nowy (?) trojan.vundo

**Posty:** 2 · przez **reszta** 07 Maj 2008, 21:02

Witam!

Po raz kolejny pojawia się taki temat, ale jak na razie nic co znalazłem mi nie pomaga... Te wszystkie "Fixy" i inne "Virtumundy" nie działają, to znaczy działają do pewnego momentu

sam usunąłem jednego dll'a, a one drugiego, ale mojemu AntyVirowi chodzi jeszcze o plik opnnmKdD.dll oczywiście w katalogu system32, którego tamte removery nie widzą.

Znalazłem coś na francuskim forum, ale choć nie znam francuskiego to ewidentnie widać, że temat jeszcze nie jest zamknięty, a posty są z 6 maja tego roku.

Czy ktoś wie co zrobić, jeśli żaden program stosowany wcześniej do takich trojanów w tym przypadku nie pomaga?
Mam jeszcze zamiar spróbować ręcznie pod dosem to usunąć... jakieś przeciwwskazania?

**Posty:** 8001 · przez **Okocza** 07 Maj 2008, 21:08

daj log z combofixa http://www.forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

a potem z hijack'a http://www.forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 2 · przez **reszta** 07 Maj 2008, 22:33

dobrze, dam je jutro wieczorem albo w piatek, bo ten problem jest na komputerze mojej narzeczonej, a póki co jesteśmy w moim domu

Pozdrawiam i dziękuję za szybką odpowiedź!

[ Dodano: Dzisiaj o 19:53 ]
Tutaj daję loga z ComboFixa:

Kod: Zaznacz wszystko
ComboFix 08-05-08.1 - Basia 2008-05-09 19:41:41.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.705 [GMT 2:00] Running from: C:\Documents and Settings\Basia\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\cookies.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\aycyijor.ini C:\WINDOWS\system32\DdKmnnpo.ini C:\WINDOWS\system32\DdKmnnpo.ini2 C:\WINDOWS\system32\efcYQKBq.dll C:\WINDOWS\system32\geBqPFUo.dll C:\WINDOWS\system32\gjxjuofk.ini C:\WINDOWS\system32\hmmerwoq.ini C:\WINDOWS\system32\mwwdeyxb.ini C:\WINDOWS\system32\nucpuhtq.ini C:\WINDOWS\system32\odxjfrev.ini C:\WINDOWS\system32\oUFPqBeg.ini C:\WINDOWS\system32\oUFPqBeg.ini2 C:\WINDOWS\system32\qBKQYcfe.ini C:\WINDOWS\system32\qBKQYcfe.ini2 C:\WINDOWS\system32\ucrfdktw.ini C:\WINDOWS\system32\uyjlfxic.dll C:\WINDOWS\system32\verfjxdo.dll C:\WINDOWS\system32\wvlfumcn.ini . ((((((((((((((((((((((((( Files Created from 2008-04-09 to 2008-05-09 ))))))))))))))))))))))))))))))) . 2008-05-07 19:52 . 2008-05-07 20:25 0 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 2008-05-07 19:37 . 2008-04-09 23:17 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-05-07 19:37 . 2008-04-09 23:17 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-05-07 19:37 . 2008-04-09 23:17 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-05-07 19:37 . 2008-04-09 23:17 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-05-07 19:37 . 2008-04-09 23:17 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-05-07 19:37 . 2008-04-09 23:17 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-05-07 19:37 . 2008-04-09 23:17 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-05-07 19:37 . 2008-05-07 19:37 <DIR> d-------- C:\Documents and Settings\Administrator 2008-05-07 19:37 . 2008-05-09 19:41 1,024 --ah----- C:\Documents and Settings\Administrator\NtUser.dat.LOG 2008-05-07 19:20 . 2008-05-07 19:47 <DIR> d-------- C:\VundoFix Backups 2008-05-05 14:37 . 2008-05-05 14:37 <DIR> d-------- C:\Documents and Settings\Basia\Dane aplikacji\Lavasoft 2008-04-26 08:50 . 2008-05-07 21:04 109,843 --a------ C:\WINDOWS\BM730f6059.xml 2008-04-24 18:15 . 2008-04-24 18:15 272,384 --------- C:\WINDOWS\system32\opnnmKdD.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-05 13:57 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-04-09 21:22 --------- d-----w C:\Program Files\XviD 2008-04-09 21:22 --------- d-----w C:\Program Files\Winamp 2008-04-09 21:22 --------- d-----w C:\Program Files\VIA Technologies, INC 2008-04-09 21:22 --------- d-----w C:\Program Files\Usługi online 2008-04-09 21:22 --------- d-----w C:\Program Files\Symantec 2008-04-09 21:22 --------- d-----w C:\Program Files\QuickTime Alternative 2008-04-09 21:22 --------- d-----w C:\Program Files\Norton AntiVirus 2008-04-09 21:21 --------- d-----w C:\Program Files\Microsoft.NET 2008-04-09 21:21 --------- d-----w C:\Program Files\microsoft frontpage 2008-04-09 21:21 --------- d-----w C:\Program Files\Media Player Classic 2008-04-09 21:21 --------- d-----w C:\Program Files\MarBit 2008-04-09 21:21 --------- d-----w C:\Program Files\Lavasoft 2008-04-09 21:21 --------- d-----w C:\Program Files\Java 2008-04-09 21:20 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-09 21:20 --------- d-----w C:\Program Files\Gadu-Gadu 2008-04-09 21:20 --------- d-----w C:\Program Files\DivX 2008-04-09 21:19 --------- d-----w C:\Program Files\Common Files\Java 2008-04-09 21:19 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-04-09 21:19 --------- d-----w C:\Program Files\Common Files\Ahead 2008-04-09 21:18 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-09 21:18 --------- d-----w C:\Program Files\AvRack 2008-04-09 21:18 --------- d-----w C:\Program Files\Avance Sound Manager 2008-04-09 21:18 --------- d-----w C:\Program Files\Ahead 2008-04-09 21:18 --------- d-----w C:\Program Files\AC3Filter 2008-04-09 21:17 --------- d-----w C:\Documents and Settings\NetworkService\Dane aplikacji\Symantec 2008-04-09 21:16 --------- d-----w C:\Documents and Settings\Basia\Dane aplikacji\Winamp 2008-04-09 21:16 --------- d-----w C:\Documents and Settings\Basia\Dane aplikacji\Symantec 2008-04-09 21:16 --------- d-----w C:\Documents and Settings\Basia\Dane aplikacji\Gadu-Gadu 2008-04-09 21:16 --------- d-----w C:\Documents and Settings\Basia\Dane aplikacji\DivX 2008-04-09 21:16 --------- d-----w C:\Documents and Settings\Basia\Dane aplikacji\AdobeUM 2008-04-09 21:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2008-04-09 21:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-04-09 21:12 --------- d-----w C:\Documents and Settings\Alek\Dane aplikacji\Winamp 2008-04-09 21:12 --------- d-----w C:\Documents and Settings\Alek\Dane aplikacji\AdobeUM . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F39EB434-E82C-4559-BF91-03AAD5B81FBB}] 2008-04-24 18:15 272384 --------- C:\WINDOWS\system32\opnnmKdD.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="soundman.exe" [2001-12-20 03:37 124416 C:\WINDOWS\soundman.exe] "NvCplDaemon"="NvQTwk" [] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 15:43 188416] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-08-13 22:17 58488] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= S2 ousbehci;%OWC_USBEHCD.DeviceDesc%;C:\WINDOWS\system32\Drivers\ousbehci.sys [2002-01-31 17:39] . Contents of the 'Scheduled Tasks' folder "2008-04-11 18:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Basia.job" - C:\PROGRA~1\NORTON~1\Navw32.exef/task: . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-09 19:45:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Messenger\msmsgs.exe . ************************************************************************** . Completion time: 2008-05-09 19:48:41 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-09 17:48:38 Pre-Run: 26,903,789,568 bajtów wolnych Post-Run: 27,056,025,600 bajt˘w wolnych 149

No i z HiJackThis tak jak pisałeś:

Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:58:26, on 2008-05-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Messenger\msmsgs.exe C:\Hi\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {F9380F29-7435-46A6-B875-57764352C6B2} - C:\WINDOWS\system32\opnnmKdD.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 5763 bytes

nowy (?) trojan.vundo

Nowy (?) Trojan.Vundo

Kto jest na forum