Problem z Open (0)

[robert_rurka]

Prosze o sprawdzenie loga mam chyba wirusa zwiazanego z CTFMON.exe. Partycje na dysku twardym nie otwieraja sie przez klikniecie bo dodane zostalo Open (0) prosze o pomoc o to log z hijacka

Logfile of HijackThis v1.99.1 Scan saved at 21:44:36, on 2007-05-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\VDOTool\TBPanel.exe C:\WINDOWS\system32\RunDLL32.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Ad Muncher\AdMunch.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\eMule\emule.exe C:\Program Files\D-Link AirPlus\AirPlus.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Gadu-Gadu\gg.exe D:\Instalki Programow_Do Netu\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll O4 - HKLM…\Run: [skyTel] SkyTel.EXE O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [Ad Muncher] “C:\Program Files\Ad Muncher\AdMunch.exe” /bt O4 - HKCU…\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - Global Startup: D-Link AirPlus.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Block frame with Ad Muncher - http://www.admuncher.com/request_will_b … u_ie_frame O8 - Extra context menu item: Block image with Ad Muncher - http://www.admuncher.com/request_will_b … u_ie_image O8 - Extra context menu item: Block link with Ad Muncher - http://www.admuncher.com/request_will_b … nu_ie_link O8 - Extra context menu item: Don’t filter page with Ad Muncher - http://www.admuncher.com/request_will_b … ie_exclude O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Report page to the Ad Muncher developers - http://www.admuncher.com/request_will_b … _ie_report O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra ‘Tools’ menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

z gory dziekuje za pomoc. Czekam na odp.

[Joan (Joan Sunshine)]

log ok, daj SilentRunners, skan AVG AntySpyware 7.5 po update, wklej raport.

[robert_rurka]

SilentRunners nie dziala “Dostem do Hosta skryptow Windows jest wylaczony na tym komputerze. Skontaktuj sie z adm…” a tu jest rapor z AVG AntySpyware 7.5 po update

--------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 23:32:06 2007-05-30 + Scan result: C:\Documents and Settings\Rurka\Cookies\rurka@ad.adocean[1].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Rurka\Cookies\rurka@gde.adocean[1].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Rurka\Cookies\rurka@gde.adocean[3].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Rurka\Cookies\rurka@gg.adocean[2].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Rurka\Cookies\rurka@hit.gemius[1].txt -> TrackingCookie.Gemius : Cleaned. C:\Documents and Settings\Rurka\Cookies\rurka@hit.gemius[2].txt -> TrackingCookie.Gemius : Cleaned. C:\Documents and Settings\Rurka\Cookies\rurka@hit.gemius[3].txt -> TrackingCookie.Gemius : Cleaned. C:\Documents and Settings\Rurka\Cookies\rurka@hit.gemius[4].txt -> TrackingCookie.Gemius : Cleaned. C:\Documents and Settings\Rurka\Cookies\rurka@ie.search.msn[2].txt -> TrackingCookie.Msn : Cleaned. ::Report end

[Joan (Joan Sunshine)]

tu nic nie ma

O problemach z Silentem poczytaj tutaj -> KLIK

[robert_rurka]

hmm a nie moze sie obejsc bez tego silenta ? bo nie moge znalezc topiku wyjasniajacy problem zwiazany z moim nie dzialaniem jego. A poza tym nie ma jakies latki czy cos takiego na tego wirusa/ robacka Dodam jeszcze ze zaczelo sie od zaatakowania pliku CTFMON.exe w koszu. Czekam na podpowiedz

[Gutek]

Daj log z Combofix

[robert_rurka]

Sie robi

“Rurka” - 2007-05-31 1:03:26 Dodatek Service Pack 2 ComboFix 07-05.27.BV - Running from: “C:\Downloads” ((((((((((((((((((((((((((((((( Files Created from 2007-04-28 to 2007-05-30 )))))))))))))))))))))))))))))))))) 2007-05-30 23:15 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-05-02 00:03 2007-04-30 11:21 2007-04-19 19:15 706 --a------ C:\WINDOWS\unins001.dat 2007-04-16 07:58 2007-04-16 07:58 2007-04-10 17:49 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-04-07 14:15 92,064 --a------ C:\Documents and Settings\Rurka\mqdmmdm.sys 2007-04-07 14:15 92,064 --a------ C:\DOCUME~1\Rurka\mqdmmdm.sys 2007-04-07 14:15 9,232 --a------ C:\Documents and Settings\Rurka\mqdmmdfl.sys 2007-04-07 14:15 9,232 --a------ C:\DOCUME~1\Rurka\mqdmmdfl.sys 2007-04-07 14:15 79,328 --a------ C:\Documents and Settings\Rurka\mqdmserd.sys 2007-04-07 14:15 79,328 --a------ C:\DOCUME~1\Rurka\mqdmserd.sys 2007-04-07 14:15 66,656 --a------ C:\Documents and Settings\Rurka\mqdmbus.sys 2007-04-07 14:15 66,656 --a------ C:\DOCUME~1\Rurka\mqdmbus.sys 2007-04-07 14:15 6,208 --a------ C:\Documents and Settings\Rurka\mqdmcmnt.sys 2007-04-07 14:15 6,208 --a------ C:\DOCUME~1\Rurka\mqdmcmnt.sys 2007-04-07 14:15 5,936 --a------ C:\Documents and Settings\Rurka\mqdmwhnt.sys 2007-04-07 14:15 5,936 --a------ C:\DOCUME~1\Rurka\mqdmwhnt.sys 2007-04-07 14:15 4,048 --a------ C:\Documents and Settings\Rurka\mqdmcr.sys 2007-04-07 14:15 4,048 --a------ C:\DOCUME~1\Rurka\mqdmcr.sys 2007-04-07 13:26 25,600 --a------ C:\Documents and Settings\Rurka\usbsermptxp.sys 2007-04-07 13:26 25,600 --a------ C:\DOCUME~1\Rurka\usbsermptxp.sys 2007-04-07 13:26 22,768 --a------ C:\Documents and Settings\Rurka\usbsermpt.sys 2007-04-07 13:26 22,768 --a------ C:\DOCUME~1\Rurka\usbsermpt.sys 2007-04-07 13:26 2007-04-07 12:52 2007-04-07 12:50 2007-04-07 12:50 2007-04-07 12:48 2007-04-07 11:29 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2007-04-07 01:12 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-04-07 01:12 165,376 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-04-05 22:52 2007-04-05 22:46 2007-04-05 22:46 2007-04-05 22:44 5,248 --a------ C:\WINDOWS\system32\drivers\Vax347s.sys 2007-04-05 22:44 159,616 --a------ C:\WINDOWS\system32\drivers\Vax347b.sys 2007-04-05 22:44 2007-04-05 22:40 2007-04-05 22:40 2007-04-05 22:36 2007-04-05 19:38 2007-04-05 19:36 2007-04-05 19:24 1,416 --a------ C:\WINDOWS\unins000.dat 2007-04-05 17:31 2007-04-05 16:06 2007-04-04 17:57 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:41:56 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 15:39:42 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 15:38:52 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 15:37:24 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-09 06:22:22 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-09 06:22:22 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-03-15 10:00:36 466,432 ----a-w C:\WINDOWS\system32\SkanerOnline.dll 2007-03-12 15:40:20 113,548 ----a-w C:\WINDOWS\hpoins07.dat 2007-03-12 14:35:14 0 --sha-r C:\MSDOS.SYS 2007-03-12 14:35:14 0 --sha-r C:\IO.SYS 2007-03-12 14:35:14 0 ----a-w C:\CONFIG.SYS 2007-03-12 14:35:14 0 ----a-w C:\AUTOEXEC.BAT 2007-03-12 14:32:42 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 11:56] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}=C:\Program Files\FlashGet\jccatch.dll [2007-01-29 11:46] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {F156768E-81EF-470C-9057-481BA8380DBA}=C:\Program Files\FlashGet\getflash.dll [2007-01-15 05:40] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SkyTel”=“SkyTel.EXE” [] “RTHDCPL”=“RTHDCPL.EXE” [] “Gainward”=“C:\Program Files\VDOTool\TBPanel.exe” [2006-09-13 09:58] “nwiz”=“nwiz.exe” [2006-08-11 14:43 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“NvMCTray.dll” [2006-08-11 14:43 C:\WINDOWS\system32\nvmctray.dll] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] “iKeyWorks”=“C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe” [2002-03-12 16:48] “RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2003-10-31 19:42] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2006-11-12 11:48] “Ad Muncher”=“C:\Program Files\Ad Muncher\AdMunch.exe” [2007-04-05 23:55] “!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2006-10-07 14:20] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “eMuleAutoStart”=“C:\Program Files\eMule\emule.exe” [2006-09-14 16:15] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [2006-09-28 16:13] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] ALCMTR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\PROGRA~1\FLASHGET\Flashget.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\Recycled\ctfmon.exe Open(&O)\command- C:\Recycled\Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command- D:\Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command- E:\Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command- F:\Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command- G:\Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command- H:\Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] AutoRun\command- J:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command- K:\Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{5a5f3a68-d0cd-11db-9f90-0013469f4da0}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command- M:\Recycled\ctfmon.exe *Newly Created Service* - AVG_ANTI-SPYWARE_DRIVER *Newly Created Service* - AVG_ANTI-SPYWARE_GUARD ******************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-31 01:04:14 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2007-05-31 1:04:15 — E O F —

[Gutek]

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=509

Proszę opróżnić KOSZ