Trojan Win32:BHO-KD[Trj] wykryty przez awasta

robert_0601 · 9 Luty 2008 17:01

ten sam problem co koledzy wyzej;/

ComboFix 08-02.02.5 - robert 2008-02-04 14:44:46.5 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.123 [GMT 1:00]

Running from: C:\Downloads\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED

.

((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))

.

2008-02-03 21:13 . 2008-02-03 21:20

2008-02-03 13:11 . 2007-10-11 00:52 6,065,664 -----c— C:\WINDOWS\system32\dllcache\ieframe.dll

2008-02-03 13:11 . 2007-07-01 04:31 2,455,488 -----c— C:\WINDOWS\system32\dllcache\ieapfltr.dat

2008-02-03 13:11 . 2007-07-01 04:36 1,036,288 -----c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui

2008-02-03 13:11 . 2007-10-11 00:52 459,264 -----c— C:\WINDOWS\system32\dllcache\msfeeds.dll

2008-02-03 13:11 . 2007-10-11 00:52 383,488 -----c— C:\WINDOWS\system32\dllcache\ieapfltr.dll

2008-02-03 13:11 . 2007-10-11 00:52 267,776 -----c— C:\WINDOWS\system32\dllcache\iertutil.dll

2008-02-03 13:11 . 2007-10-11 00:52 63,488 -----c— C:\WINDOWS\system32\dllcache\icardie.dll

2008-02-03 13:11 . 2007-10-11 00:52 52,224 -----c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll

2008-02-03 13:11 . 2007-10-10 11:59 13,824 -----c— C:\WINDOWS\system32\dllcache\ieudinit.exe

2008-02-03 13:10 . 2008-02-03 13:13

2008-02-03 03:35 . 2008-02-03 03:35 192 --a------ C:\WINDOWS\VplayerINI.vpl

2008-02-03 03:34 . 2008-02-03 03:35 1,038 --a------ C:\WINDOWS\VPlayer.INI

2008-01-30 17:54 . 2008-01-30 17:54

2008-01-30 17:53 . 2008-01-30 17:53

2008-01-30 13:05 . 2008-01-30 13:13

2008-01-30 13:05 . 2008-01-30 19:47

2008-01-30 12:31 . 2004-04-12 17:27 1,081,616 --a------ C:\WINDOWS\system32\mscomctl.ocx

2008-01-30 12:31 . 2004-04-12 17:27 609,584 --a------ C:\WINDOWS\system32\comctl32.ocx

2008-01-30 12:30 . 2008-01-30 12:31

2008-01-30 12:30 . 2004-04-12 17:27 152,848 --a------ C:\WINDOWS\system32\comdlg32.ocx

2008-01-30 12:28 . 2008-02-04 14:29

2008-01-30 12:27 . 2008-01-30 12:28

2008-01-30 12:27 . 2008-02-03 14:53

2008-01-30 12:26 . 2008-01-30 12:27 3,663,208 --a------ C:\Program Files\BSINSTALLPL_(http://www.programs.pl).exe

2008-01-30 07:46 . 2008-02-04 14:43

2008-01-30 06:41 . 2008-02-03 12:31 1,665 --a------ C:\WINDOWS\bestplayer.ini

2008-01-30 06:41 . 2008-02-03 12:31 68 --a------ C:\WINDOWS\bestplayer.bpp

2008-01-30 06:41 . 2008-02-03 12:31 0 --a------ C:\WINDOWS\bestplayer.bbt

2008-01-30 06:29 . 2008-01-30 07:46

2008-01-30 06:27 . 2008-01-30 06:27

2008-01-30 06:25 . 19,584 C:\WINDOWS\system32\drivers\qknspmfu.dat

2008-01-30 06:20 . 2008-01-30 06:20 120,576 --a------ C:\WINDOWS\system32\joslihqi.dat

2008-01-30 06:14 . 2008-01-30 08:40

2008-01-30 06:14 . 2008-02-02 21:27 83,968 --a------ C:\WINDOWS\system32\cmcfg32s.dll

2008-01-30 06:14 . 2008-01-30 06:14 17,408 --a------ C:\WINDOWS\system32\eo50e1yext2z.exe

2008-01-30 06:13 . 2006-03-02 13:00 83,968 --a------ C:\WINDOWS\system32\dinput8i.dll

2008-01-30 05:43 . 2008-01-30 05:45

2008-01-30 05:34 . 2008-01-30 05:35 23,405,072 --a------ C:\Program Files\AdbeRdr811_en_US.exe

2008-01-30 03:39 . 2006-03-02 13:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

2008-01-30 03:19 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe

2008-01-30 01:14 . 2006-03-17 01:38 28,672 --------- C:\WINDOWS\system32\verclsid.exe

2008-01-29 19:17 . 2008-01-29 19:17

2008-01-29 19:16 . 2008-01-29 19:39

2008-01-29 19:15 . 2008-01-29 19:15

2008-01-29 19:14 . 2008-01-29 19:14 4,349,168 --a------ C:\Program Files\gg77.exe

2008-01-29 19:08 . 2008-01-29 19:08

2008-01-29 19:07 . 2008-01-29 19:07

2008-01-29 19:06 . 2008-01-29 19:06

2008-01-29 19:05 . 2008-01-29 19:05

2008-01-29 19:05 . 2008-02-04 06:02 177 --a------ C:\WINDOWS\LEXSTAT.INI

2008-01-29 19:02 . 2008-01-29 19:03

2008-01-29 19:02 . 2001-10-26 17:29 87,040 --a------ C:\WINDOWS\system32\wiafbdrv.dll

2008-01-29 19:02 . 2001-10-26 17:29 87,040 --a–c— C:\WINDOWS\system32\dllcache\wiafbdrv.dll

2008-01-29 19:02 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys

2008-01-29 19:02 . 2004-08-03 22:58 15,104 --a–c— C:\WINDOWS\system32\dllcache\usbscan.sys

2008-01-26 22:17 . 2006-02-15 01:22 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys

2008-01-26 22:17 . 2006-06-14 10:00 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys

2008-01-26 22:17 . 2006-06-14 09:47 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys

2008-01-26 22:17 . 2004-08-03 23:58 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys

2008-01-26 22:17 . 2004-08-04 00:07 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys

2008-01-26 22:16 . 2006-06-14 09:47 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys

2008-01-26 22:16 . 2004-08-04 00:15 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys

2008-01-26 22:16 . 2001-08-17 23:00 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys

2008-01-26 22:16 . 2004-08-04 00:07 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys

2008-01-26 22:16 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys

2008-01-26 22:16 . 2004-08-03 23:58 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys

2008-01-26 22:16 . 2004-08-03 23:58 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2008-01-26 22:16 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys

2008-01-26 22:15 . 2004-08-04 01:44 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll

2008-01-26 22:15 . 2004-08-03 23:29 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys

2008-01-26 22:15 . 2004-08-04 01:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys

2008-01-26 22:15 . 2004-08-04 00:08 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys

2008-01-26 22:14 . 2004-08-04 00:15 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys

2008-01-26 22:14 . 2004-08-04 01:44 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax

2008-01-26 22:14 . 2004-08-03 23:32 84,480 --a------ C:\WINDOWS\system32\drivers\ac97via.sys

2008-01-26 22:14 . 2004-08-04 01:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll

2008-01-26 22:14 . 2004-08-04 00:08 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys

2008-01-26 22:14 . 2004-08-04 00:07 42,240 --a------ C:\WINDOWS\system32\drivers\VIAAGP.SYS

2008-01-26 22:14 . 2004-08-04 01:44 4,096 --a------ C:\WINDOWS\system32\ksuser.dll

2008-01-26 22:12 . 2008-02-03 13:13 1,355 --a------ C:\WINDOWS\imsins.BAK

2008-01-26 22:11 . 2008-02-04 14:35

2008-01-26 22:11 . 2008-01-26 22:11

2008-01-26 22:11 . 2008-01-29 18:18

2008-01-26 22:11 . 2008-01-26 22:11

2008-01-26 22:11 . 2008-02-03 21:13

2008-01-26 22:11 . 2008-01-29 18:26

2008-01-26 22:11 . 2008-01-29 18:20

2008-01-26 22:10 . 2008-02-04 03:01

2008-01-26 22:10 . 2008-02-03 13:03

2008-01-26 22:10 . 2008-01-26 22:11

2008-01-26 22:10 . 2008-01-30 05:44

2008-01-26 22:10 . 2006-03-02 13:00 1,086,058 -ra------ C:\WINDOWS\SET4.tmp

2008-01-26 22:10 . 2006-03-02 13:00 1,014,483 -ra------ C:\WINDOWS\SET3.tmp

2008-01-26 22:08 . 2008-01-29 18:31 261 --a------ C:\WINDOWS\system32$winnt$.inf

2008-01-26 22:08 . 2008-01-29 18:16 211 —hs---- C:\boot.ini

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-04 13:42 --------- d-----w C:\Program Files\Neostrada TP

2008-02-03 20:13 --------- d–h--w C:\Program Files\InstallShield Installation Information

2008-02-03 20:12 --------- d-----w C:\Program Files\Common Files\InstallShield

2008-01-29 17:59 --------- d-----w C:\Program Files\Google

2008-01-29 17:58 1,150,016 ----a-w C:\Program Files\GoogleToolbarInstaller.exe

2008-01-29 17:43 --------- d-----w C:\Program Files\Thomson

2008-01-29 17:42 --------- d-----w C:\Program Files\Java

2008-01-29 17:26 --------- d-----w C:\Program Files\microsoft frontpage

2008-01-29 17:22 --------- d-----w C:\Program Files\Usługi online

2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr

2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\lsasrv.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{5B7336B5-2341-400D-96CC-C31F887C3F77}]

2006-03-02 13:00 83968 --a------ C:\WINDOWS\system32\dinput8i.dll

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{72ADB829-6D7E-480A-84A9-F788D144206E}]

2008-02-02 21:27 83968 --a------ c:\windows\system32\cmcfg32s.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2008-02-03 22:05 68856]

“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-11-14 11:54 2131392]

“eo50e1yext2z”=“C:\WINDOWS\system32\eo50e1yext2z.exe” [2008-01-30 06:14 17408]

“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2006-03-02 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“WooCnxMon”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [2003-10-16 18:07 24576]

“SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-01-26 11:38 866816]

“WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2003-10-16 18:07 20480]

“WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [2003-10-16 18:07 53248]

“Lexmark X74-X75”=“C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe” [2002-10-14 21:20 57344]

“Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-10-10 19:51 39792]

“eo50e1yext2z”=“C:\WINDOWS\system32\eo50e1yext2z.exe” [2008-01-30 06:14 17408]

“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 14:00 79224]

“WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2008-01-15 23:54 37376]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2006-03-02 13:00 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

GetRight.lnk - C:\Program Files\GetRight\GetRight.exe [2008-01-30 06:29:31 4240448]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]

appsecdll REG_EXPAND_SZ C:\WINDOWS\system32\AppCert\wsil32.dll

R0 zvwxfrjs;zvwxfrjs;C:\WINDOWS\system32\drivers\qknspmfu.dat []

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-04 14:48:11

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

prosze POMOCY :!:

Gutek · 9 Luty 2008 18:55

Pobierz program SDFix

robert_0601 · 10 Luty 2008 23:07

SDFix: Version 1.140

Run by robert on 2008-02-04 at 19:04

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:

Checking Services:

Name:

zvwxfrjs

Path:

system32\drivers\qknspmfu.dat

zvwxfrjs - Deleted

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Rebooting…

Service zvwxfrjs - Deleted after Reboot

Normal Mode:

Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\drivers\qknspmfu.dat - Deleted

C:\WINDOWS\SYSTEM32\DINPUT8I.DLL - Deleted

Removing Temp Files…

ADS Check:

Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-04 19:13:02

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]

“Order”=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,…

scanning hidden files …

C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 65536 bytes

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 1

Remaining Services:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

“C:\WINDOWS\system32\eo50e1yext2z.exe”=“C:\WINDOWS\system32\eo50e1yext2z.exe:*:Disabled:eo50e1yext2z”

“C:\Program Files\BearShare\BearShare.exe”=“C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare”

“C:\Program Files\Gadu-Gadu\gg.exe”=“C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny”

“C:\Program Files\Valve\hl.exe”=“C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher”

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Finished!

chyba wszystko poszlo dobrze

Gutek · 11 Luty 2008 18:31

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=213350

Daj log z ComboFix

robert_0601 · 13 Luty 2008 18:04

http://wklej.org/id/1be28b2473

or

http://wklej.org/id/0a6ae88572

jessica · 15 Luty 2008 17:25

Wklej do Notatnika :

File::

C:\WINDOWS\system32\eo50e1yext2z.exe

C:\WINDOWS\system32\cmcfg32s.dll


Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72ADB829-6D7E-480A-84A9-F788D144206E}]

>>Plik>>Zapisz jako… >>> CFScript

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe

– podobnie jak na tym obrazku –>

Ma się rozpocząć usuwanie. (i powstanie log).

Daj ten log, który powstanie w trakcie usuwania. (na wklej.org).

Jeśli pójdzie dobrze, to:

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Sprawdź go na – http://virusscan.jotti.org/

albo na http://www.virustotal.com/en/indexf.html.

jessi

robert_0601 · 23 Luty 2008 16:41

http://wklej.org/id/49c9b6e17c

Leon1 · 23 Luty 2008 19:12

Otwórz notatnik i wklej

Windows Registry Editor Version 5.00


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"eo50e1yext2z"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

"eo50e1yext2z"=-

zapisz jako plik.reg >> wszystkie pliki >> scal z rejestrem >> restart

powstanie plik o takiej ikonie

w który dwa razy klikniesz potwierdzisz chęć dodania do rejestru potem restart

po za tym czysto

robert_0601 · 1 Marzec 2008 20:27

dzieki =D>