Trojan Kavos - dzięki za pomoc w wywaleniu drania :) pozdro

[MarrgoM]

ComboFix 09-02-26.02 - SanczoPanczo 2009-02-27 22:05:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.502.243 [GMT 1:00]
Uruchomiony z: c:\documents and settings\SanczoPanczo\Pulpit\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090227-0] *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\2fiy.bat
C:\autorun.inf
c:\windows\system32\olhrwef.exe
D:\2fiy.bat
D:\Autorun.inf
E:\2fiy.bat
E:\Autorun.inf

.
((((((((((((((((((((((((( Pliki utworzone od 2009-01-27 do 2009-02-27 )))))))))))))))))))))))))))))))
.

2009-02-27 21:56 . 2009-02-27 21:56 <DIR> d-------- c:\program files\Mozilla Firefox 3.1 Beta 2
2009-02-27 21:56 . 2009-02-27 21:56 0 --a------ c:\windows\nsreg.dat
2009-02-27 21:47 . 2009-02-27 21:47 940,794 --a------ c:\windows\system32\LoopyMusic.wav
2009-02-27 21:47 . 2009-02-27 21:47 146,650 --a------ c:\windows\system32\BuzzingBee.wav
2009-02-27 21:46 . 2009-02-27 21:46 <DIR> d-------- c:\windows\system32\Lang
2009-02-27 21:45 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-02-27 21:45 . 2004-08-03 23:08 31,616 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2009-02-27 21:45 . 2001-10-26 16:57 12,160 --a------ c:\windows\system32\drivers\mouhid.sys
2009-02-27 21:45 . 2001-10-26 16:57 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys
2009-02-27 21:45 . 2001-08-17 22:02 9,600 --a------ c:\windows\system32\drivers\hidusb.sys
2009-02-27 21:45 . 2001-08-17 22:02 9,600 --a--c--- c:\windows\system32\dllcache\hidusb.sys
2009-02-27 21:44 . 2009-02-27 21:44 <DIR> d-------- C:\Intel
2009-02-27 21:42 . 2009-02-27 21:42 <DIR> d-------- c:\windows\system32\RTCOM
2009-02-27 21:41 . 2009-02-27 21:41 <DIR> d-------- c:\program files\Realtek
2009-02-27 21:41 . 2009-02-27 21:41 <DIR> d-------- c:\program files\Common Files\InstallShield
2009-02-27 21:41 . 2007-05-29 06:32 16,132,608 --a------ c:\windows\RTHDCPL.exe
2009-02-27 21:41 . 2007-03-24 09:19 9,715,200 --a------ c:\windows\RTLCPL.exe
2009-02-27 21:41 . 2007-05-31 10:04 4,424,192 --a------ c:\windows\system32\drivers\RtkHDAud.sys
2009-02-27 21:41 . 2006-05-05 06:26 2,808,832 --a------ c:\windows\alcwzrd.exe
2009-02-27 21:41 . 2007-04-26 06:55 2,162,688 --a------ c:\windows\MicCal.exe
2009-02-27 21:41 . 2007-05-29 10:39 1,826,816 --a------ c:\windows\SkyTel.exe
2009-02-27 21:41 . 2007-01-17 00:39 1,191,936 --a------ c:\windows\RtlUpd.exe
2009-02-27 21:41 . 2007-01-13 06:54 520,192 --a------ c:\windows\RtlExUpd.dll
2009-02-27 21:41 . 2005-09-22 00:25 299,008 --a------ c:\windows\system32\ALSndMgr.cpl
2009-02-27 21:41 . 2006-08-18 20:58 282,624 --a------ c:\windows\system32\RTSndMgr.cpl
2009-02-27 21:41 . 2006-07-22 06:14 86,016 --a------ c:\windows\SoundMan.exe
2009-02-27 21:41 . 2005-05-04 08:43 69,632 --a------ c:\windows\Alcmtr.exe
2009-02-27 21:38 . 2009-02-27 21:38 <DIR> d-------- c:\program files\Fingerprint Sensor
2009-02-27 21:35 . 2009-02-27 21:35 <DIR> d-------- c:\documents and settings\LocalService\Menu Start
2009-02-27 21:34 . 2009-02-27 21:34 <DIR> d---s---- c:\windows\system32\Microsoft
2009-02-27 21:26 . 2009-02-27 21:26 <DIR> d-------- c:\windows\ServicePackFiles
2009-02-27 21:21 . 2004-11-18 10:42 22,752 --a------ c:\windows\system32\spupdsvc.exe
2009-02-27 21:21 . 2004-07-17 11:40 19,528 --a------ c:\windows\002247_.tmp
2009-02-27 21:19 . 2009-02-27 21:28 <DIR> d-------- c:\windows\EHome
2009-02-27 19:14 . 2009-02-27 21:48 <DIR> d-------- c:\windows\system32\FTCOMModule
2009-02-27 19:14 . 2004-06-10 16:20 40,960 --a------ c:\windows\system32\FTRTSVC.exe
2009-02-27 19:14 . 2005-10-06 15:27 36,864 --a------ c:\windows\system32\IfHelper.dll
2009-02-27 19:13 . 2006-05-29 10:52 19,328 --a------ c:\windows\system32\drivers\gtscser.sys
2009-02-27 19:13 . 2006-05-29 10:52 8,064 --a------ c:\windows\system32\drivers\gtptser.sys
2009-02-27 19:13 . 2006-05-29 10:52 5,120 --a------ c:\windows\system32\drivers\GtVUsb.sys
2009-02-27 19:12 . 2009-02-27 22:06 <DIR> d-------- c:\program files\OrangeBs
2009-02-27 18:55 . 2009-02-27 18:55 <DIR> d-------- c:\program files\Common Files\Adobe
2009-02-27 18:54 . 2009-02-27 19:11 <DIR> d-------- c:\program files\FranceTelecomUninstall
2009-02-27 18:54 . 2003-08-04 14:22 94,208 --a------ c:\windows\system32\W32n50.dll
2009-02-27 18:54 . 2003-08-04 14:22 16,128 --------- c:\windows\system32\PCANDIS5.SYS
2009-02-27 18:53 . 2006-05-29 10:52 112,000 --a------ c:\windows\system32\drivers\Gtm51Irp.sys
2009-02-27 18:53 . 2006-05-29 10:52 25,344 --a------ c:\windows\system32\drivers\gtmmdmusb.sys
2009-02-27 18:53 . 2006-05-29 10:52 21,760 --a------ c:\windows\system32\drivers\gtmserusb.sys
2009-02-27 18:53 . 2006-05-29 10:52 16,128 --a------ c:\windows\system32\drivers\gtffbus.sys
2009-02-27 18:39 . 2009-02-27 21:47 1,734 --a------ c:\windows\system32\TRJ_NTAUTO.TMP

.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-27 20:44 --------- d-----w c:\program files\Intel
2009-02-27 20:41 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-26 22:35 --------- d-----w c:\program files\Trojan Remover
2009-02-26 22:25 315,392 ----a-w c:\windows\HideWin.exe
2009-02-26 22:25 --------- d-----w c:\documents and settings\SanczoPanczo\Dane aplikacji\InstallShield
2009-02-26 21:55 --------- d-----w c:\program files\Alwil Software
2009-02-26 21:48 --------- d-----w c:\program files\microsoft frontpage
2009-02-26 21:46 --------- d-----w c:\program files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2006-01-02 295936]
"OBSWATCH"="c:\progra~1\OrangeBs\Watch.exe" [2005-09-07 20480]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-12 53248]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-29 c:\windows\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-26 114768]
R3 GTFFBUS;GT FF BUS;c:\windows\system32\drivers\gtffbus.sys [2009-02-27 16128]
R3 GTMMDMUSB;GT M 3G+ USB MDM;c:\windows\system32\drivers\gtmmdmusb.sys [2009-02-27 25344]
R3 GTMNDISIRPXP;GT M 3G+ IRP NDIS;c:\windows\system32\drivers\Gtm51Irp.sys [2009-02-27 112000]
R3 GTMSERUSB;GT M 3G+ USB SER;c:\windows\system32\drivers\gtmserusb.sys [2009-02-27 21760]
R3 GTPTSER;GT PT SER;c:\windows\system32\drivers\gtptser.sys [2009-02-27 8064]
R3 GTSCSER;GT SC SER;c:\windows\system32\drivers\gtscser.sys [2009-02-27 19328]
S3 GtVUsb;GlobeTrotter 3G+ Viper Filter Service;c:\windows\system32\drivers\GtVUsb.sys [2009-02-27 5120]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKCU-Run-cdoosoft - c:\windows\system32\olhrwef.exe


.
------- Skan uzupełniający -------
.
FF - ProfilePath - c:\documents and settings\SanczoPanczo\Dane aplikacji\Mozilla\Firefox\Profiles\vtq4zl6p.default\

---- FIREFOX - SPOSÓB POSTĘPOWANIA ----
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-27 22:06:49
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]
@Denied: (Full) (LocalSystem)
"OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd
.
Czas ukończenia: 2009-02-27 22:07:31
ComboFix-quarantined-files.txt 2009-02-27 21:07:26

Przed: 11,244,699,648 bajtów wolnych
Po: 11,244,699,648 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

149