win32/ircbot ---trojan prosze o sprawdzenie loga

**Posty:** 671 · przez **oklahoma** 12 Cze 2007, 21:08

Właśnie z braku zajęcia przeskanowalem sobie dysk F (system mam na C)
Nod wykrył mi prawie 200 tych trojanów i nie może ich pokasować jak narazie to mi nie przeszkadza w pracy na kompie ale fakt jest taki ze już o tym wiem :wow:

Odpalalem SmitFraudFix z opcji 2 i mam loga

SmitFraudFix v2.132

Scan done at 20:24:20,42, 2007-06-12
Run from C:\Narz©dzia\SmitFraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"="kdfcl.exe"

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Reboot

C:\WINDOWS\system32\kdfcl.exe Deleted

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» End

hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 20:22:08, on 2007-06-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
D:\akrobat\Distillr\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\VistaMizer\madotate\madotate.exe
D:\Konnekt\konnekt.exe
C:\Program Files\VisualTaskTips\VisualTaskTips.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Narzędzia\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\akrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\akrobat\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\WINDOWS\VistaMizer\styler\TB\StylerTB.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\akrobat\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Skrót do strony właściwości High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [p2p networking] p2pnetworking.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\akrobat\Distillr\Acrotray.exe"
O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Madotate.lnk = C:\WINDOWS\VistaMizer\madotate\madotate.exe
O4 - Startup: Skrót do konnekt.lnk = D:\Konnekt\konnekt.exe
O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: VisualTaskTips.lnk = C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\akrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\akrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\akrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\akrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\akrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\akrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\akrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\akrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{B04B1C35-09A0-4513-984D-737BDBFF553F}: NameServer = 217.30.129.149,217.30.137.200
O17 - HKLM\System\CS1\Services\Tcpip\..\{B04B1C35-09A0-4513-984D-737BDBFF553F}: NameServer = 217.30.129.149,217.30.137.200
O17 - HKLM\System\CS2\Services\Tcpip\..\{B04B1C35-09A0-4513-984D-737BDBFF553F}: NameServer = 217.30.129.149,217.30.137.200
O17 - HKLM\System\CS3\Services\Tcpip\..\{B04B1C35-09A0-4513-984D-737BDBFF553F}: NameServer = 217.30.129.149,217.30.137.200
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe

Silent Runners

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "]
"Skrót do strony właściwości High Definition Audio" = "HDAudPropShortcut.exe" ["Windows (R) Server 2003 DDK provider"]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"AlcWzrd" = "ALCWZRD.EXE" ["RealTek Semicoductor Corp."]
"Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."]
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"WinampAgent" = "D:\Winamp\winampa.exe" [null data]
"OutpostFeedBack" = "C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup" ["Agnitum Ltd."]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Outpost Firewall" = "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice" ["Agnitum Ltd."]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"p2p networking" = "p2pnetworking.exe" [file not found]
"Acrobat Assistant 7.0" = ""D:\akrobat\Distillr\Acrotray.exe"" ["Adobe Systems Inc."]
"(Default)" = "(empty string)" [file not found]

HKLM\Software\Microsoft\Active Setup\Installed Components\
>{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer"
\StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE" [MS]
>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}\(Default) = "Outlook Express"
\StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "D:\akrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Groove GFS Browser Helper"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]
{AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEToolbarHelper Class"
\InProcServer32\(Default) = "D:\akrobat\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\A120%\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" = "PowerISO"
-> {HKLM...CLSID} = "PowerISO"
\InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper"
-> {HKLM...CLSID} = "Groove GFS Browser Helper"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar"
-> {HKLM...CLSID} = "Groove Folder Synchronization"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler"
-> {HKLM...CLSID} = "Groove GFS Stub Icon Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
-> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler"
-> {HKLM...CLSID} = "Groove XML Icon Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {HKLM...CLSID} = "Microsoft Office Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS]
"{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
-> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{4FED14EE-8086-4b0c-A0DE-C27042ED1296}" = "PDFTransformer2ContextMenu"
-> {HKLM...CLSID} = "PDFTransformer2.PDFTContextMenu.1"
\InProcServer32\(Default) = "C:\Program Files\ABBYY PDF Transformer 2.0\PDFTContextMenu.dll" ["ABBYY Software"]
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "D:\akrobat\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
-> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "D:\akrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "D:\akrobat\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
-> {HKLM...CLSID} = "Outpost.ASWShellExt Component"
\InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."]
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
PDFTransformer2ContextMenu\(Default) = "{4FED14EE-8086-4b0c-A0DE-C27042ED1296}"
-> {HKLM...CLSID} = "PDFTransformer2.PDFTContextMenu.1"
\InProcServer32\(Default) = "C:\Program Files\ABBYY PDF Transformer 2.0\PDFTContextMenu.dll" ["ABBYY Software"]
PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"
-> {HKLM...CLSID} = "PowerISO"
\InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
-> {HKLM...CLSID} = "Outpost.ASWShellExt Component"
\InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."]
PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"
-> {HKLM...CLSID} = "PowerISO"
\InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
-> {HKLM...CLSID} = "Outpost.ASWShellExt Component"
\InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."]
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"
-> {HKLM...CLSID} = "PowerISO"
\InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

Group Policies {policy setting}:
--------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Startup items in "Mania" & "All Users" startup folders:
-------------------------------------------------------

C:\Documents and Settings\Mania\Menu Start\Programy\Autostart
"Madotate" -> shortcut to: "C:\WINDOWS\VistaMizer\madotate\madotate.exe" [null data]
"Skrót do konnekt" -> shortcut to: "D:\Konnekt\konnekt.exe" ["Stamina"]
"Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007" -> shortcut to: "C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE /tsr" [MS]
"VisualTaskTips" -> shortcut to: "C:\Program Files\VisualTaskTips\VisualTaskTips.exe" ["VisualTaskTips.com"]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Adobe Acrobat Speed Launcher" -> shortcut to: "C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe" [null data]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 11
%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 19
%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{D2F8F919-690B-4EA2-9FA7-A203D1E04F75}" = (no title provided)
-> {HKLM...CLSID} = "StylerToolBar"
\InProcServer32\(Default) = "C:\WINDOWS\VistaMizer\styler\TB\StylerTB.dll" ["StyleFantasist"]
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "D:\akrobat\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "D:\akrobat\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]

HKLM\Software\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

HKLM\Software\Classes\CLSID\{A1A7E22D-1587-4230-8F16-081C68D21448}\(Default) = "Szybkie dostosowywanie programu"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll" ["Agnitum Ltd."]

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_01"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_01"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."]

{44627E97-789B-40D4-B5C2-58BD171129A1}\
"ButtonText" = "Szybkie dostosowywanie programu Outpost Firewall Pro"

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "]
Outpost Firewall Service, OutpostFirewall, "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /service" ["Agnitum Ltd."]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" ["Adobe Systems Incorporated."]
PDF-XChange\Driver = "C:\WINDOWS\system32\pxc25pm.dll" ["Tracker Software"]

----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 51 seconds.
---------- (total run time: 107 seconds)

Jest sie czego bać czy sobie darować

**Posty:** 18165 · przez **wojtas** 12 Cze 2007, 21:51

oklahoma napisał(a):Jest sie czego bać czy sobie darować Very Happy Very Happy

jest lekki syf...

smitfraudfix jednego wywalil zostalo:

sadze ze wiesz co z tym zrobic :wink:

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [p2p networking] p2pnetworking.exe
O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe

dodatkowo podeslij loga z

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

oraz screena z znalezionych trojanow

**Posty:** 671 · przez **oklahoma** 12 Cze 2007, 22:08

combofix

ComboFix 07-06-13 - C:\Narz©dzia\ComboFix.exe
"Mania" - 2007-06-12 21:39:16 - Dodatek Service Pack 2 NTFS

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\packet.dll

((((((((((((((((((((((((( Files Created from 2007-05-12 to 2007-06-12 )))))))))))))))))))))))))))))))

2007-06-12 20:50 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-12 20:23 1,784 --a------ C:\WINDOWS\system32\tmp.reg
2007-06-12 20:22 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-06-12 20:22 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-06-12 20:22 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-06-12 18:43 <DIR> d-------- C:\DOCUME~1\Mania\DANEAP~1\AdobeUM
2007-06-12 18:41 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-06-12 18:41 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Adobe Systems
2007-06-12 17:32 <DIR> d-------- C:\DOCUME~1\Mania\DANEAP~1\eXPert PDF Editor
2007-06-12 15:05 <DIR> d-------- C:\Program Files\PDF Password Remover v3.0
2007-06-12 14:59 167 --a------ C:\WINDOWS\system32\8459.bat
2007-06-12 14:59 128 --a------ C:\WINDOWS\system32\ps.exe
2007-06-12 14:59 128 --a------ C:\WINDOWS\system32\install.exe
2007-06-12 14:58 32,768 --a------ C:\WINDOWS\system32\setup9x.exe
2007-06-12 14:58 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-06-12 14:58 128 --a------ C:\WINDOWS\system32\app.exe
2007-06-12 14:58 0 --a------ C:\WINDOWS\system32\taskkill.exe
2007-06-12 14:34 <DIR> d-------- C:\Program Files\PasswordTools
2007-06-12 14:24 5,632 --a------ C:\WINDOWS\system32\pxc25pm.dll
2007-06-12 14:24 258,352 --a------ C:\WINDOWS\system32\unicows.dll
2007-06-12 14:23 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ABBYY
2007-06-12 13:51 <DIR> d-------- C:\Program Files\ABBYY PDF Transformer 2.0
2007-06-12 13:50 <DIR> d-------- C:\temp\PDFT20
2007-06-12 13:50 <DIR> d-------- C:\temp
2007-06-12 13:45 <DIR> d-------- C:\Program Files\PDFCreator
2007-06-12 13:00 <DIR> d-------- C:\WINDOWS\speech
2007-06-11 16:57 <DIR> d-------- C:\WINDOWS\Cache
2007-06-09 16:08 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-06-05 13:36 <DIR> d-------- C:\Program Files\MarBit
2007-06-05 12:50 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Transport Picture Pack
2007-06-05 12:49 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Seasons Picture Pack
2007-06-05 12:49 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Religion Picture Pack
2007-06-05 12:49 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Nature Picture Pack
2007-06-05 12:49 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Miscellaneous Picture Pack
2007-06-05 12:49 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Insects Picture Pack
2007-06-05 12:49 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Events Picture Pack
2007-06-05 12:49 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Animals Picture Pack
2007-06-05 12:49 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2005 - Sport Picture Pack
2007-06-05 12:49 <DIR> d-------- C:\Program Files\Kids Colouring Book 2005
2007-06-05 12:48 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Fantasy Picture Pack
2007-06-05 12:48 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Countries Picture Pack
2007-06-05 12:48 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006 - Activities Picture Pack
2007-06-05 12:47 <DIR> d-------- C:\WINDOWS\system32\www.My-Software.co.uk
2007-06-05 12:47 <DIR> d-------- C:\WINDOWS\Kids Colouring Book 2006
2007-06-05 12:47 <DIR> d-------- C:\Program Files\Kids Colouring Book 2006
2007-06-02 22:10 <DIR> d-------- C:\DOCUME~1\Mania\Gadu-Gadu
2007-06-02 22:10 <DIR> d-------- C:\DOCUME~1\Mania\DANEAP~1\Gadu-Gadu
2007-05-31 20:10 <DIR> d-------- C:\Program Files\VisualTaskTips
2007-05-31 20:07 <DIR> d-------- C:\WINDOWS\VistaMizer
2007-05-31 12:58 <DIR> d-------- C:\WINDOWS\pss
2007-05-30 16:37 <DIR> d-------- C:\Program Files\Shareaza Turbo Accelerator
2007-05-25 07:48 49,152 --a------ C:\WINDOWS\system32\btfunc.dll
2007-05-23 09:08 89,872 -ra------ C:\WINDOWS\system32\drivers\k750mdm.sys
2007-05-23 09:08 81,728 -ra------ C:\WINDOWS\system32\drivers\k750mgmt.sys
2007-05-23 09:08 79,488 -ra------ C:\WINDOWS\system32\drivers\k750obex.sys
2007-05-23 09:08 6,576 -ra------ C:\WINDOWS\system32\drivers\k750mdfl.sys
2007-05-23 09:08 6,144 -ra------ C:\WINDOWS\system32\drivers\k750cmnt.sys
2007-05-23 09:08 6,144 -ra------ C:\WINDOWS\system32\drivers\k750cm.sys
2007-05-23 09:07 55,216 -ra------ C:\WINDOWS\system32\drivers\k750bus.sys
2007-05-23 09:07 5,744 -ra------ C:\WINDOWS\system32\drivers\k750whnt.sys
2007-05-23 09:07 5,744 -ra------ C:\WINDOWS\system32\drivers\k750wh.sys
2007-05-23 09:06 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-05-23 07:57 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-05-23 07:57 77,824 -ra------ C:\WINDOWS\system32\drivers\SioUi2k.dll
2007-05-23 07:57 63,488 -ra------ C:\WINDOWS\system32\drivers\wssbtr1f.sys
2007-05-23 07:57 54,784 --a------ C:\WINDOWS\system32\drivers\vfwwdm32.dll
2007-05-23 07:57 51,169 -ra------ C:\WINDOWS\system32\drivers\OXSER.SYS
2007-05-23 07:57 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2007-05-23 07:57 48,556 -ra------ C:\WINDOWS\system32\drivers\SktBt2k.sys
2007-05-23 07:57 48,076 -ra------ C:\WINDOWS\system32\drivers\Sio9502k.sys
2007-05-23 07:57 40,960 -ra------ C:\WINDOWS\system32\drivers\SCTray.exe
2007-05-23 07:57 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-05-23 07:57 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-05-23 07:57 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2007-05-23 07:57 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2007-05-23 07:57 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2007-05-23 07:56 82,148 --a------ C:\WINDOWS\system32\drivers\VcommMgr.sys
2007-05-23 07:56 7,680 --a------ C:\WINDOWS\system32\btinstall.dll
2007-05-23 07:56 61,312 --a------ C:\WINDOWS\system32\drivers\VComm.sys
2007-05-23 07:56 28,271 --a------ C:\WINDOWS\system32\drivers\BTHidMgr.sys
2007-05-23 07:56 23,000 --a------ C:\WINDOWS\system32\drivers\btcusb.sys
2007-05-23 07:56 20,480 --a------ C:\WINDOWS\system32\drivers\blueletaudio.sys
2007-05-23 07:56 148,830 --a------ C:\WINDOWS\system32\drivers\bcbthub.sys
2007-05-23 07:56 13,304 --a------ C:\WINDOWS\system32\drivers\BTNetFilter.sys
2007-05-23 07:56 116,021 --a------ C:\WINDOWS\system32\drivers\fw203x.sys
2007-05-23 07:56 11,860 --a------ C:\WINDOWS\system32\drivers\vbtenum.sys
2007-05-23 07:56 11,736 --a------ C:\WINDOWS\system32\drivers\VHIDMini.sys
2007-05-23 07:56 10,804 --a------ C:\WINDOWS\system32\drivers\BtNetDrv.sys
2007-05-22 16:01 <DIR> d-------- C:\Program Files\Real Alternative
2007-05-22 16:01 <DIR> d-------- C:\DOCUME~1\Mania\DANEAP~1\Real
2007-05-22 16:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real
2007-05-19 21:15 974,848 --a------ C:\WINDOWS\system32\mfc70.dll
2007-05-19 21:15 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
2007-05-19 21:15 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll
2007-05-19 21:15 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll
2007-05-19 21:15 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2007-05-19 21:15 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2007-05-19 20:43 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2007-05-18 15:00 <DIR> d-------- C:\DOCUME~1\Mania\DANEAP~1\Shareaza
2007-05-18 08:35 73,728 --a------ C:\WINDOWS\system32\dpl100.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-12 19:00:13 -------- d-----w C:\DOCUME~1\Mania\DANEAP~1\Skype
2007-06-07 16:06:05 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-05 07:51:38 -------- d-----w C:\Program Files\Total Video Converter
2007-05-31 18:11:41 -------- d-----w C:\Program Files\Movie Maker
2007-05-31 18:10:37 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-05-28 18:25:43 1,395 ----a-w C:\WINDOWS\mozver.dat
2007-05-23 07:06:48 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-05-19 18:43:08 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2007-05-19 18:43:07 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-05-12 20:38:03 50,748 ----a-w C:\WINDOWS\system32\perfc015.dat
2007-05-12 20:38:03 358,834 ----a-w C:\WINDOWS\system32\perfh015.dat
2007-05-12 20:37:41 -------- d-----w C:\Program Files\Windows NT
2007-05-09 18:51:17 -------- d-----w C:\DOCUME~1\Mania\DANEAP~1\Navigator
2007-05-07 19:10:26 -------- d-----w C:\DOCUME~1\Mania\DANEAP~1\DivX
2007-05-07 18:59:32 56 --sh--r C:\WINDOWS\system32\BE65210A56.sys
2007-05-07 18:59:32 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-05-07 18:51:12 -------- d-----w C:\Program Files\RADVideo
2007-05-07 17:03:45 -------- d-----w C:\Program Files\WinAVIVideoConverter
2007-05-07 15:13:21 -------- d-----w C:\Program Files\DVD Shrink
2007-05-07 15:10:38 -------- d-----w C:\DOCUME~1\Mania\DANEAP~1\Ahead
2007-05-07 14:55:23 -------- d-----w C:\Program Files\Microsoft Works
2007-05-07 14:55:13 -------- d-----w C:\Program Files\MSBuild
2007-05-07 14:44:10 -------- d-----w C:\Program Files\PowerISO
2007-05-07 10:57:42 -------- d-----w C:\Program Files\GSpot
2007-05-06 16:20:26 -------- d-----w C:\DOCUME~1\Mania\DANEAP~1\Help
2007-05-06 08:11:58 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-05-06 07:41:38 -------- d-----w C:\Program Files\Skype
2007-05-03 10:24:17 -------- d-----w C:\Program Files\Common Files\LightScribe
2007-05-03 10:18:24 -------- d-----w C:\Program Files\Common Files\Ahead
2007-05-02 18:04:15 36,624 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-05-02 18:04:14 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-05-02 18:04:14 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-05-02 13:46:42 -------- d-----w C:\Program Files\Common Files\Agnitum Shared
2007-05-02 13:46:41 -------- d-----w C:\Program Files\Agnitum
2007-05-02 12:42:35 -------- d-----w C:\Program Files\Common Files\ODBC
2007-05-02 12:42:32 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-05-02 12:11:35 -------- d-----w C:\Program Files\Winamp
2007-05-02 12:01:34 -------- d-----w C:\DOCUME~1\Mania\DANEAP~1\stamina
2007-05-02 11:48:07 -------- d-----w C:\DOCUME~1\Mania\DANEAP~1\Talkback
2007-05-02 11:48:01 0 ----a-w C:\WINDOWS\nsreg.dat
2007-05-02 11:05:22 -------- d-----w C:\Program Files\ATI Technologies
2007-05-02 11:03:36 -------- d-----w C:\Program Files\Intel
2007-05-02 10:51:58 -------- d-----w C:\Program Files\microsoft frontpage
2007-05-02 10:51:46 0 --sha-r C:\MSDOS.SYS
2007-05-02 10:51:46 0 --sha-r C:\IO.SYS
2007-05-02 10:51:46 0 ----a-w C:\CONFIG.SYS
2007-05-02 10:51:46 0 ----a-w C:\AUTOEXEC.BAT
2007-05-02 10:50:37 -------- d--h--w C:\Program Files\WindowsUpdate
2007-05-02 10:50:32 -------- d-----w C:\Program Files\Usługi online
2007-05-02 10:49:49 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-05-02 10:49:16 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-05-02 10:48:22 -------- d-----w C:\Program Files\MSN Gaming Zone
2004-08-04 12:00:00 60,928 --sha-w C:\WINDOWS\VistaMizer\old\msimn.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=D:\akrobat\ActiveX\AcroIEHelper.dll [2004-12-14 01:56]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 00:48]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{AE7CD045-E861-484f-8273-0445EE161910}=D:\akrobat\Acrobat\AcroIEFavClient.dll [2004-12-14 02:13]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-05-19 20:43]
"Skrót do strony właściwości High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 15:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 01:12 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-06-18 00:43 C:\WINDOWS\ALCWZRD.EXE]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 21:10]
"WinampAgent"="D:\Winamp\winampa.exe" [2006-11-21 19:38]
"OutpostFeedBack"="C:\Program Files\Agnitum\Outpost Firewall\feedback.exe" [2006-12-29 14:06]
"Outpost Firewall"="C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" [2006-12-18 12:39]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Acrobat Assistant 7.0"="D:\akrobat\Distillr\Acrotray.exe" [2004-12-14 02:12]
"@"="" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-11-24 17:16]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 00:48]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-12 21:40:18
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-12 21:40:46
C:\ComboFix-quarantined-files.txt ... 2007-06-12 21:40

--- E O F ---

wojtas19162 napisał(a):oraz screena z znalezionych trojanow Very Happy

Wszystkich nie ująłem :mrgreen:

wojtas19162 napisał(a):sadze ze wiesz co z tym zrobic

To jest pikuś

tzn aż tak mi nie przeszkadza ale już powywalałem :lol:

Teraz właśnie jestem na etapie skanowania ale myśle że problem zniknie bo na dysku F zrobił sie folder sam nie wiem jak nawet nazwy nie mial :idea:

i w tym folderze było to wszystko co wykrył nod folder usunął sie bez problemu dlatego teraz znowu skanuje

**Posty:** 18165 · przez **wojtas** 12 Cze 2007, 22:39

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\8459.bat
C:\WINDOWS\system32\app.exe
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\ps.exe
C:\WINDOWS\system32\install.exe
C:\WINDOWS\system32\setup9x.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

dziwny jest ten wynik skanu wszystko z folderu ,,pobrane" wiec same wiry sciagasz czy blad Noda

Autor postu otrzymał pochwałę

**Posty:** 671 · przez **oklahoma** 13 Cze 2007, 13:49

wojtas19162 napisał(a):Klikasz Done

No i DONE

wojtas19162 napisał(a):dziwny jest ten wynik skanu wszystko z folderu ,,pobrane"

A no dziwny ale nie wszystko z folderu pobrane tylko jeden folder był a w nim to wszystko siedzialo.Ktoś mi świnie podlożył :wow:

bo miałem porty pootwierane ale już nie mam :wink:

Ogólnie problem znikł Dzięki

win32/ircbot ---trojan prosze o sprawdzenie loga

Win32/IRCBot ---Trojan Prosze o sprawdzenie loga

Kto jest na forum