Nieuchronne zagrozenie

**Posty:** 2 · przez **greyfka** 22 Paź 2008, 20:06

CUs po kosciach czuje ze jakies robaki opanowaly Moze ktos byl by laskawy spr log Jestem newbie w temacie prosze o wyrozumialosc

Kod: Zaznacz wszystko: ComboFix 08-10-21.05 - SDM 2008-10-22 18:53:12.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.356 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\SDM\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\msxml71.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-22 do 2008-10-22 ))))))))))))))))))))))))))))))) . 2008-10-22 17:00 . 2008-10-22 17:00 <DIR> dr------- C:\Documents and Settings\NetworkService\Ulubione 2008-10-22 16:49 . 2008-10-22 16:49 <DIR> d-------- C:\Documents and Settings\SDM\Dane aplikacji\VirusRemover2008 2008-10-22 16:14 . 2008-10-22 16:13 55,296 --a------ C:\WINDOWS\system32\oWmhen0g.exe 2008-10-20 14:33 . 2008-10-20 14:33 <DIR> d-------- C:\Program Files\xp-AntiSpy 2008-10-15 17:07 . 2008-10-15 18:08 <DIR> d-------- C:\CYBERTECH 2008-10-13 19:48 . 2008-10-19 09:40 <DIR> d-------- C:\Program Files\CCleaner 2008-10-13 19:47 . 2008-10-13 19:47 <DIR> d-------- C:\Program Files\LD-Anime 2008-09-30 15:11 . 2008-09-30 15:11 <DIR> d-------- C:\Program Files\uTorrent 2008-09-30 15:11 . 2008-10-22 18:48 <DIR> d-------- C:\Documents and Settings\SDM\Dane aplikacji\uTorrent 2008-09-29 18:49 . 2008-09-29 18:49 <DIR> d-------- C:\Documents and Settings\SDM\DoctorWeb . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-22 15:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-10-22 15:11 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-10-20 12:51 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-09-29 15:36 395,794 ----a-w C:\SztuczkiWindows.zip 2008-09-07 16:57 66,048 ----a-w C:\mbr.exe 2008-09-05 05:54 43,008 ----a-w C:\sysdbby.exe 2008-09-05 05:41 43,008 ----a-w C:\systqge.exe . ------- Sigcheck ------- 2008-06-20 12:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys 2008-06-20 13:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys 2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys 2004-08-04 00:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys 2008-04-13 21:20 361344 93ea8d04ec73a85db02eb8805988f733 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\tcpip.sys 2008-10-20 14:51 360320 4395ca9fca8d70149cc209d42cc189cf C:\WINDOWS\system32\dllcache\tcpip.sys 2008-10-20 14:51 360320 4395ca9fca8d70149cc209d42cc189cf C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( snapshot_2008-09-28_15.40.23.83 ))))))))))))))))))))))))))))))))))))))))) . + 2008-10-04 18:16:46 1,887,080 ----a-w C:\WINDOWS\Downloaded Program Files\CONFLICT.1\FP_AX_CAB_INSTALLER.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 36352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Remote Controller.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Remote Controller.lnk backup=C:\WINDOWS\pss\Remote Controller.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Scheduler.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Scheduler.lnk backup=C:\WINDOWS\pss\Scheduler.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^SDM^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\SDM\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 01:55 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerS] --a------ 2001-08-03 18:56 159800 C:\WINDOWS\PowerS.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] --------- 2008-07-07 09:42 2156368 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\java.exe"= "E:\\eMule\\emule.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= R2 BT878;BtCap, WDM Video Capture;C:\WINDOWS\system32\drivers\BT878.SYS [2003-03-26 99334] R2 BTTUNER;BtTuner, WDM TV Tuner;C:\WINDOWS\system32\drivers\BTTUNER.SYS [2001-02-03 22288] R2 BTXBAR;BtXBar, WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.SYS [2001-02-03 12632] R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2001-04-27 38946] . Zawartość folderu 'Zaplanowane zadania' 2008-10-22 C:\WINDOWS\Tasks\At1.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At10.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At11.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At12.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At13.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At14.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At15.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At16.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At17.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At18.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At19.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At2.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At20.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At21.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At22.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At23.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At24.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At3.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At4.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At5.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At6.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At7.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At8.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] 2008-10-22 C:\WINDOWS\Tasks\At9.job - C:\WINDOWS\system32\oWmhen0g.exe [2008-10-22 16:13] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-Google Update - C:\Documents and Settings\SDM\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe MSConfigStartUp-Gadu-Gadu - E:\Program Files\Gadu-Gadu\gg.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\SDM\Dane aplikacji\Mozilla\Firefox\Profiles\3gcyrjrg.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1408409&SearchSource=3&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - about:blank . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-22 18:54:36 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... C:\DOCUME~1\SDM\USTAWI~1\Temp\RGI5.tmp skanowanie pomyślnie ukończone ukryte pliki: 1 ************************************************************************** . Czas ukończenia: 2008-10-22 18:56:28 ComboFix-quarantined-files.txt 2008-10-22 16:56:25 ComboFix2.txt 2008-09-07 17:13:37 ComboFix3.txt 2008-07-21 15:11:25 ComboFix4.txt 2008-07-21 14:44:36 Przed: 1 866 043 392 bajtów wolnych Po: 1,859,371,008 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 176 --- E O F --- 2008-09-10 17:21:32

**Posty:** 7956 · przez **Magik** 22 Paź 2008, 20:08

Witam

nie rob z tego forum jakeigos o2.pl i wstaw log w tagi 'code'

do tego wklej log z HiJackThis

http://forum.programosy.pl/hijackthis-silent-runners-obsluga-i-umieszczanie-vt9452.html

**Posty:** 2 · przez **greyfka** 22 Paź 2008, 22:31

Kod: Zaznacz wszystko: log z HiJackThis ogfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:25:11, on 2008-10-22 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\RealVNC\VNC4\WinVNC4.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\internet explorer\iexplore.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\oWmhen0g.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{A409B583-722A-42FF-B27B-732F1152DCA0}: NameServer = 10.0.0.2 O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe O24 - Desktop Component 0: (no name) - http://upload.wikimedia.org/wikipedia/commons/b/be/Moonc.gif -- End of file - 4425 bytes

**Posty:** 7956 · przez **Magik** 22 Paź 2008, 22:39

odpalasz kompa w trybie awaryjnym F8 wciskasz przy starcie i wybierasz z menu. Po zaladowaniu wlaczasz Hijacka, wybierasz->do a scan only> i nastepnie wpisy ponizej "ptaszkujesz" i dajesz "fix checked"

Kod: Zaznacz wszystko: C:\WINDOWS\system32\oWmhen0g.exe

do tego robisz skan jeszcze tym narzedziem

http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\mbr.exe C:\WINDOWS\system32\oWmhen0g.exe C:\sysdbby.exe C:\systqge.exe C:\WINDOWS\Tasks\At1.job C:\WINDOWS\Tasks\At10.job C:\WINDOWS\Tasks\At11.job C:\WINDOWS\Tasks\At12.job C:\WINDOWS\Tasks\At13.job C:\WINDOWS\Tasks\At14.job C:\WINDOWS\Tasks\At15.job C:\WINDOWS\Tasks\At16.job C:\WINDOWS\Tasks\At17.job C:\WINDOWS\Tasks\At18.job C:\WINDOWS\Tasks\At19.job C:\WINDOWS\Tasks\At2.job C:\WINDOWS\Tasks\At20.job C:\WINDOWS\Tasks\At21.job C:\WINDOWS\Tasks\At22.job C:\WINDOWS\Tasks\At23.job C:\WINDOWS\Tasks\At24.job C:\WINDOWS\Tasks\At3.job

Zapisz plik jako CFScript.txt najlepiej aby ikonka tego pliku znajdowała się obok ikonki ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na ikonkę ComboFix.exe powinno rozpocząć się usuwanie po tym daj log na forum.