backdor

**Posty:** 974 · przez **Swat** 08 Gru 2006, 16:31

Mam na dysku backdora i ewidio sobie nie radzi , potrzebuje do tego jakis firewall , i jak usunąć Usługe posłaniec bo czasami jest czasami jej niema <lol>

I dalej pingi zabójcze mam na neo 512 ;( Help o co chodzi z tym win xp ?

**Posty:** 1134 · przez **MISTEJK** 08 Gru 2006, 16:38

daj loga z hijacka

**Posty:** 935 · przez **Aqui** 08 Gru 2006, 16:40

MISTEJK napisał(a):daj loga z hijacka

plus silentrunners,i daj raport z ewido :wink:

**Posty:** 974 · przez **Swat** 08 Gru 2006, 16:45

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:44:43, on 2006-12-08 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\System32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe D:\WINDOWS\System32\irdvxc.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe D:\Program Files\Alwil Software\Avast4\ashWebSv.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\Xerox\PanelMgr\ssmmgr.exe D:\program files\zte corporation\zxdsl852\CnxDslTb.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Program Files\Java\jre1.5.0_09\bin\jusched.exe D:\WINDOWS\System32\RunDll32.exe D:\WINDOWS\System32\wimf.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe D:\WINDOWS\System32\kavsvc.exe D:\WINDOWS\System32\ctfmon.exe D:\Program Files\Gadu-Gadu\gg.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\Program Files\Advanced Registry Doctor\RegManServ.exe D:\InStAlKi\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - D:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Xerox PanelMgr] D:\WINDOWS\Xerox\PanelMgr\ssmmgr.exe /autorun O4 - HKLM\..\Run: [CnxDslTaskBar] "d:\program files\zte corporation\zxdsl852\CnxDslTb.exe" "ZTE Corporation\ZXDSL852" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [Services] D:\WINDOWS\System32\wimf.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [Windows Updates Security System] kavsvc.exe O4 - HKLM\..\RunServices: [Windows Updates Security System] kavsvc.exe O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Windows Updates Security System] kavsvc.exe O4 - HKCU\..\RunServices: [Windows Updates Security System] kavsvc.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\WINDOWS\System32\shdocvw.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{5A64FED8-F48D-4C00-B43D-81557DB0A202}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{5A64FED8-F48D-4C00-B43D-81557DB0A202}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Network helper Service (MSDisk) - Unknown owner - D:\WINDOWS\System32\irdvxc.exe" /service (file missing) O23 - Service: Registry Management Service (RegManServ) - Unknown owner - D:\Program Files\Advanced Registry Doctor\RegManServ.exe

reszta zaraz

[ Dodano: Dzisiaj o 15:49 ]

Kod: Zaznacz wszystko: AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 23:23:18 2006-12-05 + Scan result: HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Cleaned. D:\WINDOWS\system32\firewall.exe -> Dropper.Pakes : Cleaned. D:\WINDOWS\system32\helpermdm4.exe -> Proxy.Slaper.e : Cleaned. D:\WINDOWS\system32\helpersrrvc.exe -> Proxy.Slaper.e : Cleaned. :mozilla.11:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Adocean : Cleaned. :mozilla.12:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Adocean : Cleaned. D:\Documents and Settings\Admin\Cookies\admin@atdmt[1].txt -> TrackingCookie.Atdmt : Ignored. :mozilla.50:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Doubleclick : Ignored. :mozilla.36:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Fastclick : Ignored. :mozilla.37:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Fastclick : Ignored. :mozilla.46:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.47:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.48:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. D:\Documents and Settings\Admin\Cookies\admin@questionmarket[2].txt -> TrackingCookie.Questionmarket : Ignored. :mozilla.10:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.9:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.21:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.22:D:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\e0u8tsos.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. D:\Documents and Settings\Admin\Cookies\admin@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned. ::Report end

a i mam chyba cos uszkodzone w win . przy logowaniu po hibernacji pyta mnie o hasło żeby sie zalogować jak hasła nie mam oc o chodzi mu ?

**Posty:** 1134 · przez **MISTEJK** 08 Gru 2006, 16:54

Wyłącz przywracanie systemu i wejdź w tryb awaryjny.
Najpierw usuwasz wpisy w Hijackthis, następnie pogrubione pliki ręcznie z dysku:

Start --> uruchom --> services.msc --> zatrzymaj i wyłącz usługe:Network helper Service
Otwórz hijackthis --> open misc tools section --> delete a NT service --> wpisz: MSDisk --> ok

D:\WINDOWS\System32\irdvxc.exe
D:\WINDOWS\System32\wimf.exe
O4 - HKLM\..\Run: [Services] D:\WINDOWS\System32\wimf.exe
O4 - HKLM\..\Run: [Windows Updates Security System] kavsvc.exe
O4 - HKLM\..\RunServices: [Windows Updates Security System] kavsvc.exe
O4 - HKCU\..\Run: [Windows Updates Security System] kavsvc.exe
O4 - HKCU\..\RunServices: [Windows Updates Security System] kavsvc.exe O23 - Service: Network helper Service (MSDisk) - Unknown owner - D:\WINDOWS\System32\irdvxc.exe" /service (file missing)

i nowe logi

Autor postu otrzymał pochwałę

**Posty:** 974 · przez **Swat** 08 Gru 2006, 16:55

ok zaraz sie biore do roboty tylko co zrobić jak sie ładuje login żeby mi hasło nie wyskakiwało po hibernacji ?

[ Dodano: Dzisiaj o 16:15 ]

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:14:09, on 2006-12-08 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\System32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe D:\WINDOWS\System32\irdvxc.exe D:\Program Files\Advanced Registry Doctor\RegManServ.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe D:\Program Files\Alwil Software\Avast4\ashWebSv.exe D:\WINDOWS\Xerox\PanelMgr\ssmmgr.exe D:\program files\zte corporation\zxdsl852\CnxDslTb.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Program Files\Java\jre1.5.0_09\bin\jusched.exe D:\WINDOWS\System32\RunDll32.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe D:\WINDOWS\System32\ctfmon.exe D:\Program Files\Gadu-Gadu\gg.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\InStAlKi\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - D:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Xerox PanelMgr] D:\WINDOWS\Xerox\PanelMgr\ssmmgr.exe /autorun O4 - HKLM\..\Run: [CnxDslTaskBar] "d:\program files\zte corporation\zxdsl852\CnxDslTb.exe" "ZTE Corporation\ZXDSL852" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\WINDOWS\System32\shdocvw.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{5A64FED8-F48D-4C00-B43D-81557DB0A202}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{5A64FED8-F48D-4C00-B43D-81557DB0A202}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS2\Services\Tcpip\..\{5A64FED8-F48D-4C00-B43D-81557DB0A202}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Network helper Service (MSDisk) - Unknown owner - D:\WINDOWS\System32\irdvxc.exe" /service (file missing) O23 - Service: Registry Management Service (RegManServ) - Unknown owner - D:\Program Files\Advanced Registry Doctor\RegManServ.exe

**Posty:** 1134 · przez **MISTEJK** 09 Gru 2006, 13:17

Jeszcze siedzi... zrób to jeszcze raz

Start --> uruchom --> services.msc --> zatrzymaj i wyłącz usługe:Network helper Service
Otwórz hijackthis --> open misc tools section --> delete a NT service --> wpisz: MSDisk --> ok

Wyłącz przywracanie systemu i wejdź w tryb awaryjny.
Najpierw usuwasz wpisy w Hijackthis, następnie pogrubione pliki ręcznie z dysku:

D:\WINDOWS\System32\irdvxc.exe
O23 - Service: Network helper Service (MSDisk) - Unknown owner - D:\WINDOWS\System32\irdvxc.exe" /service (file missing)

http://www.downloads.subratam.org/KillBox.zip
Zaznaczasz Delete on reboot, w polu full path of file wklej ścieżkę pliku:D:\WINDOWS\System32\irdvxc.exe i klikasz na czerwony krzyżyk.

i nowy log

backdor

backdor

Kto jest na forum