Miałem infekcję, proszę o sprawdzenie logów

Dla specjalistów Bezpieczeństwo
#1

Witam. Niedawno mialem taką samą infekcję[i pomogliście], tzn. czerwona tapeta(Fajna, może ktoś na taką) wyskakujące okna, itd. itp.

Odrazu restart i na awaryjnym użyłem SDFix-a

log:

http://wklej.org/id/1888a2183b

Teraz włączyłem Log z HijackThis v1.99.1

log:

http://www.wklej.org/id/512ba6ca47

oraz Silenta w trakcie skanowania miałem taki komunikat

c905c660e924d1ff.jpg

Użylem usuń, ale plik był zablokowany i nedało to rezultatu

log:

http://www.wklej.org/id/84e4e8aea1

Proszę o info czy SDFix poradził sobie z infekcją i jeśli nie co mam dalej robić.

Najważniejsze że na 90% wiem co wywołało tą infekcję.

Ps. Może macie taką tapetkę z infekcji tzn czerwona wzór coś na kształt biohazard, waląca po oczach ?

#2

Użyj -->SmitfraudFix.

Użyj go z opcji “Clean”, czyli wpisz 2 i naciśnij ENTER.

Po jego użyciu może zajść potrzeba ustawiania od nowa tapety (czyli prawoklik na ekranie>>właściwości, itd. )

Daj z niego raport z C:\SmitfraudFix.txt

Potem:

Masz chyba Unlockera, więc przy jego pomocy usuń:

bo SmitfraudFix chyba jeszcze nie ma tego w swoim module usuwania.

Potem:

Te w/w wpisy sfiksuj w Hijacku (jeśli jeszcze będą):

>>Hijack>>scan(Do a system scan only)>>zaznacz je >> Fix checked.

Daj raport SmitfraudFixa i log z Hijacka.

jessi

#3

Ok

log z SmitfraudFix

http://www.wklej.org/id/5a8ffd5798

Hijack

http://www.wklej.org/id/d885cb7eb4

{File missing} nie kasowalem

dll-a skasowałem ręcznie Shift+Del

BTW. Po rozpakowaniu SmitfraudFix.zip, nie mam w folderze SmitfraudFix.exe tylko SmitfraudFix.cmd.

#4

To sfiksuj te wpisy z “file missing”:

Wygląda, że poza tym powinno już być OK.

jessi

#5

Dzięki złotko drugi raz :wink:

Gdybym mógł to piwko bym postawił.

Dzięki jeszcze raz .

Pozdrawiam i dobranoc .

#6

Wersja VPS000780-2. 2007-10-11. Avast wykrył trojana.Umieściłem go w kwarantannie.Chciałbym się go pozbyć.Bardzo proszę o sprawdzenie loga.

“Silent Runners.vbs”, revision 41, http://www.silentrunners.org/

Operating System: Windows XP

Output limited to non-default values, except where indicated by “{++}”

Startup items buried in registry:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

“Odkurzacz-MCD” = “C:\Program Files\Odkurzacz\odk_mcd.exe” [“Franmo Software”]

“SpybotSD TeaTimer” = “D:\Spybot-Search 1.5.1.15\Spybot - Search & Destroy\TeaTimer.exe” [“Safer Networking Limited”]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

“avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [“ALWIL Software”]

“DAEMON Tools” = ““C:\Program Files\DAEMON Tools\daemon.exe” -lang 1045” [“DT Soft Ltd.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{02478D38-C3F9-4EFB-9B51-7695ECA05670}(Default) = “Yahoo! Toolbar Helper” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = “AcroIEHlprObj Class” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = “SSVHelper Class” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll” [“Sun Microsystems, Inc.”]

{85F685C3-20D9-4943-95E4-EB4224056C3F}(Default) = “Expressivo” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ivo\Expressivo Demo\IH_iexplore.dll” [“IVO Software Sp. z o.o.”]

{AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = “Google Toolbar Helper” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”]

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}(Default) = “Google Toolbar Notifier BHO” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll” [“Google Inc.”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

“{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania”

-> {CLSID}\InProcServer32(Default) = “deskpan.dll” [file not found]

“{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”]

“{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Eksplorator pulpitów”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”]

“{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”]

“{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

“{472083B0-C522-11CF-8763-00608CC02F24}” = “avast”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”]

“{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}” = “UnlockerShellExtension”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data]

“{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\

INFECTION WARNING! “AppInit_DLLs” = “C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL” [“Google”]

HKLM\Software\Classes*\shellex\ContextMenuHandlers\

avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”]

UnlockerShellExtension(Default) = “{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Unlocker\UnlockerCOM.dll” [null data]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

Active Desktop and Wallpaper:

Active Desktop is disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\

“Wallpaper” = “C:\Documents and Settings\Staszek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp”

Enabled Screen Saver:

HKCU\Control Panel\Desktop\

“SCRNSAVE.EXE” = “C:\WINDOWS\System32\MAL-PC.scr” [null data]

Startup items in “Staszek” & “All Users” startup folders:

C:\Documents and Settings\Staszek\Menu Start\Programy\Autostart

“uni_spiker-2.6” -> shortcut to: “C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe” [null data]

Winsock2 Service Provider DLLs:

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS]

000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

000000000004\LibraryPath = “C:\Program Files\FRITZ!DSL\sarah.dll” [“AVM Berlin”]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

C:\Program Files\FRITZ!DSL\sarah.dll [“AVM Berlin”], 01 - 03, 21

%SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 09 - 20

%SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08

Toolbars, Explorer Bars, Extensions:

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = “Yahoo! Toolbar” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

“{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = “&Google” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\

“{85F685C3-20D9-4943-95E4-EB4224056C3F}” = “Expressivo”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ivo\Expressivo Demo\IH_iexplore.dll” [“IVO Software Sp. z o.o.”]

“{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = “&Google” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”]

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = “Yahoo! Toolbar” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

“MenuText” = “Sun Java Console”

“CLSIDExtension” = “{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll” [“Sun Microsystems, Inc.”]

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\

“MenuText” = “Spybot - Search & Destroy Configuration”

“CLSIDExtension” = “{53707962-6F74-2D53-2644-206D7942484F}”

-> {CLSID}\InProcServer32(Default) = “D:\SPYBOT~1.15\SPYBOT~1\SDHelper.dll” [“Safer Networking Limited”]

Miscellaneous IE Hijack Points

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

Missing lines (compared with English-language version):

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = “*d” (unwritable string)

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

Running Services (Display Name, Service Name, Path {Service DLL}):

avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [“ALWIL Software”]

avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [“ALWIL Software”]

avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”]

avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”]

AVM IGD CTRL Service, AVM IGD CTRL Service, “C:\Program Files\FRITZ!DSL\IGDCTRL.EXE” [“AVM Berlin”]

NVIDIA Driver Helper Service, NVSvc, “C:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”]

SoundMAX Agent Service, SoundMAX Agent Service (default), “C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe” [“Analog Devices, Inc.”]

Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS]

  • This report excludes default entries except where indicated.

  • To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

  • To search all directories of local fixed drives for DESKTOP.INI

DLL launch points and all Registry CLSIDs for dormant Explorer Bars,

use the -supp parameter or answer “No” at the first message box.

---------- (total run time: 183 seconds, including 7 seconds for message boxes)