Wykryto wyłączony javascript

Aktualnie masz wyłączony javascript. Kilka funkcji może nie działać. Włącz ponownie javascript, aby korzystać z pełnej funkcjonalności.

Logi - Dwa podejrzane procesy

Rozpoczęty przez Grigo , 01 08 2008 09:49

Temat jest zamknięty

9 odpowiedzi w tym temacie

#1 Grigo

Początkujący

116 postów

Napisano 01 08 2008 - 09:49

mam pewien problem. otorz gdy otwieram moj komputer i wchodze dajmy na dysk e to sie otwiera w nowym oknie, a w opcjach folderow mam ustawione zeby otwieralo w tym samym oknie, i mam 2 dziwne procesy pod nazwa

sysdfk.exe

i

rpget.exe

i jeszcze dodam ze niemoge przenosic ikon na pulpicie w inne miejsc, np, z lewego boku ekranu na prawy itp ^_^

prosze o pomoc

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:45:25, on 2008-08-01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ULI5289\ALi5289.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\4t Tray Minimizer\4t-min.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Winamp\winamp.exe
E:\Grigo\WebServ\no-ip\No-IP DUC20.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ldlog.exe
C:\WINDOWS\system32\rpget.exe
C:\WINDOWS\system32\sysdfk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\xXx\Pulpit\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll
O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
O4 - HKLM\..\Run: [Windows Log Page] C:\WINDOWS\system32\ldlog.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: 4t Tray Minimizer.lnk = C:\Program Files\4t Tray Minimizer\4t-min.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{60007B8C-1560-48BB-B422-5B3E2CFEBD6F}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7616 bytes

0

Do góry

#2 ordynat

Zaawansowany użytkownik

804 postów

Napisano 01 08 2008 - 19:52

Ściągnij (do wyboru):
>ComboFix
>ComboFix
>ComboFix
Wklej do Notatnika:

File::
C:\WINDOWS\system32\ldlog.exe
C:\WINDOWS\system32\rpget.exe
C:\WINDOWS\system32\sysdfk.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Log Page"=-

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
– podobnie jak na tym obrazku --> Dołączona grafika

Ma się rozpocząć usuwanie. (i powstanie log)
Po restarcie usuń ręcznie folder C:\Qoobox.

Daj ten log, króry powstanie w trakcie usuwania.

ordynat

0

Do góry

#3 Grigo

Początkujący

116 postów

Napisano 03 08 2008 - 10:23

ComboFix 08-08-01.05 - xXx 2008-08-03 10:19:30.2 - NTFSx86

Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.204 [GMT 2:00]

Running from: C:\Documents and Settings\xXx\Pulpit\ComboFix.exe

Command switches used :: C:\Documents and Settings\xXx\Pulpit\CFScript.txt

 * Created a new restore point



[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/b][/color]



FILE ::

C:\WINDOWS\system32\ldlog.exe

C:\WINDOWS\system32\rpget.exe

C:\WINDOWS\system32\sysdfk.exe

.



(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.



D:\Autorun.inf

E:\Autorun.inf



.

(((((((((((((((((((((((((   Files Created from 2008-07-03 to 2008-08-03  )))))))))))))))))))))))))))))))

.



2008-08-02 17:50 . 2008-08-02 17:49	89,460	-r-hs----	C:\r813.bat

2008-08-01 10:01 . 2008-08-03 10:01	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy

2008-08-01 09:56 . 2008-08-01 09:57	<DIR>	d--------	C:\Program Files\SkanerOnline

2008-08-01 09:17 . 2008-07-31 21:13	89,037	-r-hs----	C:\e.com

2008-07-31 21:28 . 2008-07-31 21:28	<DIR>	d--h-----	C:\WINDOWS\system32\GroupPolicy

2008-07-31 21:13 . 2008-08-02 17:49	83,456	-r-hs----	C:\WINDOWS\system32\ckvo1.dll

2008-07-31 21:12 . 2008-07-21 17:32	117,520	-r-hs----	C:\e9ehn1m8.com

2008-07-25 18:16 . 2008-08-03 09:58	174	--a------	C:\WINDOWS\system32\winslog.ini

2008-07-24 09:06 . 2008-07-24 09:06	<DIR>	d--------	C:\Program Files\Winamp

2008-07-23 16:29 . 2008-07-23 17:03	<DIR>	d--------	C:\Documents and Settings\xXx\Dane aplikacji\Ulead Systems

2008-07-23 16:25 . 2008-07-23 16:25	<DIR>	d--------	C:\Program Files\Common Files\InterVideo

2008-07-23 16:25 . 2008-07-23 16:25	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\InterVideo

2008-07-23 16:25 . 2007-03-06 11:58	210,456	--a------	C:\WINDOWS\system32\IVIresizeW7.dll

2008-07-23 16:25 . 2007-03-06 11:58	206,360	--a------	C:\WINDOWS\system32\IVIresizeA6.dll

2008-07-23 16:25 . 2007-03-06 11:58	198,168	--a------	C:\WINDOWS\system32\IVIresizeP6.dll

2008-07-23 16:25 . 2007-03-06 11:58	198,168	--a------	C:\WINDOWS\system32\IVIresizeM6.dll

2008-07-23 16:25 . 2007-03-06 11:58	194,072	--a------	C:\WINDOWS\system32\IVIresizePX.dll

2008-07-23 16:25 . 2007-03-06 11:58	26,136	--a------	C:\WINDOWS\system32\IVIresize.dll

2008-07-23 16:24 . 2008-07-23 16:24	<DIR>	d--------	C:\Program Files\Windows Media Components

2008-07-23 16:23 . 2008-07-23 16:23	<DIR>	d--------	C:\Program Files\Ulead Systems

2008-07-23 16:23 . 2008-07-23 16:24	<DIR>	d--------	C:\Program Files\Common Files\Ulead Systems

2008-07-23 16:23 . 2008-07-23 16:29	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems

2008-07-22 19:34 . 2008-07-22 19:48	<DIR>	d--------	C:\Program Files\AviSynth 2.5

2008-07-22 19:33 . 2008-07-22 19:48	<DIR>	d--------	C:\Program Files\Avi2Dvd

2008-07-22 19:08 . 2008-07-22 19:11	<DIR>	d--------	C:\Program Files\GoD

2008-07-22 11:48 . 2008-05-04 11:11	2,482,176	--a------	C:\WINDOWS\system32\FerOTS.exe

2008-07-21 22:51 . 2008-07-21 22:52	<DIR>	d--------	C:\Program Files\Far

2008-07-20 10:37 . 2008-08-01 09:42	<DIR>	d--------	C:\WINDOWS\system32\FlashAX

2008-07-20 10:36 . 2008-07-20 10:36	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Microgaming

2008-07-20 10:36 . 2008-07-20 10:36	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\MGS

2008-07-20 10:35 . 2008-07-20 10:35	<DIR>	d--------	C:\MicroGaming

2008-07-20 10:28 . 2008-08-01 18:00	<DIR>	d--------	C:\Program Files\Norton Security Scan

2008-07-20 10:25 . 2008-07-23 09:51	<DIR>	d--------	C:\WINDOWS\system32\Adobe

2008-07-17 13:56 . 2008-07-17 13:57	<DIR>	d--------	C:\Program Files\NokiaFREE Unlock Codes Calculator

2008-07-11 21:00 . 2008-07-11 21:00	<DIR>	d--------	C:\Automap

2008-07-11 20:59 . 2008-07-11 21:00	<DIR>	d--------	C:\Program Files\Tibia

2008-07-11 20:08 . 2008-07-11 20:08	<DIR>	d--------	C:\Program Files\ivo

2008-07-11 20:08 . 2008-07-11 20:08	<DIR>	d--------	C:\Documents and Settings\xXx\Dane aplikacji\Expressivo

2008-07-09 09:17 . 2008-07-09 09:17	<DIR>	d--------	C:\Documents and Settings\xXx\SpectroN

2008-07-05 10:55 . 2008-07-05 11:00	<DIR>	d--------	C:\Documents and Settings\xXx\Dane aplikacji\Tibia

2008-07-04 15:56 . 2008-07-04 15:59	<DIR>	d--------	C:\Program Files\Wirtualna Polska

2008-07-03 14:49 . 2008-07-03 15:09	<DIR>	d--------	C:\Documents and Settings\xXx\.mysqlcc

2008-07-03 13:59 . 2008-07-03 14:04	<DIR>	d--------	C:\Program Files\SHOUTcast



.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-03 07:53	---------	d-----w	C:\Program Files\Neostrada TP

2008-07-25 12:31	247,808	----a-w	C:\WINDOWS\system32\cmdsys.exe

2008-07-24 12:07	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Winamp

2008-07-23 19:29	---------	d-----w	C:\Program Files\Gadu-Gadu

2008-07-23 14:25	---------	d--h--w	C:\Program Files\InstallShield Installation Information

2008-07-22 17:02	---------	d-----w	C:\Program Files\VirtualDJ

2008-07-22 15:40	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Skype

2008-07-20 16:05	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\PC Suite

2008-06-26 09:40	---------	d-----w	C:\Program Files\NSS

2008-06-26 09:14	---------	d-----w	C:\Program Files\BitComet

2008-06-26 09:13	2,560	----a-w	C:\WINDOWS\system32\bitcometres.dll

2008-06-24 15:30	---------	d-----w	C:\Program Files\CDex_150

2008-06-20 17:42	246,784	----a-w	C:\WINDOWS\system32\mswsock.dll

2008-06-20 15:34	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Media Player Classic

2008-06-20 10:45	360,320	----a-w	C:\WINDOWS\system32\drivers\tcpip.sys

2008-06-20 10:44	138,368	----a-w	C:\WINDOWS\system32\drivers\afd.sys

2008-06-20 09:52	225,920	----a-w	C:\WINDOWS\system32\drivers\tcpip6.sys

2008-06-18 18:45	---------	d---a-w	C:\Documents and Settings\All Users\Dane aplikacji\TEMP

2008-06-14 18:01	273,024	------w	C:\WINDOWS\system32\drivers\bthport.sys

2008-06-11 13:58	---------	d-----w	C:\Program Files\WapSter

2008-06-09 14:02	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Ahead

2008-06-08 17:40	274,944	----a-w	C:\WINDOWS\system32\wintime.exe

2008-06-08 10:01	---------	d-----w	C:\Program Files\4t Tray Minimizer

2008-06-06 20:30	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\AdobeUM

2008-06-06 18:43	---------	d-----w	C:\Program Files\Skype

2008-06-06 18:43	---------	d-----w	C:\Program Files\Common Files\Skype

2008-06-06 18:43	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Skype

2008-06-05 20:08	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Nokia

2008-06-05 20:06	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\PC Suite

2008-06-05 19:54	---------	d-----w	C:\Program Files\PC Connectivity Solution

2008-06-05 19:54	---------	d-----w	C:\Program Files\Nokia

2008-06-05 19:54	---------	d-----w	C:\Program Files\DIFX

2008-06-05 19:54	---------	d-----w	C:\Program Files\Common Files\PCSuite

2008-06-05 19:54	---------	d-----w	C:\Program Files\Common Files\Nokia

2008-06-05 19:52	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Installations

2008-06-05 12:15	23	----a-w	C:\WINDOWS\system32\drivers\adidsl.cfg

2008-06-05 12:15	---------	d-----w	C:\Program Files\SAGEM

2008-06-05 12:15	---------	d-----w	C:\Program Files\Java

2008-06-04 19:27	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Zylom

2008-06-04 19:27	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Zylom

2008-06-04 16:20	---------	d-----w	C:\Program Files\SpectroN

2008-06-04 16:20	---------	d-----w	C:\Program Files\Common Files\Adobe

2008-06-04 16:17	---------	d-----w	C:\Program Files\Ahead

2008-06-04 16:13	---------	d-----w	C:\Program Files\Common Files\Ahead

2008-06-04 16:13	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Ahead

2008-06-04 16:05	---------	d-----w	C:\Program Files\Creative

2008-06-04 16:05	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Creative

2008-06-04 16:05	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\ATI

2008-06-04 16:00	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Creative

2008-06-04 15:57	---------	d-----w	C:\Program Files\ULI5289

2008-06-04 15:54	---------	d-----w	C:\Program Files\Common Files\InstallShield

2008-06-04 15:54	---------	d-----w	C:\Program Files\ATI Technologies

2008-06-04 15:54	---------	d-----w	C:\Program Files\Ares

2008-06-04 15:51	---------	d-----w	C:\Program Files\Alwil Software

2008-06-04 15:50	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Gadu-Gadu

2008-06-04 15:49	---------	d-----w	C:\Program Files\MarBit

2008-06-04 15:49	---------	d-----w	C:\Program Files\<a href="http://www.download.net.pl/105/K-Lite-Codec-Pack/">K-Lite Codec Pack</a>

2008-06-04 15:49	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer

2008-06-04 15:42	---------	d-----w	C:\Program Files\microsoft frontpage

2008-06-04 15:40	---------	d-----w	C:\Program Files\Usługi online

2008-05-07 05:16	1,291,264	----a-w	C:\WINDOWS\system32\quartz.dll

.



(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4



[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

"AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 14:18 2351864]

"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]

"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 21:05 339968]

"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 22:21 32768]

"ALi5289"="C:\Program Files\ULI5289\ALi5289.exe" [2005-03-10 14:56 405504]

"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]

"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]

"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07 24576]

"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07 20480]

"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 18:07 53248]

"UVS11 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 14:12 341488]

"CTHelper"="CTHELPER.EXE" [2003-08-28 10:45 24576 C:\WINDOWS\system32\CTHELPER.EXE]



[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 22:21 32768]

"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]



C:\Documents and Settings\xXx\Menu Start\Programy\Autostart\

4t Tray Minimizer.lnk - C:\Program Files\4t Tray Minimizer\4t-min.exe [2008-06-08 12:01:42 1091584]



C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 14:44:06 29696]

ATI CATALYST System Tray.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-02-22 22:21:26 32768]

DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-06-05 14:15:45 962661]

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]



[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.X264"= x264vfw.dll

"msacm.ctmp3"= C:\WINDOWS\system32\ctmp3.acm

"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm

"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm

"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm



[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Ares\\Ares.exe"=

"E:\\Grigo\\WebServ\\mysql\\bin\\WebServ(mysqld-max-nt).exe"=

"E:\\Grigo\\WebServ\\apache2\\bin\\WebServ(apache).exe"=

"C:\\WINDOWS\\system32\\wintime.exe"=

"C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"=

"C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"=

"E:\\Grigo\\WebServ\\mysql\\bin\\WebServ(mysqld).exe"=

"C:\\Program Files\\Gadu-Gadu\\gg.exe"=

"C:\\Program Files\\BitComet\\BitComet.exe"=

"C:\\Program Files\\SHOUTcast\\sc_serv.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=



[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"7171:TCP"= 7171:TCP:spokolokoots.no-ip.org

"7171:UDP"= 7171:UDP:spokolokoots.no-iporg

"8632:TCP"= 8632:TCP:BitComet 8632 TCP

"8632:UDP"= 8632:UDP:BitComet 8632 UDP

"8461:TCP"= 8461:TCP:GoD High Port

"8462:TCP"= 8462:TCP:GoD Low Port

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009



R0 m5289;m5289;C:\WINDOWS\system32\DRIVERS\m5289.sys [2004-12-01 10:49]

R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys [2005-05-03 17:31]

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]

R2 ALIEHCD;ULi PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ALIEHCI.sys [2005-06-02 19:59]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]

R3 aliroothub;USB 2.0 Root Hub;C:\WINDOWS\system32\DRIVERS\AliRtHub.sys [2005-06-02 18:27]



[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7b98ee4-37bd-11dd-9903-4d6564696130}]

\Shell\AutoRun\command - G:\e9ehn1m8.com

\Shell\explore\Command - G:\e9ehn1m8.com

\Shell\open\Command - G:\e9ehn1m8.com

.

Contents of the 'Scheduled Tasks' folder



2008-08-01 C:\WINDOWS\Tasks\Norton Security Scan.job

- C:\Program Files\Norton Security Scan\Nss.exe [2008-01-09 04:08]

.

- - - - ORPHANS REMOVED - - - -



HKCU-Run-kamsoft - C:\WINDOWS\system32\ckvo.exe





**************************************************************************



catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-03 10:20:44

Windows 5.1.2600 Dodatek Service Pack 2 NTFS



scanning hidden processes ... 



scanning hidden autostart entries ...



scanning hidden files ... 



scan completed successfully

hidden files: 0



**************************************************************************

.

Completion time: 2008-08-03 10:22:01

ComboFix-quarantined-files.txt  2008-08-03 08:21:41



Pre-Run: 4,344,442,880 bajtów wolnych

Post-Run: 4,328,992,768 bajtów wolnych



219	--- E O F ---	2008-07-09 06:05:57

0

Do góry

#4 ordynat

Zaawansowany użytkownik

804 postów

Napisano 03 08 2008 - 11:48

Wklej do Notatnika:

File::
C:\r813.bat
C:\e.com
C:\WINDOWS\system32\ckvo1.dll
C:\e9ehn1m8.com
C:\WINDOWS\system32\cmdsys.exe
C:\WINDOWS\system32\wintime.exe
G:\e9ehn1m8.com
d:\e9ehn1m8.com
e:\e9ehn1m8.com

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\wintime.exe"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7b98ee4-37bd-11dd-9903-4d6564696130}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
--> Dołączona grafika

Ma się rozpocząć usuwanie. (i powstanie log).
Daj ten log, który powstanie w trakcie usuwania.
Po restarcie usuń ręcznie folder C:\Qoobox.

ordynat

0

Do góry

#5 Grigo

Początkujący

116 postów

Napisano 03 08 2008 - 12:31

ComboFix 08-08-01.05 - xXx 2008-08-03 12:27:25.3 - NTFSx86

Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.176 [GMT 2:00]

Running from: C:\Documents and Settings\xXx\Pulpit\ComboFix.exe

Command switches used :: C:\Documents and Settings\xXx\Pulpit\CFScript.txt

 * Created a new restore point



[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/b][/color]



FILE ::

C:\e.com

C:\e9ehn1m8.com

C:\r813.bat

C:\WINDOWS\system32\ckvo1.dll

C:\WINDOWS\system32\cmdsys.exe

C:\WINDOWS\system32\wintime.exe

d:\e9ehn1m8.com

e:\e9ehn1m8.com

G:\e9ehn1m8.com

.



(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.



C:\e.com

C:\e9ehn1m8.com

C:\r813.bat

C:\WINDOWS\system32\ckvo1.dll

C:\WINDOWS\system32\cmdsys.exe

C:\WINDOWS\system32\wintime.exe

d:\e9ehn1m8.com

e:\e9ehn1m8.com



.

(((((((((((((((((((((((((   Files Created from 2008-07-03 to 2008-08-03  )))))))))))))))))))))))))))))))

.



2008-08-03 12:15 . 2008-08-03 12:15	<DIR>	d--------	C:\Program Files\Winamp

2008-08-03 12:15 . 2008-08-03 12:18	<DIR>	d--------	C:\Documents and Settings\xXx\Dane aplikacji\Winamp

2008-08-01 10:01 . 2008-08-03 10:01	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy

2008-08-01 09:56 . 2008-08-03 12:10	<DIR>	d--------	C:\Program Files\SkanerOnline

2008-07-31 21:28 . 2008-07-31 21:28	<DIR>	d--h-----	C:\WINDOWS\system32\GroupPolicy

2008-07-25 18:16 . 2008-08-03 09:58	174	--a------	C:\WINDOWS\system32\winslog.ini

2008-07-23 16:29 . 2008-07-23 17:03	<DIR>	d--------	C:\Documents and Settings\xXx\Dane aplikacji\Ulead Systems

2008-07-23 16:25 . 2008-07-23 16:25	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\InterVideo

2008-07-23 16:25 . 2007-03-06 11:58	210,456	--a------	C:\WINDOWS\system32\IVIresizeW7.dll

2008-07-23 16:25 . 2007-03-06 11:58	206,360	--a------	C:\WINDOWS\system32\IVIresizeA6.dll

2008-07-23 16:25 . 2007-03-06 11:58	198,168	--a------	C:\WINDOWS\system32\IVIresizeP6.dll

2008-07-23 16:25 . 2007-03-06 11:58	198,168	--a------	C:\WINDOWS\system32\IVIresizeM6.dll

2008-07-23 16:25 . 2007-03-06 11:58	194,072	--a------	C:\WINDOWS\system32\IVIresizePX.dll

2008-07-23 16:25 . 2007-03-06 11:58	26,136	--a------	C:\WINDOWS\system32\IVIresize.dll

2008-07-23 16:24 . 2008-07-23 16:24	<DIR>	d--------	C:\Program Files\Windows Media Components

2008-07-23 16:23 . 2008-07-23 16:23	<DIR>	d--------	C:\Program Files\Ulead Systems

2008-07-23 16:23 . 2008-07-23 16:24	<DIR>	d--------	C:\Program Files\Common Files\Ulead Systems

2008-07-23 16:23 . 2008-07-23 16:29	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems

2008-07-22 19:34 . 2008-07-22 19:48	<DIR>	d--------	C:\Program Files\AviSynth 2.5

2008-07-22 19:33 . 2008-07-22 19:48	<DIR>	d--------	C:\Program Files\Avi2Dvd

2008-07-22 19:08 . 2008-07-22 19:11	<DIR>	d--------	C:\Program Files\GoD

2008-07-22 11:48 . 2008-05-04 11:11	2,482,176	--a------	C:\WINDOWS\system32\FerOTS.exe

2008-07-20 10:37 . 2008-08-01 09:42	<DIR>	d--------	C:\WINDOWS\system32\FlashAX

2008-07-20 10:36 . 2008-07-20 10:36	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Microgaming

2008-07-20 10:36 . 2008-07-20 10:36	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\MGS

2008-07-20 10:35 . 2008-07-20 10:35	<DIR>	d--------	C:\MicroGaming

2008-07-20 10:25 . 2008-07-23 09:51	<DIR>	d--------	C:\WINDOWS\system32\Adobe

2008-07-11 21:00 . 2008-07-11 21:00	<DIR>	d--------	C:\Automap

2008-07-11 20:59 . 2008-07-11 21:00	<DIR>	d--------	C:\Program Files\Tibia

2008-07-09 09:17 . 2008-07-09 09:17	<DIR>	d--------	C:\Documents and Settings\xXx\SpectroN

2008-07-05 10:55 . 2008-07-05 11:00	<DIR>	d--------	C:\Documents and Settings\xXx\Dane aplikacji\Tibia

2008-07-04 15:56 . 2008-07-04 15:59	<DIR>	d--------	C:\Program Files\Wirtualna Polska

2008-07-03 14:49 . 2008-07-03 15:09	<DIR>	d--------	C:\Documents and Settings\xXx\.mysqlcc

2008-07-03 13:59 . 2008-08-03 12:10	<DIR>	d--------	C:\Program Files\SHOUTcast



.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-03 10:26	---------	d-----w	C:\Program Files\Neostrada TP

2008-07-23 19:29	---------	d-----w	C:\Program Files\Gadu-Gadu

2008-07-23 14:25	---------	d--h--w	C:\Program Files\InstallShield Installation Information

2008-07-22 17:02	---------	d-----w	C:\Program Files\VirtualDJ

2008-07-22 15:40	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Skype

2008-07-20 16:05	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\PC Suite

2008-06-26 09:40	---------	d-----w	C:\Program Files\NSS

2008-06-26 09:14	---------	d-----w	C:\Program Files\BitComet

2008-06-26 09:13	2,560	----a-w	C:\WINDOWS\system32\bitcometres.dll

2008-06-24 15:30	---------	d-----w	C:\Program Files\CDex_150

2008-06-20 17:42	246,784	----a-w	C:\WINDOWS\system32\mswsock.dll

2008-06-20 15:34	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Media Player Classic

2008-06-20 10:45	360,320	----a-w	C:\WINDOWS\system32\drivers\tcpip.sys

2008-06-20 10:44	138,368	----a-w	C:\WINDOWS\system32\drivers\afd.sys

2008-06-20 09:52	225,920	----a-w	C:\WINDOWS\system32\drivers\tcpip6.sys

2008-06-18 18:45	---------	d---a-w	C:\Documents and Settings\All Users\Dane aplikacji\TEMP

2008-06-14 18:01	273,024	------w	C:\WINDOWS\system32\drivers\bthport.sys

2008-06-11 13:58	---------	d-----w	C:\Program Files\WapSter

2008-06-09 14:02	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Ahead

2008-06-06 20:30	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\AdobeUM

2008-06-06 18:43	---------	d-----w	C:\Program Files\Skype

2008-06-06 18:43	---------	d-----w	C:\Program Files\Common Files\Skype

2008-06-06 18:43	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Skype

2008-06-05 20:08	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Nokia

2008-06-05 20:06	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\PC Suite

2008-06-05 19:54	---------	d-----w	C:\Program Files\PC Connectivity Solution

2008-06-05 19:54	---------	d-----w	C:\Program Files\Nokia

2008-06-05 19:54	---------	d-----w	C:\Program Files\DIFX

2008-06-05 19:54	---------	d-----w	C:\Program Files\Common Files\PCSuite

2008-06-05 19:54	---------	d-----w	C:\Program Files\Common Files\Nokia

2008-06-05 19:52	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Installations

2008-06-05 12:15	23	----a-w	C:\WINDOWS\system32\drivers\adidsl.cfg

2008-06-05 12:15	---------	d-----w	C:\Program Files\SAGEM

2008-06-05 12:15	---------	d-----w	C:\Program Files\Java

2008-06-04 19:27	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Zylom

2008-06-04 19:27	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Zylom

2008-06-04 16:20	---------	d-----w	C:\Program Files\SpectroN

2008-06-04 16:20	---------	d-----w	C:\Program Files\Common Files\Adobe

2008-06-04 16:17	---------	d-----w	C:\Program Files\Ahead

2008-06-04 16:13	---------	d-----w	C:\Program Files\Common Files\Ahead

2008-06-04 16:13	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Ahead

2008-06-04 16:05	---------	d-----w	C:\Program Files\Creative

2008-06-04 16:05	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Creative

2008-06-04 16:05	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\ATI

2008-06-04 16:00	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Creative

2008-06-04 15:57	---------	d-----w	C:\Program Files\ULI5289

2008-06-04 15:54	---------	d-----w	C:\Program Files\Common Files\InstallShield

2008-06-04 15:54	---------	d-----w	C:\Program Files\ATI Technologies

2008-06-04 15:54	---------	d-----w	C:\Program Files\Ares

2008-06-04 15:51	---------	d-----w	C:\Program Files\Alwil Software

2008-06-04 15:50	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Gadu-Gadu

2008-06-04 15:49	---------	d-----w	C:\Program Files\MarBit

2008-06-04 15:49	---------	d-----w	C:\Program Files\K-Lite Codec Pack

2008-06-04 15:49	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer

2008-06-04 15:42	---------	d-----w	C:\Program Files\microsoft frontpage

2008-06-04 15:40	---------	d-----w	C:\Program Files\Usługi online

2008-05-07 05:16	1,291,264	----a-w	C:\WINDOWS\system32\quartz.dll

.



(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4



[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

"AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 14:18 2351864]

"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]

"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 21:05 339968]

"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 22:21 32768]

"ALi5289"="C:\Program Files\ULI5289\ALi5289.exe" [2005-03-10 14:56 405504]

"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]

"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]

"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07 24576]

"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07 20480]

"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 18:07 53248]

"UVS11 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 14:12 341488]

"CTHelper"="CTHELPER.EXE" [2003-08-28 10:45 24576 C:\WINDOWS\system32\CTHELPER.EXE]



[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 22:21 32768]

"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]



C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 14:44:06 29696]

ATI CATALYST System Tray.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-02-22 22:21:26 32768]

DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-06-05 14:15:45 962661]

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]



[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.X264"= x264vfw.dll

"msacm.ctmp3"= C:\WINDOWS\system32\ctmp3.acm

"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm

"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm

"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm



[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Ares\\Ares.exe"=

"E:\\Grigo\\WebServ\\mysql\\bin\\WebServ(mysqld-max-nt).exe"=

"E:\\Grigo\\WebServ\\apache2\\bin\\WebServ(apache).exe"=

"C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"=

"C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"=

"E:\\Grigo\\WebServ\\mysql\\bin\\WebServ(mysqld).exe"=

"C:\\Program Files\\Gadu-Gadu\\gg.exe"=

"C:\\Program Files\\BitComet\\BitComet.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=



[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"7171:TCP"= 7171:TCP:spokolokoots.no-ip.org

"7171:UDP"= 7171:UDP:spokolokoots.no-iporg

"8632:TCP"= 8632:TCP:BitComet 8632 TCP

"8632:UDP"= 8632:UDP:BitComet 8632 UDP

"8461:TCP"= 8461:TCP:GoD High Port

"8462:TCP"= 8462:TCP:GoD Low Port

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009



R0 m5289;m5289;C:\WINDOWS\system32\DRIVERS\m5289.sys [2004-12-01 10:49]

R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys [2005-05-03 17:31]

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]

R2 ALIEHCD;ULi PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ALIEHCI.sys [2005-06-02 19:59]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]

R3 aliroothub;USB 2.0 Root Hub;C:\WINDOWS\system32\DRIVERS\AliRtHub.sys [2005-06-02 18:27]

.

**************************************************************************



catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-03 12:29:03

Windows 5.1.2600 Dodatek Service Pack 2 NTFS



scanning hidden processes ... 



scanning hidden autostart entries ...



scanning hidden files ... 



scan completed successfully

hidden files: 0



**************************************************************************

.

Completion time: 2008-08-03 12:30:21

ComboFix-quarantined-files.txt  2008-08-03 10:30:03

ComboFix2.txt  2008-08-03 08:22:03



Pre-Run: 4,322,775,040 bajtów wolnych

Post-Run: 4,328,165,376 bajtów wolnych



205	--- E O F ---	2008-07-09 06:05:57

0

Do góry

#6 ordynat

Zaawansowany użytkownik

804 postów

Napisano 03 08 2008 - 12:58

Log czysty (chyba), ale chyba, tak na wszelki wypadek, trzeba jeszcze powtórzyć usuwanie, bo ja nie podałem usuwania tak, jak należy. Chodzi o to, że pliki z infekcji z pendrive najczęściej są na wszystkich dyskach, a ja dwóch z nich dałem tylko na jeden dysk.
Wklej do Notatnika:

File::
c:\r813.bat
c:\e.com
D:\r813.bat
D:\e.com
E:\r813.bat
E:\e.com

DirLook::
C:\WINDOWS\system32\GroupPolicy

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
--> Dołączona grafika

Ma się rozpocząć usuwanie. (i powstanie log).
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

C:\WINDOWS\system32\winslog.ini

Sprawdź go na --> http://virusscan.jotti.org/
albo na http://www.virustotal.com/en/indexf.html.

ordynat

0

Do góry

#7 Grigo

Początkujący

116 postów

Napisano 04 08 2008 - 09:44

ten plik jest czysty. obydwa skanery nic nie wykazaly i komp juz tak nie muli:) dzieki

masz tu jeszcze ostatni log sprawdz

ComboFix 08-08-01.05 - xXx 2008-08-04  9:47:01.4 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.204 [GMT 2:00]
Running from: C:\Documents and Settings\xXx\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\xXx\Pulpit\CFScript.txt
 * Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/b][/color]

FILE ::
c:\e.com
c:\r813.bat
D:\e.com
D:\r813.bat
E:\e.com
E:\r813.bat
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\e.com
D:\r813.bat
E:\e.com
E:\r813.bat

.
(((((((((((((((((((((((((   Files Created from 2008-07-04 to 2008-08-04  )))))))))))))))))))))))))))))))
.

2008-08-03 14:15 . 2008-08-03 14:15	<DIR>	d--------	C:\Program Files\Common Files\HP
2008-08-03 14:14 . 2008-08-03 14:14	<DIR>	d--------	C:\Program Files\Hewlett-Packard
2008-08-03 14:13 . 2008-08-03 14:13	<DIR>	d--------	C:\Program Files\Common Files\Hewlett-Packard
2008-08-03 14:13 . 2004-12-14 20:33	51,120	-ra------	C:\WINDOWS\system32\drivers\HPZid412.sys
2008-08-03 14:13 . 2004-12-14 20:33	16,496	-ra------	C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-08-03 14:12 . 2004-12-14 20:33	21,744	-ra------	C:\WINDOWS\system32\drivers\HPZius12.sys
2008-08-03 14:11 . 2004-08-03 23:01	25,856	--a------	C:\WINDOWS\system32\drivers\usbprint.sys
2008-08-03 14:11 . 2004-08-03 23:01	25,856	--a--c---	C:\WINDOWS\system32\dllcache\usbprint.sys
2008-08-03 14:11 . 2004-08-03 22:58	15,104	--a------	C:\WINDOWS\system32\drivers\usbscan.sys
2008-08-03 14:11 . 2004-08-03 22:58	15,104	--a--c---	C:\WINDOWS\system32\dllcache\usbscan.sys
2008-08-03 14:10 . 2004-08-03 23:08	31,616	--a------	C:\WINDOWS\system32\drivers\usbccgp.sys
2008-08-03 14:10 . 2004-08-03 23:08	31,616	--a--c---	C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-08-03 14:08 . 2004-09-29 12:12	278,584	--a------	C:\WINDOWS\system32\HPZidr12.dll
2008-08-03 14:08 . 2004-09-29 12:15	204,800	--a------	C:\WINDOWS\system32\HPZipr12.dll
2008-08-03 14:08 . 2004-09-29 12:09	94,208	--a------	C:\WINDOWS\system32\HPZipt12.dll
2008-08-03 14:08 . 2004-09-29 12:14	69,632	--a------	C:\WINDOWS\system32\HPZipm12.exe
2008-08-03 14:08 . 2004-09-29 12:08	61,440	--a------	C:\WINDOWS\system32\HPZinw12.exe
2008-08-03 14:08 . 2004-09-29 12:09	57,344	--a------	C:\WINDOWS\system32\HPZisn12.dll
2008-08-03 14:07 . 2008-08-03 14:15	<DIR>	d--------	C:\Program Files\HP
2008-08-03 14:06 . 2008-08-03 14:16	69,989	--a------	C:\WINDOWS\hpoins05.dat
2008-08-03 14:06 . 2004-12-14 20:33	19,696	---------	C:\WINDOWS\hpomdl05.dat
2008-08-03 12:15 . 2008-08-03 12:15	<DIR>	d--------	C:\Program Files\Winamp
2008-08-03 12:15 . 2008-08-03 12:18	<DIR>	d--------	C:\Documents and Settings\xXx\Dane aplikacji\Winamp
2008-08-01 10:01 . 2008-08-03 10:01	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-08-01 09:56 . 2008-08-03 12:10	<DIR>	d--------	C:\Program Files\SkanerOnline
2008-07-31 21:28 . 2008-07-31 21:28	<DIR>	d--h-----	C:\WINDOWS\system32\GroupPolicy
2008-07-25 18:16 . 2008-08-03 09:58	174	--a------	C:\WINDOWS\system32\winslog.ini
2008-07-23 16:29 . 2008-07-23 17:03	<DIR>	d--------	C:\Documents and Settings\xXx\Dane aplikacji\Ulead Systems
2008-07-23 16:25 . 2008-07-23 16:25	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\InterVideo
2008-07-23 16:25 . 2007-03-06 11:58	210,456	--a------	C:\WINDOWS\system32\IVIresizeW7.dll
2008-07-23 16:25 . 2007-03-06 11:58	206,360	--a------	C:\WINDOWS\system32\IVIresizeA6.dll
2008-07-23 16:25 . 2007-03-06 11:58	198,168	--a------	C:\WINDOWS\system32\IVIresizeP6.dll
2008-07-23 16:25 . 2007-03-06 11:58	198,168	--a------	C:\WINDOWS\system32\IVIresizeM6.dll
2008-07-23 16:25 . 2007-03-06 11:58	194,072	--a------	C:\WINDOWS\system32\IVIresizePX.dll
2008-07-23 16:25 . 2007-03-06 11:58	26,136	--a------	C:\WINDOWS\system32\IVIresize.dll
2008-07-23 16:24 . 2008-07-23 16:24	<DIR>	d--------	C:\Program Files\Windows Media Components
2008-07-23 16:23 . 2008-07-23 16:23	<DIR>	d--------	C:\Program Files\Ulead Systems
2008-07-23 16:23 . 2008-07-23 16:24	<DIR>	d--------	C:\Program Files\Common Files\Ulead Systems
2008-07-23 16:23 . 2008-07-23 16:29	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
2008-07-22 19:34 . 2008-07-22 19:48	<DIR>	d--------	C:\Program Files\AviSynth 2.5
2008-07-22 19:33 . 2008-07-22 19:48	<DIR>	d--------	C:\Program Files\Avi2Dvd
2008-07-22 19:08 . 2008-07-22 19:11	<DIR>	d--------	C:\Program Files\GoD
2008-07-22 11:48 . 2008-05-04 11:11	2,482,176	--a------	C:\WINDOWS\system32\FerOTS.exe
2008-07-20 10:37 . 2008-08-01 09:42	<DIR>	d--------	C:\WINDOWS\system32\FlashAX
2008-07-20 10:36 . 2008-07-20 10:36	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Microgaming
2008-07-20 10:36 . 2008-07-20 10:36	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\MGS
2008-07-20 10:35 . 2008-07-20 10:35	<DIR>	d--------	C:\MicroGaming
2008-07-20 10:25 . 2008-07-23 09:51	<DIR>	d--------	C:\WINDOWS\system32\Adobe
2008-07-11 21:00 . 2008-07-11 21:00	<DIR>	d--------	C:\Automap
2008-07-11 20:59 . 2008-07-11 21:00	<DIR>	d--------	C:\Program Files\Tibia
2008-07-09 09:17 . 2008-07-09 09:17	<DIR>	d--------	C:\Documents and Settings\xXx\SpectroN
2008-07-05 10:55 . 2008-07-05 11:00	<DIR>	d--------	C:\Documents and Settings\xXx\Dane aplikacji\Tibia
2008-07-04 15:56 . 2008-07-04 15:59	<DIR>	d--------	C:\Program Files\Wirtualna Polska

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-03 16:02	---------	d-----w	C:\Program Files\Neostrada TP
2008-08-03 10:10	---------	d-----w	C:\Program Files\SHOUTcast
2008-07-23 19:29	---------	d-----w	C:\Program Files\Gadu-Gadu
2008-07-23 14:25	---------	d--h--w	C:\Program Files\InstallShield Installation Information
2008-07-22 17:02	---------	d-----w	C:\Program Files\VirtualDJ
2008-07-22 15:40	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Skype
2008-07-20 16:05	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\PC Suite
2008-06-26 09:40	---------	d-----w	C:\Program Files\NSS
2008-06-26 09:14	---------	d-----w	C:\Program Files\BitComet
2008-06-26 09:13	2,560	----a-w	C:\WINDOWS\system32\bitcometres.dll
2008-06-24 15:30	---------	d-----w	C:\Program Files\CDex_150
2008-06-20 17:42	246,784	----a-w	C:\WINDOWS\system32\mswsock.dll
2008-06-20 15:34	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Media Player Classic
2008-06-20 10:45	360,320	----a-w	C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44	138,368	----a-w	C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52	225,920	----a-w	C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-18 18:45	---------	d---a-w	C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-14 18:01	273,024	------w	C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 13:58	---------	d-----w	C:\Program Files\WapSter
2008-06-09 14:02	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Ahead
2008-06-06 20:30	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\AdobeUM
2008-06-06 18:43	---------	d-----w	C:\Program Files\Skype
2008-06-06 18:43	---------	d-----w	C:\Program Files\Common Files\Skype
2008-06-06 18:43	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-06-05 20:08	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Nokia
2008-06-05 20:06	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-06-05 19:54	---------	d-----w	C:\Program Files\PC Connectivity Solution
2008-06-05 19:54	---------	d-----w	C:\Program Files\Nokia
2008-06-05 19:54	---------	d-----w	C:\Program Files\DIFX
2008-06-05 19:54	---------	d-----w	C:\Program Files\Common Files\PCSuite
2008-06-05 19:54	---------	d-----w	C:\Program Files\Common Files\Nokia
2008-06-05 19:52	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-06-05 12:15	23	----a-w	C:\WINDOWS\system32\drivers\adidsl.cfg
2008-06-05 12:15	---------	d-----w	C:\Program Files\SAGEM
2008-06-05 12:15	---------	d-----w	C:\Program Files\Java
2008-06-04 19:27	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Zylom
2008-06-04 19:27	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Zylom
2008-06-04 16:20	---------	d-----w	C:\Program Files\SpectroN
2008-06-04 16:20	---------	d-----w	C:\Program Files\Common Files\Adobe
2008-06-04 16:17	---------	d-----w	C:\Program Files\Ahead
2008-06-04 16:13	---------	d-----w	C:\Program Files\Common Files\Ahead
2008-06-04 16:13	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-06-04 16:05	---------	d-----w	C:\Program Files\Creative
2008-06-04 16:05	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Creative
2008-06-04 16:05	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\ATI
2008-06-04 16:00	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Creative
2008-06-04 15:57	---------	d-----w	C:\Program Files\ULI5289
2008-06-04 15:54	---------	d-----w	C:\Program Files\Common Files\InstallShield
2008-06-04 15:54	---------	d-----w	C:\Program Files\ATI Technologies
2008-06-04 15:54	---------	d-----w	C:\Program Files\Ares
2008-06-04 15:51	---------	d-----w	C:\Program Files\Alwil Software
2008-06-04 15:50	---------	d-----w	C:\Documents and Settings\xXx\Dane aplikacji\Gadu-Gadu
2008-06-04 15:49	---------	d-----w	C:\Program Files\MarBit
2008-06-04 15:49	---------	d-----w	C:\Program Files\K-Lite Codec Pack
2008-06-04 15:49	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-06-04 15:42	---------	d-----w	C:\Program Files\microsoft frontpage
2008-06-04 15:40	---------	d-----w	C:\Program Files\Usługi online
2008-05-07 05:16	1,291,264	----a-w	C:\WINDOWS\system32\quartz.dll
.

((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\WINDOWS\system32\GroupPolicy ----

2008-07-31 21:36	38	--a------	C:\WINDOWS\system32\GroupPolicy\gpt.ini 
2008-07-31 21:28	81	---h-----	C:\WINDOWS\system32\GroupPolicy\Adm\admfiles.ini 
2007-07-30 19:13	56646	--a------	C:\WINDOWS\system32\GroupPolicy\Adm\wuau.adm 
2004-07-23 21:42	1545692	--a------	C:\WINDOWS\system32\GroupPolicy\Adm\inetres.adm 
2004-07-17 22:56	71460	--a------	C:\WINDOWS\system32\GroupPolicy\Adm\wmplayer.adm 
2004-07-17 22:56	1904292	--a------	C:\WINDOWS\system32\GroupPolicy\Adm\system.adm 
2004-07-17 11:41	42690	--a------	C:\WINDOWS\system32\GroupPolicy\Adm\conf.adm 


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 14:18 2351864]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 21:05 339968]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 22:21 32768]
"ALi5289"="C:\Program Files\ULI5289\ALi5289.exe" [2005-03-10 14:56 405504]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07 24576]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 18:07 53248]
"UVS11 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 14:12 341488]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 15:49 49152]
"CTHelper"="CTHELPER.EXE" [2003-08-28 10:45 24576 C:\WINDOWS\system32\CTHELPER.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 22:21 32768]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 14:44:06 29696]
ATI CATALYST System Tray.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-02-22 22:21:26 32768]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-06-05 14:15:45 962661]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"msacm.ctmp3"= C:\WINDOWS\system32\ctmp3.acm
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"E:\\Grigo\\WebServ\\mysql\\bin\\WebServ(mysqld-max-nt).exe"=
"E:\\Grigo\\WebServ\\apache2\\bin\\WebServ(apache).exe"=
"C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"=
"C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"=
"E:\\Grigo\\WebServ\\mysql\\bin\\WebServ(mysqld).exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7171:TCP"= 7171:TCP:spokolokoots.no-ip.org
"7171:UDP"= 7171:UDP:spokolokoots.no-iporg
"8632:TCP"= 8632:TCP:BitComet 8632 TCP
"8632:UDP"= 8632:UDP:BitComet 8632 UDP
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 m5289;m5289;C:\WINDOWS\system32\DRIVERS\m5289.sys [2004-12-01 10:49]
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys [2005-05-03 17:31]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 ALIEHCD;ULi PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ALIEHCI.sys [2005-06-02 19:59]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R3 aliroothub;USB 2.0 Root Hub;C:\WINDOWS\system32\DRIVERS\AliRtHub.sys [2005-06-02 18:27]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-04 09:48:26
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 


C:\DOCUME~1\xXx\USTAWI~1\Temp\RGI17.tmp 7115 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
Completion time: 2008-08-04  9:49:29
ComboFix-quarantined-files.txt  2008-08-04 07:49:25

Pre-Run: 3,943,030,784 bajtów wolnych
Post-Run: 3,927,711,744 bajtów wolnych

230	--- E O F ---	2008-07-09 06:05:57

0

Do góry

#8 ordynat

Zaawansowany użytkownik

804 postów

Napisano 04 08 2008 - 11:59

A więc jednak te pliki infekcji były jeszcze na dysku "D" i "E" - dopiero teraz zostały usunięte.

C:\DOCUME~1\xXx\USTAWI~1\Temp\RGI17.tmp

Opróżnij foldery TEMP przy pomocy jakiegoś czyściciela, np.:
>>ATF Cleaner> http://www.searchengines.pl/index.php?show...=0&p=138520

To wszystko z mojej strony.

ordynat