KOń trojański Win32:KillAV-DS [Trj] POMOCY ! PROSZE!

[system]

Witam

Właśnie złapałem trojana Win32:KillAV-DS [Trj] jak mam go usunąć avast nie pomaga inne skanery też nie .

Średnio się na tym znam , ale czytałem wypowiedz kogoś kto miał to samo i po przeskanowaniu hijack wyszło mi :

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:58, on 2007-11-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\explorer.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\UMonit.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\sm56hlpr.exe C:\Program Files\Power Manager\PM.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\bdir\sdflkj8.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM…\Run: [skrót do strony właściwości High Definition Audio] HDAShCut.exe O4 - HKLM…\Run: [ATIPTA] “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” O4 - HKLM…\Run: [uMonit] C:\WINDOWS\system32\UMonit.exe O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [sMSERIAL] sm56hlpr.exe O4 - HKLM…\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [Adobe Photo Downloader] “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe” O4 - HKLM…\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO O4 - HKLM…\Run: [sDTray] “C:\Program Files\Spyware Doctor\SDTrayApp.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [strkjhk] C:\WINDOWS\bdir\sdflkj8.exe O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe – End of file - 6115 bytes

Zupełnie nie wiem co z tym zrobić i jeśli ktoś był by tak miły proszę dokładnie krok po kroku o pomoc !

Z góry dziękuje i pozdrawiam jureczek7

[Gutek]

O4 - HKCU…\Run: [strkjhk] C:\WINDOWS\bdir\sdflkj8.exe

usuń wpis HJT

Daj log z ComboFix

[system]

Czy możliwe jest że po usunięciu

O4 - HKCU…\Run: [strkjhk] C:\WINDOWS\bdir\sdflkj8.exe

z notatnika i próby przeskanowania combo fixem trojan znikł ??

Po tej czynności już nic avast nie wyświetla a wcześniej w kółko informacja o wirusie .

Teraz cisza jak sprawdzić czy już go niema przeskanowałem jeszcze (na wszelki wypadek) dysk innymi skanerami i wydaje mi się że jest ok .

Czy wirus się usunął ??

[arekmalek]

Daj log z ComboFix

[system]

ComboFix 07-11-19.4C - Marcin 2007-12-02 10:19:32.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.477 [GMT 1:00] Running from: C:\Documents and Settings\Marcin\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\bdir . ((((((((((((((((((((((((( Files Created from 2007-11-02 to 2007-12-02 ))))))))))))))))))))))))))))))) . 2007-11-30 23:43 2007-11-30 23:22 2007-11-30 23:22 2007-11-30 23:22 2007-11-30 23:22 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-30 23:22 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-30 23:22 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-30 23:22 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-30 23:22 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-21 16:39 2007-11-08 13:59 2007-11-08 00:00 2,560 --a------ C:\WINDOWS_MSRSTRT.EXE 2007-11-07 23:51 2007-11-07 23:50 2007-11-07 23:50 2007-11-07 23:50 2007-11-07 10:42 577,536 --a------ C:\WINDOWS\system32\ac3filter.ax 2007-11-07 10:41 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2007-11-07 10:41 921,600 --a------ C:\WINDOWS\system32\vorbisenc.dll 2007-11-07 10:41 319,488 --a------ C:\WINDOWS\system32\CoreAAC.ax 2007-11-07 10:41 237,568 --a------ C:\WINDOWS\system32\OggDS.dll 2007-11-07 10:41 188,416 --a------ C:\WINDOWS\system32\vorbis.dll 2007-11-07 10:41 45,056 --a------ C:\WINDOWS\system32\ogg.dll 2007-11-07 10:40 245,760 --a------ C:\WINDOWS\system32\mplvpx.dll 2007-11-07 10:39 1,559,040 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-11-07 10:38 2007-11-07 10:36 2007-11-07 10:01 2007-11-03 14:51 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-02 09:21 --------- d-----w C:\Documents and Settings\Marcin\Dane aplikacji\Skype 2007-12-02 09:17 --------- d-----w C:\Program Files\Championship Manager 2006 2007-11-24 21:02 --------- d-----w C:\Program Files\GameShadow 2007-11-24 20:24 --------- d-----w C:\Program Files\eMule 2007-11-22 09:23 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-07 16:00 --------- d-----w C:\Program Files\Winamp 2007-11-07 09:42 892,928 ----a-w C:\WINDOWS\system32\iconv.dll 2007-11-07 09:40 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-11-07 09:39 740,442 ----a-w C:\WINDOWS\system32\DivX.dll 2007-11-07 09:38 79,360 ----a-w C:\WINDOWS\system32\mkzlib.dll 2007-11-07 09:38 23,552 ----a-w C:\WINDOWS\system32\mkunicode.dll 2007-11-07 09:38 167,936 ----a-w C:\WINDOWS\system32\ts.dll 2007-11-07 09:38 151,040 ----a-w C:\WINDOWS\system32\mkx.dll 2007-11-07 09:38 142,848 ----a-w C:\WINDOWS\system32\mp4.dll 2007-11-07 09:36 --------- d-----w C:\Documents and Settings\Marcin\Dane aplikacji\Apple Computer 2007-11-07 09:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2007-11-07 09:13 --------- d-----w C:\Program Files\XviD 2007-11-07 09:13 --------- d-----w C:\Documents and Settings\Marcin\Dane aplikacji\DeepBurner 2007-11-03 15:13 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-03 14:07 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-05 21:55 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 13:00] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2006-11-24 17:16] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-06-23 13:53] “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” [2007-05-03 10:02] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 08:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Skrót do strony właściwości High Definition Audio”=“HDAShCut.exe” [2005-01-07 16:07 C:\WINDOWS\system32\HdAShCut.exe] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-08-05 20:05] “UMonit”=“C:\WINDOWS\system32\UMonit.exe” [2005-08-25 12:48] “RTHDCPL”=“RTHDCPL.EXE” [2005-09-07 09:52 C:\WINDOWS\RTHDCPL.EXE] “SMSERIAL”=“sm56hlpr.exe” [2005-09-12 14:35 C:\WINDOWS\sm56hlpr.exe] “PowerManager”=“C:\Program Files\Power Manager\PM.exe” [2005-08-18 14:52] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe” [2005-06-06 23:46] “SDTray”=“C:\Program Files\Spyware Doctor\SDTrayApp.exe” [2007-11-02 17:24] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 13:00] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 13:44:06] Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2006-09-06 19:46:10] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R0 SiSRaid2;SiSRaid2;C:\WINDOWS\system32\drivers\SiSRaid2.sys R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys R3 EKBfltr;ENE Keyboard Controller;C:\WINDOWS\system32\DRIVERS\EKBfltr.sys R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys R3 WINIO;WINIO;??\C:\Program Files\Power Manager\winio.sys S3 ATE_PROCMON;ATE_PROCMON;??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys S3 fixustor;fixustor;C:\WINDOWS\system32\drivers\fixustor.sys S3 ZDCndis5;ZDCndis5 Protocol Driver;??\C:\WINDOWS\system32\ZDCndis5.SYS S3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;??\C:\WINDOWS\system32\ZDPNDIS5.SYS *Newly Created Service* - WINIO . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-02 10:21:28 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … HKLM\Software\Microsoft\Windows\CurrentVersion\Run UMonit = C:\WINDOWS\system32\UMonit.exe?Vid_0???Pid_0712???L??2&PID437???B?O??? Q???Q???w?L???DP??X???|p??|???m??|C??w???L???w???L?? Q???L??0Q???\Q???w???P???X???R??A7??P???X???R??? scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-02 10:22:25 . — E O F —

// Poprawiłem Twój post - dodałem tagi quote.

Kaka’

[Gutek]

Jest Ok

[system]