Temat jest zamknięty
Trojan.FakeAlet
Trojan.GaslideB
Win32:PatchedCK
Win32:SmallDFK
Wirusy usunięto, objawy infekcji też zniknęły(nie dało się włączać większosci .exe, strony internetowe nie ładowały się do końca i zawieszało przegladarkę, nie można było zmienić tapety) ale żeby być pewien że komputer jest czysty daje logi:
Hijack:
Logfile of Trend Micro HijackThis v2.0.2Scan saved at 14:17:52, on 2008-07-11Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXEC:\WINDOWS\RTHDCPL.EXEC:\Program Files\Winamp\winampa.exeC:\Program Files\Java\jre1.6.0_06\bin\jusched.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Spyware Doctor\pctsTray.exeC:\Program Files\DAEMON Tools Lite\daemon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Gadu-Gadu\gg.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exeC:\Program Files\Spyware Doctor\pctsAuxs.exeC:\Program Files\Spyware Doctor\pctsSvc.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Skype\Plugin Manager\skypePM.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\WINDOWS\system32\wbem\wmiprvse.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url="http://www.google.pl/"]http://www.google.pl/[/url]R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = ŁączaO2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dllO4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exeO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [lphcn80j0e13t] C:\WINDOWS\system32\lphcn80j0e13t.exeO4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorunO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimizedO4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /trayO4 - HKCU\..\Run: [Somefox] C:\DOCUME~1\xxx\USTAWI~1\Temp\setup68.exeO4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exeO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exeO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe--End of file - 5004 bytesComboFix
ComboFix 08-07-10.1 - xxx 2008-07-11 14:19:41.1 - NTFSx86Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.405 [GMT 2:00]Running from: C:\Documents and Settings\xxx\Pulpit\ComboFix.exe * Created a new restore point<strong class='bbc'>WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED 
</strong>.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).C:\WINDOWS\system32\blphcn80j0e13t.scr.((((((((((((((((((((((((( Files Created from 2008-06-11 to 2008-07-11 ))))))))))))))))))))))))))))))).2008-07-11 13:56 . 2008-07-11 13:56 <DIR> d-------- C:\Program Files\Trend Micro2008-07-11 13:36 . 2008-07-11 13:38 <DIR> d-------- C:\Program Files\Spyware Doctor2008-07-11 13:36 . 2008-07-11 13:36 <DIR> d-------- C:\Documents and Settings\xxx\Dane aplikacji\PC Tools2008-07-11 13:36 . 2008-07-11 14:15 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP2008-07-11 13:36 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys2008-07-11 13:36 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys2008-07-11 13:36 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys2008-07-11 13:36 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys2008-07-10 19:37 . 2008-07-11 14:20 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne2008-07-10 19:37 . 2008-07-10 19:41 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione2008-07-10 19:37 . 2008-04-16 14:43 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony2008-07-10 19:37 . 2008-04-16 16:36 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit2008-07-10 19:37 . 2008-04-16 16:36 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty2008-07-10 19:37 . 2008-04-16 16:36 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start2008-07-10 19:37 . 2008-04-16 16:36 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji2008-07-10 19:37 . 2008-07-10 19:37 <DIR> d-------- C:\Documents and Settings\Administrator2008-07-08 16:49 . 2008-07-08 16:49 56,836 --a------ C:\WINDOWS\system32\msxml71.dll2008-07-06 15:56 . 2008-07-06 15:56 <DIR> d-------- C:\Documents and Settings\xxx\Dane aplikacji\Gadu-Gadu2008-07-05 22:13 . 2008-07-11 08:05 <DIR> d-------- C:\Documents and Settings\xxx\Dane aplikacji\skypePM2008-07-05 22:13 . 2008-07-05 22:13 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat2008-07-05 22:05 . 2008-07-05 22:05 <DIR> d-------- C:\Program Files\Skype2008-07-05 22:05 . 2008-07-05 22:05 <DIR> d-------- C:\Program Files\Common Files\Skype2008-07-05 22:05 . 2008-07-11 14:18 <DIR> d-------- C:\Documents and Settings\xxx\Dane aplikacji\Skype2008-07-05 22:05 . 2008-07-05 22:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype2008-06-11 10:38 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys2008-06-11 10:38 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-07-11 12:14 57,856 ----a-w C:\WINDOWS\system32\spoolsv.exe2008-07-11 12:14 504,832 ----a-w C:\WINDOWS\system32\winlogon.exe2008-07-11 12:14 14,336 ----a-w C:\WINDOWS\system32\svchost.exe2008-07-11 12:14 13,312 ----a-w C:\WINDOWS\system32\lsass.exe2008-07-11 12:14 108,544 ----a-w C:\WINDOWS\system32\services.exe2008-07-11 12:10 1,034,752 ----a-w C:\WINDOWS\explorer.exe2008-07-06 15:38 --------- d-----w C:\Program Files\Gadu-Gadu2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys2008-06-01 08:00 --------- d-----w C:\Program Files\Alwil Software2008-06-01 07:47 --------- d-----w C:\Program Files\Java2008-06-01 07:46 --------- d-----w C:\Program Files\Common Files\Java2008-05-26 14:58 --------- d-----w C:\Program Files\EA Sports2008-05-26 13:46 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll2008-05-24 09:14 --------- d--h--w C:\Program Files\InstallShield Installation Information2008-05-11 06:57 --------- d-----w C:\Program Files\Eidos Interactive2008-05-11 06:56 --------- d-----w C:\Program Files\directx2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll2008-04-21 07:03 662,016 ----a-w C:\WINDOWS\system32\wininet.dll2008-04-16 13:15 15,600 ----a-w C:\WINDOWS\gdrv.sys2008-04-16 13:13 315,392 ----a-w C:\WINDOWS\HideWin.exe.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-06-03 15:08 21718312]"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 07:28 36352]"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-04-10 15:14 1107848]"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"msacm.avis"= ff_acm.acm[HKEY_LOCAL_MACHINE\software\microsoft\security center]"AntiVirusOverride"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe"=R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]*Newly Created Service* - CATCHME*Newly Created Service* - MCHINJDRV.- - - - ORPHANS REMOVED - - - -HKLM-Run-lphcn80j0e13t - C:\WINDOWS\system32\lphcn80j0e13t.exe**************************************************************************catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url="http://www.gmer.net"]http://www.gmer.net[/url]Rootkit scan 2008-07-11 14:21:05Windows 5.1.2600 Dodatek Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.Completion time: 2008-07-11 14:21:53ComboFix-quarantined-files.txt 2008-07-11 12:21:49Pre-Run: 69,166,587,904 bajtów wolnychPost-Run: 69,644,972,032 bajtów wolnych115 --- E O F --- 2008-07-09 12:12:10Z góry dzięki za pomoc 
