trojan z karty pamięci

**Posty:** 202 · przez **majkel** 24 Lip 2008, 11:15

Wiem, że troche głupio tak znowu. Wczoraj moja siostra chciała zgrać jakieś zdjęcia z karty pamięci na kompa. Jak otworzyła kartę to antywirus wykrył jakiegoś trojana i zamknał do kwarantanny. Siostra mówiła, że koleżanka ma "rozje**any" komputer, się domysliłem, że zawirusowany pewnie.

Moglibyście tak "profilaktycznie" sprawdzić logi :?:

z combofix'a

Kod: Zaznacz wszystko: ComboFix 08-07-20.A0 - Administrator 2008-07-24 10:28:06.4 - NTFSx86 Running from: C:\abc\antywirusy\combofix\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-06-24 to 2008-07-24 ))))))))))))))))))))))))))))))) . 2008-07-23 12:04 . 2008-07-24 00:24 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-07-22 17:30 . 2008-07-24 10:25 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-07-22 17:30 . 2008-07-22 17:30 <DIR> d-------- C:\Program Files\AVG 2008-07-22 17:30 . 2008-07-22 17:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\avg8 2008-07-22 17:30 . 2008-07-22 17:30 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-07-22 17:30 . 2008-07-22 17:30 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-07-22 16:16 . 2008-07-22 16:16 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Kerio 2008-07-22 14:54 . 2008-07-22 16:01 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2008-07-22 14:45 . 2008-07-22 14:48 <DIR> d-------- C:\Program Files\Common Files\Softwin 2008-07-22 14:40 . 2008-07-22 14:40 <DIR> d-------- C:\Program Files\Kerio 2008-07-21 22:43 . 2008-07-21 22:43 <DIR> d-------- C:\Program Files\PrevxCSI 2008-07-21 22:43 . 2008-07-23 22:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PrevxCSI 2008-07-21 22:43 . 2008-07-21 22:43 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys 2008-07-21 21:09 . 2008-07-21 21:09 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-21 20:26 . 2008-07-21 20:26 505 --a------ C:\fix.reg 2008-07-10 13:42 . 2002-06-06 14:38 139,264 --a------ C:\WINDOWS\system32\eax.dll 2008-07-08 14:08 . 2008-07-08 14:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-07-08 14:08 . 2008-07-08 14:08 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-29 14:00 . 2008-06-29 14:00 <DIR> d-------- C:\WINDOWS\V16BGLQVZ49EJOTY . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-24 08:36 22,988 ----a-w C:\windows\system32\drivers\kwfupper.log 2008-07-24 08:35 36,659 ----a-w C:\windows\system32\drivers\kwflower.log 2008-07-21 14:23 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent 2008-07-21 14:19 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\BearShare 2008-06-30 08:00 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-23 14:57 --------- d-----w C:\Program Files\Novalogic 2008-06-13 17:54 --------- d-----w C:\Program Files\uTorrent 2008-05-29 10:29 --------- d-----w C:\Program Files\eTeacher 3.0 Angielski 2008-04-03 18:10 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT 2007-08-07 19:58 291,888 ----a-w C:\Program Files\DevalVR_installer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D64DB10-DC7E-44FF-8B5E-441EE8ED668F}] 2004-08-04 14:00 105984 --a------ C:\WINDOWS\system32\dsdm.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\windows\system32\ctfmon.exe" [2004-08-04 14:00 15360] "WrCtrl"="C:\Program Files\Kerio\WinRoute Firewall\wrctrl.exe" [2008-01-16 10:05 124776] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-08 02:31 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-08 02:27 126976] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-04-02 18:31 98304] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-22 17:30 1232152] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 00:49:24 73728] Microsoft Firewall Client Management.lnk - C:\WINDOWS\Installer\{199B7F78-69B7-47C5-8D4B-A3ED1391FB6B}\NewShortcut1_8C7A59A89ABE459A9A9308C281A4A264.exe [2005-11-14 17:03:57 53248] NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-03-14 19:37:57 118784] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 22:07:32 81920] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoWelcomeScreen"= 1 (0x1) "NoMSAppLogo5ChannelNotify"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i420vfw.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "vidc.3ivx"= 3ivxVfWCodec.dll "vidc.3iv2"= 3ivxVfWCodec.dll "msacm.divxa32"= divxa32.acm "VIDC.HFYU"= huffyuv.dll "VIDC.i263"= i263_32.drv "msacm.imc"= imc32.acm "VIDC.VP31"= vp31vfw.dll "VIDC.X264"= x264vfw.dll "vidc.yv12"= yv12vfw.dll "msacm.l3fhg"= mp3fhg.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\[u]0[/u]\[u]0[/u]] "Script"=ISACLI.CMD [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\[u]0[/u]\1] "Script"=R:\software\opiekun.cmd [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=C:\windows\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater] -ra------ 2007-03-01 10:37 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 20:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Novalogic\\Delta Force Helikopter w Ogniu\\DFBHD.EXE"= "C:\\erozrywka-gry\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\BearShare applications\\BearShare\\BearShare.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "2244:UDP"= 2244:UDP:Windows Media Format SDK (wmplayer.exe) "2245:UDP"= 2245:UDP:Windows Media Format SDK (wmplayer.exe) R0 ilcffezs;ilcffezs;C:\windows\system32\drivers\lmkcjuoo.dat [] R0 pxark;pxark;C:\windows\system32\drivers\pxark.sys [2008-07-21 22:43] R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\windows\system32\Drivers\avgldx86.sys [2008-07-22 17:30] R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-22 17:30] R2 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [2008-07-21 22:43] R2 FwcAgent;Firewall Client Agent;C:\Program Files\Microsoft Firewall Client 2004\FwcAgent.exe [2005-02-10 22:43] R2 OpSrv;Opiekun;C:\WINDOWS\system32\opsrv.exe [2005-10-06 06:52] R2 WinRoute;Kerio WinRoute Firewall;C:\Program Files\Kerio\WinRoute Firewall\winroute.exe [2008-01-16 10:05] R3 CONAN;CONAN;C:\windows\system32\drivers\o2mmb.sys [2004-02-12 04:18] R3 kvpndev;Kerio VPN adapter;C:\windows\system32\DRIVERS\kvpndrv.sys [2008-01-16 09:58] R3 kwflower;Kerio WinRoute Firewall Driver - Lower Layer;C:\windows\system32\DRIVERS\kwflower.sys [2008-01-16 10:00] R3 kwfupper;Kerio WinRoute Firewall Driver - Upper Layer;C:\windows\system32\DRIVERS\kwfupper.sys [2008-01-16 10:00] R3 MbxStby;MbxStby;C:\windows\system32\drivers\MbxStby.sys [2004-01-28 17:15] S3 siusbmod;siusbmod;C:\windows\system32\DRIVERS\siusbmod.sys [] S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\windows\system32\DRIVERS\w300bus.sys [2006-03-13 17:49] S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\windows\system32\DRIVERS\w300mdfl.sys [2006-03-13 17:50] S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\windows\system32\DRIVERS\w300mdm.sys [2006-03-13 17:50] . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.google.pl/ R0 -: HKLM-Main,Start Page = hxxp://www.google.com R1 -: HKCU-Internet Settings,ProxyOverride = <local> O8 -: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O17 -: HKLM\CCS\Interface\{9F9050B7-53C1-4CEF-9D83-781BEBC29E1C}: NameServer = 194.204.159.1,194.204.152.34 ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-24 10:42:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\OpSrv] "ImagePath"="C:\WINDOWS\system32\opsrv.exe /startedbyscm:BB66DA22-40E2A281-OpiekunService" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ilcffezs] "ImagePath"="system32\drivers\lmkcjuoo.dat" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\windows\system32\lsass.exe -> C:\WINDOWS\system32\OPLSP.DLL . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\CTSVCCDA.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Program Files\Kerio\WinRoute Firewall\avserver.exe C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe . ************************************************************************** . Completion time: 2008-07-24 10:54:58 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-24 08:54:34 Pre-Run: 26,640,113,664 bajtów wolnych Post-Run: 26,610,999,296 bajt˘w wolnych 171

i z hijackthis'a

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:01:35, on 2008-07-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\WINDOWS\system32\opsrv.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\windows\system32\svchost.exe C:\windows\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\PrevxCSI\prevxcsi.exe C:\Program Files\Microsoft Firewall Client 2004\FwcAgent.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\windows\system32\svchost.exe C:\Program Files\Kerio\WinRoute Firewall\winroute.exe c:\program files\kerio\winroute firewall\avServer.exe C:\Program Files\PrevxCSI\prevxcsi.exe C:\windows\system32\wuauclt.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\windows\system32\ctfmon.exe C:\Program Files\Kerio\WinRoute Firewall\wrctrl.exe C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\windows\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Opiekun\optray.exe C:\abc\antywirusy\HiJackThis\hijackthis.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0D64DB10-DC7E-44FF-8B5E-441EE8ED668F} - C:\WINDOWS\system32\dsdm.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe O4 - HKCU\..\Run: [WrCtrl] "C:\Program Files\Kerio\WinRoute Firewall\wrctrl.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Firewall Client Management.lnk = ? O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\oplsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\oplsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\oplsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\oplsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\oplsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\oplsp.dll O14 - IERESET.INF: START_PAGE_URL=http://www.pcworld.pl O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sbsmenis.edu.pl O17 - HKLM\Software\..\Telephony: DomainName = sbsmenis.edu.pl O17 - HKLM\System\CCS\Services\Tcpip\..\{9F9050B7-53C1-4CEF-9D83-781BEBC29E1C}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sbsmenis.edu.pl O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\prevxcsi.exe O23 - Service: Opiekun (OpSrv) - SoftStory - C:\WINDOWS\system32\opsrv.exe O23 - Service: SmartLinkService (SLService) - - C:\windows\SYSTEM32\slserv.exe O23 - Service: Kerio WinRoute Firewall (WinRoute) - Kerio Technologies - C:\Program Files\Kerio\WinRoute Firewall\winroute.exe -- End of file - 6890 bytes

i jak otwieram jej karte to sie wyswietla odmowa dotepu, a jak owieram moją to wszystko dobrze śmiga, windows mógł ją zablokować :?:

**Posty:** 8001 · przez **Okocza** 24 Lip 2008, 11:23

Kod: Zaznacz wszystko: O2 - BHO: (no name) - {0D64DB10-DC7E-44FF-8B5E-441EE8ED668F} - C:\WINDOWS\system32\dsdm.dll

to na fix w hj

a teraz otworz notatnik i wklej:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\dsdm.dll Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D64DB10-DC7E-44FF-8B5E-441EE8ED668F}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 202 · przez **majkel** 24 Lip 2008, 12:12

log z combofix'a

Kod: Zaznacz wszystko: ComboFix 08-07-20.A0 - Administrator 2008-07-24 11:31:37.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.183 [GMT 2:00] Running from: C:\abc\antywirusy\combofix\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrator\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\dsdm.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\dsdm.dll . . . . failed to delete . ((((((((((((((((((((((((( Files Created from 2008-06-24 to 2008-07-24 ))))))))))))))))))))))))))))))) . 2008-07-24 11:02 . 2008-07-24 11:05 8,192 --a------ C:\Documents and Settings\ROBERT~2 2008-07-24 11:02 . 2008-07-24 11:05 8,192 --a------ C:\Documents and Settings\PIOTRS~2 2008-07-24 11:02 . 2008-07-24 11:05 8,192 --a------ C:\Documents and Settings\MATEUS~4 2008-07-24 11:02 . 2008-07-24 11:05 8,192 --a------ C:\Documents and Settings\KATARZ~2 2008-07-24 11:02 . 2008-07-24 11:05 8,192 --a------ C:\Documents and Settings\IZATRM~2 2008-07-24 11:02 . 2008-07-24 11:05 8,192 --a------ C:\Documents and Settings\GABRIE~2 2008-07-24 11:02 . 2008-07-24 11:05 8,192 --a------ C:\Documents and Settings\EWELIN~2 2008-07-24 11:02 . 2008-07-24 11:05 8,192 --a------ C:\Documents and Settings\DAWIDS~2 2008-07-24 11:02 . 2008-07-24 11:05 8,192 --a------ C:\Documents and Settings\DAMIAN~2 2008-07-23 12:04 . 2008-07-24 00:24 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-07-22 17:30 . 2008-07-24 11:06 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-07-22 17:30 . 2008-07-22 17:30 <DIR> d-------- C:\Program Files\AVG 2008-07-22 17:30 . 2008-07-24 11:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\avg8 2008-07-22 17:30 . 2008-07-22 17:30 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-07-22 17:30 . 2008-07-22 17:30 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-07-22 16:16 . 2008-07-22 16:16 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Kerio 2008-07-22 14:54 . 2008-07-22 16:01 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2008-07-22 14:45 . 2008-07-22 14:48 <DIR> d-------- C:\Program Files\Common Files\Softwin 2008-07-22 14:40 . 2008-07-22 14:40 <DIR> d-------- C:\Program Files\Kerio 2008-07-21 22:43 . 2008-07-21 22:43 <DIR> d-------- C:\Program Files\PrevxCSI 2008-07-21 22:43 . 2008-07-23 22:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PrevxCSI 2008-07-21 22:43 . 2008-07-21 22:43 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys 2008-07-21 21:09 . 2008-07-21 21:09 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-21 20:26 . 2008-07-21 20:26 505 --a------ C:\fix.reg 2008-07-10 13:42 . 2002-06-06 14:38 139,264 --a------ C:\WINDOWS\system32\eax.dll 2008-07-08 14:08 . 2008-07-08 14:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-07-08 14:08 . 2008-07-08 14:08 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-29 14:00 . 2008-06-29 14:00 <DIR> d-------- C:\WINDOWS\V16BGLQVZ49EJOTY . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-24 09:40 25,231 ----a-w C:\windows\system32\drivers\kwfupper.log 2008-07-24 09:39 40,232 ----a-w C:\windows\system32\drivers\kwflower.log 2008-07-21 14:23 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent 2008-07-21 14:19 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\BearShare 2008-06-30 08:00 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-23 14:57 --------- d-----w C:\Program Files\Novalogic 2008-06-13 17:54 --------- d-----w C:\Program Files\uTorrent 2008-05-29 10:29 --------- d-----w C:\Program Files\eTeacher 3.0 Angielski 2008-04-03 18:10 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT 2007-08-07 19:58 291,888 ----a-w C:\Program Files\DevalVR_installer.exe . ((((((((((((((((((((((((((((( snapshot@2008-07-24_10.53.48.07 ))))))))))))))))))))))))))))))))))))))))) . + 2008-07-24 09:40:25 16,384 ----atw C:\windows\Temp\Perflib_Perfdata_2cc.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D64DB10-DC7E-44FF-8B5E-441EE8ED668F}] 2004-08-04 14:00 105984 --a------ C:\WINDOWS\system32\dsdm.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\windows\system32\ctfmon.exe" [2004-08-04 14:00 15360] "WrCtrl"="C:\Program Files\Kerio\WinRoute Firewall\wrctrl.exe" [2008-01-16 10:05 124776] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-08 02:31 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-08 02:27 126976] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-04-02 18:31 98304] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-22 17:30 1232152] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 00:49:24 73728] Microsoft Firewall Client Management.lnk - C:\WINDOWS\Installer\{199B7F78-69B7-47C5-8D4B-A3ED1391FB6B}\NewShortcut1_8C7A59A89ABE459A9A9308C281A4A264.exe [2005-11-14 17:03:57 53248] NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-03-14 19:37:57 118784] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 22:07:32 81920] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoWelcomeScreen"= 1 (0x1) "NoMSAppLogo5ChannelNotify"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i420vfw.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "vidc.3ivx"= 3ivxVfWCodec.dll "vidc.3iv2"= 3ivxVfWCodec.dll "msacm.divxa32"= divxa32.acm "VIDC.HFYU"= huffyuv.dll "VIDC.i263"= i263_32.drv "msacm.imc"= imc32.acm "VIDC.VP31"= vp31vfw.dll "VIDC.X264"= x264vfw.dll "vidc.yv12"= yv12vfw.dll "msacm.l3fhg"= mp3fhg.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\[u]0[/u]\[u]0[/u]] "Script"=ISACLI.CMD [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\[u]0[/u]\1] "Script"=R:\software\opiekun.cmd [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=C:\windows\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater] -ra------ 2007-03-01 10:37 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 20:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Novalogic\\Delta Force Helikopter w Ogniu\\DFBHD.EXE"= "C:\\erozrywka-gry\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\BearShare applications\\BearShare\\BearShare.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "2244:UDP"= 2244:UDP:Windows Media Format SDK (wmplayer.exe) "2245:UDP"= 2245:UDP:Windows Media Format SDK (wmplayer.exe) R0 ilcffezs;ilcffezs;C:\windows\system32\drivers\lmkcjuoo.dat [] R0 pxark;pxark;C:\windows\system32\drivers\pxark.sys [2008-07-21 22:43] R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\windows\system32\Drivers\avgldx86.sys [2008-07-22 17:30] R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-22 17:30] R2 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [2008-07-21 22:43] R2 FwcAgent;Firewall Client Agent;C:\Program Files\Microsoft Firewall Client 2004\FwcAgent.exe [2005-02-10 22:43] R2 OpSrv;Opiekun;C:\WINDOWS\system32\opsrv.exe [2005-10-06 06:52] R2 WinRoute;Kerio WinRoute Firewall;C:\Program Files\Kerio\WinRoute Firewall\winroute.exe [2008-01-16 10:05] R3 CONAN;CONAN;C:\windows\system32\drivers\o2mmb.sys [2004-02-12 04:18] R3 kvpndev;Kerio VPN adapter;C:\windows\system32\DRIVERS\kvpndrv.sys [2008-01-16 09:58] R3 kwflower;Kerio WinRoute Firewall Driver - Lower Layer;C:\windows\system32\DRIVERS\kwflower.sys [2008-01-16 10:00] R3 kwfupper;Kerio WinRoute Firewall Driver - Upper Layer;C:\windows\system32\DRIVERS\kwfupper.sys [2008-01-16 10:00] R3 MbxStby;MbxStby;C:\windows\system32\drivers\MbxStby.sys [2004-01-28 17:15] S3 siusbmod;siusbmod;C:\windows\system32\DRIVERS\siusbmod.sys [] S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\windows\system32\DRIVERS\w300bus.sys [2006-03-13 17:49] S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\windows\system32\DRIVERS\w300mdfl.sys [2006-03-13 17:50] S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\windows\system32\DRIVERS\w300mdm.sys [2006-03-13 17:50] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-24 11:42:23 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\OpSrv] "ImagePath"="C:\WINDOWS\system32\opsrv.exe /startedbyscm:BB66DA22-40E2A281-OpiekunService" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ilcffezs] "ImagePath"="system32\drivers\lmkcjuoo.dat" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\windows\system32\lsass.exe -> C:\WINDOWS\system32\OPLSP.DLL . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\CTSVCCDA.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Program Files\Kerio\WinRoute Firewall\avserver.exe C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe . ************************************************************************** . Completion time: 2008-07-24 11:55:54 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-24 09:55:31 ComboFix2.txt 2008-07-24 08:55:02 Pre-Run: 26,551,939,072 bajtów wolnych Post-Run: 26,545,369,088 bajt˘w wolnych 186

**Posty:** 8001 · przez **Okocza** 24 Lip 2008, 12:17

masz jakiegos opiekuna zainstalowanego :?:

jesli nie to sprobuj usunac to killboxem:

C:\WINDOWS\system32\dsdm.dll

http://www.forum.programosy.pl/narzedzia-do-usuwania-plikow-vt96629.html

**Posty:** 202 · przez **majkel** 24 Lip 2008, 12:24

killbox'em nie da rady już kiedyś próbowałem

ale emo Magik mówił, żeby tego pliku nie ruszać

**Posty:** 8001 · przez **Okocza** 24 Lip 2008, 12:25

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

to wykonaj tylko to

**Posty:** 202 · przez **majkel** 24 Lip 2008, 12:52

log z FixIEDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.5.1.6010 * * * ******************************************************************************** Created at 12:42:02 on Thursday, July 24, 2008 Time Zone : Logged On User : Administrator Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Celeron(R) M processor 1.30GHz System Drive : C:\ Windows Directory : C:\windows System Directory : C:\windows\system32 Total Physical Memory : 507248 KB Free Physical Memory : 126560 KB Total Virtual Memory : 2097024 KB Free Virtual Memory : 2020288 KB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\*.* -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

i screeny

**Posty:** 8001 · przez **Okocza** 24 Lip 2008, 13:11

jesli masz aparat nikona to wylacz nkbmonitor i hp image zone

to bedzie na tyle

Autor postu otrzymał pochwałę

**Posty:** 202 · przez **majkel** 24 Lip 2008, 13:18

dzięki okocza :wink:

trojan z karty pamięci

trojan z karty pamięci

Kto jest na forum