MailSkiner.rtk -Trojan

[LeszekG]

Witam serdecznie ostatnio spaybot usunął mi właśnie tego trojana MailSkiner.rtk prosze o sprawdzenie loga czy czasem czegoś po sobie nie zostawił.

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:14:40, on 2007-10-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\IH_iexplore.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\IH_iexplore.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [AVP] “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe” O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra ‘Tools’ menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour … se8300.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso … 4025231359 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s … wflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe – End of file - 7159 bytes

Z góry dziękuje za pomoc.

[Lost_World]

W logu nic nie widać.

Daj log z Combofix

Opis użycia ComboFix jest na tej stronie z linku.

Log może być długi, więc zapisz go sobie gdzieś, a potem wklej na http://wklej.org/, a tu daj tylko link.

@edit

http://forum.dobreprogramy.pl/viewtopic.php?t=189171

[zuczek126p (Asamer)]

MailSkiner.rtk to fałszywy alarm jest błąd w bazach SpyBot’a

[LeszekG]

Podaje log combo-fix

ComboFix 07-09-21.2 - “Monika” 2007-10-01 16:19:14.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.614 [GMT 2:00] * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-09-01 to 2007-10-01 ))))))))))))))))))))))))))))))) . 2007-10-01 16:16 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-01 14:27 2007-10-01 00:59 2007-10-01 00:54 32,768 --a------ C:\Uninstall.exe 2007-09-28 20:11 2007-09-27 23:46 2007-09-24 17:41 811,008 --a------ C:\WINDOWS\FeedingFrenzy.scr 2007-09-24 16:39 2007-09-24 16:39 2007-09-23 10:06 2007-09-22 14:51 2007-09-22 14:41 215,144 -ra------ C:\WINDOWS\patchw32.dll 2007-09-22 14:40 215,144 -ra------ C:\WINDOWS\pw32a.dll 2007-09-22 14:34 37,864 --a------ C:\WINDOWS\system32\drivers\v2imount.sys 2007-09-22 14:34 15,664 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys 2007-09-22 14:34 14,072 --a------ C:\WINDOWS\system32\drivers\vproeventmonitor.sys 2007-09-22 14:34 128,104 --a------ C:\WINDOWS\system32\drivers\WimFltr.sys 2007-09-22 14:34 109,360 --a------ C:\WINDOWS\system32\GEARAspi.dll 2007-09-22 14:33 131,808 --a------ C:\WINDOWS\system32\drivers\symsnap.sys 2007-09-22 14:32 2007-09-22 14:32 2007-09-20 20:29 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL 2007-09-20 20:29 116,224 --a------ C:\WINDOWS\system32\pdfcmnnt.dll 2007-09-20 20:29 2007-09-20 03:12 2007-09-19 10:13 2007-09-19 10:07 2007-09-19 10:06 2007-09-19 00:43 24,072 --a------ C:\WINDOWS\system32\uxtuneup.dll 2007-09-19 00:43 2007-09-19 00:42 2007-09-18 23:56 2007-09-17 23:58 2007-09-15 13:46 2007-09-15 13:45 274,432 --------- C:\WINDOWS\TLCUninstall.exe 2007-09-13 20:08 2007-09-13 18:17 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2007-09-13 18:15 2007-09-13 18:14 2007-09-13 18:10 2007-09-13 18:09 2007-09-13 18:08 2007-09-05 18:16 79,360 --a------ C:\WINDOWS\system32\mkzlib.dll 2007-09-05 18:16 23,552 --a------ C:\WINDOWS\system32\mkunicode.dll 2007-09-05 18:16 167,936 --a------ C:\WINDOWS\system32\ts.dll 2007-09-05 18:16 151,040 --a------ C:\WINDOWS\system32\mkx.dll 2007-09-05 18:16 142,848 --a------ C:\WINDOWS\system32\mp4.dll 2007-09-05 18:16 1,559,040 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-09-03 12:12 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys 2007-09-03 12:12 20,400 --a------ C:\WINDOWS\system32\drivers\Entech.sys 2007-09-03 12:12 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-01 16:27 29270560 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-01 16:19 288800 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-01 15:26 --------- d-------- C:\DOCUME~1\Monika\DANEAP~1\Skype 2007-09-30 18:29 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Kaspersky Lab 2007-09-30 16:05 364172 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-09-30 16:05 30248 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2007-09-29 17:44 --------- d-------- C:\Program Files\Kalendarz XP 2007-09-20 23:18 --------- d-------- C:\Program Files\BitTorrent 2007-09-19 01:17 --------- d-------- C:\DOCUME~1\Monika\DANEAP~1\BitTorrent 2007-09-19 00:39 --------- d-------- C:\Program Files\GT Racers 2007-09-18 00:12 --------- d-------- C:\Program Files\BitComet 2007-09-16 22:56 --------- d-------- C:\Program Files\eMule 2007-09-14 11:25 --------- d-------- C:\DOCUME~1\Monika\DANEAP~1\IE7Pro 2007-09-14 11:24 --------- d-------- C:\Program Files\IE7Pro 2007-09-05 18:16 740442 --a------ C:\WINDOWS\system32\DivX.dll 2007-09-05 18:15 --------- d-------- C:\Program Files\Real Alternative 2007-09-05 15:15 82061 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-09-05 15:15 81549 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-09-03 12:12 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-08-16 18:51 --------- d-------- C:\Program Files\Kaspersky Lab 2007-08-16 18:50 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Kaspersky Lab Setup Files 2007-08-15 22:14 --------- d-------- C:\Program Files\WinAVIVideoConverter 2007-08-15 19:30 --------- d-------- C:\Program Files\Opera 2007-08-12 13:43 --------- d-------- C:\DOCUME~1\Monika\DANEAP~1\Help 2007-08-11 02:35 --------- d-------- C:\Program Files\Yahoo! 2007-08-11 00:28 --------- d-------- C:\Program Files\Common Files\Skype 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-07-30 19:19 207736 --a------ C:\WINDOWS\system32\muweb.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2007-06-29 00:43] “nwiz”=“nwiz.exe” [2007-06-29 00:43 C:\WINDOWS\system32\nwiz.exe] “SoundMan”=“SOUNDMAN.EXE” [2005-09-22 10:42 C:\WINDOWS\SOUNDMAN.EXE] “AVP”=“C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe” [2007-06-28 12:51] “NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2007-06-29 00:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2006-03-02 14:00] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] “NoDispBackgroundPage”=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoLowDiscSpaceChecks”=000000000000f03f [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “appinit_dlls”=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] “NBJ”=“C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” “Odkurzacz-MCD”=C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] “NeroFilterCheck”=C:\WINDOWS\system32\NeroCheck.exe “SNPSTD2”=C:\WINDOWS\vsnpstd2.exe “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” R0 sojubus;sojubus;C:\WINDOWS\system32\DRIVERS\sojubus.sys R0 sojuscsi;sojuscsi;C:\WINDOWS\system32\DRIVERS\sojuscsi.sys R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys S3 snpstd2;USB PC Camera (SN9C103);C:\WINDOWS\system32\DRIVERS\snpstd2.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS S3 viafilter;VIA USB Filter;C:\WINDOWS\system32\Drivers\viausb.sys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp *Newly Created Service* - CATCHME . Contents of the ‘Scheduled Tasks’ folder “2007-09-28 15:16:37 C:\WINDOWS\Tasks\1-Click Maintenance.job” - C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe “2007-09-28 15:15:00 C:\WINDOWS\Tasks\1-Klik Konserwacja.job” . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-01 16:27:34 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-01 16:29:17 . — E O F —

[Lost_World]

Czysto.

[Gutek]

Wrzuć jeszcze -

Pobierz program SDFix

[LeszekG]

Podaje log

SDFix: Version 1.107 Run by Monika on 2007-10-02 at 09:15 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] “C:\Program Files\Skype\Phone\Skype.exe”=“C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype” [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Thu 22 Dec 2005 71,168 …SHR — “C:\Program Files\Metro 3D\Anubis II\Setup.exe” Finished!

[jessica]

SDFix niczego już nie wykrył, a więc powinno być OK.

jessi