Amvo atakuje

Dla specjalistów Bezpieczeństwo
#1

mam to dziwactwo amvo, nie znam sie zbytnio na komputerach - prosze o pomoc.

moj log z hjacka:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:48:30, on 2008-07-03

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\Program Files\Softwin\BitDefender10\bdmcon.exe

C:\Program Files\Softwin\BitDefender10\bdagent.exe

D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Mozilla Firefox\firefox.exe

D:\EVEREST Home Edition\everest.bin

D:\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=488

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

O4 - HKLM…\Run: [bDMCon] “C:\Program Files\Softwin\BitDefender10\bdmcon.exe” /reg

O4 - HKLM…\Run: [bDAgent] “C:\Program Files\Softwin\BitDefender10\bdagent.exe”

O4 - HKLM…\Run: [ZoneAlarm Client] “D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe”

O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [amva] C:\WINDOWS\system32\amvo.exe

O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)

O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)

O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

–

End of file - 3577 bytes

____________________________________________________________________________

A TU Z COMBOFIXA:

ComboFix 08-07-02.5 - fredi 2008-07-03 19:49:52.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.473 [GMT 2:00]

Running from: C:\Documents and Settings\fredi\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED!!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Autorun.inf

C:\WINDOWS\system32\amvo.exe

C:\WINDOWS\system32\amvo0.dll

C:\WINDOWS\system32\amvo1.dll

D:\Autorun.inf

E:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 )))))))))))))))))))))))))))))))

.

2008-07-03 19:38 . 2004-03-17 14:36 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe

2008-07-03 19:37 . 2008-07-03 19:38

2008-07-03 19:22 . 2008-07-03 19:22

2008-07-03 18:06 . 2008-07-03 18:06

2008-07-03 18:06 . 2008-07-03 18:06

2008-07-03 18:06 . 2008-07-03 19:39

2008-07-03 13:26 . 2008-06-27 13:00 110,443 -r-hs---- C:\r.cmd

2008-07-03 13:22 . 2004-08-03 23:08 26,496 --a–c— C:\WINDOWS\system32\dllcache\usbstor.sys

2008-07-03 13:11 . 2008-07-03 13:11 0 --a------ C:\WINDOWS\nsreg.dat

2008-07-03 13:06 . 2008-07-03 19:26 906 --a------ C:\WINDOWS\VPlayer.INI

2008-07-03 13:06 . 2008-07-03 19:26 45 --a------ C:\WINDOWS\VplayerINI.vpl

2008-07-03 12:44 . 2008-07-03 17:59 114,611 -r-hs---- C:\xmnm2.cmd

2008-07-03 12:41 . 2008-07-03 19:51 452,640 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat

2008-07-03 12:41 . 2008-07-03 18:17 8,024 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx

2008-07-03 12:39 . 2008-07-03 12:39

2008-07-03 12:38 . 2008-07-03 12:38

2008-07-03 12:37 . 2008-07-03 19:50

2008-07-03 12:36 . 2008-07-03 12:36

2008-07-03 12:33 . 2008-07-03 12:33

2008-07-03 12:33 . 2008-07-03 12:33

2008-07-03 12:32 . 2008-07-03 12:33

2008-07-03 12:32 . 2008-05-24 11:32 107,966 -r-hs---- C:\qa8sywva.cmd

2008-07-03 00:39 . 2008-07-03 01:50

2008-07-03 00:39 . 2008-07-03 00:39

2008-07-03 00:39 . 2008-07-02 23:58

2008-07-03 00:39 . 2008-07-03 18:27

2008-07-03 00:39 . 2008-07-03 00:39

2008-07-03 00:39 . 2008-07-03 01:50

2008-07-03 00:39 . 2008-07-03 13:45

2008-07-03 00:39 . 2008-07-03 18:17

2008-07-03 00:23 . 2008-07-03 00:23

2008-07-03 00:23 . 2008-07-03 19:51

2008-07-03 00:23 . 2008-07-03 00:23

2008-07-03 00:23 . 2008-07-03 00:23

2008-07-03 00:07 . 2008-07-03 19:51

2008-07-03 00:07 . 2008-07-03 00:07

2008-07-03 00:07 . 2008-07-03 00:07

2008-07-03 00:07 . 2008-07-03 00:07 8,192 --a------ C:\WINDOWS\REGLOCS.OLD

2008-07-03 00:05 . 2001-07-22 00:23 1,875,968 --a–c— C:\WINDOWS\system32\dllcache\msir3jp.lex

2008-07-03 00:04 . 2001-10-26 19:28 13,463,552 --a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll

2008-07-03 00:03 . 2004-08-04 01:44 2,134,528 --a–c— C:\WINDOWS\system32\dllcache\smtpsnap.dll

2008-07-03 00:02 . 2008-07-03 00:02 316,640 --a------ C:\WINDOWS\WMSysPr9.prx

2008-07-03 00:02 . 2008-07-03 00:02 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb

2008-07-03 00:02 . 2008-07-03 00:02 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb

2008-07-03 00:02 . 2008-07-03 00:02 2,596 --a------ C:\WINDOWS\system32\CONFIG.NT

2008-07-03 00:02 . 2008-07-03 00:02 0 --a------ C:\WINDOWS\control.ini

2008-07-03 00:01 . 2008-07-03 00:02

2008-07-03 00:01 . 2001-07-22 04:53 4,399,505 --a–c— C:\WINDOWS\system32\dllcache\nls302en.lex

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\WindowsShell.Manifest

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\cdplayer.exe.manifest

2008-07-03 00:01 . 2008-07-03 00:01 488 -rah----- C:\WINDOWS\system32\WindowsLogon.manifest

2008-07-03 00:01 . 2008-07-03 00:01 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-03 17:49 81,984 ----a-w C:\WINDOWS\system32\bdod.bin

2008-07-02 21:34 --------- d-----w C:\Program Files\microsoft frontpage

2008-07-02 21:32 --------- d-----w C:\Program Files\Usługi online

.

((((((((((((((((((((((((((((( snapshot@2008-07-03_13.16.45,96 )))))))))))))))))))))))))))))))))))))))))

.

  • 2008-07-03 10:41:13 2,048 --s-a-w C:\WINDOWS\bootstat.dat

  • 2008-07-03 16:18:09 2,048 --s-a-w C:\WINDOWS\bootstat.dat

  • 2004-10-27 13:21:36 138,240 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\Hdaudbus.sys

  • 2004-10-27 13:21:30 145,920 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\Hdaudio.sys

  • 2001-08-23 19:03:54 25,434 ----a-w C:\WINDOWS\OPTIONS\CABS\RTL8139.SYS

  • 2001-09-19 16:03:48 38,238 ----a-w C:\WINDOWS\OPTIONS\CABS\RTLSETN5.EXE

  • 2007-12-04 00:33:16 682,496 ----a-w C:\WINDOWS\system32\divx.dll

  • 2001-08-23 19:03:54 25,434 -c–a-w C:\WINDOWS\system32\dllcache\rtl8139.sys

  • 2007-11-29 21:28:24 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll

  • 2004-10-27 13:21:36 138,240 ------w C:\WINDOWS\system32\drivers\Hdaudbus.sys

  • 2004-10-27 13:21:30 145,920 ------w C:\WINDOWS\system32\drivers\Hdaudio.sys

  • 2004-08-03 22:31:34 20,992 ----a-w C:\WINDOWS\system32\drivers\RTL8139.sys

  • 2001-08-23 19:03:54 25,434 ----a-w C:\WINDOWS\system32\drivers\RTL8139.sys

  • 2004-08-03 21:08:48 26,496 ----a-w C:\WINDOWS\system32\drivers\USBSTOR.SYS

  • 2007-12-24 11:49:52 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll

  • 2004-10-27 13:21:28 25,088 ------w C:\WINDOWS\system32\HdAProp.dll

  • 2004-10-27 13:21:30 61,952 ------w C:\WINDOWS\system32\HdAShCut.exe

  • 2004-10-27 13:21:14 5,120 ------w C:\WINDOWS\system32\HdAudRes.dll

  • 2008-03-25 03:21:18 2,889,088 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

  • 2008-03-25 03:21:20 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe

  • 2008-07-03 11:29:55 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe

  • 2003-08-02 07:50:34 356,352 ----a-w C:\WINDOWS\system32\mkxds.dll

  • 2002-10-04 22:04:18 45,056 ----a-w C:\WINDOWS\system32\ogg.dll

  • 2002-10-06 17:42:58 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll

  • 2008-07-02 22:29:52 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
  • 2008-07-03 17:40:01 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
  • 2008-07-02 22:29:53 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
  • 2008-07-03 17:40:01 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
  • 2008-07-02 22:29:53 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
  • 2008-07-03 17:40:01 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
  • 2008-07-02 22:29:53 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat

  • 2008-07-03 17:40:01 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat

  • 2007-11-29 21:30:28 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll

  • 2004-08-03 22:31:34 20,992 ----a-w C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\RTL8139.sys

  • 2007-09-04 15:56:10 164,352 ----a-w C:\WINDOWS\system32\unrar.dll

  • 2002-10-04 22:04:26 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll

  • 2002-10-04 22:04:26 921,600 ----a-w C:\WINDOWS\system32\VorbisEnc.dll

  • 2007-07-25 12:24:30 1,559,040 ----a-w C:\WINDOWS\system32\xvidcore.dll

  • 2007-03-10 10:51:50 282,624 ----a-w C:\WINDOWS\system32\xvidvfw.dll

  • 2004-01-25 15:18:44 217,088 ----a-w C:\WINDOWS\system32\yv12vfw.dll

.

– Snapshot reset to current date –

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 01:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“BDMCon”=“C:\Program Files\Softwin\BitDefender10\bdmcon.exe” [2007-04-02 16:48 290816]

“BDAgent”=“C:\Program Files\Softwin\BitDefender10\bdagent.exe” [2007-03-26 15:49 69632]

“ZoneAlarm Client”=“D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-11-14 16:05 919016]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 01:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

“AppInit_DLLs”=sockspy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

“VIDC.YV12”= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

“AntiVirusDisableNotify”=dword:00000001

“UpdatesDisableNotify”=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

“DisableMonitoring”=dword:00000001

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

“EnableFirewall”= 0 (0x0)

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

“%windir%\system32\sessmgr.exe”=

R3 EverestDriver;Lavalys EVEREST Kernel Driver;D:\EVEREST Home Edition\kerneld.wnt [2005-08-18 00:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{487c4d42-48f1-11dd-b03d-001d6089f083}]

\Shell\AutoRun\command - H:\r.cmd

\Shell\explore\Command - H:\r.cmd

\Shell\open\Command - H:\r.cmd

*Newly Created Service* - EVERESTDRIVER

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-03 19:51:51

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]

“ImagePath”="??\D:\EVEREST Home Edition\kerneld.wnt"

.

Completion time: 2008-07-03 19:52:46

ComboFix-quarantined-files.txt 2008-07-03 17:52:40

ComboFix2.txt 2008-07-03 11:17:03

Pre-Run: 18,938,429,440 bajtów wolnych

Post-Run: 18,924,392,448 bajtów wolnych

175

______________________________________________________________________________________

#2

HijackThis:

>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked.

Combofix:

Wklej do notatnika:

File::

C:\r.cmd

C:\xmnm2.cmd

C:\qa8sywva.cmd

C:\r.cmd

H:\r.cmd

D:\r.cmd

E:\r.cmd


Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{487c4d42-48f1-11dd-b03d-001d6089f083}]

>>Plik>>Zapisz jako… >>> CFScript

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe

02f8f1e3c410a4cc.gif

Ma się rozpocząć usuwanie. (i powstanie log). Daj ten log, który powstanie w trakcie usuwania.

Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

Sformatuj pendriv’a

#3

zrobilam hjacka jeszcze raz tak jak napisales/as, i nie ma tam teraz tego:

O4 - HKCU…\Run: [amva] C:\WINDOWS\system32\amvo.exe

tak wiec nie wiem o co chodzi…

a tu ten log z combofixa, po wykonaniu czynnosci, ktore zalecales/as:

ComboFix 08-07-02.5 - fredi 2008-07-03 20:47:03.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.508 [GMT 2:00]

Running from: C:\Documents and Settings\fredi\Pulpit\ComboFix.exe

Command switches used :: C:\Documents and Settings\fredi\Pulpit\CFScript.txt

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED!!

FILE ::

C:\qa8sywva.cmd

C:\r.cmd

C:\xmnm2.cmd

D:\r.cmd

E:\r.cmd

H:\r.cmd

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\qa8sywva.cmd

C:\r.cmd

C:\xmnm2.cmd

D:\r.cmd

E:\r.cmd

.

((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 )))))))))))))))))))))))))))))))

.

2008-07-03 19:38 . 2004-03-17 14:36 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe

2008-07-03 19:37 . 2008-07-03 19:38

2008-07-03 19:22 . 2008-07-03 19:22

2008-07-03 18:06 . 2008-07-03 18:06

2008-07-03 18:06 . 2008-07-03 18:06

2008-07-03 18:06 . 2008-07-03 19:39

2008-07-03 13:22 . 2004-08-03 23:08 26,496 --a–c— C:\WINDOWS\system32\dllcache\usbstor.sys

2008-07-03 13:11 . 2008-07-03 13:11 0 --a------ C:\WINDOWS\nsreg.dat

2008-07-03 13:06 . 2008-07-03 19:26 906 --a------ C:\WINDOWS\VPlayer.INI

2008-07-03 13:06 . 2008-07-03 19:26 45 --a------ C:\WINDOWS\VplayerINI.vpl

2008-07-03 12:41 . 2008-07-03 20:48 520,224 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat

2008-07-03 12:41 . 2008-07-03 18:17 8,024 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx

2008-07-03 12:39 . 2008-07-03 12:39

2008-07-03 12:38 . 2008-07-03 12:38

2008-07-03 12:37 . 2008-07-03 20:48

2008-07-03 12:36 . 2008-07-03 12:36

2008-07-03 12:33 . 2008-07-03 12:33

2008-07-03 12:33 . 2008-07-03 12:33

2008-07-03 12:32 . 2008-07-03 12:33

2008-07-03 00:39 . 2008-07-03 20:48

2008-07-03 00:39 . 2008-07-03 00:39

2008-07-03 00:39 . 2008-07-02 23:58

2008-07-03 00:39 . 2008-07-03 20:47

2008-07-03 00:39 . 2008-07-03 00:39

2008-07-03 00:39 . 2008-07-03 01:50

2008-07-03 00:39 . 2008-07-03 13:45

2008-07-03 00:39 . 2008-07-03 18:17

2008-07-03 00:23 . 2008-07-03 00:23

2008-07-03 00:23 . 2008-07-03 20:48

2008-07-03 00:23 . 2008-07-03 00:23

2008-07-03 00:23 . 2008-07-03 00:23

2008-07-03 00:07 . 2008-07-03 20:48

2008-07-03 00:07 . 2008-07-03 00:07

2008-07-03 00:07 . 2008-07-03 00:07

2008-07-03 00:07 . 2008-07-03 00:07 8,192 --a------ C:\WINDOWS\REGLOCS.OLD

2008-07-03 00:05 . 2001-07-22 00:23 1,875,968 --a–c— C:\WINDOWS\system32\dllcache\msir3jp.lex

2008-07-03 00:04 . 2001-10-26 19:28 13,463,552 --a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll

2008-07-03 00:03 . 2004-08-04 01:44 2,134,528 --a–c— C:\WINDOWS\system32\dllcache\smtpsnap.dll

2008-07-03 00:02 . 2008-07-03 00:02 316,640 --a------ C:\WINDOWS\WMSysPr9.prx

2008-07-03 00:02 . 2008-07-03 00:02 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb

2008-07-03 00:02 . 2008-07-03 00:02 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb

2008-07-03 00:02 . 2008-07-03 00:02 2,596 --a------ C:\WINDOWS\system32\CONFIG.NT

2008-07-03 00:02 . 2008-07-03 00:02 0 --a------ C:\WINDOWS\control.ini

2008-07-03 00:01 . 2008-07-03 00:02

2008-07-03 00:01 . 2001-07-22 04:53 4,399,505 --a–c— C:\WINDOWS\system32\dllcache\nls302en.lex

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\WindowsShell.Manifest

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest

2008-07-03 00:01 . 2008-07-03 00:01 749 -rah----- C:\WINDOWS\system32\cdplayer.exe.manifest

2008-07-03 00:01 . 2008-07-03 00:01 488 -rah----- C:\WINDOWS\system32\WindowsLogon.manifest

2008-07-03 00:01 . 2008-07-03 00:01 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-03 18:47 81,984 ----a-w C:\WINDOWS\system32\bdod.bin

2008-07-02 21:34 --------- d-----w C:\Program Files\microsoft frontpage

2008-07-02 21:32 --------- d-----w C:\Program Files\Usługi online

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 01:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“BDMCon”=“C:\Program Files\Softwin\BitDefender10\bdmcon.exe” [2007-04-02 16:48 290816]

“BDAgent”=“C:\Program Files\Softwin\BitDefender10\bdagent.exe” [2007-03-26 15:49 69632]

“ZoneAlarm Client”=“D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-11-14 16:05 919016]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 01:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

“AppInit_DLLs”=sockspy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

“VIDC.YV12”= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

“AntiVirusDisableNotify”=dword:00000001

“UpdatesDisableNotify”=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

“DisableMonitoring”=dword:00000001

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

“EnableFirewall”= 0 (0x0)

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

“%windir%\system32\sessmgr.exe”=

R3 EverestDriver;Lavalys EVEREST Kernel Driver;D:\EVEREST Home Edition\kerneld.wnt [2005-08-18 00:00]

*Newly Created Service* - EVERESTDRIVER

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-03 20:48:55

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]

“ImagePath”="??\D:\EVEREST Home Edition\kerneld.wnt"

.

Completion time: 2008-07-03 20:49:40

ComboFix-quarantined-files.txt 2008-07-03 18:49:36

ComboFix2.txt 2008-07-03 18:43:55

ComboFix3.txt 2008-07-03 17:52:48

ComboFix4.txt 2008-07-03 11:17:03

Pre-Run: 18,950,303,744 bajtów wolnych

Post-Run: 18,938,699,776 bajtów wolnych

133

______________________

teraz zrestartuje komp zeby usunac ten C:\Qoobox.

#4

Log wygląda na czysty

usuń ręcznie folder C: \Qoobox usuń instalkę Combofix z dysku.

Wyłącz I włącz przywracanie systemu na wszystkich dyskach.http://support.microsoft.com/kb/310405/pl

przeskanuj obszar Mój komputer http://www.kaspersky.pl/virusscanner.html pokaż raport stronę uruchomić przez IE

:slight_smile:

#5

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=253052

#6

nie moge zrobic kasperskiego bo jak wlaczam explorera to mi sie pokazuje okienko zebym polaczyla sie z internetem tak jakbym miala modem, a nie mam, bo mam internet przez kablowke. cos mam zle w jakis ustawienieach i znow nie wiem jakich…

korzystajac z okazji Twojej pomocy mam loga jeszcze z combofixa drugiego komputera, ktorego najprawdopodobniej zainfekowalam…

zrobilam hjacka i usunelam tam tego amvo,

a z combofixa log jest taki:

ComboFix 08-07-02.5 - fred 2008-07-03 21:06:22.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.151 [GMT 2:00]

Running from: C:\Documents and Settings\fred.FRED-AFE357FAED\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED!!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

C:\WINDOWS\system32\amvo.exe

C:\WINDOWS\system32\amvo0.dll

C:\WINDOWS\system32\amvo1.dll

D:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 )))))))))))))))))))))))))))))))

.

2008-07-03 19:18 . 2008-06-27 13:00110,443-r-hs----C:\xmnm2.cmd

2008-07-02 18:56 . 2008-06-27 13:00110,443-r-hs----C:\r.cmd

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-03 19:1126,136,608–sha-wC:\WINDOWS\system32\drivers\fidbox.dat

2008-07-03 18:49---------d-----wC:\Documents and Settings\fred.FRED-AFE357FAED\Dane aplikacji\Skype

2008-07-03 17:17---------d-----wC:\Documents and Settings\fred.FRED-AFE357FAED\Dane aplikacji\skypePM

2008-07-03 17:17---------d-----wC:\Documents and Settings\fred.FRED-AFE357FAED\Dane aplikacji\OpenOffice.org2

2008-07-03 12:17309,584–sha-wC:\WINDOWS\system32\drivers\fidbox.idx

2008-07-02 17:31---------d-----wC:\Program Files\Mozilla Thunderbird

2008-06-18 16:25---------d-----wC:\Documents and Settings\fred.FRED-AFE357FAED\Dane aplikacji\AVG7

2008-06-18 16:25---------d-----wC:\Documents and Settings\All Users\Dane aplikacji\avg7

2008-04-28 12:2657,856----a-wC:\WINDOWS\Internet Logs\xDB8.tmp

2008-04-22 23:1196,768----a-wC:\WINDOWS\Internet Logs\xDB7.tmp

2008-04-18 17:3883,968----a-wC:\WINDOWS\Internet Logs\xDB6.tmp

2008-04-15 17:42134,656----a-wC:\WINDOWS\Internet Logs\xDB5.tmp

2008-04-13 18:17691,545----a-wC:\WINDOWS\unins000.exe

2008-04-10 11:19118,784----a-wC:\WINDOWS\Internet Logs\xDB4.tmp

2008-04-05 23:33176,128----a-wC:\WINDOWS\Internet Logs\xDB3.tmp

2008-02-11 16:2232----a-wC:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 01:44 15360]

“Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-11-16 13:39 21760296]

“Gadu-Gadu”=“D:\programy\Gadu-Gadu\gg.exe” [2006-11-14 11:12 1849032]

“SpybotSD TeaTimer”=“D:\programy\Spybot - Search Destroy\TeaTimer.exe” [2007-08-31 16:46 1460560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“ZoneAlarm Client”=“D:\programy\ZoneAlarm\zlclient.exe” [2007-11-14 17:05 919016]

“AVG7_CC”=“C:\PROGRA~1\Grisoft\AVG7\avgcc.exe” [2008-04-15 13:42 579584]

“Adobe Reader Speed Launcher”=“D:\Programy\adobeReader\Reader 8.0\Reader\Reader_sl.exe” [2008-01-11 23:16 39792]

“HP Software Update”=“D:\programy\hp\HP Software Update\HPWuSchd2.exe” [2006-02-19 03:41 49152]

“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 02:11 132496]

“Google Desktop Search”=“C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” [2008-03-09 15:25 29744]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 01:44 15360]

“AVG7_Run”=“C:\PROGRA~1\Grisoft\AVG7\avgw.exe” [2008-02-11 16:25 219136]

C:\Documents and Settings\fred.FRED-AFE357FAED\Menu Start\Programy\Autostart\

OpenOffice.org 2.0.3.lnk - C:\Program Files\OpenOffice.org 2.0.3\program\quickstart.exe [2006-07-02 18:46:50 393216]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

HP Digital Imaging Monitor.lnk - D:\programy\hp\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472]

Microsoft Office.lnk - D:\programy\MS Word\Office\OSA9.EXE [1999-02-17 20:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

“AppInit_DLLs”=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

“DisableMonitoring”=dword:00000001

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

“EnableFirewall”= 0 (0x0)

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

“%windir%\system32\sessmgr.exe”=

“C:\Program Files\Grisoft\AVG7\avginet.exe”=

“C:\Program Files\Grisoft\AVG7\avgamsvr.exe”=

“C:\Program Files\Grisoft\AVG7\avgcc.exe”=

“C:\Program Files\Grisoft\AVG7\avgemc.exe”=

“D:\programy\hp\Digital Imaging\bin\hpqtra08.exe”=

“D:\programy\hp\Digital Imaging\bin\hpqste08.exe”=

“D:\programy\hp\Digital Imaging\bin\hpofxm08.exe”=

“D:\programy\hp\Digital Imaging\bin\hposfx08.exe”=

“D:\programy\hp\Digital Imaging\bin\hposid01.exe”=

“D:\programy\hp\Digital Imaging\bin\hpqscnvw.exe”=

“D:\programy\hp\Digital Imaging\bin\hpqkygrp.exe”=

“D:\programy\hp\Digital Imaging\bin\hpqCopy.exe”=

“D:\programy\hp\Digital Imaging\bin\hpfccopy.exe”=

“D:\programy\hp\Digital Imaging\bin\hpzwiz01.exe”=

“D:\programy\hp\Digital Imaging\bin\hpoews01.exe”=

“D:\programy\hp\Digital Imaging\bin\hpqnrs08.exe”=

“C:\Program Files\Bonjour\mDNSResponder.exe”=

“C:\Program Files\Skype\Phone\Skype.exe”=

R3 Smcpwr2n;Sterownik karty SMC EtherPower II 10/100 Ethernet Adapter ;C:\WINDOWS\system32\DRIVERS\smcpwr2n.sys [2001-08-17 22:12]

S3 GoogleDesktopManager-022208-143751;Mened¿er Google Desktop 5.7.802.22438;“C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” [2008-03-09 15:25]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{49fd2c33-206c-11dd-83c9-00e02945a733}]

\Shell\AutoRun\command - G:\t.com

\Shell\explore\Command - G:\t.com

\Shell\open\Command - G:\t.com

*Newly Created Service* - CATCHME

.

        • ORPHANS REMOVED - - - -

HKLM-Run-Cmaudio - cmicnfg.cpl

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-03 21:11:46

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-07-03 21:15:26

ComboFix-quarantined-files.txt 2008-07-03 19:14:53

Pre-Run: 1,085,857,792 bajtów wolnych

Post-Run: 1,341,730,816 bajtów wolnych

113

#7 
C:\xmnm2.cmd

C:\r.cmd

pliki do usunięcia użyj - http://www.brothersoft.com/prt-(perlovga-removal-tool)-60877.html

#8

nie bardzo rozumiem jak uzyc tego:

http://www.brothersoft.com/prt-(perlovga-removal-tool-download-60877.html

nie moge usunac tego tak jak poprzednim razem ze utworze dok.txt i przeniose go na combofixa powstanie log itp?

W dniu 03.07.2008 , o godzinie 23:02 został dopisany post przez mem

hmmm??? to jak? mozecie jeszcze podpowiedziec?

#9

Masz opis - http://www.bezpieczenstwosystemow.pl/in … pic=1647.0