Win32:patched-hh [trj]

[Szpiller]

Jakiś śmieć blokuje mi dostęp do różnych programów, niekiedy nie da się otworzyć folderów, avast nie umie sobie z nim poradzić... dziwię się w ogóle, że jakoś udało mi się tu coś napisać... Proszę o pomoc

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:39:58, on 2008-10-09
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
D:\hp\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
D:\hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\RaConfig.exe
D:\hp\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\blablabla\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://interia.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.java.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "D:\hp\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [SAFE8] "C:\Program Files\Steganos Safe 8\SAFE8.exe" -firstboot (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [SAFE8] "C:\Program Files\Steganos Safe 8\SAFE8.exe" -firstboot (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SAFE8] "C:\Program Files\Steganos Safe 8\SAFE8.exe" -firstboot (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SAFE8] "C:\Program Files\Steganos Safe 8\SAFE8.exe" -firstboot (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = D:\hp\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Lukman.lnk = ?
O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA80DDD4-A208-475A-84E1-B1BDEF269459}: NameServer = 82.160.219.1 213.199.225.14
O23 - Service: Abel - Unknown owner - D:\Cain\Abel.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--
End of file - 5680 bytes

[Magik]

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa

[Szpiller]

SDFix

Kod: Zaznacz wszystko

[b]SDFix: Version 1.234 [/b]
Run by Kamil on 2008-10-09 at 21:19

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\DOCUME~1\Kamil\USTAWI~1\Temp\tmp2B.tmp - Deleted
C:\DOCUME~1\Kamil\USTAWI~1\Temp\tmp2C.tmp - Deleted
C:\DOCUME~1\Kamil\USTAWI~1\Temp\tmp2E.tmp - Deleted
C:\DOCUME~1\Kamil\USTAWI~1\Temp\tmp4D.tmp - Deleted





Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-09 21:31:05
Windows 5.1.2600  NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:de,be,0e,08,b8,48,74,89,b3,dc,3f,fa,b4,da,5e,61,8a,e1,b2,59,e2,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,32,f1,95,df,8b,6c,cc,09,86,6a,05,66,32,b0,54,e5,84,..
"khjeh"=hex:99,65,69,16,1f,d9,84,62,99,d8,d0,e0,2c,62,ef,19,ab,b3,31,35,8b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:f3,00,d5,47,f8,f6,49,5a,61,ea,4f,27,76,7f,36,b8,90,48,37,98,d0,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:04,5e,a4,22,3a,b6,cc,fd,0d,82,d7,4c,33,4f,da,58,a9,bd,b5,0d,91,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:6f,0b,57,7d,79,f7,43,fe,b3,a0,55,79,e2,46,9a,a5,69,b5,fe,dd,63,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:ca,bd,c4,b2,a5,89,78,25,f0,2f,72,75,d1,73,c4,d9,a2,82,b7,ad,c6,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:de,be,0e,08,b8,48,74,89,b3,dc,3f,fa,b4,da,5e,61,8a,e1,b2,59,e2,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,32,f1,95,df,8b,6c,cc,09,86,6a,05,66,32,b0,54,e5,84,..
"khjeh"=hex:99,65,69,16,1f,d9,84,62,99,d8,d0,e0,2c,62,ef,19,ab,b3,31,35,8b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:f3,00,d5,47,f8,f6,49,5a,61,ea,4f,27,76,7f,36,b8,90,48,37,98,d0,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:04,5e,a4,22,3a,b6,cc,fd,0d,82,d7,4c,33,4f,da,58,a9,bd,b5,0d,91,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:6f,0b,57,7d,79,f7,43,fe,b3,a0,55,79,e2,46,9a,a5,69,b5,fe,dd,63,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:ca,bd,c4,b2,a5,89,78,25,f0,2f,72,75,d1,73,c4,d9,a2,82,b7,ad,c6,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Wapster\\AQQ\\AQQ.exe"="C:\\Program Files\\Wapster\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ"
"C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Sat 28 Jul 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Tue 23 Oct 2007     3,350,528 A..H. --- "C:\Documents and Settings\Kamil\Dane aplikacji\U3\temp\Launchpad Removal.exe"

[b]Finished![/b]



Combo

Kod: Zaznacz wszystko

ComboFix 08-10-08.05 - Kamil 2008-10-09 21:39:25.2 - NTFSx86 MINIMAL
Microsoft Windows XP Professional  5.1.2600.0.1250.1.1045.18.217 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\Kamil\Pulpit\ComboFix.exe

[COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ABEL
-------\Service_Abel


(((((((((((((((((((((((((   Pliki utworzone od 2008-09-09 do 2008-10-09  )))))))))))))))))))))))))))))))
.

2008-10-09 21:16 . 2008-10-09 21:16   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-10-09 21:03 . 2008-10-09 21:37   <DIR>   d--------   C:\SDFix
2008-10-06 14:03 . 2008-10-06 14:03   754   --a------   C:\WINDOWS\WORDPAD.INI
2008-10-03 18:49 . 2008-10-03 18:49   <DIR>   d--------   C:\Documents and Settings\Kamil\Dane aplikacji\Nowe Gadu-Gadu
2008-09-30 15:06 . 2008-09-30 17:54   <DIR>   d--------   C:\Documents and Settings\slawek.GOKU\Dane aplikacji\Nowe Gadu-Gadu
2008-09-26 14:49 . 2008-09-26 14:50   <DIR>   d--------   C:\Documents and Settings\slawek.GOKU\Dane aplikacji\ENet
2008-09-26 14:46 . 2008-09-26 14:46   <DIR>   d--------   C:\Program Files\E-Net
2008-09-10 16:17 . 2008-09-10 16:18   <DIR>   d--------   C:\Documents and Settings\slawek.GOKU\Dane aplikacji\uTorrent

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-09 18:36   ---------   d-----w   C:\Program Files\MWSnap
2008-10-09 18:26   ---------   d-----w   C:\Program Files\cFosSpeed
2008-10-05 06:42   1,001,006   -c--a-w   C:\WINDOWS\system32DESServer_M.tmp
2008-10-05 06:21   1,002,300   -c--a-w   C:\WINDOWS\system32DESServer_IO.tmp
2008-10-04 06:22   ---------   d-----w   C:\Documents and Settings\Kamil\Dane aplikacji\uTorrent
2008-10-01 13:55   ---------   d-----w   C:\Documents and Settings\slawek.GOKU\Dane aplikacji\FileZilla
2008-09-24 06:52   ---------   d-----w   C:\Documents and Settings\Adam.GOKU\Dane aplikacji\AdobeUM
2008-09-17 22:48   ---------   d-----w   C:\Documents and Settings\Kamil\Dane aplikacji\Skype
2008-09-12 12:38   ---------   d-----w   C:\Program Files\Winamp
2008-09-10 14:17   ---------   d-----w   C:\Program Files\Gronzo
2008-08-19 07:48   ---------   d-----w   C:\Program Files\MIKSOFT
2008-08-09 20:16   ---------   d-----w   C:\Program Files\Real Alternative
2008-07-12 10:35   1,001,087   -c--a-w   C:\WINDOWS\system32DESProxyM.tmp
2008-01-26 15:12   81,920   --sha-w   C:\Program Files\Thumbs.db
2001-11-23 04:08   712,704   -c--a-w   C:\WINDOWS\inf\OTHER\audio3d.dll
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-30 13312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 315392]
"snpstd3"="C:\WINDOWS\vsnpstd3.exe" [2005-07-08 339968]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-06-21 172032]
"HP Software Update"="D:\hp\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-30 13312]

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - D:\hp\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
HP Image Zone - szybkie uruchamianie.lnk - D:\hp\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"vidc.ffds"= C:\PROGRA~1\ffdshow\ffdshow.ax
"vidc.XVID"= xvid.dll
"vidc.3ivx"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.i263"= i263_32.drv
"msacm.imc"= imc32.acm
"VIDC.CSCD"= camcodec.dll
"VIDC.VP40"= vp4vfw.dll
"vidc.X264"= x264vfw.dll
"VIDC.DRAW"= DVIDEO.DLL
"VIDC.YV12"= yv12vfw.dll
"VIDC.MSUD"= msulvc05.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Wapster\\AQQ\\AQQ.exe"=
"C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-07-19 78416]
R1 SLEE_13_DRIVER;Steganos Live Encryption Engine 13 [Driver];C:\WINDOWS\System32\drivers\SLEE13.sys [2005-10-04 18:42 74240]
R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\System32\DRIVERS\RT2400.sys [2003-10-08 51712]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [2005-08-18 7168]
S3 siusbmod;siusbmod;C:\WINDOWS\System32\DRIVERS\siusbmod.sys [2004-05-25 26624]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\System32\DRIVERS\ss_bus.sys [2005-08-30 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\System32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\System32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
.
Zawartość folderu 'Zaplanowane zadania'

2008-10-07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKU-Default-RunOnce-SAFE8 - C:\Program Files\Steganos Safe 8\SAFE8.exe


.
------- Skan uzupełniający -------
.
FireFox -: Profile - C:\Documents and Settings\Kamil\Dane aplikacji\Mozilla\Firefox\Profiles\ftv7nu02.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.interia.pl/
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPBILLARD8.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npganymedenet.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPPOKER.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-09 21:48:40
Windows 5.1.2600  NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...


C:\banus :).png 1729 bytes hidden from API

skanowanie pomyślnie ukończone
ukryte pliki: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt"
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\RaConfig.exe
D:\hp\Digital Imaging\bin\hpqgalry.exe
.
**************************************************************************
.
Czas ukończenia: 2008-10-09 21:57:26 - komputer został uruchomiony ponownie [Kamil]
ComboFix-quarantined-files.txt  2008-10-09 19:56:30
ComboFix2.txt  2008-06-04 09:26:56

Przed: 1 413 492 736 bajtów wolnych
Po: 1,563,189,248 bajtów wolnych

133   --- E O F ---   2008-09-10 17:02:16


[Magik]

W HJT nic nie ma

odpal jeszcze to

http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html

bo w combo tez bez rewelacji

wklej do notatnika

Kod: Zaznacz wszystko

FILE::

C:\WINDOWS\WORDPAD.INI
C:\WINDOWS\system32DESServer_M.tmp
C:\WINDOWS\system32DESServer_IO.tmp
C:\WINDOWS\system32DESProxyM.tmp

Zapisz jako CFScript.txt. Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.

avast nie umie sobie z nim poradzić

i od razu pozbadz sie tego chwasta-->zmien na NoD'a albo Kaspra

BTW, dziwne trojan a zadnego procesu uruchomionego w tle


przeskanuj jeszcze kompa tym
http://www.kaspersky.com/virusscanner

Autor postu otrzymał pochwałę