Tr/rookit.gen - ciągłe wyskakujące okna o wirusach

**Posty:** 6 · przez **michalix** 06 Kwi 2010, 21:40

Od 10 minut, ciągle wyskakują powiadomienia o wykryciu wirusa TR/Rookit.Gen
Już nie wiem co mam robić ;d jakaś poważniejsza infekcja chyba ;d

Tera logi:
DDS:
http://www.wklej.org/id/311185/

Attach:
http://www.wklej.org/id/311186/

OTL:
http://www.wklej.org/id/311187/

Extras:
http://www.wklej.org/id/311188/

Hijack:
http://www.wklej.org/id/311200/

Jeszcze coś dodać ? ;d

**Posty:** 18165 · przez **wojtas** 06 Kwi 2010, 21:53

michalix napisał(a):Jeszcze coś dodać ? ;d

tak z Gmera (pamiętaj o programie emulującym + sptd.sys)
gmer-opis-dzialania-vt117883.html
ale najpierw :
Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
SRV - File not found [Disabled | Stopped] -- -- (MkS_Scan)
SRV - File not found [Auto | Stopped] -- -- (gupdate1c9d5f0d1447844) Usługa Google Update (gupdate1c9d5f0d1447844)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SHOUTcast Loader) - {ccec60fc-2608-4e58-9659-3ffc159e8ea9} - C:\Program Files\SHOUTcast Radio Toolbar\shoutcasttb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (SHOUTcast Radio Toolbar) - {0457331D-8CA6-4F97-9C26-6A9EF2B2DBA8} - C:\Program Files\SHOUTcast Radio Toolbar\shoutcasttb.dll (AOL LLC)
O4 - Startup: C:\Documents and Settings\x\Menu Start\Programy\Autostart\syspck32.exe ()
O33 - MountPoints2\{3bec5e1e-8baf-11dc-b7b5-00508d7b8531}\Shell - "" = AutoRun
O33 - MountPoints2\{3bec5e1e-8baf-11dc-b7b5-00508d7b8531}\Shell\AutoRun\command - "" = F:\autorun.exe -- File not found
O33 - MountPoints2\{acb697c2-0930-11dc-9c1b-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{acb697c2-0930-11dc-9c1b-806d6172696f}\Shell\AutoRun\command - "" = E:\Autorun.exe root.ini -- File not found
O33 - MountPoints2\{ee2e538a-04c1-11de-806b-00508d7b8531}\Shell\AutoRun\command - "" = c2e.exe
O33 - MountPoints2\{ee2e538a-04c1-11de-806b-00508d7b8531}\Shell\open\Command - "" = c2e.exe

:Files
C:\WINDOWS\System32\drivers\mxxofhr.sys
C:\WINDOWS\System32\drivers\lbrtfdc.sys
C:\WINDOWS\System32\dllcache\lbrtfdc.sys
C:\WINDOWS\System32\dllcache\i2omgmt.sys
C:\WINDOWS\System32\drivers\changer.sys
C:\WINDOWS\System32\dllcache\changer.sys
C:\Documents and Settings\x\Menu Start\Programy\Autostart\syspck32.exe
C:\Program Files\SHOUTcast Radio Toolbar
C:\Documents and Settings\LocalService\Dane aplikacji\jasltw.dat
C:\Documents and Settings\x\Dane aplikacji\avdrn.dat
C:\WINDOWS\System32\drivers\f20476b6.sys
C:\Documents and Settings\x\Dane aplikacji\wiaserva.log

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Services
f20476b6
mxxofhr

:Commands
[resethosts]
[emptytemp]

Kliknij w Run Fix. I potwierdź reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia komputera + log z Gmera

**Posty:** 6 · przez **michalix** 06 Kwi 2010, 22:18

OTL:
http://www.wklej.org/id/311251/

Jakiś raport który się pokazał po włączeniu kompa:
http://www.wklej.org/id/311253/

Log z Gmera Zaraz dodam, bo się skanuje

Dodano Dzisiaj, 15:02:

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-04-07 14:48:10 Windows 5.1.2600 Dodatek Service Pack 3 Running: h7pgj52n.exe; Driver: C:\DOCUME~1\x\USTAWI~1\Temp\uwtyypow.sys ---- System - GMER 1.0.15 ---- SSDT F7AB0FC6 ZwCreateKey SSDT F7AB0FBC ZwCreateThread SSDT F7AB0FCB ZwDeleteKey SSDT F7AB0FD5 ZwDeleteValueKey SSDT F7AB0FDA ZwLoadKey SSDT F7AB0FA8 ZwOpenProcess SSDT F7AB0FAD ZwOpenThread SSDT F7AB0FE4 ZwReplaceKey SSDT F7AB0FDF ZwRestoreKey SSDT F7AB0FD0 ZwSetValueKey SSDT F7AB0FB7 ZwTerminateProcess ---- Kernel code sections - GMER 1.0.15 ---- .pak2 C:\WINDOWS\system32\drivers\mxxofhr.sys entry point in ".pak2" section [0xF7281B97] ? C:\WINDOWS\system32\drivers\mxxofhr.sys Urządzenie podłączone do komputera nie działa. PAGE Ntfs.sys F70F3E55 4 Bytes CALL 8A2F97E9 .text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF5AF8000, 0x1C5D58, 0xE8000020] init C:\WINDOWS\system32\drivers\skfilt.sys entry point in "init" section [0xA2D9D430] ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\Mozilla Firefox\firefox.exe[2688] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation) ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 8A2871D8 ---- Services - GMER 1.0.15 ---- Service (*** hidden *** ) [BOOT] mxxofhr <-- ROOTKIT !!! ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x7A 0x5E 0x2E 0x7A ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBA 0x31 0xB6 0xEC ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xE1 0x6B 0xB2 0xEF ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x21 0xE6 0xE1 0x81 ... Reg HKLM\SYSTEM\ControlSet002\Services\mxxofhr@Type 1 Reg HKLM\SYSTEM\ControlSet002\Services\mxxofhr@Start 0 Reg HKLM\SYSTEM\ControlSet002\Services\mxxofhr@ErrorControl 0 Reg HKLM\SYSTEM\ControlSet002\Services\mxxofhr@Group Boot Bus Extender Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x7A 0x5E 0x2E 0x7A ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBA 0x31 0xB6 0xEC ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xE1 0x6B 0xB2 0xEF ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x21 0xE6 0xE1 0x81 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\mxxofhr@Type 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\mxxofhr@Start 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\mxxofhr@ErrorControl 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\mxxofhr@Group Boot Bus Extender Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x7A 0x5E 0x2E 0x7A ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBA 0x31 0xB6 0xEC ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xE1 0x6B 0xB2 0xEF ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x21 0xE6 0xE1 0x81 ... ---- EOF - GMER 1.0.15 ----

Ok, kod z GMERa

**Posty:** 4765 · przez **ordynat** 07 Kwi 2010, 15:51

Do Notatnika wklej:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}"=- [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{14f0d511-36a2-41ca-ae01-ba4f87282c97}"=- [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks] "{14f0d511-36a2-41ca-ae01-ba4f87282c97}"=- [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=- [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=""

Z Menu Notatnika >> Plik >> Zapisz jako >> Ustaw rozszerzenie na Wszystkie pliki >> Zapisz jako> FIX.REG >>
plik uruchom (dwuklik i OK).
Potem:
Ściągnij -->Avenger.
wklej do niego ten tekst:

Kod: Zaznacz wszystko: Files to delete: C:\WINDOWS\System32\drivers\mxxofhr.sys Registry keys to delete: HKLM\SYSTEM\ControlSet002\Services\mxxofhr HKLM\SYSTEM\CurrentControlSet\Services\mxxofhr Drivers to delete: mxxofhr gupdate1c9d5f0d1447844

Kliknij w "Execute" i zatwierdź restart komputera.
Zrestartuj komputer.
Daj Raport z Avengera z C:\avenger.txt.
Oraz nowy log z OTL.
.

**Posty:** 6 · przez **michalix** 07 Kwi 2010, 19:21

Dobra. OTL:
http://wklej.org/id/311712/

Avenger:

Kod: Zaznacz wszystko: ////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Platform: Windows XP (build 2600, Dodatek Service Pack 3) Wed Apr 07 18:38:18 2010 18:38:16: Warning: Skipping potentially dangerous line: "HKLM\SYSTEM\CurrentControlSet\Services\mxxofhr" (Registry key deletion mode) 18:38:18: Error: Execution aborted by user! ////////////////////////////////////////// Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\WINDOWS\System32\drivers\mxxofhr.sys" deleted successfully. Registry key "HKLM\SYSTEM\ControlSet002\Services\mxxofhr" deleted successfully. Registry key "HKLM\SYSTEM\CurrentControlSet\Services\mxxofhr" deleted successfully. Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\mxxofhr" not found! Deletion of driver "mxxofhr" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Driver "gupdate1c9d5f0d1447844" deleted successfully. Completed script processing. ******************* Finished! Terminate.

**Posty:** 4765 · przez **ordynat** 07 Kwi 2010, 20:41

Strona "wklej.org" jest dziś nieczynna, więc nie da się sprawdzić nowego logu OTL.
Ale sądząc po raporcie Avengera - to powinno już być czysto.
.

Autor postu otrzymał pochwałę