DOWNLOAD.TROJAN jak sie go pozbyć? pomocy! :(

Dla specjalistów Bezpieczeństwo
#1

witam. prosze o pomoc w sprawie tego wirusa.

nie mozna go usunąc za pomocą mks-vira i Nortona 2005…

a ręcznie nie potrafie tego zrobić.

byłbym wdzęczny za udzielenie mi porad jak to zrobić…

z góry dzekuje

Logfile of HijackThis v1.99.1

Scan saved at 17:39:01, on 2005-03-28

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Kazaa Lite\kazaalite.kpp

C:\WINDOWS\System32\RUNDLL32.exe

C:\WINDOWS\hnqtceib.exe

C:\Program Files\xcqueeqt\xcqueeqt.exe

C:\WINDOWS\win32082012157446.exe

C:\WINDOWS\SysCheckBop32.exe

C:\WINDOWS\System32\rundll32.exe

C:\WINDOWS\System32\rundll32.exe

C:\WINDOWS\System32\rundll32.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Messenger\msmsgs.exe

D:\programy\norton antywirus\navapsvc.exe

C:\PROGRA~1\GADU-G~1\2\gg.exe

C:\WINDOWS\System32\n?tepad.exe

D:\programy\norton antywirus\IWP\NPFMntor.exe

C:\Program Files\xcqueeqt\28503329.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\System32\wuauclt.exe

C:\WINDOWS\System32\nvcpi.exe

C:\WINDOWS\System32\occsrv32.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Symantec\LiveUpdate\AUpdate.exe

E:\KAPEC\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.o2.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\PAWE~1\USTAWI~1\Temp\se.dll/spage.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\programy\SPYBOT~1\SDHelper.dll

O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll

O2 - BHO: (no name) - {9A1287ED-291F-6AE8-5214-49EF8E6739F6} - C:\WINDOWS\System32\mujhrw.dll

O2 - BHO: (no name) - {AA3FB7EC-042F-2BAB-7F20-79C2B95614B5} - C:\WINDOWS\System32\mujhrw.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\programy\norton antywirus\NavShExt.dll

O2 - BHO: (no name) - {E2BDCCFD-11C9-4547-AA34-2B41922A4458} - C:\WINDOWS\System32\cbjb.dll (file missing)

O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\programy\norton antywirus\NavShExt.dll

O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [nwiz] nwiz.exe /install

O4 - HKLM…\Run: [system32] “C:\Program Files\Dialer.pl\user32.exe” -user

O4 - HKLM…\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe

O4 - HKLM…\Run: [100% Clock] D:\programy\AlfaClock\AlfaClock.exe

O4 - HKLM…\Run: [KAZAA] “C:\Program Files\Kazaa Lite\kpp.exe” “C:\Program Files\Kazaa Lite\kazaalite.kpp” /SYSTRAY

O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM…\Run: [Media Pass] C:\PROGRA~1\MEDIAP~1\MediaPassK.exe

O4 - HKLM…\Run: [PayTime] C:\WINDOWS\System32\paytime.exe

O4 - HKLM…\Run: [Disk Keeper] C:\DOCUME~1\PAWE~1\USTAWI~1\Temp\keep.exe

O4 - HKLM…\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe

O4 - HKLM…\Run: [winupdtl] C:\WINDOWS\System32\winupdt.exe

O4 - HKLM…\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16

O4 - HKLM…\Run: [pvzjrbjesjqmkomc] C:\WINDOWS\hnqtceib.exe

O4 - HKLM…\Run: [farmmext] C:\WINDOWS\farmmext.exe

O4 - HKLM…\Run: [xcqueeqt] C:\Program Files\xcqueeqt\xcqueeqt.exe

O4 - HKLM…\Run: [rgxyxur] C:\WINDOWS\rgxyxur.exe

O4 - HKLM…\Run: [bMan] C:\Documents and Settings\All Users\Dane aplikacji\msw\BMan1.exe

O4 - HKLM…\Run: [win32082012157446] C:\WINDOWS\win32082012157446.exe

O4 - HKLM…\Run: [systemCheck] C:\WINDOWS\SysCheckBop32

O4 - HKLM…\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe

O4 - HKLM…\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe

O4 - HKLM…\Run: [etbrun] C:\windows\system32\eliteupt32.exe

O4 - HKLM…\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C

O4 - HKLM…\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1

O4 - HKLM…\Run: [ccApp] “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

O4 - HKLM…\Run: [sSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe

O4 - HKLM…\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe

O4 - HKLM…\Run: [tF5R3sl] occsrv32.exe

O4 - HKLM…\RunOnce: [AAW] “D:\programy\adaware\Ad-Aware SE Personal\Ad-Aware.exe” “+b1”

O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background

O4 - HKCU…\Run: [skype] “D:\programy\Phone Skype\Skype.exe” /nosplash /minimized

O4 - HKCU…\Run: [Gadu-Gadu] “C:\PROGRA~1\GADU-G~1\2\gg.exe” /tray

O4 - HKCU…\Run: [spyware Vanisher] D:\programy\spy vanisher\FreeScanner.exe -FastScan

O4 - HKCU…\Run: [PayTime] C:\WINDOWS\System32\paytime.exe

O4 - HKCU…\Run: [Rumu] C:\WINDOWS\System32\hldh.exe

O4 - HKCU…\Run: [Ebhyabg] C:\WINDOWS\System32\n?tepad.exe

O4 - HKCU…\Run: [cou5RiJ5j] nvcpi.exe

O4 - Startup: Power Project.lnk = C:\Program Files\Gadu-Gadu\PowerGG.exe

O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Microsoft AntiSpyware helper - {B6789EAE-86E1-4B6E-AAFA-1F18A0D59C85} - (no file) (HKCU)

O9 - Extra ‘Tools’ menuitem: Microsoft AntiSpyware helper - {B6789EAE-86E1-4B6E-AAFA-1F18A0D59C85} - (no file) (HKCU)

O15 - Trusted Zone: *.iframedollars.biz

O15 - Trusted Zone: *.skoobidoo.com

O15 - Trusted Zone: *.slotchbar.com

O15 - Trusted Zone: *.windupdates.com

O15 - Trusted Zone: *.iframedollars.biz (HKLM)

O15 - Trusted Zone: *.skoobidoo.com (HKLM)

O15 - Trusted Zone: *.slotchbar.com (HKLM)

O15 - Trusted Zone: *.windupdates.com (HKLM)

O15 - Trusted IP range: 213.159.117.202

O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab

O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\PAWE~1\USTAWI~1\Temp\hpdj.exe (file missing)

O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - D:\programy\norton antywirus\navapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - D:\programy\norton antywirus\IWP\NPFMntor.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: SAVScan - Symantec Corporation - D:\programy\norton antywirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

#2

pomożecie? :>

#3

Na początek to i poczytaj dzisiejsze posty podobnych było dużo.

http://forum.dobreprogramy.pl/viewtopic.php?t=23685

Kasowanie wpisów w HJ nic nie daje jak nie usuniesz przyczyny.

Po scanowaniu wklej log.

#4

To mozesz usunąć, tylko tyle z mojej strony ale jest tego więcej

#5

O15 - Trusted Zone: *.iframedollars.biz

O15 - Trusted Zone: *.skoobidoo.com

O15 - Trusted Zone: *.slotchbar.com

O15 - Trusted Zone: *.windupdates.com

O15 - Trusted Zone: *.iframedollars.biz (HKLM)

O15 - Trusted Zone: *.skoobidoo.com (HKLM)

O15 - Trusted Zone: *.slotchbar.com (HKLM)

O15 - Trusted Zone: *.windupdates.com (HKLM)

O15 - Trusted IP range: 213.159.117.202

kosz 8)

#6

Na początek wyczyść katalog TEMP

Start=>Uruchom=>%temp%=>I usuń wszystko co sie tam znajduje (oczywiście wszystko robisz w trybie awaryjnym i wyłączonym przywracaniem systemu)

Usuń:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\PAWE~1\USTAWI~1\Temp\se.dll/spage.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

O2 - BHO: (no name) - {E2BDCCFD-11C9-4547-AA34-2B41922A4458} - C:\WINDOWS\System32\cbjb.dll (file missing)

O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)

O2 - BHO: (no name) - {9A1287ED-291F-6AE8-5214-49EF8E6739F6} - C:\WINDOWS\System32\mujhrw.dll

O2 - BHO: (no name) - {AA3FB7EC-042F-2BAB-7F20-79C2B95614B5} - C:\WINDOWS\System32\mujhrw.dll

O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll

O4 - HKLM…\Run: [system32] “C:\Program Files\Dialer.pl\user32.exe” -user

O4 - HKLM…\Run: [Media Pass] C:\PROGRA~1\MEDIAP~1\MediaPassK.exe

O4 - HKLM…\Run: [PayTime] C:\WINDOWS\System32\paytime.exe

O4 - HKLM…\Run: [Disk Keeper] C:\DOCUME~1\PAWE~1\USTAWI~1\Temp\keep.exe

O4 - HKLM…\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe

O4 - HKLM…\Run: [winupdtl] C:\WINDOWS\System32\winupdt.exe

O4 - HKLM…\Run: [pvzjrbjesjqmkomc] C:\WINDOWS\hnqtceib.exe

O4 - HKLM…\Run: [farmmext] C:\WINDOWS\farmmext.exe

O4 - HKLM…\Run: [xcqueeqt] C:\Program Files\xcqueeqt\xcqueeqt.exe

O4 - HKLM…\Run: [rgxyxur] C:\WINDOWS\rgxyxur.exe

O4 - HKLM…\Run: [bMan] C:\Documents and Settings\All Users\Dane aplikacji\msw\BMan1.exe

O4 - HKLM…\Run: [win32082012157446] C:\WINDOWS\win32082012157446.exe

O4 - HKLM…\Run: [systemCheck] C:\WINDOWS\SysCheckBop32

O4 - HKLM…\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe

O4 - HKLM…\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe

O4 - HKLM…\Run: [etbrun] C:\windows\system32\eliteupt32.exe

O4 - HKLM…\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C

O4 - HKLM…\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1

O4 - HKLM…\Run: [tF5R3sl] occsrv32.exe

O4 - HKCU…\Run: [PayTime] C:\WINDOWS\System32\paytime.exe

O4 - HKCU…\Run: [Rumu] C:\WINDOWS\System32\hldh.exe

O4 - HKCU…\Run: [Ebhyabg] C:\WINDOWS\System32\n?tepad.exe

O4 - HKCU…\Run: [cou5RiJ5j] nvcpi.exe

O9 - Extra button: Microsoft AntiSpyware helper - {B6789EAE-86E1-4B6E-AAFA-1F18A0D59C85} - (no file) (HKCU)

O9 - Extra ‘Tools’ menuitem: Microsoft AntiSpyware helper - {B6789EAE-86E1-4B6E-AAFA-1F18A0D59C85} - (no file) (HKCU)

O15 - Trusted Zone: *.iframedollars.biz

O15 - Trusted Zone: *.skoobidoo.com

O15 - Trusted Zone: *.slotchbar.com

O15 - Trusted Zone: *.windupdates.com

O15 - Trusted Zone: *.iframedollars.biz (HKLM)

O15 - Trusted Zone: *.skoobidoo.com (HKLM)

O15 - Trusted Zone: *.slotchbar.com (HKLM)

O15 - Trusted Zone: *.windupdates.com (HKLM)

O15 - Trusted IP range: 213.159.117.202

O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\PAWE~1\USTAWI~1\Temp\hpdj.exe (file missing)

C:\WINDOWS\hnqtceib.exe

C:\Program Files\xcqueeqt\xcqueeqt.exe

C:\WINDOWS\win32082012157446.exe

C:\WINDOWS\SysCheckBop32.exe

C:\WINDOWS\System32\n?tepad.exe

C:\Program Files\xcqueeqt\28503329.exe

C:\WINDOWS\System32\nvcpi.exe

C:\WINDOWS\System32\occsrv32.exe

Wszystkie pliki na czerwono usuwasz ręcznie z dysku

O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll

Ten wpis to Backdoor.Haxdoor ver. D

Sposób usuwania masz Tutaj

Po wykonaniu tych czynności wklej nowego loga