proszę o sprawdzenie loga

[Melonix]

Komputer praktycznie bez przerwy wysyła i pobiera jakieś dane przez Internet co bardzo spowalnia albo wręcz uniemożliwia korzystanie ze stron internetowych. Brak wyskakujących okienek ani innych objawów wskazujących na jakiegoś konkretnego trojana bądż wirusa.

Logi z hijackthis (swoją drogą działa mi jedynie w trybie awaryjnym bo normalnie jakiś syf od razu po uruchomieniu go zamyka):

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 16:11:34, on 2008-01-19
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Anti Spyware - różne progsy\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [mmsass] mmdmm.exe
O4 - HKLM\..\Run: [Windows Secure Update] load.exe
O4 - HKLM\..\Run: [WMI Standard Event Consumer - hosting] C:\WINDOWS\System32\wbem\scrcs.exe
O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe
O4 - HKLM\..\RunServices: [Windows Secure Update] load.exe
O4 - HKLM\..\RunServices: [WMI Standard Event Consumer - hosting] C:\WINDOWS\System32\wbem\scrcs.exe
O4 - HKLM\..\RunServices: [WindowsUpdater] WindowsUpdater.exe
O4 - HKLM\..\RunServices: [wind32dll] win32dll.exe
O4 - HKLM\..\RunOnce: [Windows Secure Update] load.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows Secure Update] load.exe
O4 - HKCU\..\Run: [WMI Standard Event Consumer - hosting] C:\WINDOWS\System32\wbem\scrcs.exe
O4 - HKCU\..\RunServices: [WMI Standard Event Consumer - hosting] C:\WINDOWS\System32\wbem\scrcs.exe
O4 - HKCU\..\RunOnce: [Windows Secure Update] load.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: Notowania ONET - http://gielda.onet.pl/notowania.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: lsass - Unknown owner - C:\RECYCLER\S-1-5-21-484763869-1614574334-18083462561-100\csrss.exe
O23 - Service: Microsoft Windows TCP Protocol - Unknown owner - C:\WINDOWS\System32\dllcache\wintcps.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)
O23 - Service: smss - Unknown owner - C:\RECYCLER\S-1-5-21-484763869-1614574334-18083462561-100\services.exe



[Dzi@dek]

daj jeszcze log z combofix.

[Melonix]

Niestety ComboFix zawiesza się w trakcie skanowania.

Dodatkowo jeszcze SilentRunners:

Kod: Zaznacz wszystko


"Silent Runners.vbs", revision 43, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\System32\ctfmon.exe" [MS]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"Windows Secure Update" = "load.exe" [null data]
"WMI Standard Event Consumer - hosting" = "C:\WINDOWS\System32\wbem\scrcs.exe" [null data]

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"Windows Secure Update" = "load.exe" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"AdslTaskBar" = "rundll32.exe stmctrl.dll,TaskBar" [MS]
"mmsass" = "mmdmm.exe" [null data]
"Windows Secure Update" = "load.exe" [null data]
"WMI Standard Event Consumer - hosting" = "C:\WINDOWS\System32\wbem\scrcs.exe" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"Windows Secure Update" = "load.exe" [null data]

HKLM\Software\Microsoft\Active Setup\Installed Components\
{306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided)
                                       \StubPath   = ""C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
"VIA RAID TOOL" -> shortcut to: "C:\Program Files\VIA\RAID\raid_tool.exe" ["VIA Technologies"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."]
lsass, lsass, "C:\RECYCLER\S-1-5-21-484763869-1614574334-18083462561-100\csrss.exe" [null data]
Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
Microsoft Windows TCP Protocol, Microsoft Windows TCP Protocol, ""C:\WINDOWS\System32\dllcache\wintcps.exe"" [null data]
Network Windows Service, MSWindows, ""C:\WINDOWS\System32\urdvxc.exe" /service" [null data]
smss, smss, "C:\RECYCLER\S-1-5-21-484763869-1614574334-18083462561-100\services.exe" [null data]
Windows Secure Update, flys.q8pilots.net, ""C:\WINDOWS\System32\load.exe" -netsvcs" [null data]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
  DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
  use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 32 seconds, including 14 seconds for message boxes)


[Dzi@dek]

Spróbuj pobrać
Zastosuj SDFix . Po pobraniu uruchom go - rozpakuje się do C:\SDFix.
Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w trybie awaryjnym uruchom plik

RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zrestartuje.

Później wejdź do folderu C:\SDFix i wrzuć zawartość pliku Report.txt + log z

Combofix-a oraz z Hijackthis

No to mamy problem.
Wyłącz przywracanie systemu - uruchom kompa w trybie awaryjnym - odpal Hijackthis - zaznacz wpisy i daj - Fix checked.

O4 - HKLM\..\Run: [mmsass] mmdmm.exe
O4 - HKLM\..\Run: [Windows Secure Update] load.exe
O4 - HKLM\..\Run: [WMI Standard Event Consumer - hosting] C:\WINDOWS\System32\wbem\scrcs.exe
O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe
O4 - HKLM\..\RunServices: [Windows Secure Update] load.exe
O4 - HKLM\..\RunServices: [WMI Standard Event Consumer - hosting] C:\WINDOWS\System32\wbem\scrcs.exe
O4 - HKLM\..\RunServices: [WindowsUpdater] WindowsUpdater.exe
O4 - HKLM\..\RunServices: [wind32dll] win32dll.exe
O4 - HKLM\..\RunOnce: [Windows Secure Update] load.exe
O4 - HKCU\..\Run: [Windows Secure Update] load.exe
O4 - HKCU\..\Run: [WMI Standard Event Consumer - hosting] C:\WINDOWS\System32\wbem\scrcs.exe
O4 - HKCU\..\RunServices: [WMI Standard Event Consumer - hosting] C:\WINDOWS\System32\wbem\scrcs.exe
O4 - HKCU\..\RunOnce: [Windows Secure Update] load.exe
O23 - Service: lsass - Unknown owner - C:\RECYCLER\S-1-5-21-484763869-1614574334-18083462561-100\csrss.exe
O23 - Service: Microsoft Windows TCP Protocol - Unknown owner - C:\WINDOWS\System32\dllcache\wintcps.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)
O23 - Service: smss - Unknown owner - C:\RECYCLER\S-1-5-21-484763869-1614574334-18083462561-100\services.exe

Zlokalizuj pogrubione pliki

c:\windows\system32

i usuń je ręcznie.