Smitfraud-C.Toolbar888 i ErrorSafe

sebusdm · 24 Maj 2007 16:11

Co jakiś czas wyskakuje mi okienko rekomendujące załadowanie ErrorSafe oraz okno ze stroną tego syfu. Dodatkowo wyskakuje mi strony w rodzaju broadcaster.com itd.

SpyBot pokazuje mi, że w rejestrach jest Smitfraud-C.Toolbar888, którego niby usuwa i zaraz jest ponownie, a także komunikat o MicrosoftWindowsSecurityCenter.AntivirusOverride (choć nie mam pewnosci, ze to wirus?).

Logfile of HijackThis v1.99.1 Scan saved at 18:00:24, on 2007-05-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\VIA\RAID\raid_tool.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\D-Tools\daemon.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\OpenOffice.ux.pl 2.0\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.0\program\soffice.BIN C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Instalki\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\vcgqrfrx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll O4 - HKLM…\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [DAEMON Tools-1033] “C:\Program Files\D-Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe” O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [setup] rundll32.exe “C:\WINDOWS\system32\nxwgtrsl.dll”,realset O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [RealPlayer] “C:\Program Files\Real\RealPlayer\realplay.exe” /RunUPGToolCommandReBoot O4 - HKCU…\Run: [NBJ] “C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” O4 - Startup: OpenOffice.ux.pl 2.0.lnk = C:\Program Files\OpenOffice.ux.pl 2.0\program\quickstart.exe O8 - Extra context menu item: Download with Star Downloader - C:\Program Files\Star Downloader\sdie.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp02.photoprintit.de/microsite/ … loader.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{4AEF5776-78CB-4C98-91D1-3CBD6069734F}: NameServer = 10.101.1.1,194.204.159.1,62.233.128.17 O17 - HKLM\System\CS1\Services\Tcpip…{4AEF5776-78CB-4C98-91D1-3CBD6069734F}: NameServer = 10.101.1.1,194.204.159.1,62.233.128.17 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\MKS\Bin\mksmonsv.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe

Gutek · 24 Maj 2007 16:14

Użyj VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone.

Daj log z Combofix

sebusdm · 24 Maj 2007 21:30

VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone użyte jednak zupełnie nie mogę sobie poradzić z Combofix. Czy to możliwe żeby skanował półtorej godziny? Nic się nie dzieje i wygląda jakby po prostu program stał.

qrczak13 · 24 Maj 2007 21:34

http://www.unicorn.ksiezyc.pl/WWW/instrukcje/combofix.html

http://cybertrash.pl/images/tata/ComboFix.html

Poczytaj o combofix.

C:\ComboFix.txt - wejdź i zobacz czy nie masz takiego pliku.

sebusdm · 24 Maj 2007 22:20

Udało się, dzięki

“Seba” - 2007-05-24 23:49:13 Dodatek Service Pack 2 ComboFix 07-05.24.7.V - Running from: “C:\Documents and Settings\Seba\Pulpit” ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-25 )))))))))))))))))))))))))))))))))) 2007-05-23 23:26 2007-05-23 23:26 2007-05-23 23:26 2007-05-22 20:14 627,004 —hs---- C:\WINDOWS\system32\rqtwa.bak2 2007-05-22 20:14 627,004 —hs---- C:\WINDOWS\system32\rqtwa.bak2 2007-05-22 20:14 627,004 —hs---- C:\WINDOWS\system32\rqtwa.bak2 2007-05-22 20:06 2007-05-22 20:06 2007-05-22 20:06 2007-05-21 20:24 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-05-21 20:24 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-05-21 20:24 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-05-21 20:24 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-05-21 20:24 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-05-21 20:24 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-05-21 20:24 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-05-21 20:24 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-05-21 20:24 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-05-21 20:24 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-05-21 20:24 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-05-21 20:24 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-05-21 20:24 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-05-21 20:24 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-05-21 20:24 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-05-21 20:23 95,872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-05-21 20:23 95,872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-05-21 20:23 95,872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-05-21 20:23 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-05-21 20:23 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-05-21 20:23 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-05-21 20:23 2007-05-21 20:23 2007-05-21 20:23 2007-05-21 20:14 610,138 —hs---- C:\WINDOWS\system32\rqtwa.bak1 2007-05-21 20:14 610,138 —hs---- C:\WINDOWS\system32\rqtwa.bak1 2007-05-21 20:14 610,138 —hs---- C:\WINDOWS\system32\rqtwa.bak1 2007-05-21 20:14 262,708 --ahs---- C:\WINDOWS\system32\awtqr.dll.vir 2007-05-21 20:14 262,708 --ahs---- C:\WINDOWS\system32\awtqr.dll.vir 2007-05-21 20:14 262,708 --ahs---- C:\WINDOWS\system32\awtqr.dll.vir 2007-05-16 19:17 2007-05-16 19:17 2007-05-16 19:17 2007-05-16 19:15 2007-05-16 19:15 2007-05-16 19:15 2007-05-15 19:51 5,505,024 --a------ C:\DOCUME~1\Seba\ntuser.dat 2007-05-15 19:51 5,505,024 --a------ C:\DOCUME~1\Seba\ntuser.dat 2007-05-15 19:51 5,505,024 --a------ C:\DOCUME~1\Seba\ntuser.dat 2007-05-12 14:04 2007-05-12 14:04 2007-05-12 14:04 2007-05-11 02:23 2007-05-11 02:23 2007-05-11 02:23 2007-05-03 23:00 2007-05-03 23:00 2007-05-03 23:00 2007-05-03 23:00 2007-05-03 23:00 2007-05-03 23:00 2007-05-01 16:14 2007-05-01 16:14 2007-05-01 16:14 2007-04-30 22:38 2007-04-30 22:38 2007-04-30 22:38 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-24 19:33:36 -------- d-----w C:\DOCUME~1\Seba\DANEAP~1\OpenOffice.ux.pl2 2007-05-24 16:43:44 -------- d-----w C:\Program Files\DC++ 2007-05-21 18:08:06 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-18 21:09:20 -------- d-----w C:\DOCUME~1\Seba\DANEAP~1\Skype 2007-05-16 15:11:04 -------- d-----w C:\Program Files\Free Easy Burner 2007-04-21 11:43:36 -------- d-----w C:\Program Files\Alcohol Soft 2007-04-04 19:43:51 -------- d-----w C:\Program Files\SkanerOnline 2007-03-25 19:47:04 50,748 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-03-25 19:47:04 358,702 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-03-20 19:50:39 -------- d-----w C:\Program Files\Micro Application 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys 2007-02-05 20:19:48 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-05-12 00:47] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll [2006-11-09 16:21] {FFFFFEF0-5B30-21D4-945D-000000000000}=C:\PROGRA~1\STARDO~1\SDIEInt.dll [2006-02-26 14:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “RaidTool”=“C:\Program Files\VIA\RAID\raid_tool.exe” [2005-06-20 18:53] “SoundMan”=“SOUNDMAN.EXE” [] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “DAEMON Tools-1033”=“C:\Program Files\D-Tools\daemon.exe” [2004-08-22 17:05] “QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2006-08-17 20:39] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe” [2006-11-09 16:07] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-10-22 13:22] “nwiz”=“nwiz.exe” [2006-10-22 13:22 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-10-22 13:22] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 14:00] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 18:24] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2006-02-17 15:03] “RealPlayer”=“C:\Program Files\Real\RealPlayer\realplay.exe” [2006-06-02 23:55] “NBJ”=“C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” [2005-06-02 15:03] “Start WingMan Profiler”="" [] ******************************************************************** catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-25 00:16:07 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-25 0:16:35 — E O F —

Gutek · 24 Maj 2007 22:32

Już jest Ok, możesz skasować