Anderkent
29 Wrzesień 2007 04:14
#1
Od pewnego czasu ( a dokładniej próby uruchomienia pewnego programu, gah) Symantec Antivirus wykrywa i izoluje mniej więcej dwa trojany dziennie. Głębokie skany nic nie dają, i tak następnego dnia pojawia się coś nowego. Dodatkowo w czasie przeglądania internetu w IE ‘wyskakują’ okienka z wiadomościami ‘Your PC may be infected’ etc sugerujące pobranie różnych programów.
Proszę o sprawdzenie loga:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 06:10:51, on 2007-09-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: G:\WINDOWS\System32\smss.exe G:\WINDOWS\system32\winlogon.exe G:\WINDOWS\system32\services.exe G:\WINDOWS\system32\lsass.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\System32\svchost.exe G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe G:\WINDOWS\system32\spoolsv.exe G:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe G:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe G:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe G:\WINDOWS\system32\nvsvc32.exe G:\WINDOWS\system32\wscntfy.exe G:\WINDOWS\Explorer.EXE G:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe G:\WINDOWS\system32\RUNDLL32.EXE G:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe G:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe G:\Program Files\Java\j2re1.4.2_15\bin\jucheck.exe G:\WINDOWS\System32\svchost.exe C:\Program Files\iTunes\iTunesHelper.exe G:\Program Files\SlySoft\CloneCD\CloneCDTray.exe G:\WINDOWS\system32\ctfmon.exe G:\Program Files\Gadu-Gadu\gg.exe G:\Program Files\DAEMON Tools\daemon.exe G:\Program Files\BitTorrent_DNA\dna.exe G:\Program Files\NETGEAR\WG311v3\wlancfg5.exe G:\WINDOWS\system32\svchost.exe G:\Program Files\iPod\bin\iPodService.exe G:\Documents and Settings\Jarek\Pulpit\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [vptray] G:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE G:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [sunJavaUpdateSched] “G:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe” O4 - HKLM…\Run: [Adobe Photo Downloader] “G:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe” O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “G:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” O4 - HKLM…\Run: [QuickTime Task] “G:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKLM…\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe” O4 - HKLM…\Run: [CloneCDTray] “G:\Program Files\SlySoft\CloneCD\CloneCDTray.exe” /s O4 - HKLM…\Run: [searchIndexer] rundll32.exe “G:\WINDOWS\system32\odqpiaaj.dll”,sitypnow O4 - HKCU…\Run: [CTFMON.EXE] G:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “G:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [DAEMON Tools] “G:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKCU…\Run: [AutoPowerOn] G:\Program Files\AutoPowerOn\AutoPowerOn.exe O4 - HKCU…\Run: [spybotSD TeaTimer] G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU…\Run: [bitTorrent DNA] “G:\Program Files\BitTorrent_DNA\dna.exe” O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = G:\Program Files\NETGEAR\WG311v3\wlancfg5.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - G:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: DefWatch - Symantec Corporation - G:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - G:\Program Files\iPod\bin\iPodService.exe O23 - Service: Klient Symantec AntiVirus (Norton AntiVirus Server) - Symantec Corporation - G:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe – End of file - 5909 bytes
jessica
29 Wrzesień 2007 07:56
#2
>>Hijack>>scan(Do a system scan only)>>zaznacz (V) >> Fix checked .
Masz infekcję " VUNDO ", więc na początek użyj -->ComboFix
Log z ComboFixa wklej na http://wklej.org/
jessi