MS06-001 WMF Exploit (http://allcount.net/ugpvmavam/xpl.wmf)

fisk · 23 Maj 2006 17:02

Jakiś człowiek (nr: 1845175) wysłał mi link do strony z wirusami http://www.fotki.qd.******* a ja głupi oczywiście kliknąłem he,

w logu avasta jest takie coś:

Logfile of HijackThis v1.99.1 Scan saved at 18:36:16, on 2006-05-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: E:\DER_ZUG\System32\smss.exe E:\DER_ZUG\system32\winlogon.exe E:\DER_ZUG\system32\services.exe E:\DER_ZUG\system32\lsass.exe E:\DER_ZUG\system32\svchost.exe E:\DER_ZUG\System32\svchost.exe E:\DER_ZUG\system32\spoolsv.exe F:\Program Files\Apache Group\Apache\Apache.exe F:\Security\Alwil Software\Avast4\aswUpdSv.exe F:\Security\Alwil Software\Avast4\ashServ.exe C:\MYSQL\BIN\MYSQLD-NT.exe E:\DER_ZUG\system32\svchost.exe F:\Program Files\Apache Group\Apache\Apache.exe F:\Security\Alwil Software\Avast4\ashMaiSv.exe F:\Security\Alwil Software\Avast4\ashWebSv.exe E:\DER_ZUG\Explorer.EXE F:\Security\ALWILS~1\Avast4\ashDisp.exe F:\canon\ScanSoft\OmniPageSE\opware32.exe F:\Communicators\Gadu-Gadu\gg.exe F:\INTERN~1\MOZILL~1\FIREFOX.EXE F:\Program Files\Outlook Express\msimn.exe E:\DER_ZUG\system32\drivers\network\piotr_badecki\Dane aplikacji\Microsoft\Internet Explorer\Security\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pajacyk.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 217.8.189.34:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\tools\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - F:\tools\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: SafeIE Utility - {B5D4581D-ED6A-4905-A267-25BAF7BE79C1} - E:\DER_ZUG\system32\safeie.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\tools\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM…\Run: [avast!] F:\Security\ALWILS~1\Avast4\ashDisp.exe O8 - Extra context menu item: &Ściągnij wszystko za pomocą WellGeta - F:\Tools\Download\WellGet\nxall.htm O8 - Extra context menu item: Convert link target to Adobe PDF - res://F:\tools\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://F:\tools\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://F:\tools\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://F:\tools\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://F:\tools\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://F:\tools\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://F:\tools\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://F:\tools\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Ściągnij za pomocą &WellGeta - F:\Tools\Download\WellGet\nxcatch.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: WellGet - {35980F6E-A258-4E50-953D-813BB8556899} - f:\tools\download\WellGet\WellGet.exe O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - f:\communicators\ICQLite\ICQLite.exe O9 - Extra ‘Tools’ menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - f:\communicators\ICQLite\ICQLite.exe O17 - HKLM\System\CCS\Services\Tcpip…{013673AE-1301-4B4D-B040-4A9CC8C6F772}: NameServer = 194.204.158.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip…{013673AE-1301-4B4D-B040-4A9CC8C6F772}: NameServer = 194.204.158.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip…{013673AE-1301-4B4D-B040-4A9CC8C6F772}: NameServer = 194.204.158.1,194.204.152.34 O23 - Service: Adobe LM Service - Adobe Systems - F:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apache - Unknown owner - F:\Program Files\Apache Group\Apache\Apache.exe" --ntservice (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - F:\Security\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - F:\Security\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - F:\Security\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - F:\Security\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: ewido security suite control - ewido networks - f:\security\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - f:\security\ewido anti-malware\ewidoguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe O23 - Service: MySQL - Unknown owner - C:\MYSQL\BIN\MYSQLD-NT.exe

Bieniol · 23 Maj 2006 17:05

W logu jest czysto

Przeleć kompa --> Skanerami OnLine