Win32/Pacex

[Stolar20 (Stolar99)]

Siemano, mam problem z virusem Win32/Pacex.

Plik : D:\Documents and Settings\Administrator.KOMPUTER\Ustawienia lokalne\Temp\cvasds0.dll

log z hijacktis’a

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:05:43, on 2010-02-21

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20583)

Boot mode: Normal


Running processes:

D:\WINDOWS.1\System32\smss.exe

D:\WINDOWS.1\system32\winlogon.exe

D:\WINDOWS.1\system32\services.exe

D:\WINDOWS.1\system32\lsass.exe

D:\WINDOWS.1\system32\svchost.exe

D:\WINDOWS.1\System32\svchost.exe

D:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe

D:\WINDOWS.1\system32\svchost.exe

D:\WINDOWS.1\system32\LEXBCES.EXE

D:\WINDOWS.1\system32\spoolsv.exe

D:\WINDOWS.1\system32\LEXPPS.EXE

D:\WINDOWS.1\Explorer.EXE

D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

D:\Program Files\ATK Hotkey\HcontrolUser.exe

D:\Program Files\ATK Hotkey\Hcontrol.exe

D:\Program Files\ATK Hotkey\MsgTranAgt.exe

D:\Program Files\Lenovo\Energy Management\utilty.exe

D:\Program Files\Lenovo\Energy Management\Energy Management.exe

D:\WINDOWS.1\system32\RUNDLL32.EXE

D:\WINDOWS.1\RTHDCPL.EXE

D:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

D:\Program Files\Synaptics\SynTP\SynTPEnh.exe

D:\Program Files\DAEMON Tools\daemon.exe

D:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe

D:\Program Files\ESET\ESET Smart Security\egui.exe

D:\Program Files\Lexmark X1100 Series\lxbkbmon.exe

D:\WINDOWS.1\system32\ctfmon.exe

D:\Program Files\Skype\Phone\Skype.exe

D:\Program Files\ipla\ipla.exe

D:\gry\steam\steam.exe

D:\Program Files\Microsoft ActiveSync\wcescomm.exe

D:\PROGRA~1\MICROS~3\rapimgr.exe

D:\Program Files\Lenovo\Bluetooth Software\BTTray.exe

D:\Program Files\ATK Hotkey\ATKOSD.exe

D:\Program Files\ESET\ESET Smart Security\ekrn.exe

D:\WINDOWS.1\system32\nvsvc32.exe

D:\Program Files\ATK Hotkey\WDC.exe

D:\WINDOWS.1\system32\svchost.exe

D:\WINDOWS.1\system32\wbem\wmiapsrv.exe

D:\Program Files\Skype\Plugin Manager\skypePM.exe

D:\Program Files\Gadu-Gadu 10\gg.exe

D:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe

c:\program files\Mozilla Firefox\firefox.exe

D:\Documents and Settings\Administrator.KOMPUTER\Moje dokumenty\Pobieranie\HiJackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [HControlUser] "D:\Program Files\ATK Hotkey\HcontrolUser.exe"

O4 - HKLM\..\Run: [ATKHOTKEY] "D:\Program Files\ATK Hotkey\Hcontrol.exe"

O4 - HKLM\..\Run: [MsgTranAgt] "D:\Program Files\ATK Hotkey\MsgTranAgt.exe"

O4 - HKLM\..\Run: [EnergyUtility] D:\Program Files\Lenovo\Energy Management\utilty.exe

O4 - HKLM\..\Run: [Energy Management] D:\Program Files\Lenovo\Energy Management\Energy Management.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS.1\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS.1\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [SMSERIAL] D:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

O4 - HKLM\..\Run: [SynTPEnh] D:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "D:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [Lexmark X1100 Series] "D:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"

O4 - HKLM\..\Run: [egui] "D:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice

O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS.1\system32\ctfmon.exe

O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [IPLA!] D:\Program Files\ipla\ipla.exe /autorun

O4 - HKCU\..\Run: [Steam] "d:\gry\steam\steam.exe" -silent

O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Program Files\Microsoft ActiveSync\wcescomm.exe"

O4 - HKCU\..\Run: [Gadu-Gadu 10] "D:\Program Files\Gadu-Gadu 10\gg.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS.1\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS.1\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS.1\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS.1\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: BTTray.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Wyślij do interfejsu Bluetooth - D:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm

O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - D:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS.1\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS.1\Network Diagnostic\xpnetdiag.exe

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - D:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - D:\Program Files\ESET\ESET Smart Security\ekrn.exe

O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - D:\Program Files\MAGIX\Common\Database\bin\fbserver.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS.1\system32\LEXBCES.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS.1\system32\nvsvc32.exe


--

End of file - 8487 bytes

[jessica]

Odpowiedź automatyczna: Log z Hijacka w dzisiejszych czasach to za mało, bo większość infekcji potrafi go ominąć. Zalecany log: >OTL Mile widziany dodatkowo log z >SRENG W OTL przed skanowaniem, ustaw jeszcze dodatkowe opcje poprzez wklejenie do pola “Custom Scans/Fixes”: Następnie przestaw “Processes” i “Modules” na “All”, inne ustawienia zrób zgodnie z opisem narzędzia, i potem kliknij “Run Scan”, Logi wklej na http://wklejto.pl/, a w poście daj tylko linki(czyli skopiuj adres z paska adresów)

jessi

[Stolar20 (Stolar99)]

log z OTL -> http://www.wklejto.pl/58278

log z Sdfx -> http://www.wklejto.pl/58280

log z HijackThis -> http://www.wklejto.pl/58281

[jessica]

Uruchom OTL i w oknie Custom Scans/Fixes wklej to:

:OTL MOD - [2010-02-21 11:35:46 | 000,081,408 | ---- | M] () – D:\Documents and Settings\Administrator.KOMPUTER\Ustawienia lokalne\Temp\cvasds0.dll O32 - AutoRun File - [2010-02-21 11:36:58 | 000,000,053 | RHS- | M] () - D:\autorun.inf – [NTFS] O33 - MountPoints2{0646cbae-0b8e-11df-855a-0022fa61179c}\Shell\AutoRun\command - “” = H:\9fo3ar0j.exe – File not found O33 - MountPoints2{0646cbae-0b8e-11df-855a-0022fa61179c}\Shell\open\Command - “” = H:\9fo3ar0j.exe – File not found O33 - MountPoints2{7c35203c-ed8f-11de-a149-806d6172696f}\Shell\AutoRun\command - “” = tgt.exe O33 - MountPoints2{7c35203c-ed8f-11de-a149-806d6172696f}\Shell\open\Command - “” = tgt.exe O33 - MountPoints2{7fd54eb2-1b45-11df-81d0-0022fa61179c}\Shell\AutoRun\command - “” = G:\p3vwxx.exe – File not found O33 - MountPoints2{7fd54eb2-1b45-11df-81d0-0022fa61179c}\Shell\open\Command - “” = G:\p3vwxx.exe – File not found O33 - MountPoints2{90171d3a-0ea3-11df-8561-0022fa61179c}\Shell\AutoRun\command - “” = p3vwxx.exe O33 - MountPoints2{90171d3a-0ea3-11df-8561-0022fa61179c}\Shell\open\Command - “” = p3vwxx.exe O33 - MountPoints2{ad40a716-f59b-11de-853d-0022fa61179c}\Shell - “” = Autorun O33 - MountPoints2{ad40a717-f59b-11de-853d-0022fa61179c}\Shell - “” = Autorun O33 - MountPoints2{c7db944b-0402-11df-8553-0022fa61179c}\Shell - “” = Autorun O33 - MountPoints2{c7db944c-0402-11df-8553-0022fa61179c}\Shell - “” = Autorun O33 - MountPoints2{c7db944e-0402-11df-8553-0022fa61179c}\Shell - “” = Autorun O33 - MountPoints2{c7db9450-0402-11df-8553-0022fa61179c}\Shell - “” = Autorun O33 - MountPoints2{f4b79d19-f2f2-11de-853c-0022fa61179c}\Shell - “” = Autorun :Files C:\autorun.inf :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “SuperHidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “Hidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “ShowSuperHidden”=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] “CheckedValue”=dword:00000001 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] @="" :Commands [emptytemp] [Reboot]

Kliknij w Run Fix. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.

Następnie uruchom OTL ponownie, tym razem kliknij “Run Scan”.

Pokaż nowy log OTL.txt oraz raport z usuwania.

jessi

[Stolar20 (Stolar99)]

raport z usuwania -> http://www.wklejto.pl/58283

nowy log z OTL -> http://www.wklejto.pl/58284

[jessica]

Większość obiektów była “not found”, bo już SDFix usunął.

Użyj którejś szczepionki:

>Flash Disinfector

>Panda Vaccine

W OTL kliknij na przycisk “CleanUp” - to go usunie razem z jego Kwarantanną.

Usuń kopie szkodników z folderu “System Volume Information” poprzez chwilowe wyłączenie “Przywracania Systemu”:

>START>Panel Sterowania>System>Przywracanie Systemu>>zaznacz w okienku przy “Wyłącz przywracanie na wszystkich dyskach”>Zastosuj>OK. (W czasie tego chwilowego wyłączenia te kopie usuną się samoczynnie, więc nie ma potrzeby zaglądania do folderu.) Potem możesz powrócić do poprzedniego ustawienia (czyli usunąć zaznaczenie z okienka).

jessi

[Stolar20 (Stolar99)]

dziękuję bardzo, problem rozwiązany

pozdrawiam Paweł.