proszę o sprawdzenie loga, możliwy virus backdoor.graybird

[pablio]

Proszę o sprawdzenie loga.
Prawdopodobnie komp zainfekowany trojanem Backdoor.Graybird.
Spowolnił system i pozmieniał coś w rejestrach.

Poniżej logi z HiJack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:52:51, on 2008-04-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\LG USB Drive 2.9\LG_Drive.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LG Drive] C:\Program Files\LG USB Drive 2.9\LG_Drive.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{98423296-6025-450B-BD48-ED879408302D}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 6745 bytes

[wojtas]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

[pablio]

Zrobione według wskazówek, program WWDC zamknął 4 porty na zielono i netbios na żółto

Raport z SDFIX

SDFix: Version 1.168
Run by WOJTEK on 2008-04-10 at 23:25

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\Temp\bca4e2da.$$$ - Deleted

Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use Gmer or Dr.Web CureIt

Could Not Remove C:\WINDOWS\Temp\fa56d7ec.$$$



Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 23:30:59
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&7????wd??w????????\???\??????????????w-??w\???\?????????`??????C@?\???\??????s????\??????s\????&7?A??s?&7??C@?x???`|?w\?????@

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny"
"D:\\Gry\\Pacyfik\\mohpa.exe"="D:\\Gry\\Pacyfik\\mohpa.exe:*:Disabled:Medal of Honor Pacific Assault(tm)"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"D:\\Gry\\Pacyfik\\mohpa.exe +set developer 1.exe"="D:\\Gry\\Pacyfik\\mohpa.exe +set developer 1.exe:*:Disabled:Medal of Honor Pacific Assault(tm)"
"D:\\Gry\\Full\\Launcher.exe"="D:\\Gry\\Full\\Launcher.exe:*:Disabled:Launcher"
"D:\\Gry\\Earned\\System\\EiB.exe"="D:\\Gry\\Earned\\System\\EiB.exe:*:Disabled:Brothers In Arms Earned In Blood"
"D:\\Gry\\CCC\\iw3mp.exe"="D:\\Gry\\CCC\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"D:\\Download\\Foxit PDF Editor 1.4.1531+PDF Creator 1.0\\Foxit PDF Editor v1.4.1531\\PDFEdit.exe"="D:\\Download\\Foxit PDF Editor 1.4.1531+PDF Creator 1.0\\Foxit PDF Editor v1.4.1531\\PDFEdit.exe:*:Disabled:Foxit PDF Editor, the first REAL editor for PDF files!"
"C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"="C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe:*:Disabled:Foxit PDF Editor, the first REAL editor for PDF files!"
"D:\\Gry\\Juarez\\CoJ.exe"="D:\\Gry\\Juarez\\CoJ.exe:*:Enabled:The Call of Juarez"
"D:\\Gry\\HALO\\halo.exe"="D:\\Gry\\HALO\\halo.exe:*:Disabled:Halo"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

C:\WINDOWS\Temp\fa56d7ec.$$$ Found

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 25 Mar 2008 1,665,536 ...H. --- "C:\Documents and Settings\WOJTEK\Moje dokumenty\MGR\~WRL0392.tmp"

Finished!

Log z ComboFIX

ComboFix 08-04-09.9 - WOJTEK 2008-04-10 23:41:39.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.842 [GMT 2:00]
Running from: D:\Programy\OCHRONA\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-03-10 to 2008-04-10 )))))))))))))))))))))))))))))))
.

2008-04-10 23:23 . 2008-04-10 23:23 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-10 23:18 . 2008-04-09 10:46 <DIR> d-------- C:\SDFix
2008-04-10 19:25 . 2008-04-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-09 20:22 . 2008-04-09 20:39 705 --a------ C:\WINDOWS\CoD.INI
2008-04-08 22:15 . 2008-04-08 22:15 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-03-27 19:24 . 2008-03-27 19:24 <DIR> d-------- C:\Documents and Settings\WOJTEK\Dane aplikacji\NeroDCTemplates
2008-03-26 19:15 . 2008-03-26 19:15 <DIR> d-------- C:\Program Files\PITy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 10:53 20,848 ----a-w C:\Documents and Settings\WOJTEK\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-03-06 19:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-06 19:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-06 19:32 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-03-05 16:09 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-05 16:03 --------- d-----w C:\Program Files\GameShadow
2008-02-20 14:48 --------- d-----w C:\Program Files\Foxit Software
2008-02-20 14:43 45,056 ----a-w C:\WINDOWS\system32\sstunst3.exe
2008-02-20 14:00 --------- d-----w C:\Program Files\VeryPDF PDF Editor v1.1
2008-02-20 13:50 74,752 ----a-w C:\WINDOWS\cadkasdeinst01e.exe
2008-02-20 13:14 --------- d-----w C:\Documents and Settings\WOJTEK\Dane aplikacji\eXPert PDF Editor
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 11:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
"CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [2001-12-20 01:00 28672]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 14:23 200704]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 07:59 115816]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-20 20:32 33792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"LG Drive"="C:\Program Files\LG USB Drive 2.9\LG_Drive.exe" [2006-07-28 20:31 1015808]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST System Tray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST System Tray.lnk
backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-02-01 21:05 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--------- 2005-10-27 12:00 299008 C:\Program Files\Creative\Shared Files\CamTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe +set developer 1.exe"=
"D:\\Gry\\CCC\\iw3mp.exe"=
"C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"=
"D:\\Gry\\HALO\\halo.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14638:TCP"= 14638:TCP:BitComet 14638 TCP
"14638:UDP"= 14638:UDP:BitComet 14638 UDP
"10267:TCP"= 10267:TCP:BitComet 10267 TCP
"10267:UDP"= 10267:UDP:BitComet 10267 UDP
"8114:TCP"= 8114:TCP:BitComet 8114 TCP
"8114:UDP"= 8114:UDP:BitComet 8114 UDP

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46]
R3 V0330VID;WebCam Vista;C:\WINDOWS\system32\DRIVERS\V0330Vid.sys [2006-11-03 19:01]
S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};C:\WINDOWS\TEMP\B5.tmp []
S3 aaudstum;aaudstum;C:\DOCUME~1\WOJTEK\USTAWI~1\Temp\aaudstum.sys []
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d722860a-8229-11dc-9358-0040f478a4e4}]
\Shell\Auto\command - activexdebugger32.exe f
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
\Shell\explore\Command - activexdebugger32.exe f
\Shell\open\Command - activexdebugger32.exe f

*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 23:44:15
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&7????wd??w????????\???\??????????????w-??w\???\???????8?`??????C@?\???\??????s????\??????s\????&7?A??s?&7??C@?x???`|?w\?????@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}]
"ImagePath"="\??\C:\WINDOWS\TEMP\B5.tmp"
.
Completion time: 2008-04-10 23:45:04
ComboFix-quarantined-files.txt 2008-04-10 21:44:50
Pre-Run: 8,149,352,448 bajtów wolnych
Post-Run: 8,140,161,024 bajtów wolnych

Log z HIJACK

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:47:50, on 2008-04-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\LG USB Drive 2.9\LG_Drive.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LG Drive] C:\Program Files\LG USB Drive 2.9\LG_Drive.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{98423296-6025-450B-BD48-ED879408302D}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 6766 bytes

Czy jest już dobrze czy nadal źle ? Proszę o dalsze instrukcje albo opinię ...

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\TEMP\B5.tmp

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d722860a-8229-11dc-9358-0040f478a4e4}]

Driver::
{DEF85C80-216A-43ab-AF70-1665EDBE2780}

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i zapisz go sobie

sciagnij gmera


Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >> i wrzuc loga z combofixa (ten zapisany) oraz z gmera

[pablio]

Zrobione

Wydruk z ComboFIX

ComboFix 08-04-09.9 - WOJTEK 2008-04-11 12:53:54.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.840 [GMT 2:00]
Running from: D:\Programy\OCHRONA\ComboFix.exe
Command switches used :: D:\Programy\OCHRONA\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\TEMP\B5.tmp
.

((((((((((((((((((((((((( Files Created from 2008-03-11 to 2008-04-11 )))))))))))))))))))))))))))))))
.

2008-04-10 23:23 . 2008-04-10 23:23 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-10 23:18 . 2008-04-09 10:46 <DIR> d-------- C:\SDFix
2008-04-10 19:25 . 2008-04-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-09 20:22 . 2008-04-09 20:39 705 --a------ C:\WINDOWS\CoD.INI
2008-04-08 22:15 . 2008-04-08 22:15 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-03-27 19:24 . 2008-03-27 19:24 <DIR> d-------- C:\Documents and Settings\WOJTEK\Dane aplikacji\NeroDCTemplates
2008-03-26 19:15 . 2008-03-26 19:15 <DIR> d-------- C:\Program Files\PITy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 10:53 20,848 ----a-w C:\Documents and Settings\WOJTEK\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-03-06 19:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-06 19:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-06 19:32 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-03-05 16:09 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-05 16:03 --------- d-----w C:\Program Files\GameShadow
2008-02-20 14:48 --------- d-----w C:\Program Files\Foxit Software
2008-02-20 14:43 45,056 ----a-w C:\WINDOWS\system32\sstunst3.exe
2008-02-20 14:00 --------- d-----w C:\Program Files\VeryPDF PDF Editor v1.1
2008-02-20 13:50 74,752 ----a-w C:\WINDOWS\cadkasdeinst01e.exe
2008-02-20 13:14 --------- d-----w C:\Documents and Settings\WOJTEK\Dane aplikacji\eXPert PDF Editor
.

((((((((((((((((((((((((((((( snapshot@2008-04-10_23.44.29,92 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-10 21:44:08 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-11 10:56:28 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 11:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
"CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [2001-12-20 01:00 28672]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 14:23 200704]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 07:59 115816]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-20 20:32 33792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"LG Drive"="C:\Program Files\LG USB Drive 2.9\LG_Drive.exe" [2006-07-28 20:31 1015808]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST System Tray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST System Tray.lnk
backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-02-01 21:05 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--------- 2005-10-27 12:00 299008 C:\Program Files\Creative\Shared Files\CamTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe +set developer 1.exe"=
"D:\\Gry\\CCC\\iw3mp.exe"=
"C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"=
"D:\\Gry\\HALO\\halo.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14638:TCP"= 14638:TCP:BitComet 14638 TCP
"14638:UDP"= 14638:UDP:BitComet 14638 UDP
"10267:TCP"= 10267:TCP:BitComet 10267 TCP
"10267:UDP"= 10267:UDP:BitComet 10267 UDP
"8114:TCP"= 8114:TCP:BitComet 8114 TCP
"8114:UDP"= 8114:UDP:BitComet 8114 UDP

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46]
R3 V0330VID;WebCam Vista;C:\WINDOWS\system32\DRIVERS\V0330Vid.sys [2006-11-03 19:01]
S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};C:\WINDOWS\TEMP\B5.tmp []
S3 aaudstum;aaudstum;C:\DOCUME~1\WOJTEK\USTAWI~1\Temp\aaudstum.sys []
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-11 12:56:35
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&7????wd??w????????\???\??????????????w-??w\???\????????1`??????C@?\???\??????s????\??????s\????&7?A??s?&7??C@?x???`|?w\?????@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}]
"ImagePath"="\??\C:\WINDOWS\TEMP\B5.tmp"
.
Completion time: 2008-04-11 12:57:23
ComboFix-quarantined-files.txt 2008-04-11 10:57:10
ComboFix2.txt 2008-04-10 21:45:06
Pre-Run: 8,134,049,792 bajtów wolnych
Post-Run: 8,125,038,592 bajtów wolnych

Końcówka loga z gmer w następnym post'cie. Ale chyba musisz coś napisać, ponieważ nie mogę dodać następnego posta, ani edycja nie działa.
Wyskakuje komunikat: za dużo znaków, przekroczyłeś 65500 !!!
HELP ...

[wojtas]

wejdz na www.wklej.org i wklej tam caly log z gmera a tu daj tylko link do niego

[pablio]

Przyszłościowe rozwiązanie ...
Dobry pomysł, THX

Oto link:
http://wklej.org/id/49291e94c6

Co dalej ?

[wojtas]

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

{DEF85C80-216A-43ab-AF70-1665EDBE2780}

Files to delete:

C:\WINDOWS\Temp\bca4e2da.$$$
C:\WINDOWS\TEMP\B5.tmp

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED


Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combo

[pablio]

Log z Avanger'a

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "{DEF85C80-216A-43ab-AF70-1665EDBE2780}" deleted successfully.
File "C:\WINDOWS\Temp\bca4e2da.$$$" deleted successfully.

Error: file "C:\WINDOWS\TEMP\B5.tmp" not found!
Deletion of file "C:\WINDOWS\TEMP\B5.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

Nowy log z ComboFix'a:

ComboFix 08-04-09.9 - WOJTEK 2008-04-11 14:44:14.3 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.829 [GMT 2:00]
Running from: D:\Programy\OCHRONA\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-03-11 to 2008-04-11 )))))))))))))))))))))))))))))))
.

2008-04-11 12:58 . 2008-04-11 12:58 250 --a------ C:\WINDOWS\gmer.ini
2008-04-10 23:23 . 2008-04-10 23:23 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-10 23:18 . 2008-04-09 10:46 <DIR> d-------- C:\SDFix
2008-04-10 19:25 . 2008-04-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-09 20:22 . 2008-04-09 20:39 705 --a------ C:\WINDOWS\CoD.INI
2008-04-08 22:15 . 2008-04-08 22:15 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-03-27 19:24 . 2008-03-27 19:24 <DIR> d-------- C:\Documents and Settings\WOJTEK\Dane aplikacji\NeroDCTemplates
2008-03-26 19:15 . 2008-03-26 19:15 <DIR> d-------- C:\Program Files\PITy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 10:53 20,848 ----a-w C:\Documents and Settings\WOJTEK\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-03-06 19:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-06 19:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-06 19:32 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-03-05 16:09 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-05 16:03 --------- d-----w C:\Program Files\GameShadow
2008-02-20 14:48 --------- d-----w C:\Program Files\Foxit Software
2008-02-20 14:43 45,056 ----a-w C:\WINDOWS\system32\sstunst3.exe
2008-02-20 14:00 --------- d-----w C:\Program Files\VeryPDF PDF Editor v1.1
2008-02-20 13:50 74,752 ----a-w C:\WINDOWS\cadkasdeinst01e.exe
2008-02-20 13:14 --------- d-----w C:\Documents and Settings\WOJTEK\Dane aplikacji\eXPert PDF Editor
.

((((((((((((((((((((((((((((( snapshot@2008-04-10_23.44.29,92 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-11 10:58:42 819,200 ----a-w C:\WINDOWS\gmer.dll
+ 2008-03-03 18:29:06 761,856 ----a-w C:\WINDOWS\gmer.exe
- 2008-04-10 21:44:08 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-11 12:47:00 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-11 10:58:42 86,097 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 11:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
"CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [2001-12-20 01:00 28672]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 14:23 200704]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 07:59 115816]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-20 20:32 33792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"LG Drive"="C:\Program Files\LG USB Drive 2.9\LG_Drive.exe" [2006-07-28 20:31 1015808]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST System Tray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST System Tray.lnk
backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-02-01 21:05 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--------- 2005-10-27 12:00 299008 C:\Program Files\Creative\Shared Files\CamTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe +set developer 1.exe"=
"D:\\Gry\\CCC\\iw3mp.exe"=
"C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"=
"D:\\Gry\\HALO\\halo.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14638:TCP"= 14638:TCP:BitComet 14638 TCP
"14638:UDP"= 14638:UDP:BitComet 14638 UDP
"10267:TCP"= 10267:TCP:BitComet 10267 TCP
"10267:UDP"= 10267:UDP:BitComet 10267 UDP
"8114:TCP"= 8114:TCP:BitComet 8114 TCP
"8114:UDP"= 8114:UDP:BitComet 8114 UDP

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46]
R3 V0330VID;WebCam Vista;C:\WINDOWS\system32\DRIVERS\V0330Vid.sys [2006-11-03 19:01]
S3 aaudstum;aaudstum;C:\DOCUME~1\WOJTEK\USTAWI~1\Temp\aaudstum.sys []
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-11 14:47:07
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&7????wd??w????????\???\??????????????w-??w\???\?????????a??????C@?\???\??????s????\??????s\????&7?A??s?&7??C@?x???`|?w\?????@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-11 14:47:58
ComboFix-quarantined-files.txt 2008-04-11 12:47:44
ComboFix3.txt 2008-04-10 21:45:06
ComboFix2.txt 2008-04-11 10:57:26
Pre-Run: 8,122,146,816 bajtów wolnych
Post-Run: 8,113,291,264 bajtów wolnych

[wojtas]

wklej jeszcze do notatnika:

File::
C:\DOCUME~1\WOJTEK\USTAWI~1\Temp\aaudstum.sys

Driver::
aaudstum

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[pablio]

Wklejone, skan zrobiony

Oto wynik :

ComboFix 08-04-09.9 - WOJTEK 2008-04-11 16:18:23.4 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.854 [GMT 2:00]
Running from: D:\Programy\OCHRONA\ComboFix.exe
Command switches used :: D:\Programy\OCHRONA\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\DOCUME~1\WOJTEK\USTAWI~1\Temp\aaudstum.sys
.

((((((((((((((((((((((((( Files Created from 2008-03-11 to 2008-04-11 )))))))))))))))))))))))))))))))
.

2008-04-11 12:58 . 2008-04-11 12:58 250 --a------ C:\WINDOWS\gmer.ini
2008-04-10 23:23 . 2008-04-10 23:23 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-10 23:18 . 2008-04-09 10:46 <DIR> d-------- C:\SDFix
2008-04-10 19:25 . 2008-04-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-09 20:22 . 2008-04-09 20:39 705 --a------ C:\WINDOWS\CoD.INI
2008-04-08 22:15 . 2008-04-08 22:15 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-03-27 19:24 . 2008-03-27 19:24 <DIR> d-------- C:\Documents and Settings\WOJTEK\Dane aplikacji\NeroDCTemplates
2008-03-26 19:15 . 2008-03-26 19:15 <DIR> d-------- C:\Program Files\PITy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 10:53 20,848 ----a-w C:\Documents and Settings\WOJTEK\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-03-06 19:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-06 19:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-06 19:32 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-03-05 16:09 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-05 16:03 --------- d-----w C:\Program Files\GameShadow
2008-02-20 14:48 --------- d-----w C:\Program Files\Foxit Software
2008-02-20 14:43 45,056 ----a-w C:\WINDOWS\system32\sstunst3.exe
2008-02-20 14:00 --------- d-----w C:\Program Files\VeryPDF PDF Editor v1.1
2008-02-20 13:50 74,752 ----a-w C:\WINDOWS\cadkasdeinst01e.exe
2008-02-20 13:14 --------- d-----w C:\Documents and Settings\WOJTEK\Dane aplikacji\eXPert PDF Editor
.

((((((((((((((((((((((((((((( snapshot@2008-04-10_23.44.29,92 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-11 10:58:42 819,200 ----a-w C:\WINDOWS\gmer.dll
+ 2008-03-03 18:29:06 761,856 ----a-w C:\WINDOWS\gmer.exe
- 2008-04-10 21:44:08 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-11 14:20:44 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-11 10:58:42 86,097 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 11:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
"CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [2001-12-20 01:00 28672]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 14:23 200704]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 07:59 115816]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-20 20:32 33792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"LG Drive"="C:\Program Files\LG USB Drive 2.9\LG_Drive.exe" [2006-07-28 20:31 1015808]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST System Tray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST System Tray.lnk
backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-02-01 21:05 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--------- 2005-10-27 12:00 299008 C:\Program Files\Creative\Shared Files\CamTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe +set developer 1.exe"=
"D:\\Gry\\CCC\\iw3mp.exe"=
"C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"=
"D:\\Gry\\HALO\\halo.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14638:TCP"= 14638:TCP:BitComet 14638 TCP
"14638:UDP"= 14638:UDP:BitComet 14638 UDP
"10267:TCP"= 10267:TCP:BitComet 10267 TCP
"10267:UDP"= 10267:UDP:BitComet 10267 UDP
"8114:TCP"= 8114:TCP:BitComet 8114 TCP
"8114:UDP"= 8114:UDP:BitComet 8114 UDP

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46]
R3 V0330VID;WebCam Vista;C:\WINDOWS\system32\DRIVERS\V0330Vid.sys [2006-11-03 19:01]
S3 aaudstum;aaudstum;C:\DOCUME~1\WOJTEK\USTAWI~1\Temp\aaudstum.sys []
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-11 16:20:51
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&7????wd??w????????\???\??????????????w-??w\???\?????????a??????C@?\???\??????s????\??????s\????&7?A??s?&7??C@?x???`|?w\?????@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\Gadu-Gadu\ggwhook.dll
.
Completion time: 2008-04-11 16:21:40
ComboFix-quarantined-files.txt 2008-04-11 14:21:26
ComboFix4.txt 2008-04-10 21:45:06
ComboFix3.txt 2008-04-11 10:57:26
ComboFix2.txt 2008-04-11 12:48:00
Pre-Run: 8,063,598,592 bajtów wolnych
Post-Run: 8,058,707,968 bajtów wolnych

Końca nie widać ... tych logów.
Co dalej ?

[wojtas]

Otworz notatnik i wklej w nim to:

Driver::
aaudstum

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[pablio]

Wynikiem skanu jest taki oto log:

ComboFix 08-04-09.9 - WOJTEK 2008-04-11 16:36:44.5 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.798 [GMT 2:00]
Running from: D:\Programy\OCHRONA\ComboFix.exe
Command switches used :: D:\Programy\OCHRONA\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-03-11 to 2008-04-11 )))))))))))))))))))))))))))))))
.

2008-04-11 12:58 . 2008-04-11 12:58 250 --a------ C:\WINDOWS\gmer.ini
2008-04-10 23:23 . 2008-04-10 23:23 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-10 23:18 . 2008-04-09 10:46 <DIR> d-------- C:\SDFix
2008-04-10 19:25 . 2008-04-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-09 20:22 . 2008-04-09 20:39 705 --a------ C:\WINDOWS\CoD.INI
2008-04-08 22:15 . 2008-04-08 22:15 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-03-27 19:24 . 2008-03-27 19:24 <DIR> d-------- C:\Documents and Settings\WOJTEK\Dane aplikacji\NeroDCTemplates
2008-03-26 19:15 . 2008-03-26 19:15 <DIR> d-------- C:\Program Files\PITy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 10:53 20,848 ----a-w C:\Documents and Settings\WOJTEK\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-03-06 19:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-06 19:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-06 19:32 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-03-05 16:09 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-05 16:03 --------- d-----w C:\Program Files\GameShadow
2008-02-20 14:48 --------- d-----w C:\Program Files\Foxit Software
2008-02-20 14:43 45,056 ----a-w C:\WINDOWS\system32\sstunst3.exe
2008-02-20 14:00 --------- d-----w C:\Program Files\VeryPDF PDF Editor v1.1
2008-02-20 13:50 74,752 ----a-w C:\WINDOWS\cadkasdeinst01e.exe
2008-02-20 13:14 --------- d-----w C:\Documents and Settings\WOJTEK\Dane aplikacji\eXPert PDF Editor
.

((((((((((((((((((((((((((((( snapshot@2008-04-10_23.44.29,92 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-11 10:58:42 819,200 ----a-w C:\WINDOWS\gmer.dll
+ 2008-03-03 18:29:06 761,856 ----a-w C:\WINDOWS\gmer.exe
- 2008-04-10 21:44:08 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-11 14:39:10 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-11 10:58:42 86,097 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 11:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
"CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [2001-12-20 01:00 28672]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 14:23 200704]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 07:59 115816]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-20 20:32 33792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"LG Drive"="C:\Program Files\LG USB Drive 2.9\LG_Drive.exe" [2006-07-28 20:31 1015808]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST System Tray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST System Tray.lnk
backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-02-01 21:05 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--------- 2005-10-27 12:00 299008 C:\Program Files\Creative\Shared Files\CamTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe +set developer 1.exe"=
"D:\\Gry\\CCC\\iw3mp.exe"=
"C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"=
"D:\\Gry\\HALO\\halo.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14638:TCP"= 14638:TCP:BitComet 14638 TCP
"14638:UDP"= 14638:UDP:BitComet 14638 UDP
"10267:TCP"= 10267:TCP:BitComet 10267 TCP
"10267:UDP"= 10267:UDP:BitComet 10267 UDP
"8114:TCP"= 8114:TCP:BitComet 8114 TCP
"8114:UDP"= 8114:UDP:BitComet 8114 UDP

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46]
R3 V0330VID;WebCam Vista;C:\WINDOWS\system32\DRIVERS\V0330Vid.sys [2006-11-03 19:01]
S3 aaudstum;aaudstum;C:\DOCUME~1\WOJTEK\USTAWI~1\Temp\aaudstum.sys []
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-11 16:39:16
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&7????wd??w????????\???\??????????????w-??w\???\?????????a??????C@?\???\??????s????\??????s\????&7?A??s?&7??C@?x???`|?w\?????@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-11 16:40:05
ComboFix-quarantined-files.txt 2008-04-11 14:39:52
ComboFix5.txt 2008-04-10 21:45:06
ComboFix4.txt 2008-04-11 10:57:26
ComboFix3.txt 2008-04-11 12:48:00
ComboFix2.txt 2008-04-11 14:21:42
Pre-Run: 8,021,753,856 bajtów wolnych
Post-Run: 8,014,184,448 bajtów wolnych

dalsze wskazówki ?

[wojtas]

uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

aaudstum

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.


Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

[pablio]

Log z Avanger

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "aaudstum" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

i log z ComboFix

ComboFix 08-04-09.9 - WOJTEK 2008-04-12 0:49:21.6 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.823 [GMT 2:00]
Running from: D:\Programy\OCHRONA\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-03-11 to 2008-04-11 )))))))))))))))))))))))))))))))
.

2008-04-11 12:58 . 2008-04-11 12:58 250 --a------ C:\WINDOWS\gmer.ini
2008-04-10 23:23 . 2008-04-10 23:23 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-10 23:18 . 2008-04-09 10:46 <DIR> d-------- C:\SDFix
2008-04-10 19:25 . 2008-04-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-09 20:22 . 2008-04-09 20:39 705 --a------ C:\WINDOWS\CoD.INI
2008-04-08 22:15 . 2008-04-08 22:15 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-03-27 19:24 . 2008-03-27 19:24 <DIR> d-------- C:\Documents and Settings\WOJTEK\Dane aplikacji\NeroDCTemplates
2008-03-26 19:15 . 2008-03-26 19:15 <DIR> d-------- C:\Program Files\PITy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 10:53 20,848 ----a-w C:\Documents and Settings\WOJTEK\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-03-06 19:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-06 19:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-06 19:32 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-03-05 16:09 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-05 16:03 --------- d-----w C:\Program Files\GameShadow
2008-02-20 14:48 --------- d-----w C:\Program Files\Foxit Software
2008-02-20 14:43 45,056 ----a-w C:\WINDOWS\system32\sstunst3.exe
2008-02-20 14:00 --------- d-----w C:\Program Files\VeryPDF PDF Editor v1.1
2008-02-20 13:50 74,752 ----a-w C:\WINDOWS\cadkasdeinst01e.exe
2008-02-20 13:14 --------- d-----w C:\Documents and Settings\WOJTEK\Dane aplikacji\eXPert PDF Editor
.

((((((((((((((((((((((((((((( snapshot@2008-04-10_23.44.29,92 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-11 10:58:42 819,200 ----a-w C:\WINDOWS\gmer.dll
+ 2008-03-03 18:29:06 761,856 ----a-w C:\WINDOWS\gmer.exe
- 2008-04-10 21:44:08 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-11 22:52:04 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-11 15:02:00 3,386 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{7D3562B3-C02B-4FC8-BFAB-7189902C9F53}.bin
+ 2008-04-11 10:58:42 86,097 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 11:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
"CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [2001-12-20 01:00 28672]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 14:23 200704]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 07:59 115816]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-20 20:32 33792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"LG Drive"="C:\Program Files\LG USB Drive 2.9\LG_Drive.exe" [2006-07-28 20:31 1015808]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST System Tray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST System Tray.lnk
backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-02-01 21:05 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--------- 2005-10-27 12:00 299008 C:\Program Files\Creative\Shared Files\CamTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"D:\\Gry\\Pacyfik\\mohpa.exe +set developer 1.exe"=
"D:\\Gry\\CCC\\iw3mp.exe"=
"C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"=
"D:\\Gry\\HALO\\halo.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14638:TCP"= 14638:TCP:BitComet 14638 TCP
"14638:UDP"= 14638:UDP:BitComet 14638 UDP
"10267:TCP"= 10267:TCP:BitComet 10267 TCP
"10267:UDP"= 10267:UDP:BitComet 10267 UDP
"8114:TCP"= 8114:TCP:BitComet 8114 TCP
"8114:UDP"= 8114:UDP:BitComet 8114 UDP

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46]
R3 V0330VID;WebCam Vista;C:\WINDOWS\system32\DRIVERS\V0330Vid.sys [2006-11-03 19:01]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-12 00:52:10
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&7????wd??w????????\???\??????????????w-??w\???\???????H?`??????C@?\???\??????s????\??????s\????&7?A??s?&7??C@?x???`|?w\?????@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-12 0:53:00
ComboFix-quarantined-files.txt 2008-04-11 22:52:46
ComboFix5.txt 2008-04-11 10:57:26
ComboFix4.txt 2008-04-11 12:48:00
ComboFix3.txt 2008-04-11 14:21:42
ComboFix2.txt 2008-04-11 14:40:08
Pre-Run: 7,968,038,912 bajtów wolnych
Post-Run: 7,962,419,200 bajtów wolnych

Wykonane, co dalej ? A może już jest OK ?

[wojtas]

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem