Carlton, trzyliterowe trojany irc, i inne cuda

[jojojo]

Daję loga. Po zrobieniu loga w Combo nie mogę wejść do netu. muszę robić reboot. Poprzednio, gdy było wszystko oki też.

Tamto wpakowało mi się w trakcie ściągania SP2 A ja zostawiłem sobie jeszcze nieobrobione zdjęcia i video córki, więc wolałbym to oszczędzić, ale…

ComboFix 07-12-21.4 - Paweł Fabiszewski 2007-12-30 23:30:55.3 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.1.1250.1.1045.18.571 [GMT 1:00]

Running from: C:\Documents and Settings\Paweł Fabiszewski\Pulpit\ComboFix.exe

.


((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-30 )))))))))))))))))))))))))))))))

.


No new files created in this timespan


.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-12-30 21:17	---------	d-----w	C:\Documents and Settings\Paweł Fabiszewski\Dane aplikacji\Gadu-Gadu

2007-12-30 21:16	---------	d-----w	C:\Program Files\Gadu-Gadu

2007-12-30 21:00	512,096	----a-w	C:\WINDOWS\system32\drivers\amon.sys

2007-12-30 21:00	298,104	----a-w	C:\WINDOWS\system32\imon.dll

2007-12-30 21:00	15,424	----a-w	C:\WINDOWS\system32\drivers\nod32drv.sys

2007-12-30 20:47	---------	d--h--w	C:\Program Files\InstallShield Installation Information

2007-12-30 20:47	---------	d-----w	C:\Program Files\ATI Technologies

2007-12-30 20:42	---------	d-----w	C:\Program Files\Common Files\InstallShield

2007-12-30 20:42	---------	d-----w	C:\Program Files\Analog Devices

2007-12-30 20:31	---------	d-----w	C:\Program Files\microsoft frontpage

2007-12-30 20:27	---------	d-----w	C:\Program Files\Usługi online

.


((((((((((((((((((((((((((((( snapshot@2007-12-30_22.47.52,52 )))))))))))))))))))))))))))))))))))))))))

.

- 2007-12-30 20:59:23	39,992	----a-w	C:\WINDOWS\system32\perfc009.dat

+ 2007-12-30 21:56:03	39,992	----a-w	C:\WINDOWS\system32\perfc009.dat

- 2007-12-30 20:59:23	49,492	----a-w	C:\WINDOWS\system32\perfc015.dat

+ 2007-12-30 21:56:04	49,492	----a-w	C:\WINDOWS\system32\perfc015.dat

- 2007-12-30 20:59:23	311,604	----a-w	C:\WINDOWS\system32\perfh009.dat

+ 2007-12-30 21:56:03	311,604	----a-w	C:\WINDOWS\system32\perfh009.dat

- 2007-12-30 20:59:23	355,486	----a-w	C:\WINDOWS\system32\perfh015.dat

+ 2007-12-30 21:56:04	355,486	----a-w	C:\WINDOWS\system32\perfh015.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2003-04-16 13:00]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 08:57]

"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-12 21:10]

"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-30 22:00]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2003-04-16 13:00]



*Newly Created Service* - ALG 

*Newly Created Service* - IPNAT 

.

**************************************************************************


catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-12-30 23:31:30

Windows 5.1.2600 Dodatek Service Pack. 1 NTFS


scanning hidden processes ... 


scanning hidden autostart entries ...


scanning hidden files ... 


scan completed successfully 

hidden files: 0 


**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes --------------------- 


PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106]

-> C:\Program Files\Eset\pr_imon.dll

.

Completion time: 2007-12-30 23:31:57

[Gutek]

Na szczęście nic nie widać

[jojojo]

a mi przed chwilą wywalił błąd, z którym chce do Microsoftu się wysłać. Taki sam jak wywalał przed reinstalem.

A co z tymi plikami zdjęć i video?

[jojojo]

i znowu pełno trojanów, błędów i wyłączeń systemu za 1min.

Jutro zacznę od service packa

[Gutek]

I wtedy daj jak zainstalujesz sp2 - nowe logi

[arekmalek]

Ja mam tylko jedno pytanie…

Czy system jest oryginalny?

[jojojo]

System był na kompie oryginalny, tylko bez SP2. Teraz, na razie nie ma żadnych oznak nieproszonych gości.

Podaję logi i czekam na rozwój sytuacji…

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:07:32, on 2007-12-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\wuauclt.exe C:\DOCUME~1\jojojo\USTAWI~1\Temp\Katalog tymczasowy 1 dla HiJackThis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM…\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe – End of file - 2007 bytes

“Silent Runners.vbs”, revision 55, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “Smapp” = “C:\Program Files\Analog Devices\SoundMAX\SMTray.exe” [“Analog Devices, Inc.”] “nod32kui” = ““C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE” ["Eset "] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” = “NOD32 Context Menu Shell Extension” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] HKLM\SOFTWARE\Classes*\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 19 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ NOD32 Kernel Service, NOD32krn, ““C:\Program Files\Eset\nod32krn.exe”” ["Eset "] SoundMAX Agent Service, SoundMAX Agent Service (default), “C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe” [“Analog Devices, Inc.”] ---------- (launch time: 2007-12-31 20:03:10) + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 25 seconds, including 4 seconds for message boxes)

ComboFix 07-12-31.4 - jojojo 2007-12-31 20:02:08.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.539 [GMT 1:00] Running from: C:\Documents and Settings\jojojo\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-31 ))))))))))))))))))))))))))))))) . 2007-12-31 20:01 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-12-31 18:21 . 2007-12-31 18:21 2007-12-31 18:21 . 2007-12-31 18:21 1,158 --a------ C:\WINDOWS\mozver.dat 2007-12-31 18:12 . 2007-12-31 18:12 2007-12-31 18:12 . 2007-12-31 19:06 2007-12-31 18:12 . 2007-12-31 18:12 0 --a------ C:\WINDOWS\nsreg.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-31 16:55 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2007-12-31 16:55 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-12-31 16:55 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2007-12-31 16:43 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-12-31 16:43 --------- d-----w C:\Program Files\Analog Devices 2007-12-31 16:25 --------- d-----w C:\Program Files\ATI Technologies 2007-12-31 15:32 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-12-31 15:23 --------- d-----w C:\Program Files\microsoft frontpage 2007-12-31 15:21 --------- d-----w C:\Program Files\Usługi online 2007-09-27 16:13 991,744 ----a-w C:\WINDOWS\system32\syssetup.dll 2007-09-27 16:13 1,548,288 ----a-w C:\WINDOWS\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Smapp”=“C:\Program Files\Analog Devices\SoundMAX\SMTray.exe” [2003-05-05 08:57 143360] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-12-31 17:55 949376] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-03 23:44 15360] *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-31 20:02:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2007-12-31 20:03:02

[Gutek]

W logu nic nie widzę - pamiętaj - viewtopic.php?f=16&t=213350

[jojojo]

U mnie też na razie spokój. Pozdrawiam.