Dzi@dek napisał(a):Usuń te wpisy w hijackthis
O1 - Hosts: 66.98.136.25 auto.search.msn.com
O1 - Hosts: 66.98.136.25 auto.search.msn.es
i daj log z combofix-a.
http://www.programosy.pl/program,combofix.html
ComboFix 07-12-17.1 - User 2007-12-17 21:55:32.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.143 [GMT 1:00]
Running from: D:\Documents and Settings\User\Pulpit\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
D:\Documents and Settings\User\Dane aplikacji\inst.exe
.
((((((((((((((((((((((((( Files Created from 2007-11-17 to 2007-12-17 )))))))))))))))))))))))))))))))
.
2007-12-17 21:20 . 2007-12-17 21:20 <DIR> d-------- D:\Program Files\Ashampoo
2007-12-13 23:33 . 2007-12-13 23:34 <DIR> d-------- D:\Program Files\4x4 Evolution
2007-12-11 20:46 . 2007-12-11 20:46 3,596,288 --a------ D:\WINDOWS\system32\qt-dx331.dll
2007-12-11 20:46 . 2007-12-11 20:46 524,288 --a------ D:\WINDOWS\system32\DivXsm.exe
2007-12-11 20:46 . 2007-12-11 20:46 4,816 --a------ D:\WINDOWS\system32\divxsm.tlb
2007-12-11 20:45 . 2007-12-11 20:45 1,044,480 --a------ D:\WINDOWS\system32\libdivx.dll
2007-12-11 20:45 . 2007-12-11 20:45 200,704 --a------ D:\WINDOWS\system32\ssldivx.dll
2007-12-11 20:43 . 2007-12-11 20:43 12,288 --a------ D:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-10 22:42 . 2007-12-10 22:42 <DIR> d-------- D:\Program Files\Common Files\NSV
2007-12-10 20:07 . 2007-12-12 17:16 <DIR> d-------- D:\Documents and Settings\User\Dane aplikacji\BearShare
2007-12-10 20:07 . 2006-11-12 11:39 483,328 --a------ D:\WINDOWS\system32\actskn45.ocx
2007-12-08 17:36 . 2007-12-09 15:13 <DIR> d-------- D:\Program Files\Easiestutils
2007-12-08 17:28 . 2006-11-01 14:52 765,952 --a------ D:\WINDOWS\system32\xvidcore.dll
2007-12-08 10:28 . 2007-12-08 10:28 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\shctxex.vb
2007-12-08 10:28 . 1998-06-17 00:00 516,173 --a------ D:\WINDOWS\system32\msvcp60d.dll
2007-12-08 10:28 . 1998-06-17 00:00 385,100 --a------ D:\WINDOWS\system32\MSVCRTD.DLL
2007-12-08 10:28 . 2005-09-01 15:13 245,408 --a------ D:\WINDOWS\system32\unicows.dll
2007-12-08 10:28 . 2007-03-24 20:19 69,632 --a------ D:\WINDOWS\system32\vzcontextmenu.dll
2007-12-08 10:28 . 2003-12-22 08:20 4,608 --a------ D:\WINDOWS\system32\W95INF32.DLL
2007-12-08 10:28 . 2003-12-22 08:20 2,272 --a------ D:\WINDOWS\system32\W95INF16.DLL
2007-12-08 10:28 . 2003-12-22 08:20 1,069 --a------ D:\WINDOWS\system32\vbrun60.inf
2007-12-08 01:50 . 2007-12-08 01:50 <DIR> d-------- D:\Program Files\Riva
2007-12-08 01:50 . 2007-12-08 01:50 <DIR> d-------- D:\Program Files\Common Files\SWF Studio
2007-12-04 00:25 . 2007-12-04 00:25 <DIR> d-------- D:\Program Files\Dziobas Rar Player
2007-11-25 17:38 . 2007-11-25 17:38 <DIR> d-------- D:\WINDOWS\Easy Rapidshare Points
2007-11-23 00:21 . 2007-11-23 00:21 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Skype
2007-11-23 00:20 . 2007-11-24 10:09 <DIR> d-------- D:\Documents and Settings\User\Dane aplikacji\Skype
2007-11-18 21:09 . 2007-11-25 12:04 <DIR> d-------- D:\Program Files\Selteco
2007-11-17 12:06 . 2007-11-17 12:06 <DIR> d-------- D:\Program Files\Real Alternative
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-17 15:20 22,328 ----a-w D:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-17 15:20 107,832 ----a-w D:\WINDOWS\system32\PnkBstrB.exe
2007-12-16 13:27 --------- d--h--w D:\Program Files\InstallShield Installation Information
2007-12-16 13:23 163,644 ----a-w D:\WINDOWS\system32\drivers\secdrv.sys
2007-12-14 21:26 --------- d-----w D:\Program Files\DivX
2007-12-11 19:44 823,296 ----a-w D:\WINDOWS\system32\divx_xx0c.dll
2007-12-11 19:44 823,296 ----a-w D:\WINDOWS\system32\divx_xx07.dll
2007-12-11 19:44 81,920 ----a-w D:\WINDOWS\system32\dpl100.dll
2007-12-11 19:44 802,816 ----a-w D:\WINDOWS\system32\divx_xx11.dll
2007-12-11 19:44 682,496 ----a-w D:\WINDOWS\system32\DivX.dll
2007-12-11 19:44 593,920 ----a-w D:\WINDOWS\system32\dpuGUI11.dll
2007-12-11 19:44 57,344 ----a-w D:\WINDOWS\system32\dpv11.dll
2007-12-11 19:44 53,248 ----a-w D:\WINDOWS\system32\dpuGUI10.dll
2007-12-11 19:44 344,064 ----a-w D:\WINDOWS\system32\dpus11.dll
2007-12-11 19:44 294,912 ----a-w D:\WINDOWS\system32\dpu11.dll
2007-12-11 19:44 294,912 ----a-w D:\WINDOWS\system32\dpu10.dll
2007-12-11 19:44 196,608 ----a-w D:\WINDOWS\system32\dtu100.dll
2007-12-11 19:44 156,992 ----a-w D:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-11-26 19:34 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\Image Zone Express
2007-11-25 11:03 --------- d-----w D:\Program Files\Valve
2007-11-25 11:02 --------- d-----w D:\Program Files\Sony
2007-11-25 11:01 --------- d-----w D:\Program Files\ALCAM
2007-11-25 10:56 --------- d-----w D:\Program Files\Paltalk Messenger
2007-11-25 10:56 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\Paltalk
2007-11-19 22:55 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\MyPhoneExplorer
2007-11-19 01:12 --------- d-----w D:\Program Files\Common Files\Adobe
2007-11-17 11:06 --------- d-----w D:\Program Files\Common Files\Real
2007-11-17 11:04 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\DivX
2007-11-16 16:02 --------- d-----w D:\Program Files\Windows Media Connect 2
2007-11-16 15:17 --------- d-----w D:\Program Files\WEBDEV
2007-11-16 15:16 47,360 ----a-w D:\Documents and Settings\User\Dane aplikacji\pcouffin.sys
2007-11-16 15:16 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\Vso
2007-11-16 15:14 --------- d-----w D:\Program Files\Epocware
2007-11-16 15:13 --------- d-----w D:\Program Files\Moyea
2007-11-16 15:05 47,360 ----a-w D:\WINDOWS\system32\drivers\pcouffin.sys
2007-11-16 15:03 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\Crystal Player
2007-11-16 14:57 737,280 ----a-w D:\WINDOWS\iun6002.exe
2007-11-16 14:46 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\Media Player Classic
2007-11-13 18:18 --------- d-----w D:\Program Files\Nokia
2007-11-13 17:58 --------- d-----w D:\Program Files\MIKSOFT
2007-11-08 17:48 --------- d-----w D:\Program Files\Elaborate Bytes
2007-11-05 20:48 --------- d-----w D:\Program Files\Liceum - Przedsiebiorczosc
2007-11-04 14:41 --------- d-----w D:\Program Files\SlySoft
2007-11-04 02:29 --------- d-----w D:\Program Files\MyPhoneExplorer
2007-11-04 02:13 --------- d-----w D:\Program Files\Real
2007-11-03 12:47 --------- d-----w D:\Program Files\NPCC
2007-11-01 12:02 --------- d-----w D:\Program Files\Common Files\DVDVideoSoft
2007-11-01 10:59 --------- d-----w D:\Program Files\DiskInternals
2007-10-31 20:46 --------- d-----w D:\Program Files\SHOUTcast
2007-10-31 20:45 --------- d-----w D:\Program Files\Winamp
2007-10-31 10:35 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\Moyea
2007-10-31 10:09 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\Eltima Software
2007-10-31 10:04 13,560 --sha-w D:\WINDOWS\system32\KGyGaAvL.sys
2007-10-31 09:45 --------- d-----w D:\Program Files\Ultra Flash Video FLV Converter
2007-10-30 19:17 --------- d-----w D:\Program Files\Konnekt
2007-10-28 22:36 --------- d-----w D:\Program Files\Electronic Arts
2007-10-27 19:55 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\Sony
2007-10-27 15:40 352,256 ----a-w D:\WINDOWS\eSellerateEngine.dll
2007-10-27 15:40 --------- d-----w D:\Program Files\Raptisoft
2007-10-25 10:34 --------- d-----w D:\Program Files\DAEMON Tools
2007-10-25 10:33 639,224 ----a-w D:\WINDOWS\system32\drivers\sptd.sys
2007-10-23 20:57 --------- d-----w D:\Program Files\AIDA32 - Enterprise System Information
2007-10-23 16:35 --------- d-----w D:\Program Files\bioVirtual
2007-10-21 16:52 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\Azureus
2007-10-19 19:42 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\Ahead
2007-10-19 19:40 --------- d-----w D:\Program Files\Common Files\Ahead
2007-10-19 19:38 --------- d-----w D:\Program Files\Nero
2007-10-17 15:56 --------- d-----w D:\Documents and Settings\User\Dane aplikacji\GanymedeNet
2007-09-23 17:05 66,872 ----a-w D:\WINDOWS\system32\pnkbstra.exe
2007-09-23 17:02 22,328 ----a-w D:\Documents and Settings\User\Dane aplikacji\PnkBstrK.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Programy\Gadu-Gadu\gg.exe" [2007-01-30 15:58]
"Internet Download Accelerator"="D:\Program Files\IDA\ida.exe" []
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44]
"Konnekt"="D:\Program Files\Konnekt\konnekt.exe" [2005-05-24 22:41]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 D:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-03-09 08:29 D:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-03 23:44 D:\WINDOWS\system32\rundll32.exe]
"SoundMAXPnP"="D:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 10:11]
"SoundMAX"="D:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-09-07 14:35]
"WinampAgent"="D:\Program Files\Winamp\winampa.exe" [2006-11-21 18:38]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"HP Software Update"="D:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"Adobe Reader Speed Launcher"="D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"Sony Ericsson PC Suite"="D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24]
"Ashampoo FireWall"="D:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 14:57]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-03-25 00:36 D:\WINDOWS\system32\advpack.dll]
D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsMenu"= 1 (0x1)
"NoRecentDocsHistory"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsMenu"= 1 (0x1)
"NoRecentDocsHistory"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};D:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 15:51]
R3 AEAudioService;AEAudio Service;D:\WINDOWS\system32\drivers\AEAudio.sys [2005-03-04 21:53]
S3 PBDOWNFORCE_SERVICE;PBDOWNFORCE_SERVICE;D:\DOCUME~1\User\Temp\PHQ583.tmp []
S3 SCREAMINGBDRIVER;Screaming Bee Audio;D:\WINDOWS\system32\drivers\ScreamingBAudio.sys []
S3 usbscan;Sterownik skanera USB;D:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
S3 USBSTOR;Sterownik magazynu masowego USB;D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService REG_MULTI_SZ WebClient LmHosts upnphost SSDPSRV
*Newly Created Service* - ASFWHIDE
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2007-10-13 11:09:16 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- D:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-17 21:56:52
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: D:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> D:\Program Files\Ashampoo\Ashampoo FireWall\spi.dll
.
Completion time: 2007-12-17 21:57:08