Kaspersky pokazuje dziwne ataki na system

**Posty:** 1861 · przez **skowrona** 21 Wrz 2008, 20:44

Dzisiaj kasperski wywalił mi komunikat o takich oto atakach

Kod: Zaznacz wszystko: Zagrożenie: Scan.Generic.UDP Nie odnaleziono UDP od 213.92.148.108 na port lokalny 34363 Zagrożenie: Intrusion.Win.MSSQL.worm.Helkern Nie odnaleziono UDP od 202.99.11.99 na port lokalny 1434

oto logi

Kod: Zaznacz wszystko: ComboFix 08-09-20.05 - Administrator 2008-09-21 20:29:09.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1647 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-21 do 2008-09-21 ))))))))))))))))))))))))))))))) . 2008-09-21 20:30 . 2008-09-21 20:30 <DIR> d-------- C:\WINDOWS\system32\xircom 2008-09-21 20:30 . 2008-09-21 20:30 <DIR> d-------- C:\WINDOWS\system32\oobe 2008-09-21 20:30 . 2008-09-21 20:30 <DIR> d-------- C:\WINDOWS\srchasst 2008-09-21 20:30 . 2008-09-21 20:30 <DIR> d-------- C:\WINDOWS\msagent 2008-09-21 20:30 . 2008-09-21 20:30 <DIR> d-------- C:\Program Files\microsoft frontpage 2008-09-20 18:53 . 2008-09-20 18:53 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-09-20 18:43 . 2008-09-20 18:43 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2008-09-20 18:43 . 2008-09-20 18:43 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-09-20 18:43 . 2008-09-20 18:43 <DIR> d-------- C:\Program Files\AGEIA Technologies 2008-09-20 12:13 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-09-20 12:13 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-09-20 12:13 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-09-19 22:37 . 2008-09-19 22:37 <DIR> d-------- C:\WINDOWS\Sun 2008-09-17 16:46 . 2008-09-17 16:46 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Media Player Classic 2008-09-17 15:42 . 2008-09-17 15:42 <DIR> d-------- C:\Program Files\Opera 2008-09-17 15:38 . 2008-09-17 15:39 <DIR> d-------- C:\Program Files\Dziobas Rar Player 2008-09-17 15:23 . 2008-09-17 15:23 <DIR> d-------- C:\Program Files\BearShare Pro 2008-09-17 15:23 . 2008-09-17 15:23 <DIR> d-------- C:\DOWNLOADS 2008-09-17 15:23 . 2008-09-17 15:23 <DIR> d-------- C:\!Temp 2008-09-16 20:22 . 2008-09-16 20:25 <DIR> d-------- C:\Program Files\Screamer Radio 2008-09-16 20:22 . 2008-09-16 20:22 <DIR> d-------- C:\Program Files\foobar2000 2008-09-16 20:22 . 2008-09-16 20:25 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\foobar2000 2008-09-16 14:24 . 2008-09-16 14:24 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2008-09-16 14:24 . 2008-09-16 14:24 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2008-09-16 14:15 . 2008-09-16 14:15 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Ashampoo 2008-09-16 14:14 . 2008-09-16 14:14 <DIR> d-------- C:\Program Files\Ashampoo 2008-09-16 14:14 . 2008-09-16 14:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-09-16 13:08 . 2008-09-16 13:08 <DIR> d-------- C:\Program Files\Trend Micro 2008-09-16 11:44 . 2008-09-16 11:44 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\ESET 2008-09-16 11:43 . 2008-09-16 11:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-09-16 11:39 . 2008-09-16 11:39 <DIR> d-------- C:\Documents and Settings\Administrator\WapSter 2008-09-16 11:38 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2008-09-16 11:35 . 2008-09-16 11:35 <DIR> d-------- C:\Program Files\WapSter 2008-09-16 11:33 . 2008-09-16 11:33 <DIR> d-------- C:\Program Files\Codemasters 2008-09-16 11:28 . 2006-06-14 11:17 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys 2008-09-16 11:28 . 2004-08-03 22:58 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys 2008-09-16 11:28 . 2004-08-03 22:58 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys 2008-09-16 11:24 . 2008-09-16 11:24 <DIR> d-------- C:\WINDOWS\nview 2008-09-16 11:24 . 2008-09-16 11:24 <DIR> d-------- C:\NVIDIA 2008-09-16 11:24 . 2008-05-16 11:48 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-09-16 11:24 . 2008-05-16 14:01 446,464 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-09-16 11:24 . 2008-09-21 20:31 186,097 --a------ C:\WINDOWS\system32\nvapps.xml 2008-09-16 11:24 . 2008-05-16 14:01 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-09-16 11:23 . 2008-09-16 11:23 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-09-16 11:16 . 2008-09-16 11:16 <DIR> d-------- C:\Program Files\uTorrent 2008-09-16 11:15 . 2008-09-21 19:37 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent 2008-09-16 11:15 . 2008-09-16 11:15 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Ubisoft 2008-09-16 11:15 . 2008-09-16 11:15 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Tlen.pl 2008-09-16 11:15 . 2008-09-16 11:15 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Sports Interactive 2008-09-16 11:07 . 2008-09-16 11:07 <DIR> d-------- C:\Program Files\Nvidia Omega Drivers 2008-09-16 11:07 . 2008-05-16 14:01 6,557,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2008-09-16 11:07 . 2008-05-16 14:01 6,108,928 --a------ C:\WINDOWS\system32\nv4_disp.dll 2008-09-16 11:07 . 2008-05-16 14:01 1,241,088 --a------ C:\WINDOWS\system32\nvcuda.dll 2008-09-16 11:07 . 2008-09-16 11:07 472,576 --a------ C:\WINDOWS\Nvidia Omega Drivers v2.169.21 Uninstall.exe 2008-09-16 11:05 . 2008-09-16 11:05 <DIR> d-------- C:\WINDOWS\OPTIONS 2008-09-16 11:05 . 2008-01-03 16:10 105,856 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys 2008-09-16 11:04 . 2008-09-16 11:04 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-09-16 11:04 . 2008-09-16 11:04 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\InstallShield 2008-09-16 11:04 . 2008-09-16 11:04 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-09-16 11:04 . 2006-06-14 10:50 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys 2008-09-16 11:04 . 2008-09-16 11:04 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-09-16 11:04 . 2006-02-15 02:22 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys 2008-09-16 11:04 . 2004-08-03 23:15 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys 2008-09-16 11:04 . 2001-08-17 22:00 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys 2008-09-16 11:04 . 2004-08-03 23:07 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys 2008-09-16 11:04 . 2006-06-14 10:50 6,272 --a------ C:\WINDOWS\system32\drivers\splitter.sys 2008-09-16 11:04 . 2004-08-03 23:07 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys 2008-09-16 11:03 . 2008-09-16 11:03 <DIR> d-------- C:\WINDOWS\system32\RTCOM 2008-09-16 11:03 . 2004-08-04 00:44 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax 2008-09-16 11:03 . 2004-08-03 23:08 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2008-09-16 11:03 . 2006-08-01 09:02 49,152 -r------- C:\WINDOWS\system32\ChCfg.exe 2008-09-16 11:03 . 2004-08-03 22:58 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2008-09-16 11:03 . 2004-08-04 00:44 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2008-09-16 11:03 . 2007-11-14 09:18 553 -r------- C:\WINDOWS\USetup.iss 2008-09-16 11:02 . 2008-09-16 11:05 <DIR> d-------- C:\Program Files\Realtek 2008-09-16 11:02 . 2008-09-17 14:23 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-09-16 11:02 . 2008-09-16 11:02 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-09-16 11:00 . 2008-09-20 18:43 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-09-16 11:00 . 2008-09-16 11:00 <DIR> d-------- C:\Program Files\Intel 2008-09-16 11:00 . 2008-09-16 11:00 <DIR> d-------- C:\Intel 2008-09-16 11:00 . 2007-12-12 09:56 53,248 -ra------ C:\WINDOWS\system32\CSVer.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-21 18:30 4,044 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-09-21 18:30 253,984 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-09-21 18:30 11,464 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-21 18:30 1,060,896 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-21 18:02 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-09-16 11:04 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-09-16 11:04 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-09-16 10:58 --------- d-----w C:\Program Files\Kaspersky Lab 2008-09-16 10:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-09-16 10:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft 2008-09-16 10:17 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-09-16 10:07 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-09-16 10:07 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\DAEMON Tools 2008-09-16 09:04 16,608 ----a-w C:\WINDOWS\gdrv.sys 2008-09-16 09:02 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-09-16 08:54 --------- d-----w C:\Program Files\Real Alternative 2008-09-16 08:53 --------- d-----w C:\Program Files\QuickTime Alternative 2008-09-16 08:53 --------- d-----w C:\Program Files\Java 2008-09-16 08:53 --------- d-----w C:\Program Files\Common Files\Java 2008-09-16 08:53 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-09-16 08:50 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll . ------- Sigcheck ------- 2007-07-10 15:06 642560 ce594e18fe0d0af804f1f3694921ce62 C:\WINDOWS\system32\user32.dll 2007-07-14 00:56 814592 ce7193c5f7c01b19768e066087c1c919 C:\WINDOWS\system32\wininet.dll 2007-07-28 03:15 360576 0fb6743e937c7bb248b2530a5a77abc6 C:\WINDOWS\system32\drivers\tcpip.sys 2007-07-26 19:30 2145792 316acc3ac43fc855204ce5e775f66b91 C:\WINDOWS\system32\ntoskrnl.exe 2007-07-14 00:42 974848 32f67215c57df2c401bf93b7ee65987f C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 201992] "nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2008-02-13 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" [2007-07-27 C:\WINDOWS\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoResolveSearch"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ] --a------ 2008-09-18 13:56 1674736 C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"= "D:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"= "D:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"= "D:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"= "C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"= "C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Polish\\setup.exe"= "D:\\Program Files\\Electronic Arts\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784] R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-NodLogin - C:\Program Files\ESET\ESET Smart Security\nodlogin.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq53ywxv.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-21 20:31:06 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-09-21 20:32:13 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-09-21 18:32:11 Przed: 7˙982˙174˙208 bajt˘w wolnych Po: 7,956,365,312 bajt˘w wolnych 212

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 58, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "DAEMON Tools Lite" = ""C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun" ["DT Soft Ltd"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "AVP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"" ["Kaspersky Lab"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}\(Default) = "IEVkbdBHO" -> {HKLM...CLSID} = "IEVkbdBHO Class" \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll" ["Kaspersky Lab"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band" -> {HKLM...CLSID} = "History Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{10677009-C23C-4FC2-A62C-29323A2201F0}" = "AQQ File Transfer Shell Extension" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\WapSter\WAPSTE~1\System\AQQSHE~1.DLL" [null data] "{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statystyki ochrony WWW" -> {HKLM...CLSID} = "Statystyki ochrony WWW" \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll" ["Kaspersky Lab"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshserviceobj.dll" [MS] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> klogon\DLLName = "C:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ AQQFileTransfer\(Default) = "{10677009-C23C-4FC2-A62C-29323A2201F0}" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\WapSter\WAPSTE~1\System\AQQSHE~1.DLL" [null data] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ShellEx.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ShellEx.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Default executables: -------------------- <<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile" Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoSMMyPictures" = (REG_DWORD) dword:0x00000001 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove My Pictures icon from Start Menu} "NoSMConfigurePrograms" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoSMHelp" = (REG_DWORD) dword:0x00000001 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} "NoRecentDocsMenu" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoRecentDocsHistory" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoStartBanner" = (REG_DWORD) dword:0x00000001 {Remove "Click here to begin" from Start button} "NoLowDiskSpaceChecks" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoResolveTrack" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "LinkResolveIgnoreLinkInfo" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoResolveSearch" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "NoInternetOpenWith" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "DisableStatusMessages" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "VerboseStatus" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ ASHAshampoo_Burning_Studio_8BURNONARRIVAL\ "Provider" = "Ashampoo Burning Studio 8" "InvokeProgID" = "Ashampoo.BurningStudio8" "InvokeVerb" = "autoplay-burn" HKLM\SOFTWARE\Classes\Ashampoo.BurningStudio8\shell\autoplay-burn\Command\(Default) = ""C:\Program Files\Ashampoo\Ashampoo Burning Studio 8\burningstudio.exe" -autoplay -selectdrive "%l"" ["ashampoo Technology GmbH & Co. KG"] ASHAshampoo_Burning_Studio_8COPYONARRIVAL\ "Provider" = "Ashampoo Burning Studio 8" "InvokeProgID" = "Ashampoo.BurningStudio8" "InvokeVerb" = "autoplay-copy" HKLM\SOFTWARE\Classes\Ashampoo.BurningStudio8\shell\autoplay-copy\Command\(Default) = "C:\Program Files\Ashampoo\Ashampoo Burning Studio 8\burningstudio.exe" -autoplay -selectdrive "%l" -copy" [file not found] ASHAshampoo_Burning_Studio_8RIPONARRIVAL\ "Provider" = "Ashampoo Burning Studio 8" "InvokeProgID" = "Ashampoo.BurningStudio8" "InvokeVerb" = "autoplay-rip" HKLM\SOFTWARE\Classes\Ashampoo.BurningStudio8\shell\autoplay-rip\Command\(Default) = ""C:\Program Files\Ashampoo\Ashampoo Burning Studio 8\burningstudio.exe" -autoplay -selectdrive "%l" -rip" ["ashampoo Technology GmbH & Co. KG"] MPCPlayCDAudioOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayCDAudio" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["Gabest"] MPCPlayDVDMovieOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayDVDMovie" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["Gabest"] MPCPlayMusicFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayMusicFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MPCPlayVideoFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayVideoFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MSWPDShellNamespaceHandler\ "Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501" "CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}" "InitCmdLine" = " " -> {HKLM...CLSID} = "WPDShextAutoplay" \LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statystyki ochrony WWW" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll" ["Kaspersky Lab"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ "ButtonText" = "Statystyki ochrony WWW" Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Kaspersky Internet Security, AVP, ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" -r" ["Kaspersky Lab"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] PunkBuster, PnkBstrA, ""D:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe"" [null data] ---------- (launch time: 2008-09-21 20:40:25) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 23 seconds, including 8 seconds for message boxes)

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:41:40, on 2008-09-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20583) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: Dodaj do listy blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - D:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe -- End of file - 3815 bytes

**Posty:** 18165 · przez **wojtas** 21 Wrz 2008, 20:46

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.