Wirusy - log z HijackThis

Dla specjalistów Bezpieczeństwo
#1

Witam, co chwile wyskakuje mi komunikat “Security System has detected spyware infection!”

Proszę o pomoc i z góry dziękuję za odpowiedzi.

A to log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:17:47, on 2009-01-23

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

E:\Programy\Avast4\aswUpdSv.exe

C:\WINDOWS\Explorer.EXE

E:\Programy\Avast4\ashServ.exe

C:\WINDOWS\system32\RUNDLL32.EXE

E:\Programy\Avast4\ashDisp.exe

C:\WINDOWS\RTHDCPL.EXE

E:\Programy\SONICS~1\SsAAD.exe

C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

E:\Programy\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

C:\Program Files\VirusRemover2008\VRM2008.exe

C:\Program Files\SecureExpertCleaner\Reminder.exe

C:\Program Files\ClamWin\bin\ClamTray.exe

E:\Programy\Expressivo\expressivo.exe

C:\DOCUME~1\aaa\USTAWI~1\Temp\a.exe

C:\Documents and Settings\aaa\Ustawienia lokalne\Dane aplikacji\qip\QuickInstallPack.exe

C:\DOCUME~1\aaa\USTAWI~1\Temp~tmph.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Teleca Shared\Generic.exe

C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

E:\Programy\Avast4\ashMaiSv.exe

E:\Programy\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\aaa\Pulpit\utorrent.exe

E:\Programy\Mozilla Firefox\firefox.exe

C:\DOCUME~1\aaa\USTAWI~1\Temp~tmpa.exe

E:\Programy\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {85F685C3-20D9-4943-95E4-EB4224056C3F} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: iercptbho - {D4CDC21D-43BE-4101-A1EF-E379F134771E} - C:\Documents and Settings\aaa\Ustawienia lokalne\Dane aplikacji\qip\iercpt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: (no name) - {85F685C3-20D9-4943-95E4-EB4224056C3F} - (no file)

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM…\Run: [avast!] E:\Programy\Avast4\ashDisp.exe

O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM…\Run: [ssAAD.exe] E:\Programy\SONICS~1\SsAAD.exe

O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe

O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “E:\Programy\Adobe\Reader 8.0\Reader\Reader_sl.exe”

O4 - HKLM…\Run: [sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions

O4 - HKLM…\Run: [Adobe Photo Downloader] “E:\Programy\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”

O4 - HKLM…\Run: [WebAccelerator] “E:\Programy\Web Accelerator\webxl.exe”

O4 - HKLM…\Run: [VirusRemover2008] C:\Program Files\VirusRemover2008\VRM2008.exe

O4 - HKLM…\Run: [secureExpertCleaner] C:\Program Files\SecureExpertCleaner\sec.exe

O4 - HKLM…\Run: [Reminder] C:\Program Files\SecureExpertCleaner\Reminder.exe

O4 - HKLM…\Run: [ClamWin] “C:\Program Files\ClamWin\bin\ClamTray.exe” --logon

O4 - HKCU…\Run: [Expressivo] “E:\Programy\Expressivo\expressivo.exe” -t -nosplash

O4 - HKCU…\Run: [Cognac] C:\DOCUME~1\aaa\USTAWI~1\Temp~tmpa.exe

O4 - HKCU…\Run: [MSFox] C:\DOCUME~1\aaa\USTAWI~1\Temp\a.exe

O4 - HKCU…\Run: [QuickInstallPack] C:\Documents and Settings\aaa\Ustawienia lokalne\Dane aplikacji\qip\QuickInstallPack.exe

O4 - HKLM…\Policies\Explorer\Run: [this] C:\Program Files\Applications\wcs.exe

O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)

O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)

O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

O4 - Startup: is-39U2Q.lnk = E:\Programy\Virus Removal Tool\is-39U2Q\startup.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virus … nicode.cab

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Programy\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - E:\Programy\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Programy\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - E:\Programy\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

–

End of file - 6991 bytes

#2

Podaj log z Combofix. Instrukcja :arrow: viewtopic.php?f=16&t=36654

Logi dajesz na wklej.org lub wklej.eu a w poście Podajesz tylko link.

#3

Usuń te wpisy w HJT

Uruchom HijackThis - Do a system scan only - w oknie programu pokaże się log - zaznacz kratki przy podanych wpisach - klikasz Fix checked

Pobierz Combofix przeskanuj system i daj log na forum.

#4

Mój log z combo: http://wklej.org/id/43497/

#5

Pobierz ComboFix, ale nie uruchamiaj

Wklej do notatnika:

File::

c:\windows\system32\drivers\99174218.sys


Folder::

C:\FOUND.011


Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05fa8d0c-1518-11dd-890c-0000cac92333}]

Plik -> zapisz jako -> CFScript.txt.

Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu->

cfscript10uc2.gif

Rozpocznie się usuwanie i powstanie log, który dasz na forum.

Logi dajesz na http://wklej.eu lub na http://wklej.org a w poście dajesz tylko link