prosze o sprawdzenie loga

[Fidelo]

anty vir swiruje, jakis wlam mialem na kompa czy cos takiego... skanowalem ale bez wiekszych efektow

Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 15:53:09, on 2007-10-17
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\AVENGINE.EXE
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsImSvc.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
c:\program files\panda software\panda antivirus + firewall 2007\WebProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Łukasz\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\SsAAD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsImSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe

[/qupte]

SilentRunner:


takie cos wskoczylo i nie wiem jak to naprawic

[wojtas]

anty vir swiruje,

wykrywa CI cos daj screeny

oraz log z combofixa

[Fidelo]

COmboFix:

ComboFix 07-10-17.8 - ťukasz 2007-10-17 19:48:07.1 - NTFSx86
Running from: C:\Documents and Settings\Adrian\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\version.txt
C:\WINDOWS\system32\2.tmp

.
((((((((((((((((((((((((( Files Created from 2007-09-17 to 2007-10-17 )))))))))))))))))))))))))))))))
.

2007-10-17 19:47 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-17 15:47 <DIR> d--h----- C:\WINDOWS\PIF
2007-10-14 16:34 <DIR> d-------- C:\Program Files\BitComet
2007-10-14 16:11 <DIR> d-------- C:\Program Files\Azureus
2007-10-14 16:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus
2007-10-12 14:41 <DIR> d-------- C:\Downloads
2007-10-12 14:17 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\AdobeUM
2007-10-03 21:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MSN6
2007-10-03 21:04 <DIR> d-------- C:\Documents and Settings\Adrian\Dane aplikacji\MSN6
2007-09-25 21:47 <DIR> d-------- C:\Program Files\Hamachi
2007-09-25 21:47 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2007-09-21 11:15 <DIR> d-------- C:\Program Files\OMGKEY
2007-09-21 11:15 <DIR> d-------- C:\Documents and Settings\Adrian\LocalCDInfo
2007-09-19 17:48 <DIR> d-------- C:\Program Files\Hide IP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-17 17:46 1,172 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG
2007-10-17 17:44 --------- d-----w C:\Program Files\Gadu-Gadu
2007-10-17 17:44 --------- d-----w C:\Program Files\FlashGet
2007-10-17 17:43 308,656 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT
2007-10-17 16:23 --------- d-----w C:\Program Files\Winamp
2007-10-17 15:42 4,194,304 ---ha-w C:\Documents and Settings\Łukasz\NTUSER.DAT
2007-10-14 20:47 --------- d-----w C:\Program Files\NAPI-PROJEKT
2007-10-14 15:52 --------- d-----w C:\Program Files\Java
2007-10-14 14:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-13 21:12 --------- d-----w C:\Program Files\MoorHunt
2007-10-09 15:26 --------- d-----w C:\Program Files\PhotoFiltre
2007-10-07 16:54 --------- d-----w C:\Program Files\Picasa2
2007-10-02 15:24 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-10-02 15:24 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-09-30 09:58 --------- d-----w C:\Program Files\RegCleaner
2007-09-28 20:26 --------- d-----w C:\Program Files\IrfanView
2007-09-28 10:48 --------- d-----w C:\Program Files\MyPortal
2007-09-28 05:29 --------- d-----w C:\Program Files\Google
2007-09-24 08:22 --------- d-----w C:\Program Files\Napisy
2007-09-21 09:15 672 ----a-w C:\Program Files\omglog.txt
2007-09-21 09:15 0 ----a-w C:\Program Files\omgii.lck
2007-09-05 12:16 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\Tibia
2007-09-04 18:54 --------- d-----w C:\Program Files\QuickTime
2007-08-31 18:04 --------- d-----w C:\Program Files\PC Connectivity Solution
2007-08-25 11:54 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2007-08-24 09:08 --------- d-----w C:\Documents and Settings\Adrian\Dane aplikacji\InstallShield
2007-08-23 10:37 --------- d--h--w C:\Program Files\Zero G Registry
2007-08-20 21:22 81,920 ----a-w C:\Program Files\5C4.tmp
2007-08-20 14:04 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-08-02 10:29 5,018 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2006-01-07 01:36 81,920 ----a-w C:\Program Files\SSAAD.exe
2006-01-07 00:37 25,600 ----a-w C:\Program Files\SsVerChk.ocx
2006-01-07 00:34 65,536 ----a-w C:\Program Files\StdoutSs2.ax
2006-01-07 00:33 53,248 ----a-w C:\Program Files\SonyWavParser2.ax
2006-01-07 00:29 720,896 ----a-w C:\Program Files\Omgbkup.exe
2006-01-07 00:19 192,512 ----a-w C:\Program Files\Ojbsir.exe
2006-01-07 00:16 110,592 ----a-w C:\Program Files\AppReg.exe
2006-01-07 00:08 5,541,888 ----a-w C:\Program Files\Omgjbox.exe
2006-01-06 23:00 65,536 ----a-w C:\Program Files\XPanel.dll
2006-01-06 22:59 20,480 ----a-w C:\Program Files\GenMediaKey.dll
2006-01-06 22:58 81,920 ----a-w C:\Program Files\DMPInternet.dll
2006-01-06 22:57 13,312 ----a-w C:\Program Files\WtsNotify.dll
2006-01-06 22:56 806,912 ----a-w C:\Program Files\Si.dll
2006-01-06 22:56 57,344 ----a-w C:\Program Files\SsTpl.dll
2006-01-06 22:48 413,696 ----a-w C:\Program Files\Items.dll
2006-01-06 22:48 32,768 ----a-w C:\Program Files\HelpHelper.dll
2006-01-06 22:45 49,152 ----a-w C:\Program Files\SsProxy.dll
2006-01-06 22:43 65,536 ----a-w C:\Program Files\SsEncWma.dll
2006-01-06 22:43 380,928 ----a-w C:\Program Files\SsEncMp3.dll
2006-01-06 22:41 131,072 ----a-w C:\Program Files\SsMtp.dll
2006-01-06 22:39 192,512 ----a-w C:\Program Files\RGraph.dll
2006-01-06 22:36 102,400 ----a-w C:\Program Files\RBasis.dll
2006-01-06 20:34 360,448 ----a-w C:\Program Files\OMG2OMA.exe
2006-01-06 20:32 16,896 ----a-w C:\Program Files\XThumbnail.dll
2006-01-06 20:25 12,800 ----a-w C:\Program Files\Lam.dll
2006-01-06 20:23 180,224 ----a-w C:\Program Files\Omg1to2.exe
2005-12-14 11:54 135,168 ----a-w C:\Program Files\SsMidAccess.dll
2005-12-14 10:44 81,920 ----a-w C:\Program Files\Cddb2Access.dll
2005-11-21 05:50 143,360 ----a-w C:\Program Files\OmgbkupRes.dll
2005-11-21 05:43 139,264 ----a-w C:\Program Files\OjbSirRes.dll
2005-11-21 04:38 925,696 ----a-w C:\Program Files\OmgjboxRes.dll
2005-11-21 03:36 155,648 ----a-w C:\Program Files\OMG2OMARes.dll
2005-11-21 03:29 3,584 ----a-w C:\Program Files\Omg1to2Res.dll
2005-10-24 14:39 7,350 ----a-w C:\Program Files\Readme.txt
2005-08-25 07:10 81,920 ----a-w C:\Program Files\SonyFsConvFilter.ax
2005-03-21 19:30 499,712 ----a-w C:\Program Files\msvcp71.dll
2005-03-21 19:30 348,160 ----a-w C:\Program Files\msvcr71.dll
2005-03-21 19:30 106,496 ----a-w C:\Program Files\atl71.dll
2005-03-21 19:30 1,060,864 ----a-w C:\Program Files\mfc71.dll
2005-03-21 18:34 352,256 ----a-w C:\Program Files\ijl15.dll
2005-03-21 18:30 7 ----a-w C:\Program Files\initials.ini
2005-03-21 18:30 65,536 ----a-w C:\Program Files\JETCOMP.exe
2005-03-21 18:30 143,360 ----a-w C:\Program Files\dunzip32.dll
2001-11-23 04:08 712,704 ----a-r C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"APVXDWIN"="C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.exe" [2006-09-13 09:59]
"SsAAD.exe"="C:\PROGRA~1\SsAAD.exe" [2006-01-07 03:36]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-23 14:00]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 11:18]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
"Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2005-09-27 13:13 45056 C:\WINDOWS\system32\avldr.dll


*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {3CBBEE47-C8F4-316A-92FF-ED7E3DFAE41E} /qb
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-17 19:50:24
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-17 19:51:08
.
--- E O F ---

antywir wyskakuje ze znaleziono i zneutralozowano jakies tam pliki, jak wyskoczy to zrobie screena.

[wojtas]

ok czekamy na screena