a------ C:\WINDOWS\system32\dpnwsock.dll 2007-07-18 22:00 61,440 --a–c— C:\WINDOWS\system32\dllcache\dmcompos.dll 2007-07-18 22:00 61,440 --a------ C:\WINDOWS\system32\dmcompos.dll 2007-07-18 22:00 60,928 --a–c— C:\WINDOWS\system32\dllcache\dpnhupnp.dll 2007-07-18 22:00 590,336 --a–c— C:\WINDOWS\system32\dllcache\d3dramp.dll 2007-07-18 22:00 590,336 --a------ C:\WINDOWS\system32\d3dramp.dll 2007-07-18 22:00 59,904 --a–c— C:\WINDOWS\system32\dllcache\devenum.dll 2007-07-18 22:00 59,904 --a------ C:\WINDOWS\system32\devenum.dll 2007-07-18 22:00 57,856 --a–c— C:\WINDOWS\system32\dllcache\dpwsockx.dll 2007-07-18 22:00 563,200 --a–c— C:\WINDOWS\system32\dllcache\qedit.dll 2007-07-18 22:00 54,032 --a–c— C:\WINDOWS\system32\dllcache\dpserial.dll 2007-07-18 22:00 54,032 --a------ C:\WINDOWS\system32\dpserial.dll 2007-07-18 22:00 51,200 --a–c— C:\WINDOWS\system32\dllcache\wstdecod.dll 2007-07-18 22:00 5,376 --a------ C:\WINDOWS\system32\drivers\mspclock.sys (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2009-01-08 12:52 --------- d-------- C:\Program Files\FLVPlayer 2007-08-17 07:23 --------- d-------- C:\DOCUME~1\Marcin\DANEAP~1\foobar2000 2007-08-17 06:51 --------- d-------- C:\Program Files\Neostrada TP 2007-08-16 13:57 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-08-12 15:36 --------- d-------- C:\DOCUME~1\Marcin\DANEAP~1\teamspeak2 2007-08-05 11:24 --------- d-------- C:\Program Files\StarCraft Brood War by Monikon 2007-08-04 10:54 --------- d-------- C:\DOCUME~1\Marcin\DANEAP~1\Skype 2007-07-16 19:12 451072 --a------ C:\WINDOWS\Radeon Omega Drivers v3.8.221 Uninstall.exe 2007-07-16 19:12 --------- d-------- C:\Program Files\Radeon Omega Drivers 2007-07-16 19:12 --------- d-------- C:\Program Files\MultiRes 2007-07-16 18:19 --------- d-------- C:\Program Files\Razer 2007-07-16 18:19 --------- d-------- C:\DOCUME~1\Marcin\DANEAP~1\InstallShield 2007-07-16 18:12 --------- d-------- C:\Program Files\VirtualDJ 2007-07-16 18:12 --------- d-------- C:\Program Files\Passware 2007-07-16 17:44 451072 --a------ C:\WINDOWS\Radeon Omega Drivers v3.8.360 Uninstall.exe 2007-07-15 20:12 --------- d-------- C:\Program Files\MadOnion.com 2007-07-08 22:34 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-07-02 13:48 --------- d-------- C:\Program Files\ScannerU 2007-07-01 10:37 --------- d-------- C:\Program Files\Asprate 2007-06-29 18:49 --------- d-------- C:\DOCUME~1\Marcin\DANEAP~1\Real ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “WooCnxMon”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [2003-10-16 18:07] “autoclk”=“autoclk.exe” [] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2003-10-16 18:07] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [2003-10-16 18:07] “UpdReg”=“C:\WINDOWS\UpdReg.EXE” [2000-05-11 01:00] “Jet Detection”=“C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe” [2001-11-29 01:00] “CTStartup”=“C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe” [2001-12-20 01:00] “Zone Labs Client”=“C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2006-08-23 23:38] “AtiPTA”=“atiptaxx.exe” [2005-11-23 02:05 C:\WINDOWS\system32\atiptaxx.exe] “Dimondback”=“C:\Program Files\Razer\Diamondback\razerhid.exe” [2007-01-18 09:48] “QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2007-06-29 06:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2006-03-02 14:00] “Gadu-Gadu”=“E:\Gadu-Gadu\gg.exe” [2007-04-19 17:43] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [] “Steam”=“e:\gry\steam\steam.exe” [2007-07-16 18:24] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Action Manager 32.lnk - C:\Program Files\ScannerU\AM32.exe [2007-04-21 09:33:52] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-07-08 22:37:39] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-04-20 13:34:45] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= “NoResolveSearch”=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\adiras] adiras.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA] atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch] CTHELPER.EXE R3 AVMWAN;Sterownik karty AVM NDIS WAN CAPI;C:\WINDOWS\system32\DRIVERS\avmwan.sys R3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet;C:\WINDOWS\system32\DRIVERS\fetnd5.sys R3 fpcibase;Kontroler AVM ISDN-Controller FRITZ!Card PCI;C:\WINDOWS\system32\DRIVERS\fpcibase.sys R3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys S1 oreans32;oreans32;??\C:\WINDOWS\system32\drivers\oreans32.sys S3 NTProcDrv;Process creation detector for NT.;??\D:\Filmy\Silkroad\NtProcDrv.sys Contents of the ‘Scheduled Tasks’ folder 2007-08-13 07:30:18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-17 07:26:22 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … C:\WINDOWS\system32\cmd.exe [3004] 0x814D4590 scanning hidden autostart entries … HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h???s???w? ?w???w???w4???.??w4???4???TA?s4???&7???6~??6~???U?6~??6~???c???C@???s???s???&7?A??s?&7??C@?x???`|?w???@ scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-17 7:28:08 - machine was rebooted C:\ComboFix-quarantined-files.txt … 2007-08-17 07:27 — E O F —

Czy z logami wszystko ok?

jessica · 17 Sierpień 2007 07:51

Jest czysto.

Ten powyższy wpis jest, wg Sillenta, bezplikowy, więc go sfiksuj w Hijacku:

>>Hijack>>scan(Do a system scan only)>>zaznacz je >> Fix checked.

Ten wpis po “wirusie” jest w logu Sillenta, a nie ma go w logach Hijacka i ComboFixa. Nie wiem dlaczego.? Czy w międzyczasie robienia tych logów usunąłeś już ten klucz z rejestru?

jessi

everic2 · 17 Sierpień 2007 08:09

Nie usuwałem nic z rejestru, przeskanowałem plik przez który złapałem co “coś” na http://virusscan.jotti.org/ i tylko BitDefender wykrył jako iż skanowałem wcześniej i usunąłem już ten plik.