Trojan, prosba o sprawdzenie logow cf ht

**Posty:** 9 · przez **patrykxes** 29 Mar 2009, 16:58

Prosze o nakierowanie mnie po sprawdzeniu logow do wykonania kolejnych czynnosci. Dzieki.

Oto log z Combofix:

Kod: Zaznacz wszystko: ComboFix 09-03-28.01 - przemek 2009-03-29 15:54:47.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1033.18.1022.524 [GMT 2:00] Uruchomiony z: c:\combofix2009\ComboFix.exe AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) FW: Kaspersky Internet Security *disabled* * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ISODRIVE -------\Service_ISODrive -------\Service_PCIDump ((((((((((((((((((((((((( Pliki utworzone od 2009-02-28 do 2009-03-29 ))))))))))))))))))))))))))))))) . 2009-03-29 15:49 . 2009-03-29 15:49 <DIR> d-------- C:\HijackThis2009 2009-03-29 15:48 . 2009-03-29 15:49 <DIR> d-------- C:\ComboFix2009 2009-03-24 13:09 . 2007-05-10 11:23 4,952,064 --a------ c:\windows\system32\stacgui.cpl 2009-03-24 13:09 . 2007-04-10 18:02 1,601,536 --a------ c:\windows\system32\stlang.dll 2009-03-24 13:09 . 2007-05-10 11:22 405,504 --a------ c:\windows\stsystra.exe 2009-03-24 13:08 . 2007-05-10 11:23 270,336 --a------ c:\windows\system32\stacapi.dll 2009-03-12 09:33 . 2009-03-12 09:38 <DIR> d-------- c:\program files\Common Files\Quest Shared 2009-03-12 09:33 . 2009-03-12 09:33 <DIR> d-------- c:\documents and settings\przemek\Application Data\Software 2009-03-12 09:29 . 2009-03-12 09:29 <DIR> d-------- c:\program files\Microsoft Visual Studio .NET 2009-03-09 20:39 . 2009-03-09 20:39 <DIR> d-------- c:\program files\UltraISO 2009-03-09 20:39 . 2009-03-09 20:39 <DIR> d-------- c:\program files\Common Files\EZB Systems . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-29 14:04 7,103,264 --sha-w c:\windows\system32\drivers\fidbox2.dat 2009-03-29 14:03 127,171,104 --sha-w c:\windows\system32\drivers\fidbox.dat 2009-03-29 14:03 --------- d-----w c:\documents and settings\LocalService\Application Data\VMware 2009-03-29 14:03 --------- d-----w c:\documents and settings\All Users\Application Data\VMware 2009-03-29 14:01 675,284 --sha-w c:\windows\system32\drivers\fidbox2.idx 2009-03-29 14:01 1,720,916 --sha-w c:\windows\system32\drivers\fidbox.idx 2009-03-29 14:00 --------- d-----w c:\documents and settings\przemek\Application Data\Vidalia 2009-03-29 13:58 --------- d-----w c:\documents and settings\przemek\Application Data\Tor 2009-03-29 11:17 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab 2009-03-28 16:49 --------- d-----w c:\documents and settings\przemek\Application Data\VMware 2009-03-22 21:14 --------- d-----w c:\documents and settings\przemek\Application Data\Skype 2009-03-22 21:12 --------- d-----w c:\documents and settings\przemek\Application Data\skypePM 2009-03-22 13:28 --------- d-----w c:\program files\Gadu-Gadu 2009-03-12 07:29 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2009-03-01 17:36 --------- d-----w c:\documents and settings\przemek\Application Data\FileZilla 2009-02-20 22:35 --------- d-----w c:\documents and settings\przemek\Application Data\ipla 2009-02-20 22:35 --------- d-----w c:\documents and settings\All Users\Application Data\ipla 2009-02-20 22:34 --------- d-----w c:\program files\ipla 2009-02-19 15:08 --------- d-----w c:\program files\Microsoft Office Communicator 2009-02-19 14:23 --------- d-----w c:\program files\Oracle 2009-02-16 20:49 --------- d-----w c:\documents and settings\przemek\Application Data\MySQL 2009-02-16 17:24 --------- d-----w c:\program files\Common Files\Mercury Interactive 2009-02-16 14:13 --------- d-----w c:\documents and settings\przemek\Application Data\Subversion 2009-02-10 08:20 --------- d-----w c:\program files\Common Files\Business Objects 2009-02-10 08:20 --------- d-----w c:\program files\Business Objects 2009-02-10 08:19 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-07 21:19 --------- d-----w c:\documents and settings\przemek\Application Data\Gzegzolka XP 2009-01-28 11:31 --------- d-----w c:\program files\Common Files\Adobe 2009-01-28 11:29 --------- d-----w c:\program files\Adobe Media Player 2009-01-28 11:27 --------- d-----w c:\program files\Common Files\Adobe AIR 2009-01-28 11:21 --------- d-----w c:\program files\Common Files\Macrovision Shared 2008-03-01 13:38 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat 2008-12-20 15:53 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-20 15:53 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-20 15:53 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-20 15:53 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-20 15:53 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN] @="{30351346-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}] 2008-02-16 12:35 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN] @="{30351347-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}] 2008-02-16 12:35 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN] @="{30351348-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}] 2008-02-16 12:35 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN] @="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}] 2008-02-16 12:35 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN] @="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}] 2008-02-16 12:35 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN] @="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}] 2008-02-16 12:35 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN] @="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}] 2008-02-16 12:35 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-16 1392640] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-01 385024] "Communicator"="c:\program files\Microsoft Office Communicator\communicator.exe" [2008-12-16 5730144] "SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 227856] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\przemek\Start Menu\Programs\Startup\ Info.lnk - c:\windows\system32\taskmgr.exe [2004-08-04 135680] Przypominacz.lnk - c:\documents and settings\przemek\My Documents\przypom\Przypominacz.exe [2008-06-30 214528] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Monitor Apache Servers.lnk - c:\webserv\bin\ApacheMonitor.exe [2008-01-18 41041] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PAStates] 2007-01-11 16:51 98304 c:\windows\system32\PAStates.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.iac2"= c:\progra~1\ACEMEG~1\SystemS\Intel\iac25_32.ax "msacm.sl_anet"= c:\progra~1\ACEMEG~1\SystemS\sl_anet.acm "vidc.yv12"= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.divx"= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll "msacm.msaudio1"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm "vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Monitor Apache Servers.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Monitor Apache Servers.lnk backup=c:\windows\pss\Monitor Apache Servers.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Nseries PC Suite.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Nokia Nseries PC Suite.lnk backup=c:\windows\pss\Nokia Nseries PC Suite.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^przemek^Start Menu^Programs^Startup^OpenOffice.org 2.3.lnk] path=c:\documents and settings\przemek\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^przemek^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk] path=c:\documents and settings\przemek\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer] c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 14:06 40048 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager] --a------ 2008-08-14 08:58 611712 c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2006-01-02 18:41 45056 c:\program files\ATI Technologies\ATI.ACE\CLI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 12:00 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2009-02-21 20:55 2127296 c:\program files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 01:47 31016 f:\microsoft_office_2007\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager] --a------ 2007-10-25 16:33 563984 c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] --a------ 2007-10-25 16:37 2178832 c:\program files\Logitech\QuickCam\Quickcam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 18:24 1694208 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] --a------ 2008-12-03 13:47 1205760 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-02-01 00:13 385024 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] --a------ 2007-05-10 11:22 405504 c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-01 18:22 21898024 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmcService] --a------ 2003-12-24 15:44 2344160 c:\progra~1\Sygate\SPF\Smc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-02-22 05:25 144784 c:\program files\Java\jre1.6.0_05\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload] --a------ 2007-09-12 12:17 340136 f:\ulead systems\Ulead VideoStudio 11\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vmware-tray] --a------ 2008-09-19 00:11 84528 f:\vmware_instalacja\VMware Workstation\vmware-tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinVNC] --a------ 2007-05-07 20:28 589824 c:\program files\TightVNC\WinVNC.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Java\\jre1.6.0_04\\bin\\java.exe"= "c:\\Program Files\\Java\\jdk1.6.0_04\\bin\\java.exe"= "c:\\Program Files\\Java\\jdk1.6.0_04\\jre\\bin\\java.exe"= "c:\\Program Files\\NetBeans 6.0.1\\mobility8\\WTK2.5.2\\bin\\emulator.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "c:\\Program Files\\VoipStunt.com\\VoipStunt\\VoipStunt.exe"= "c:\\Program Files\\Cisco Systems\\CiscoTrustAgent\\CtaEoU.exe"= "f:\\Microsoft_Office_2007\\Office12\\OUTLOOK.EXE"= "f:\\Microsoft_Office_2007\\Office12\\GROOVE.EXE"= "f:\\Microsoft_Office_2007\\Office12\\ONENOTE.EXE"= "f:\\VMware_instalacja\\VMware Workstation\\vmware-authd.exe"= "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "3306:TCP"= 3306:TCP:MySQL Server "21862:UDP"= 21862:UDP:SDNCTA "5353:TCP"= 5353:TCP:Adobe CSI CS4 R2 CtaEoU;Cisco Trust Agent EOU Daemon;c:\program files\Cisco Systems\CiscoTrustAgent\CtaEoU.exe [2007-01-11 356416] R2 ctalogd;Cisco Trust Agent Logger Daemon;c:\program files\Cisco Systems\CiscoTrustAgent\ctalogd.exe [2007-01-11 98304] R2 ctapsd;Cisco Posture Server Daemon;c:\program files\Cisco Systems\CiscoTrustAgent\ctapsd.exe [2007-01-11 327680] R2 ctatransapt;Cisco Systems, Inc. CTA Posture State Daemon;c:\program files\Cisco Systems\CiscoTrustAgent\ctatransapt.exe [2007-01-11 172032] R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2008-09-19 54960] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-12-13 24592] S3 Apache2.2;Apache2.2;c:\webserv\bin\httpd.exe [2008-01-18 24635] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064] S4 OpenSSHd;OpenSSH Server;c:\program files\OpenSSH\bin\cygrunsrv.exe [2004-04-18 36864] S4 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [2008-02-01 65536] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2c23aa39-0983-11de-b9b7-0015c5b92554}] \Shell\AutoRun\command - H:\WDSetup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95fa6606-e2d0-11dc-b0c4-0016cf80b9ff}] \Shell\AutoRun\command - H:\setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6d01620-dee7-11dd-9784-005056c00008}] \Shell\AutoRun\command - setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{efe89756-e0a2-11dc-b0ba-0015c5b92554}] \Shell\AutoRun\command - I:\Autorun.exe /run \Shell\Shell00\Command - I:\Autorun.exe /run \Shell\Shell01\Command - I:\Autorun.exe /action \Shell\Shell02\Command - I:\Autorun.exe /uninstall . . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.pl/ uInternet Settings,ProxyServer = hxxp://proxy.tepenet/tp.pac uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - f:\micros~1\Office12\EXCEL.EXE/3000 IE: {{B46B0919-62BA-4D99-A5C4-916B57A6805C} - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - c:\program files\Techland\Common\InternetTranslator\InternetTranslator.dll LSP: f:\vmware_instalacja\VMware Workstation\vsocklib.dll DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab DPF: {B2FC031D-8C74-46AE-8042-BCF4FC03C1EF} - hxxp://126.51.9.62/qcbin/Spider91.cab FF - ProfilePath - c:\documents and settings\przemek\Application Data\Mozilla\Firefox\Profiles\ekyq390z.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-29 16:04:27 Windows 5.1.2600 Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL] "ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1300) c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll c:\windows\system32\Ati2evxx.dll c:\windows\system32\klogon.dll c:\windows\system32\PAStates.dll - - - - - - - > 'lsass.exe'(1356) c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\WLTRYSVC.EXE c:\windows\system32\BCMWLTRY.EXE c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe c:\windows\system32\ati2evxx.exe c:\program files\TortoiseSVN\bin\TSVNCache.exe c:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe c:\progra~1\MICROS~2\rapimgr.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe c:\windows\system32\vmnat.exe f:\vmware_instalacja\VMware Workstation\vmware-authd.exe c:\windows\system32\vmnetdhcp.exe c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\windows\system32\wscntfy.exe c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe . ************************************************************************** . Czas ukończenia: 2009-03-29 16:08:26 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-03-29 14:08:22 Przed: 3 353 079 808 bytes free Po: 3,333,865,472 bytes free 306 --- E O F --- 2008-09-12 06:01:10

oraz log z Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:12:15, on 29-03-2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Cisco Systems\CiscoTrustAgent\ctalogd.exe C:\Program Files\Cisco Systems\CiscoTrustAgent\ctapsd.exe C:\Program Files\Cisco Systems\CiscoTrustAgent\CtaEoU.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Cisco Systems\CiscoTrustAgent\ctatransapt.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Microsoft Office Communicator\communicator.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\PROGRA~1\MICROS~2\rapimgr.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\vmnat.exe C:\WebServ\bin\ApacheMonitor.exe F:\VMware_instalacja\VMware Workstation\vmware-authd.exe C:\Documents and Settings\przemek\My Documents\przypom\Przypominacz.exe C:\WINDOWS\system32\vmnetdhcp.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\notepad2_pl\Notepad2.exe C:\HijackThis2009\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.tepenet/tp.pac R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://proxy.tepenet/tp.pac R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer.dll O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer.dll O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\communicator.exe" /fromrunkey O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Info.lnk = C:\WINDOWS\system32\taskmgr.exe O4 - Startup: Przypominacz.lnk = C:\Documents and Settings\przemek\My Documents\przypom\Przypominacz.exe O4 - Global Startup: Monitor Apache Servers.lnk = C:\WebServ\bin\ApacheMonitor.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: f:\vmware_instalacja\vmware workstation\vsocklib.dll O10 - Unknown file in Winsock LSP: f:\vmware_instalacja\vmware workstation\vsocklib.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {3605B612-C3CF-4AB4-A426-2D853391DB2E} (Certificates Class) - http://126.51.9.62/qcbin/capicom.dll O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {B2FC031D-8C74-46AE-8042-BCF4FC03C1EF} (Loader Class v4) - http://126.51.9.62/qcbin/Spider91.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - F:\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: PAStates - C:\WINDOWS\SYSTEM32\PAStates.dll O23 - Service: Apache2.2 - Apache Software Foundation - C:\WebServ\bin\httpd.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: Cisco Trust Agent EOU Daemon (CtaEoU) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\CiscoTrustAgent\CtaEoU.exe O23 - Service: Cisco Trust Agent Logger Daemon (ctalogd) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\CiscoTrustAgent\ctalogd.exe O23 - Service: Cisco Posture Server Daemon (ctapsd) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\CiscoTrustAgent\ctapsd.exe O23 - Service: Cisco Systems, Inc. CTA Posture State Daemon (ctatransapt) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\CiscoTrustAgent\ctatransapt.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing) O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - F:\VMware_instalacja\VMware Workstation\vmware-ufad.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - F:\VMware_instalacja\VMware Workstation\vmware-authd.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe O23 - Service: VNC Server (winvnc) - TightVNC Group - C:\Program Files\TightVNC\WinVNC.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 10548 bytes

Pozdrawiam

**Posty:** 18165 · przez **wojtas** 29 Mar 2009, 18:17

mozesz opisac problem ?

**Posty:** 9 · przez **patrykxes** 29 Mar 2009, 19:14

Kaspersky wykryl 'Zainfekowany: Kon trojanski Trojan-Spy.Win32.Agent.aijf c:\windows\system32\install.exe 1016,2 kB
co jakis czas pojawia sie blad Generic Win32 i nie mam mozliwosci podglasnienia oraz zciszenia dzwieku

a czy z tych logow wynika ze mam wirusa ?

**Posty:** 18165 · przez **wojtas** 29 Mar 2009, 19:36

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 9 · przez **patrykxes** 31 Mar 2009, 10:02

Witam,
Ale mam pytanie, ja korzystam z Samba i jezeli wylacze te porty, to wydaje mi sie, ze niestety nie bede mial dostepu. Moze sie myle prosba o poprawe.

**Posty:** 18165 · przez **wojtas** 31 Mar 2009, 16:42

sprobuj .. jesli nie bedziesz mial neta to odblokuj je.