Zaloguj się
Rejestracja
Pomoc
Ten temat jest zamknięty
Logi z HiJack'a:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:31:24, on 2010-05-25
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Vista Drive Icon\DrvIcon.exe
C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\DCSHost.exe
C:\Program Files\Tele2 Mobile Partner\Tele2 Mobile Partner.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Documents and Settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Webmaster\Pulpit\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xpblackedition.ubf.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - S-1-5-18 Startup: Styler.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: Styler.lnk = ? (User 'Default user')
O4 - .DEFAULT User Startup: Styler.lnk = ? (User 'Default user')
O4 - Startup: Styler.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.ad...Plus/1.6/gp.cab
O23 - Service: Usługa bramy warstwy aplikacji (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: DCSHost.exe - Unknown owner - C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\DCSHost.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 4184 bytes
Logi z ComboFix'a:
ComboFix 10-05-24.07 - Webmaster 2010-05-25 15:33:45.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1014.603 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Webmaster\Pulpit\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\midimap.dll . . . jest zainfekowany!!
.
((((((((((((((((((((((((( Pliki utworzone od 2010-04-25 do 2010-05-25 )))))))))))))))))))))))))))))))
.
2010-05-25 13:15 . 2010-05-25 13:16 -------- d-----w- c:\documents and settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Temp
2010-05-25 13:15 . 2010-05-25 13:16 -------- d-----w- c:\documents and settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Google
2010-05-25 13:13 . 2010-05-25 13:13 1956656 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-05-25 13:13 . 2010-05-25 13:25 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NOS
2010-05-25 12:55 . 2010-05-25 12:55 -------- d-sh--w- c:\documents and settings\Webmaster\PrivacIE
2010-05-25 12:52 . 2008-04-13 17:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-05-25 12:49 . 2008-04-14 22:51 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-05-25 12:46 . 2010-05-25 13:35 -------- d--h--r- c:\windows\system32\config\systemprofile\Ustawienia lokalne
2010-05-25 10:02 . 2001-08-17 20:59 3072 ----a-w- c:\windows\system32\drivers\audstub.sys
2010-05-25 10:02 . 2008-04-14 16:05 58880 ----a-w- c:\windows\system32\drivers\redbook.sys
2010-05-25 10:01 . 2001-08-17 20:46 6400 ----a-w- c:\windows\system32\drivers\enum1394.sys
2010-05-25 10:01 . 2008-04-13 18:36 10240 ----a-w- c:\windows\system32\drivers\compbatt.sys
2010-05-25 10:01 . 2008-04-13 18:36 13952 ----a-w- c:\windows\system32\drivers\CmBatt.sys
2010-05-25 10:01 . 2008-04-13 18:36 14208 ----a-w- c:\windows\system32\drivers\battc.sys
2010-05-25 10:01 . 2008-04-14 17:20 77312 ----a-w- c:\windows\system32\usbui.dll
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-25 12:54 . 2010-05-25 12:53 -------- d-----w- c:\program files\Tele2 Mobile Partner
2010-05-25 12:54 . 2010-05-25 12:53 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\DatacardService
2010-05-25 12:53 . 2010-05-25 12:53 -------- d-----w- c:\documents and settings\Webmaster\Dane aplikacji\Notepad++
2010-05-25 12:46 . 2010-05-25 08:19 -------- d-----w- c:\program files\winxpbe
2010-05-25 08:23 . 2010-05-25 12:46 205432 ----a-w- c:\windows\system32\config\systemprofile\_inst6.exe
2010-05-25 08:22 . 2010-05-25 08:22 -------- d-----w- c:\program files\MSXML 4.0
2010-05-25 08:21 . 2010-05-25 12:48 9240 ----a-w- c:\documents and settings\Webmaster\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2010-05-25 08:21 . 2010-05-25 12:46 9240 ----a-w- c:\windows\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2010-05-25 08:21 . 2010-05-25 08:21 9240 ----a-w- c:\documents and settings\Default User\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2010-05-25 08:21 . 2010-05-25 08:21 -------- d-----w- c:\program files\Thief Of Pyramid
2010-05-25 08:21 . 2010-05-25 08:20 -------- d-----w- c:\program files\Mario Forever
2010-05-25 08:19 . 2010-05-25 08:19 -------- d-----w- c:\program files\Vista Drive Icon
2010-05-25 08:19 . 2010-05-25 08:19 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-05-25 08:19 . 2010-05-25 12:46 186795 ----a-w- c:\windows\system32\config\systemprofile\_inst2.exe
2010-05-25 08:19 . 2010-05-25 12:46 90323 ----a-w- c:\windows\system32\config\systemprofile\_inst1.exe
2010-05-25 08:19 . 2010-05-25 08:19 -------- d-----w- c:\program files\System
2010-05-25 08:19 . 2001-10-26 19:15 87442 ----a-w- c:\windows\system32\perfc015.dat
2010-05-25 08:19 . 2001-10-26 19:15 497824 ----a-w- c:\windows\system32\perfh015.dat
2010-05-25 08:18 . 2010-05-25 08:19 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-05-25 08:18 . 2010-05-25 08:18 -------- d-----w- c:\program files\Java
2010-05-25 08:13 . 2010-05-25 08:13 2272 ----a-w- c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat
2010-05-25 08:12 . 2010-05-25 08:12 -------- d-----w- c:\program files\MSBuild
2010-05-25 08:12 . 2010-05-25 08:12 -------- d-----w- c:\program files\Reference Assemblies
2010-05-25 08:07 . 2010-05-25 08:07 -------- d-----w- c:\program files\Usługi online
2010-05-25 08:05 . 2010-05-25 08:05 21856 ----a-w- c:\windows\system32\emptyregdb.dat
2010-05-25 08:04 . 2010-05-25 08:04 -------- d-----w- c:\program files\Windows Media Connect 2
.
------- Sigcheck -------
[-] 2010-01-17 . 1F39C7BDBA4C5F3F01C4EABF7EDBF4B3 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[-] 2010-01-17 . 335813EACD16E84F3047A3326F6E5473 . 549888 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2010-01-17 . 02D7CEB05E0118EB592208354C21D821 . 724992 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2009-09-12 . 1E259C2EBA74C4BF719ECB02286F3F38 . 2286592 . . [5.1.2600.5755] . . c:\windows\system32\ntoskrnl.exe
[-] 2009-06-26 . 946665FA0CC98F57E1023CD21F149D8B . 642560 . . [5.1.2600.3099] . . c:\windows\system32\user32.dll
[-] 2009-12-09 . A9BD5F368966EA709A4BFF992F583F07 . 1705984 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-25 . C8BDAD4065118558B3DC360FC96D81DB . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[-] 2009-09-12 . AAED7AA4AC229C3FD2347DB2E8B942B2 . 2165248 . . [5.1.2600.5755] . . c:\windows\system32\ntkrnlpa.exe
c:\windows\System32\ctfmon.exe ... - brak elementu
.
((((((((((((((((((((((((((((( SnapShot@2010-05-25_13.06.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-25 12:57 . 2010-05-25 13:14 84507 c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2010-05-25 136176]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvIcon"="c:\program files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 49152]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"_nltide_3"="advpack.dll" [2009-03-08 128512]
c:\windows\system32\config\systemprofile\Menu Start\Programy\Autostart\
Styler.lnk - c:\documents and settings\Webmaster\Dane aplikacji\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2010-5-25 15086]
c:\documents and settings\Default User\Menu Start\Programy\Autostart\
Styler.lnk - c:\documents and settings\Webmaster\Dane aplikacji\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2010-5-25 15086]
c:\documents and settings\Webmaster\Menu Start\Programy\Autostart\
Styler.lnk - c:\documents and settings\Webmaster\Dane aplikacji\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2010-5-25 15086]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
R2 DCSHost.exe;DCSHost.exe;c:\documents and settings\All Users\Dane aplikacji\DatacardService\DCSHOST.exe [2010-05-25 110592]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2010-05-25 112640]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [2010-05-25 102656]
--- Inne Usługi/Sterowniki w Pamięci ---
*NewlyCreated* - BITS
*NewlyCreated* - DCSHOST.EXE
*NewlyCreated* - FLTMGR
*NewlyCreated* - IMAPISERVICE
*NewlyCreated* - LANMANSERVER
*NewlyCreated* - NDISUIO
*NewlyCreated* - POLICYAGENT
*NewlyCreated* - RASACD
*NewlyCreated* - RDPCDD
*NewlyCreated* - RDPNP
*NewlyCreated* - SCHEDULE
*NewlyCreated* - SENS
*NewlyCreated* - SHELLHWDETECTION
*NewlyCreated* - SR
*NewlyCreated* - SRSERVICE
*NewlyCreated* - SRV
*NewlyCreated* - TERMSERVICE
*NewlyCreated* - THEMES
*NewlyCreated* - WZCSVC
.
Zawartość folderu 'Zaplanowane zadania'
2010-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-484763869-1417001333-1002Core.job
- c:\documents and settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2010-05-25 13:15]
2010-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-484763869-1417001333-1002UA.job
- c:\documents and settings\Webmaster\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2010-05-25 13:15]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.xpblackedition.ubf.pl/
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-25 15:35
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(484)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(544)
c:\windows\system32\setupapi.dll
c:\windows\system32\scecli.dll
c:\windows\system32\psbase.dll
- - - - - - - > 'explorer.exe'(3252)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\WININET.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\LINKINFO.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Czas ukończenia: 2010-05-25 15:36:15
ComboFix-quarantined-files.txt 2010-05-25 13:36
ComboFix2.txt 2010-05-25 13:07
Przed: 75 766 857 728 bajtów wolnych
Po: 75 778 179 072 bajtów wolnych
- - End Of File - - E637B8DA1C4EA752E82082DCCDC4FC4D
Z góry dziękuję za pomoc!
