Ostatnio codziennie uruchamiam spy-bota (a także aktualizuję bazę) i praktycznie codziennie wykrywa mi:
"Win32.Rungbu.a" , wybieram opcję napraw zaznaczone problemy co kończy się powodzeniem. Jednak przy następnym uruchomieniu (kompa) spy-bota trojan znów się pojawia.
Opis trojana z poziomu spy-bota:
"Win32.Rungbu.a copies an executable file into the system directory and starts itself in autorun as "kava" without giving the user a possibility to cancel that process. It also connects to the internet in background and downloads executable files from a malicious server."
Logi:
Combofix
- Kod: Zaznacz wszystko
ComboFix 09-01-21.04 - x 2009-01-27 9:57:43.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.150 [GMT 1:00]
Uruchomiony z: c:\documents and settings\x\Pulpit\problem\ComboFix.exe
* Utworzono nowy punkt przywracania
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\2u.com
C:\autorun.inf
C:\j60osk9.cmd
C:\uvsqfgwd.cmd
c:\windows\system32\gasretyw0.dll
c:\windows\system32\kamsoft.exe
D:\2u.com
D:\Autorun.inf
D:\j60osk9.cmd
D:\uvsqfgwd.cmd
.
((((((((((((((((((((((((( Pliki utworzone od 2008-12-27 do 2009-01-27 )))))))))))))))))))))))))))))))
.
2009-01-24 10:22 . 2009-01-27 07:45 95,744 --------- c:\windows\system32\nmdfgds0.dll
2009-01-22 09:17 . 2009-01-23 08:35 107,882 -r-hs---- C:\w98.com
2009-01-20 08:53 . 2009-01-22 09:16 107,385 -r-hs---- C:\gy.exe
2009-01-16 19:04 . 2009-01-16 19:04 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Acronis
2009-01-16 19:04 . 2009-01-16 19:04 1,390,730 --a------ c:\windows\system32\AutoPartNt.exe
2009-01-16 19:04 . 2009-01-16 19:29 1,024 --a------ c:\windows\system32\AutoPartNt.let
2009-01-16 19:03 . 2009-01-27 07:45 95,744 -r-hs---- c:\windows\system32\nmdfgds1.dll
2009-01-16 19:03 . 2004-08-03 23:44 70,144 --a------ c:\windows\AhnRpta.exe
2009-01-16 19:00 . 2009-01-16 19:00 <DIR> d-------- c:\program files\Common Files\Acronis
2009-01-16 18:42 . 2009-01-16 18:42 114,048 --a------ c:\windows\system32\drivers\snapman.sys
2009-01-16 18:35 . 2009-01-17 10:21 110,003 -r-hs---- C:\x2csvg.exe
2009-01-16 18:35 . 2009-01-27 07:45 108,512 -r-hs---- c:\windows\system32\olhrwef.exe
2009-01-05 10:32 . 2009-01-05 10:32 91 --a------ c:\windows\wininit.ini
2008-12-31 16:15 . 2009-01-27 09:59 108,270 --a------ c:\windows\system32\drivers\531cf7a.sys
2008-12-27 22:51 . 2008-12-27 22:51 <DIR> d-------- c:\documents and settings\x\Dane aplikacji\Winamp5
2008-12-27 21:12 . 2008-12-27 21:12 <DIR> d-------- c:\documents and settings\x\Dane aplikacji\BESTplayer
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-06 10:57 --------- d-----w c:\program files\SHOUTcast Source
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AQQ"="d:\program2\Wapster\AQQ\WAPSTE~1\AQQ.exe" [2008-12-22 1656832]
"Google Update"="c:\documents and settings\x\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]
"cdoosoft"="c:\windows\system32\olhrwef.exe" [2009-01-27 108512]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2006-07-07 348160]
"OSSelectorReinstall"="c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-03-09 2223985]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{BB4C402F-882A-4526-8C08-51278EA437C1}"= "c:\windows\system32\afmain0.dll" [2004-08-03 78848]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= ctwdm32.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Exif Launcher.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Exif Launcher.lnk
backup=c:\windows\pss\Exif Launcher.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FineReader7NewsReaderPro]
--a------ 2003-08-05 16:16 278528 d:\programy\abbyy\AbbyyNewsReader.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-09-03 20:11 133104 c:\documents and settings\x\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 2006-11-10 16:19 1051648 d:\programy\nero\Nero 7\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 2006-12-05 22:55 54832 d:\programy\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 14:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
--------- 2002-02-04 21:32 53248 c:\program files\REGSHAVE\REGSHAVE.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2006-11-23 15:10 56928 d:\programy\CyberLink\PowerDVD\PDVDServ.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Program2\\Wapster\\AQQ\\AQQ.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"d:\\Programy\\Skype\\Phone\\Skype.exe"=
"d:\\Program2\\eMule\\EMULE.EXE"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Program2\\Wapster\\AQQ\\WapSter AQQ\\AQQ.exe"=
R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [2007-09-10 9446]
R4 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe -k netsvcs [2001-10-26 14336]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{004341c0-785e-11dd-b481-0015569e6253}]
\shell\autorun\command - G:\2u.com
\shell\explore\command - G:\2u.com
\shell\open\command - G:\2u.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e16d723-fcd4-11db-a6c8-0015569e6253}]
\shell\autorun\command - G:\w98.com
\shell\open\command - G:\w98.com
.
Zawartość folderu 'Zaplanowane zadania'
2009-01-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-842925246-436374069-1957994488-1003.job
- c:\documents and settings\x\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-09-03 20:11]
.
.
------- Skan uzupełniający -------
.
uStart Page = about:blank
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
FF - ProfilePath - c:\documents and settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\i7g7mm11.default\
FF - plugin: c:\documents and settings\x\Ustawienia lokalne\Dane aplikacji\Google\Update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: d:\programy\adobe\Acrobat 7\Reader\browser\nppdf32.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-27 09:58:56
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\531cf7a]
"ImagePath"="\SystemRoot\System32\drivers\531cf7a.sys"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\s-1-5-21-842925246-436374069-1957994488-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Czas ukończenia: 2009-01-27 10:01:15
ComboFix-quarantined-files.txt 2009-01-27 09:00:24
Przed: 1 180 626 944 bajtów wolnych
Po: 1,287,561,216 bajtów wolnych
132
Hijackthis
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:02:23, on 2009-01-27
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
D:\Program2\Wapster\AQQ\WAPSTE~1\AQQ.exe
C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\devldr32.exe
D:\Programy\nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\explorer.exe
D:\Program2\TC PowerPack\totalcmd.exe
D:\Programy\adobe\Acrobat 7\Reader\AcroRd32Info.exe
D:\Programs\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\adobe\Acrobat 7\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKCU\..\Run: [AQQ] D:\Program2\Wapster\AQQ\WAPSTE~1\AQQ.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\Programy\nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 3526 bytes
Log ze Spy-bot - (tym razem nie usunąłem trojana za pomocą spy-bota, - może ułatwi to wykrycie/pracę innym narzędziom?!)
- Kod: Zaznacz wszystko
--- Search result list ---
Hint of the Day: Click the bar at the right of this to see more information! ()
Win32.Rungbu.a: [SBI $8819FA0B] Identyfikator klasy (Klucz rejestru, nothing done)
HKEY_CLASSES_ROOT\CLSID\MADOWN
Tradedoubler: Cookie wyszukujące (Firefox: default) (Cookie, nothing done)
Tradedoubler: Cookie wyszukujące (Firefox: default) (Cookie, nothing done)
--- Spybot - Search & Destroy version: 1.6.0 (build: 20080729) ---
2008-11-05 unins000.exe (51.49.0.0)
2008-07-30 blindman.exe (1.0.0.8)
2008-07-30 SDMain.exe (1.0.0.6)
2008-07-30 SDWinSec.exe (1.0.0.12)
2008-07-30 Update.exe (1.6.0.7)
2008-07-30 SDUpdate.exe (1.6.0.9)
2008-07-30 SpybotSD.exe (1.6.0.31)
2008-07-30 TeaTimer.exe (1.6.1.22)
2008-07-30 SDFiles.exe (1.6.0.4)
2008-07-30 SDShred.exe (1.0.2.3)
2008-06-14 DelZip179.dll (1.79.11.1)
2007-04-02 aports.dll (2.1.0.0)
2008-06-19 sqlite3.dll
2008-10-22 Tools.dll (2.1.6.8)
2008-10-22 advcheck.dll (1.6.2.13)
2008-09-15 SDHelper.dll (1.6.2.14)
2008-12-16 Includes\PUPS.sbi (*)
2009-01-06 Includes\Dialer.sbi (*)
2008-12-09 Includes\Keyloggers.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2008-11-18 Includes\Hijackers.sbi (*)
2008-11-18 Includes\Malware.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2009-01-20 Includes\Spyware.sbi (*)
2009-01-13 Includes\Adware.sbi (*)
2009-01-21 Includes\Trojans.sbi (*)
2009-01-15 Includes\Cookies.sbi (*)
2009-01-13 Includes\Revision.sbi (*)
2008-06-03 Includes\Tracks.uti
2009-01-21 Includes\TrojansC.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2009-01-20 Includes\SecurityC.sbi (*)
2009-01-20 Includes\PUPSC.sbi (*)
2009-01-21 Includes\MalwareC.sbi (*)
2009-01-20 Includes\KeyloggersC.sbi (*)
2009-01-13 Includes\HijackersC.sbi (*)
2009-01-13 Includes\DialerC.sbi (*)
2009-01-13 Includes\HeavyDuty.sbi (*)
2009-01-20 Includes\AdwareC.sbi (*)
2009-01-13 Includes\SpywareC.sbi (*)
2007-12-24 Plugins\TCPIPAddress.dll
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
--- System information ---
Windows XP (Build: 2600) Dodatek Service Pack 2 (5.1.2600)
/ Windows XP / SP2: Windows XP Service Pack 2
/ Windows XP / SP3: Poprawka systemu Windows XP - KB896626
--- Startup entries list ---
Located: HK_LM:Run, OSSelectorReinstall
command: C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
file: C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
size: 2223985
MD5: 640E096997B563159991326DE1F68DDE
Located: HK_LM:Run, WinFast Schedule
command: C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
file: C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
size: 348160
MD5: 3311728B2E69F575C0154E378DF2A6D7
Located: HK_CU:Run, CTFMON.EXE
where: .default...
command: C:\WINDOWS\System32\CTFMON.EXE
file: C:\WINDOWS\System32\CTFMON.EXE
size: 15360
MD5: CBFA30492D70CE3938D8A7783D0C0436
Located: HK_CU:Run, CTFMON.EXE
where: pe_c_administrator...
command: C:\WINDOWS\System32\CTFMON.EXE
file: C:\WINDOWS\System32\CTFMON.EXE
size: 15360
MD5: CBFA30492D70CE3938D8A7783D0C0436
Located: HK_CU:RunOnce, NeroHomeFirstStart
where: pe_c_administrator...
command: C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe
file: C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe
size: 10752
MD5: E15AAD68F518E2C6C91E790FDD6B9820
Located: HK_CU:Run, AQQ
where: s-1-5-21-842925246-436374069-1957994488-1003...
command: D:\Program2\Wapster\AQQ\WAPSTE~1\AQQ.exe
file: D:\Program2\Wapster\AQQ\WAPSTE~1\AQQ.exe
size: 1656832
MD5: 4D787A13E3F70904B870F9332CAFF1A0
Located: HK_CU:Run, cdoosoft
where: s-1-5-21-842925246-436374069-1957994488-1003...
command: C:\WINDOWS\system32\olhrwef.exe
file: C:\WINDOWS\system32\olhrwef.exe
size: 108512
MD5: E737E24B20A10056A7CFED1AA47A3ADE
Located: HK_CU:Run, Google Update
where: s-1-5-21-842925246-436374069-1957994488-1003...
command: "C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c
file: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe
size: 133104
MD5: 626A24ED1228580B9518C01930936DF9
Located: HK_CU:Run, kamsoft
where: s-1-5-21-842925246-436374069-1957994488-1003...
command: C:\WINDOWS\system32\kamsoft.exe
file: C:\WINDOWS\system32\kamsoft.exe
size: 105097
MD5: 451F18694BBC49150683FE7B2BAC5322
Located: HK_CU:Run, CTFMON.EXE
where: s-1-5-18...
command: C:\WINDOWS\System32\CTFMON.EXE
file: C:\WINDOWS\System32\CTFMON.EXE
size: 15360
MD5: CBFA30492D70CE3938D8A7783D0C0436
Located: Autostart (wyłączony), Exif Launcher (DISABLED)
command: D:\Programy\FINEPI~1\QuickDCF.exe
file: D:\Programy\FINEPI~1\QuickDCF.exe
size: 282624
MD5: 8558AED89FD5004F517184F354FAF6AF
Located: WinLogon, crypt32chain
command: crypt32.dll
file: crypt32.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: WinLogon, cryptnet
command: cryptnet.dll
file: cryptnet.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: WinLogon, cscdll
command: cscdll.dll
file: cscdll.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: WinLogon, ScCertProp
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: WinLogon, Schedule
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: WinLogon, sclgntfy
command: sclgntfy.dll
file: sclgntfy.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: WinLogon, SensLogn
command: WlNotify.dll
file: WlNotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: WinLogon, termsrv
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: WinLogon, wlballoon
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
--- Browser helper object list ---
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: AcroIEHlprObj Class
description: Adobe Acrobat reader
classification: Legitimate
known filename: AcroIEhelper.ocx<br>AcroIEhelper.dll
info link: http://www.adobe.com/products/acrobat/readstep2.html
info source: TonyKlein
Path: D:\Programy\adobe\Acrobat 7\ActiveX\
Long name: AcroIEHelper.dll
Short name: ACROIE~1.DLL
Date (created): 2005-09-24 06:12:08
Date (last access): 2009-01-27
Date (last write): 2005-09-24 06:12:08
Filesize: 63136
Attributes: archive
MD5: B61D5D651ECC6055C29BF826CA7B1141
CRC32: FEF15799
Version: 7.0.5.172
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: SSVHelper Class
Path: C:\Program Files\Java\jre1.6.0_05\bin\
Long name: ssv.dll
Short name:
Date (created): 2008-08-28 12:41:22
Date (last access): 2009-01-27 09:06:58
Date (last write): 2008-02-22 03:25:20
Filesize: 509328
Attributes: archive
MD5: 5B42CB6A121256465B251840FDB1B2FE
CRC32: 6EF0BCE9
Version: 6.0.50.13
--- ActiveX list ---
DirectAnimation Java Classes (DirectAnimation Java Classes)
DPF name: DirectAnimation Java Classes
CLSID name:
Installer:
Codebase: file://C:\WINDOWS\Java\classes\dajava.cab
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\dajava.cab
info link:
info source: Patrick M. Kolla
Microsoft XML Parser for Java (Microsoft XML Parser for Java)
DPF name: Microsoft XML Parser for Java
CLSID name:
Installer:
Codebase: file://C:\WINDOWS\Java\classes\xmldso.cab
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\xmldso.cab
info link:
info source: Patrick M. Kolla
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control)
DPF name:
CLSID name: BDSCANONLINE Control
Installer: C:\WINDOWS\Downloaded Program Files\oscan8.inf
Codebase: http://download.bitdefender.com/resources/scan8/oscan8.cab
description:
classification: Legitimate
known filename: oscan8.ocx
info link:
info source: Safer Networking Ltd.
Path: C:\WINDOWS\DOWNLO~1\
Long name: oscan8.ocx
Short name:
Date (created): 2006-06-01 01:54:16
Date (last access): 2009-01-16 16:49:26
Date (last write): 2006-06-01 01:54:16
Filesize: 471040
Attributes: archive
MD5: 9026F860148F0569BD92AEEFC4BDDFD7
CRC32: D1520CCE
Version: 1.0.0.1
{68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class)
DPF name:
CLSID name: MksSkanerOnline Class
Installer: C:\WINDOWS\Downloaded Program Files\SkanerOnline.inf
Codebase: http://www.mks.com.pl/skaner/SkanerOnline.cab
Path: C:\WINDOWS\system32\
Long name: SkanerOnline.dll
Short name: SKANER~1.DLL
Date (created): 2007-03-15 11:00:36
Date (last access): 2009-01-27 09:00:00
Date (last write): 2007-03-15 11:00:36
Filesize: 466432
Attributes: archive
MD5: C0B3292A8D1F42EC3C54630CCA9B8479
CRC32: 3AB2679A
Version: 2006.6.29.1
{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_05
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
description: Sun Java
classification: Legitimate
known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
info link:
info source: Patrick M. Kolla
Path: C:\Program Files\Java\jre1.6.0_05\bin\
Long name: npjpi160_05.dll
Short name: NPJPI1~1.DLL
Date (created): 2008-02-22 01:33:32
Date (last access): 2009-01-16 16:40:18
Date (last write): 2008-02-22 03:25:20
Filesize: 132496
Attributes: archive
MD5: 4FDFB86D78994BD71CBB779A7809E9CD
CRC32: 5A0EB880
Version: 6.0.50.13
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ()
DPF name:
CLSID name:
Installer: C:\WINDOWS\Downloaded Program Files\erma.inf
Codebase: http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
description:
classification: Open for discussion
known filename:
info link:
info source: Safer Networking Ltd.
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_05
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
Path: C:\Program Files\Java\jre1.6.0_05\bin\
Long name: npjpi160_05.dll
Short name: NPJPI1~1.DLL
Date (created): 2008-02-22 01:33:32
Date (last access): 2009-01-27 09:23:22
Date (last write): 2008-02-22 03:25:20
Filesize: 132496
Attributes: archive
MD5: 4FDFB86D78994BD71CBB779A7809E9CD
CRC32: 5A0EB880
Version: 6.0.50.13
--- Process list ---
PID: 0 ( 0) [System]
PID: 640 ( 4) \SystemRoot\System32\smss.exe
size: 50688
PID: 692 ( 640) \??\C:\WINDOWS\system32\csrss.exe
size: 6144
PID: 716 ( 640) \??\C:\WINDOWS\system32\winlogon.exe
size: 504832
PID: 760 ( 716) C:\WINDOWS\system32\services.exe
size: 108544
MD5: 3DA8D964D2CC12EF8E8C342471A37917
PID: 772 ( 716) C:\WINDOWS\system32\lsass.exe
size: 13312
MD5: F485FEFC8CC4FD29243D800BE5D275D1
PID: 936 ( 760) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: BA98327E90022DBD6EE76490E0622E2E
PID: 984 ( 760) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: BA98327E90022DBD6EE76490E0622E2E
PID: 1012 ( 760) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: BA98327E90022DBD6EE76490E0622E2E
PID: 1092 ( 760) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: BA98327E90022DBD6EE76490E0622E2E
PID: 1144 ( 760) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: BA98327E90022DBD6EE76490E0622E2E
PID: 1568 (1520) C:\WINDOWS\Explorer.EXE
size: 1033728
MD5: 379098A96E6C165B659DE7E4328010EA
PID: 1660 ( 760) C:\WINDOWS\system32\spoolsv.exe
size: 57856
MD5: BEBE8A85954FF460374FD5A0CD21E19B
PID: 1736 (1568) C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
size: 348160
MD5: 3311728B2E69F575C0154E378DF2A6D7
PID: 1792 (1568) D:\Program2\Wapster\AQQ\WapSter AQQ\AQQ.exe
size: 1656832
MD5: 4D787A13E3F70904B870F9332CAFF1A0
PID: 1800 (1568) C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe
size: 133104
MD5: 626A24ED1228580B9518C01930936DF9
PID: 456 (1568) C:\WINDOWS\system32\devldr32.exe
size: 24064
MD5: FDFD623A926E2B1AE5091E18556C41EE
PID: 588 ( 760) D:\Programy\nero\Nero 7\InCD\InCDsrv.exe
size: 859136
MD5: 90241FE389CD39D4C2D5CBE046449C3A
PID: 680 ( 760) C:\Program Files\CyberLink\Shared Files\RichVideo.exe
size: 167936
MD5: BD517C7FB119997EFFBE39D5E4B37B05
PID: 1328 ( 760) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: BA98327E90022DBD6EE76490E0622E2E
PID: 1368 ( 760) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
size: 49152
MD5: 332D341D92B933600D41953B08360DFB
PID: 1396 ( 760) C:\WINDOWS\system32\wdfmgr.exe
size: 38912
MD5: C81B8635DEE0D3EF5F64B3DD643023A5
PID: 1772 ( 760) C:\WINDOWS\System32\alg.exe
size: 44544
MD5: 9D12991BC6B6C5C0FBAB4C06E7073DF1
PID: 1076 (1012) C:\WINDOWS\system32\wscntfy.exe
size: 13824
MD5: 1905812AB06A70FF21907FAA10C927D6
PID: 3364 (1568) D:\Programy\Firefox2\firefox.exe
size: 307704
MD5: 8DA0A66CB74FCBB393038E37E0F691BA
PID: 2880 (1568) D:\Programy\Spybot - Search & Destroy\Spybot - Search & Destroy\SpybotSD.exe
size: 4891984
MD5: 9C8F0F34F66BB845B42F70E92A972B5F
PID: 4 ( 0) System
--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 2009-01-27 09:23:22
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
about:blank
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
%SystemRoot%\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://go.microsoft.com/fwlink/?LinkId=54896
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://go.microsoft.com/fwlink/?LinkId=69157
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://go.microsoft.com/fwlink/?LinkId=54896
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
--- Winsock Layered Service Provider list ---
Protocol 0: MSAFD Tcpip [TCP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 1: MSAFD Tcpip [UDP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 2: MSAFD Tcpip [RAW/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 3: RSVP UDP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 4: RSVP TCP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 5: MSAFD nwlnkipx [IPX]
GUID: {11058240-BE47-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP Novell Netware UPX protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD nwlnkipx *
Protocol 6: MSAFD nwlnkspx [SPX]
GUID: {11058241-BE47-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP Novell Netware SPX protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD nwlnkspx *
Protocol 7: MSAFD nwlnkspx [SPX] [Pseudo Stream]
GUID: {11058241-BE47-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP Novell Netware SPX protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD nwlnkspx *
Protocol 8: MSAFD nwlnkspx [SPX II]
GUID: {11058241-BE47-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP Novell Netware SPX protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD nwlnkspx *
Protocol 9: MSAFD nwlnkspx [SPX II] [Pseudo Stream]
GUID: {11058241-BE47-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP Novell Netware SPX protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD nwlnkspx *
Protocol 10: MSAFD NetBIOS [\Device\NwlnkNb] SEQPACKET 5
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 11: MSAFD NetBIOS [\Device\NwlnkNb] DATAGRAM 5
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 12: MSAFD NetBIOS [\Device\NetBT_Tcpip_{33D816A3-B64C-48A6-A438-338F277B26FD}] SEQPACKET 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 13: MSAFD NetBIOS [\Device\NetBT_Tcpip_{33D816A3-B64C-48A6-A438-338F277B26FD}] DATAGRAM 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 14: MSAFD NetBIOS [\Device\NetBT_Tcpip_{949FE7CD-0304-4CEA-A3C8-7AB2EFE3771D}] SEQPACKET 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 15: MSAFD NetBIOS [\Device\NetBT_Tcpip_{949FE7CD-0304-4CEA-A3C8-7AB2EFE3771D}] DATAGRAM 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 16: MSAFD NetBIOS [\Device\NetBT_Tcpip_{F00A3467-1223-43FB-951A-5E4C169627DC}] SEQPACKET 4
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 17: MSAFD NetBIOS [\Device\NetBT_Tcpip_{F00A3467-1223-43FB-951A-5E4C169627DC}] DATAGRAM 4
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 18: MSAFD NetBIOS [\Device\NetBT_Tcpip_{F53F4DBA-B68D-408F-BB14-4C741CF7F2B5}] SEQPACKET 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 19: MSAFD NetBIOS [\Device\NetBT_Tcpip_{F53F4DBA-B68D-408F-BB14-4C741CF7F2B5}] DATAGRAM 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 20: MSAFD NetBIOS [\Device\NetBT_Tcpip_{7D59CE3B-44E1-480E-99B5-12E10F480AD9}] SEQPACKET 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 21: MSAFD NetBIOS [\Device\NetBT_Tcpip_{7D59CE3B-44E1-480E-99B5-12E10F480AD9}] DATAGRAM 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Namespace Provider 0: TCP/IP
GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: TCP/IP
Namespace Provider 1: NTDS
GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}
Filename: %SystemRoot%\System32\winrnr.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\winrnr.dll
DB protocol: NTDS
Namespace Provider 2: Obszar nazw rozpoznawania lokalizacji w sieci (NLA)
GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: NLA-Namespace
Namespace Provider 3: Protokół transportowy zgodny z NWLink IPX/SPX/NetBIOS
GUID: {E02DAAF0-7E9F-11CF-AE5A-00AA00A7112B}
Filename: %SystemRoot%\System32\nwprovau.dll
Description: Microsoft Windows NT/2k/XP Novell Netware name space provider
DB filename: %SystemRoot%\system32\nwprovau.dll
DB protocol: NWLink IPX/SPX/NetBIOS*
pozdrawiam,
.
oraz skasuj folder C:\
:
. Teraz, mam nowego dostawcę Internetu i niestety ten sam problem.
