Zamiast piec ciasta piekę trojana


(Oleńka) #1

Mój komputer zachorował na jakiegos tyfusa. Pomimo polączenia z siecią (net) nie chce zładować storn IE. Gdyby nie normalnie dzialajace GG brak byłoby jakegokolwiek połączenia z netem. Acha, sieć NET działa poprawnie (podłączony pod kabel sieciowy laptop, działa i otwiera strony IE bez zarzut.

Został przeskanowany dzisiątkami programami ANTY, jeden SPY SWEEPER, wynalazł trojana dnschanger.

Zamiast piec ciasta, slęczę nad kompem i conieco próbuję naprawić, ale bez pomocy fachowców (WAS) to narobię więcej szkód niż pożytku :slight_smile:

Przesyłam logi i

proszę o pomoc :slight_smile:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:46:19, on 2008-03-22

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Webroot\Spy Sweeper\SSU.EXE

C:\WINDOWS\system32\msiexec.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start24.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

F2 - REG:system.ini: Shell=

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - (no file)

O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - (no file)

O3 - Toolbar: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM..\Run: [TrojanScanner] "C:\Program Files\Trojan Remover\Trjscan.exe"

O4 - HKLM..\Run: [spySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray

O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6036039686

O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7380183750

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - http://www.ca.com/us/securityadvisor/vi ... ebscan.cab

O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-l ... cfscan.cab

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--

End of file - 5558 bytes


(huber2t) #2

fix


(Leon$) #3

Pobierz Combofix http://www.searchengines.pl/index.php?showtopic=86306&st=0&p=395642entry395642 przeskanuj daj log

:slight_smile:


(Oleńka) #4

ComboFix 08-03-22.1 - Ja 2008-03-22 18:47:49.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.224 [GMT 1:00]

Running from: C:\Documents and Settings\Ja\Pulpit\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED!!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\hosts

C:\WINDOWS\system32\mkghj.dll

.

((((((((((((((((((((((((( Files Created from 2008-02-22 to 2008-03-22 )))))))))))))))))))))))))))))))

.

2008-03-22 17:45 . 2008-03-22 17:45 0 --a------ C:\WINDOWS\RAVTC.TMP

2008-03-22 17:41 . 2008-03-22 17:41

2008-03-22 17:19 . 2008-03-22 17:19

2008-03-22 13:11 . 2008-03-22 13:11

2008-03-22 13:08 . 2006-10-04 01:11

2008-03-22 13:08 . 2006-10-04 01:11

2008-03-22 13:08 . 2006-10-03 23:18

2008-03-22 13:08 . 2006-10-04 01:11

2008-03-22 13:08 . 2006-10-04 01:11

2008-03-22 13:08 . 2006-10-04 01:11

2008-03-22 13:08 . 2008-03-22 13:11

2008-03-22 08:05 . 2008-03-22 08:05

2008-03-21 23:42 . 2008-03-21 23:44

2008-03-21 23:21 . 2006-03-02 13:00 39,936 --a------ C:\WINDOWS\system32\hostmib.dll

2008-03-21 23:21 . 2006-03-02 13:00 39,936 --a–c— C:\WINDOWS\system32\dllcache\hostmib.dll

2008-03-21 23:21 . 2006-03-02 13:00 33,792 --a------ C:\WINDOWS\system32\lmmib2.dll

2008-03-21 23:21 . 2006-03-02 13:00 33,792 --a–c— C:\WINDOWS\system32\dllcache\lmmib2.dll

2008-03-21 23:21 . 2006-03-02 13:00 6,144 --a------ C:\WINDOWS\system32\snmpmib.dll

2008-03-21 23:21 . 2006-03-02 13:00 6,144 --a–c— C:\WINDOWS\system32\dllcache\snmpmib.dll

2008-03-21 23:21 . 2008-03-21 23:22 4,566 --a------ C:\WINDOWS\imsins.BAK

2008-03-21 23:02 . 2008-03-21 23:02

2008-03-21 18:32 . 2008-03-21 18:32

2008-03-21 18:32 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX

2008-03-21 18:11 . 2008-03-22 08:42

2008-03-21 18:06 . 2008-03-21 18:09 81,984 --a------ C:\WINDOWS\system32\bdod.bin

2008-03-21 17:59 . 2008-03-21 18:09

2008-03-21 17:08 . 2008-03-22 08:35

2008-03-21 17:08 . 2008-03-21 17:08

2008-03-21 17:08 . 2008-03-21 17:08

2008-03-21 17:08 . 2006-05-25 14:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll

2008-03-21 17:08 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll

2008-03-21 17:08 . 2005-08-26 00:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll

2008-03-21 17:08 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll

2008-03-21 17:08 . 2006-06-19 12:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll

2008-03-21 13:20 . 2008-03-21 13:20

2008-03-21 13:20 . 2008-03-21 13:20

2008-03-21 13:20 . 2008-03-21 13:20

2008-03-21 13:20 . 2008-03-21 13:20

2008-03-21 13:20 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll

2008-03-21 13:20 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys

2008-03-21 13:20 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys

2008-03-21 13:20 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys

2008-03-21 13:20 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys

2008-03-21 11:39 . 2008-03-21 12:09

2008-03-21 11:37 . 2008-03-21 12:18

2008-03-21 11:37 . 2008-03-21 12:01 77,824 --a----t- C:\WINDOWS\system32\DRWEBSP.DLL

2008-03-21 11:36 . 2008-03-21 11:36

2008-03-21 09:06 . 2008-03-21 09:06

2008-03-21 08:13 . 2008-03-21 12:17

2008-03-21 06:32 . 2008-03-21 09:03

2008-03-20 15:30 . 2008-03-20 15:30

2008-03-20 14:25 . 2008-03-20 14:25

2008-03-20 12:38 . 2008-03-22 18:43

2008-03-20 00:14 . 2008-03-20 13:37 1,001 --a------ C:\WINDOWS\system32\CTSTATUS.FCS

2008-03-19 23:55 . 2008-03-19 23:55

2008-03-19 23:53 . 2008-03-21 06:58

2008-03-19 22:50 . 2008-03-19 22:50

2008-03-19 22:45 . 2008-03-20 00:50

2008-02-27 12:25 . 2008-03-19 20:14

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-03-22 16:19 --------- d–h--w C:\Program Files\InstallShield Installation Information

2008-03-21 10:32 --------- d-----w C:\Program Files\Gadu-Gadu

2008-03-21 05:56 --------- d-----w C:\Program Files\Common Files\InstallShield

2008-03-20 13:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Grisoft

2008-03-20 05:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype

2008-03-20 05:01 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Skype

2008-03-19 23:46 --------- d-----w C:\Program Files\SkanerOnline

2008-03-19 23:41 --------- d-----w C:\Program Files\Apple Software Update

2008-03-19 19:14 --------- d-----w C:\Program Files\Common Files\Adobe

2008-03-19 19:12 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\SUPERAntiSpyware.com

2008-03-19 18:18 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\ZipGenius

2008-02-17 17:47 --------- d-----w C:\Program Files\Microtek

2008-02-12 06:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\SUPERAntiSpyware.com

2007-04-18 18:59 5,928,576 ----a-w C:\Program Files\845-plk-xpinfu.exe

2007-01-22 19:03 5 --sha-w C:\WINDOWS\system32\ebcabeeb8_s.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2006-03-02 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-10-10 18:51 39792]

“TrojanScanner”=“C:\Program Files\Trojan Remover\Trjscan.exe” [2008-03-02 20:52 868432]

“SpySweeper”=“C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe” [2008-01-04 20:56 5367664]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2006-03-02 13:00 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588]

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

“EnableFirewall”= 0 (0x0)

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

“%windir%\system32\sessmgr.exe”=

“%windir%\Network Diagnostic\xpnetdiag.exe”=

“C:\Program Files\Gadu-Gadu\gg.exe”=

“C:\kav\kis7.0\english\setup.exe”=

R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 04:38]

R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 04:39]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{8d67e457-5d54-11db-a414-806d6172696f}]

\Shell\AutoRun\command - D:\setup.EXE /AUTORUN

\Shell\configure\command - D:\setup.EXE

\Shell\install\command - D:\setup.EXE

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-03-22 18:49:44

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-03-22 18:50:10

ComboFix-quarantined-files.txt 2008-03-22 17:50:07

.

2008-02-13 06:36:45 — E O F —


(Oleńka) #5

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb

nie chce sie sFIXować. Zostawić go tak jak jest czy proponowałbyś jednak go wywalić?


(Gutek) #6

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=213350

Daj nowy log z HJT


(Oleńka) #7

Przesyłam:

http://wklej.org/id/0cdf06948d

PS. Łącze z netem już mi do konca padlo. Są problemy z ustaleleniem adresu IP.


(Oleńka) #8

PS. Jak sie sprawdza DNS-y? Może tam tkwi diabel :shock:


(Gutek) #9

Ten wpis na razie zostaw. Pobierz program SDFix


(Oleńka) #10

(Oleńka) #11

raport z SDFix

http://www.wklej.org/id/676b0c31fa


(Oleńka) #12

Czy ktoś może zerknąc jeszcze raz na mojego posta i pomoc, proszę?


(Dawidex11) #13

A jak praca na komputerze ? W logu SDFix’a widać że skasował syf , możesz jeszcze podać log z CombFix’a :arrow: http://download.bleepingcomputer.com/sUBs/ComboFix.exe .


(Oleńka) #14

Witam,

proszę bardzo logComboFix

http://wklej.org/id/3510ed1e73


(Oleńka) #15

Teraz kompletnie nie łączy z internetem, komunikat ze mam ogeaniczenia sieciowe, nie moze ustanowić zadnego adresu IP (same zera) i nic nie pomaga komenda napraw