Hello guys. Today my friend posted on my facebook board a post with a link. He is doing it regulary so i didn't expect anything bad to happen. After i click thet link nothing happens and i relised thet the post was a spam and i probably instaled a trojan on my pc. I made a skan with Spybot:s&d and it showed a trojan called "bredolab.fb". I click "fix the problem" and make a second scan. Spybot didn't find anything els. My anti virus didnt show anything as well. I made a full scan with Malwarebytes Anti-Malware and it didnt show anything as well. But my facebook profile is still posting the link with trojan on others people boards. Probably the trojan is still on my pc and i would like to fix the problem. I am asking for help, becouse i have no idea what I can do now.
Hi Youfie,
My name is
NoodleTech . I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer. The fixes are specific to your problem and should only be used for the issues on this machine. Do not delete anything unless instructed to. DO NOT use tools such as ComboFix without supervision. Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic. Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.===================================================
Please download DDS by sUBs from one of the following links and save it to your desktop.
Disable any script blocking protection (How to Disable your Security Programs ) Double click DDS icon to run the tool (may take up to 3 minutes to run) When done, DDS.txt will open. After a few moments, attach.txt will open in a second window. Save both reports to your desktop. —————————————————
Post DDS.txt report in your next replyAttach Attach.txt Attachments area and then clicking Browse . Browse to where you saved the file, and click Open and then click UPLOAD .
Hello NoodleTech. Thanks for your replay. Here is what you asked me.
DDS logs:
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_27
Run by [removed] at 12:16:13 on 2012-06-18
Microsoft Windows 7 Home Basic 6.1.7601.1.1250.48.1045.18.3327.2424 [GMT 2:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k Akamai
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Giraffic\Veoh_GirafficWatchdog.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Giraffic\Veoh_Giraffic.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
D:\Programy\Office 2007\Office12\GrooveMonitor.exe
D:\Programy\Razer Imperator\RazerImperatorTray.exe
D:\Programy\Razer Sc2\RazerStarCraftIISysTray.exe
D:\Programy\Winamp\winampa.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Microsoft Security Client\msseces.exe
D:\Programy\DAEMON Tools Lite\DTLite.exe
C:\Users\Krystian\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\VeohWebPlayer.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Users\Krystian\AppData\Local\Akamai\netsession_win.exe
C:\Users\Krystian\AppData\Local\Akamai\netsession_win.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Users\Krystian\AppData\Local\yjyxue.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
D:\Programy\Winamp\winamp.exe
C:\Windows\system32\AUDIODG.EXE
D:\Programy\Firefox\firefox.exe
D:\Programy\Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://domredi.com/1/
uInternet Settings,ProxyOverride = 127.0.0.1:9421;
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - d:\programy\office 2007\office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\programy\java jd\bin\jp2ssv.dll
BHO: IEPluginBHO Class: {f5cc7f02-6f4e-4462-b5b1-394a57fd3e0d} - c:\programdata\gadu-gadu 10\_userdata\ggbho.2.dll
uRun: [DAEMON Tools Lite] "d:\programy\daemon tools lite\DTLite.exe" -autorun
uRun: [Octoshape Streaming Services] "c:\users\krystian\appdata\roaming\octoshape\octoshape streaming services\OctoshapeClient.exe" -inv:bootrun
uRun: [VeohPlugin] "c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe"
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [Akamai NetSession Interface] "c:\users\krystian\appdata\local\akamai\netsession_win.exe"
uRun: [Steam] "d:\programy\steam\steam.exe" -silent
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [aumgnvi] c:\users\krystian\appdata\local\yjyxue.exe
mRun: [GrooveMonitor] "d:\programy\office 2007\office12\GrooveMonitor.exe"
mRun: [Razer Imperator Driver] d:\programy\razer imperator\RazerImperatorTray.exe
mRun: [Razer StarcraftII Driver] d:\programy\razer sc2\RazerStarCraftIISysTray
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [WinampAgent] d:\programy\winamp\winampa.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "d:\programy\adobe\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
StartupFolder: c:\users\krystian\appdata\roaming\microsoft\windows\start menu\programs\startup\CurseClientStartup.ccip
StartupFolder: c:\users\krystian\appdata\roaming\microsoft\windows\start menu\programs\startup\wwopi.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&ksportuj do programu Microsoft Excel - d:\programy\office~1\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - d:\programy\office~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\programy\office~1\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.100
TCP: Interfaces\{8145D2CA-91D9-47D8-B2E3-F3AA813EBFDE} : DhcpNameServer = 192.168.1.100
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - d:\programy\office 2007\office12\GrooveSystemServices.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - d:\programy\office 2007\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\krystian\appdata\roaming\mozilla\firefox\profiles\25k4ksdb.default\
FF - prefs.js: browser.startup.homepage - www.gogle.com
FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordlegacyext.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\programdata\gadu-gadu 10\_userdata\npgg.3.dll
FF - plugin: c:\users\krystian\appdata\roaming\mozilla\plugins\npoctoshape.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_257.dll
FF - plugin: c:\windows\system32\wat\npWatWeb.dll
FF - plugin: d:\programy\adobe\reader\air\nppdf32.dll
FF - plugin: d:\programy\adobe\reader\browser\nppdf32.dll
FF - plugin: d:\programy\firefox\plugins\npdeployJava1.dll
FF - plugin: d:\programy\firefox\plugins\npijjiautoinstallpluginff.dll
FF - plugin: d:\programy\java jd\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\programy\java jd\bin\new_plugin\npjp2.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 171064]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2009-7-14 20992]
R2 Giraffic;Veoh Giraffic Video Accelerator;c:\program files\giraffic\veoh_girafficwatchdog.exe –service –> c:\program files\giraffic\Veoh_GirafficWatchdog.exe –service [?]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-2-12 654408]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-2-22 2348352]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2012-5-15 382272]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-2-12 22344]
R3 RTL8167;Sterownik Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-6-10 139776]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2012-4-3 14216]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2012-4-3 8456]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-25 113120]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 74112]
S3 NisSrv;Inspekcja sieci firmy Microsoft;c:\program files\microsoft security client\NisSrv.exe [2012-3-26 214952]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-7-2 52224]
S3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\wat\WatAdminSvc.exe [2010-9-9 1343400]
.
=============== Created Last 30 ================
.
2012-06-17 14:27:40 119300 –s—r- c:\users\krystian\appdata\local\yjyxue.exe
2012-06-17 14:27:39 119300 –s—r- c:\users\krystian\appdata\roaming\microsoft\windows\start menu\programs\startup\wwopi.exe
2012-06-17 13:02:29 6737808 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{5f9c4571-5e92-4425-a829-da69da2b33f2}\mpengine.dll
2012-06-16 22:13:48 ——– d—–w- c:\users\krystian\appdata\local\SWTOR
2012-06-16 13:38:12 6737808 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-06-14 10:42:53 ——– d—–w- c:\users\krystian\appdata\local\Macromedia
2012-06-14 04:00:35 ——– d—–w- c:\windows\rescache
2012-06-13 03:51:01 183808 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-13 01:37:40 713784 ——w- c:\programdata\microsoft\microsoft antimalware\definition updates\{8750db41-615b-408a-9cd9-654d14384345}\gapaengine.dll
2012-06-06 14:14:28 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-25 17:31:06 ——– d—–w- c:\users\krystian\appdata\roaming\LolClient2
2012-05-23 09:13:55 645440 —-a-w- c:\windows\system32\nvvsvc.exe
2012-05-23 09:13:55 62272 —-a-w- c:\windows\system32\nvshext.dll
2012-05-23 09:13:55 2719040 —-a-w- c:\windows\system32\nvsvc.dll
2012-05-23 09:13:55 2561344 —-a-w- c:\windows\system32\nvsvcr.dll
2012-05-23 09:13:54 3881792 —-a-w- c:\windows\system32\nvcpl.dll
2012-05-23 09:13:54 108352 —-a-w- c:\windows\system32\nvmctray.dll
.
==================== Find3M ====================
.
2012-06-14 10:39:52 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-15 03:03:54 981504 —-a-w- c:\windows\system32\wininet.dll
2012-05-15 01:05:38 2343936 —-a-w- c:\windows\system32\win32k.sys
2012-05-15 00:21:50 423744 —-a-w- c:\windows\system32\nvStreaming.exe
2012-05-01 04:44:12 164352 —-a-w- c:\windows\system32\profsvc.dll
2012-04-26 04:45:55 58880 —-a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 04:45:54 129536 —-a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 04:41:16 8192 —-a-w- c:\windows\system32\rdrmemptylst.exe
2012-04-24 04:36:42 140288 —-a-w- c:\windows\system32\cryptsvc.dll
2012-04-24 04:36:42 1158656 —-a-w- c:\windows\system32\crypt32.dll
2012-04-24 04:36:42 103936 —-a-w- c:\windows\system32\cryptnet.dll
2012-04-20 03:16:44 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2012-04-07 11:26:29 2342400 —-a-w- c:\windows\system32\msi.dll
2012-04-04 13:56:40 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-03-31 04:39:37 3968368 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-31 04:39:37 3913072 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-03-30 10:23:11 1291632 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-03-20 18:44:12 74112 —-a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-03-20 18:44:12 171064 —-a-w- c:\windows\system32\drivers\MpFilter.sys
.
============= FINISH: 12:16:41,29 ===============
Hi Youfie,
Please do the following
Refer to the
ComboFix User's Guide Download ComboFix from one of these locations:Link 1 Link 2 * IMPORTANT !!! Place ComboFix.exe on your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.here Double click on ComboFix.exe & follow the prompts. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next replyNote: Ensure your AntiVirus and AntiSpyware applications are re-enabled. NOTE: If you encounter a message
"illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
Here is the log from combofix.
ComboFix 12-06-16.02 - Krystian 2012-06-18 22:04:34.1.4 - x86
Microsoft Windows 7 Home Basic 6.1.7601.1.1250.48.1045.18.3327.2228 [GMT 2:00]
Uruchomiony z: c:\users\Krystian\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Utworzono nowy punkt przywracania
.
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Krystian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wwopi.exe
D:\install.exe
.
.
((((((((((((((((((((((((( Pliki utworzone od 2012-05-18 do 2012-06-18 )))))))))))))))))))))))))))))))
.
.
2012-06-18 20:10 . 2012-06-18 20:10 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2012-06-18 19:56 . 2012-06-18 19:56 56200 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AB8CBDDB-42D5-41C3-A988-22887D6EE625}\offreg.dll
2012-06-18 19:55 . 2012-05-08 16:40 6737808 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AB8CBDDB-42D5-41C3-A988-22887D6EE625}\mpengine.dll
2012-06-18 10:26 . 2012-05-08 16:40 6737808 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-06-16 22:13 . 2012-06-16 22:13 ——– d—–w- c:\users\Krystian\AppData\Local\SWTOR
2012-06-14 10:42 . 2012-06-14 10:42 ——– d—–w- c:\users\Krystian\AppData\Local\Macromedia
2012-06-14 04:00 . 2012-06-14 04:01 ——– d—–w- c:\windows\rescache
2012-06-13 03:51 . 2012-04-28 03:17 183808 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-13 01:37 . 2012-02-10 12:47 713784 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8750DB41-615B-408A-9CD9-654D14384345}\gapaengine.dll
2012-06-06 14:14 . 2012-06-14 10:39 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-25 17:31 . 2012-05-25 17:31 ——– d—–w- c:\users\Krystian\AppData\Roaming\LolClient2
2012-05-23 09:13 . 2012-02-10 03:00 2719040 —-a-w- c:\windows\system32\nvsvc.dll
2012-05-23 09:13 . 2012-02-10 03:00 645440 —-a-w- c:\windows\system32\nvvsvc.exe
2012-05-23 09:13 . 2012-02-10 03:00 62272 —-a-w- c:\windows\system32\nvshext.dll
2012-05-23 09:13 . 2012-02-10 03:00 2561344 —-a-w- c:\windows\system32\nvsvcr.dll
2012-05-23 09:13 . 2012-02-10 03:02 3881792 —-a-w- c:\windows\system32\nvcpl.dll
2012-05-23 09:13 . 2012-02-10 03:00 108352 —-a-w- c:\windows\system32\nvmctray.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-14 10:39 . 2011-06-14 14:45 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-15 00:21 . 2012-05-15 00:21 423744 —-a-w- c:\windows\system32\nvStreaming.exe
2012-04-04 13:56 . 2011-02-12 10:03 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-03-31 04:39 . 2012-05-09 03:02 3968368 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-31 04:39 . 2012-05-09 03:02 3913072 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-03-30 10:23 . 2012-05-09 03:02 1291632 —-a-w- c:\windows\system32\drivers\tcpip.sys
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-09-15 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7601.17514] . . c:\windows\System32\user32.dll
[7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\SoftwareDistribution\Download\e5556aeb28e014a0a0c9d20064d91946\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
[7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\programy\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Octoshape Streaming Services"="c:\users\Krystian\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2011-04-06 2644992]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"Akamai NetSession Interface"="c:\users\Krystian\AppData\Local\Akamai\netsession_win.exe" [2012-05-07 3331872]
"Steam"="d:\programy\Steam\steam.exe" [2011-11-12 1242448]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Razer StarcraftII Driver"="d:\programy\Razer Sc2\RazerStarCraftIISysTray" [X]
"GrooveMonitor"="d:\programy\Office 2007\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Razer Imperator Driver"="d:\programy\Razer Imperator\RazerImperatorTray.exe" [2010-03-18 2787224]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"WinampAgent"="d:\programy\Winamp\winampa.exe" [2009-03-09 37888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="d:\programy\Adobe\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\users\Krystian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2010-5-7 0]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 14216]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 8456]
R3 GarenaPEngine;GarenaPEngine;c:\users\Krystian\AppData\Local\Temp\KOAA5D8.tmp [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 74112]
R3 NisSrv;Inspekcja sieci firmy Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 214952]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-09 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-05-12 691696]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 Giraffic;Veoh Giraffic Video Accelerator;c:\program files\Giraffic\Veoh_GirafficWatchdog.exe [2012-01-22 2230416]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-02-10 2348352]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-05-15 382272]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 22344]
S3 RTL8167;Sterownik Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
— Inne Usługi/Sterowniki w Pamięci —
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc
Akamai REG_MULTI_SZ Akamai
.
.
——- Skan uzupełniający ——-
.
uStart Page = hxxp://domredi.com/1/
uInternet Settings,ProxyOverride = 127.0.0.1:9421;
IE: E&ksportuj do programu Microsoft Excel - d:\programy\OFFICE~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.100
FF - ProfilePath - c:\users\Krystian\AppData\Roaming\Mozilla\Firefox\Profiles\25k4ksdb.default\
FF - prefs.js: browser.startup.homepage - hxxp://domredi.com/1/
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_80c2ffa.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\GarenaPEngine]
"ImagePath"="\??\c:\users\Krystian\AppData\Local\Temp\KOAA5D8.tmp"
.
——————— ZABLOKOWANE KLUCZE REJESTRU ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Pozostałe uruchomione procesy ————————
.
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\AUDIODG.EXE
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Giraffic\Veoh_Giraffic.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
d:\programy\Razer Sc2\RazerStarCraftIISysTray.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Czas ukończenia: 2012-06-18 22:15:53 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2012-06-18 20:15
.
Przed: 24 174 661 632 bajtów wolnych
Po: 24 075 358 208 bajtów wolnych
.
- - End Of File - - 4BE0E26D1DCF93043117EE9B6EEE4F9D
Hi Youfie,
Copy/paste the text in the Codebox below into notepad:
Here's how to do that:
Click
Start >
Run type
Notepad click OK.
This will open an empty
notepad file:
Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the
left mouse button , while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text,
right click the mouse for options, and select 'copy'. Now over the empty Notepad box,
right click your mouse again, and select 'paste' and you will have copied and pasted the text.
FCopy::
c:\windows\SoftwareDistribution\Download\e5556aeb28e014a0a0c9d20064d91946\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll | c:\windows\System32\user32.dll
DDS::
uInternet Settings,ProxyOverride = 127.0.0.1:9421;
Save this file to your desktop,
Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …
[external image: Posted Image]
Drag CFScript.txt into ComboFix.exe
Then post the results log using Copy / Paste
Due to inactivity this topic will be closed.
If you need help please start a new thread.
New members follow the instructions here
http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic
