Win32/Adware.Virtumonde.FP aplikacja


(Maiones1) #1

Mam podobny problem prosze o pomoc.

Oto scan z hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:52:46, on 2002-01-01

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\WinKey.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\WINDOWS\System32\rundll32.exe

C:\WINDOWS\System32\rundll32.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Winamp Remote\bin\OrbTray.exe

C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

F2 - REG:system.ini: Shell=explorer.exe

O2 - BHO: (no name) - {9292C2AD-D36E-4051-AF6D-0C6D2AEE0C10} - C:\WINDOWS\System32\yayxxxvt.dll

O2 - BHO: (no name) - {B8559A0A-23B0-411C-A222-30B453ED77C3} - C:\WINDOWS\System32\efccaaxv.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM..\Run: [nwiz] nwiz.exe /install

O4 - HKLM..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM..\Run: [WinDLL (Wseclayer.exe)] rundll32.exe C:\WINDOWS\System32\Wseclayer.exe,start

O4 - HKLM..\Run: [WinDLL (tepmlayer.exe)] rundll32.exe C:\WINDOWS\System32\tepmlayer.exe,start

O4 - HKLM..\Run: [WinDLL (mysnlive.exe)] rundll32.exe C:\WINDOWS\System32\mysnlive.exe,start

O4 - HKLM..\Run: [WinDLL (start0s.exe)] rundll32.exe C:\WINDOWS\System32\start0s.exe,start

O4 - HKLM..\Run: [Microsoft Winedows startup] WinKey.exe

O4 - HKLM..\Run: [Windows Network Firewall] C:\WINDOWS\System32\firewall.exe

O4 - HKLM..\Run: [WinDLL (msygl32.exe)] rundll32.exe C:\WINDOWS\System32\msygl32.exe,start

O4 - HKLM..\Run: [Windows Explorer] C:\WINDOWS\System32\explorer.exe

O4 - HKLM..\Run: [bM13eb99c2] Rundll32.exe "C:\WINDOWS\System32\letowtbc.dll",s

O4 - HKLM..\RunServices: [Microsoft Winedows startup] WinKey.exe

O4 - HKLM..\RunOnce: [Microsoft Winedows startup] WinKey.exe

O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background

O4 - HKCU..\Run: [Microsoft Winedows startup] WinKey.exe

O4 - HKCU..\Run: [Gadu-Gadu] "F:\Gadu-Gadu\gg.exe" /tray

O4 - HKCU..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash

O4 - HKCU..\RunOnce: [Microsoft Winedows startup] WinKey.exe

O4 - HKUS\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')

O4 - HKUS\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')

O4 - HKUS\S-1-5-21-789336058-1715567821-839522115-1003..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?')

O4 - HKUS\S-1-5-21-789336058-1715567821-839522115-1003..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background (User '?')

O4 - HKUS\S-1-5-21-789336058-1715567821-839522115-1003..\Run: [Microsoft Winedows startup] WinKey.exe (User '?')

O4 - HKUS\S-1-5-21-789336058-1715567821-839522115-1003..\Run: [Gadu-Gadu] "F:\Gadu-Gadu\gg.exe" /tray (User '?')

O4 - HKUS\S-1-5-21-789336058-1715567821-839522115-1003..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash (User '?')

O4 - HKUS\S-1-5-21-789336058-1715567821-839522115-1003..\RunOnce: [Microsoft Winedows startup] WinKey.exe (User '?')

O4 - HKUS\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')

O4 - HKUS\S-1-5-18..\RunOnce: [Microsoft Winedows startup] WinKey.exe (User '?')

O4 - HKUS.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - HKUS.DEFAULT..\RunOnce: [Microsoft Winedows startup] WinKey.exe (User 'Default user')

O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O17 - HKLM\System\CCS\Services\Tcpip..{01B20810-669C-426C-BFA0-212C487BAB28}: NameServer = 213.241.79.37 83.238.255.76

O17 - HKLM\System\CS1\Services\Tcpip..{01B20810-669C-426C-BFA0-212C487BAB28}: NameServer = 213.241.79.37 83.238.255.76

O17 - HKLM\System\CS2\Services\Tcpip..{01B20810-669C-426C-BFA0-212C487BAB28}: NameServer = 213.241.79.37 83.238.255.76

O20 - Winlogon Notify: yayxxxvt - C:\WINDOWS\SYSTEM32\yayxxxvt.dll

O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--

End of file - 5707 bytes

Dziekoweczka z gory :slight_smile:


(Gutek) #2

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=213350

Automaty Tobie pomogą:

Użyj SmitFraudFix wybierz opcji nr 2 , oczywiście w trybie awaryjnym i po tym Daj log z ComboFix