2 Trojany ;\

[elmonk]

Avast wykrywa mi 2 wirusy w tych plikach:

 

Win32:Agent-LTS [Trj]

C:\DOCUME~1\Owner\LOCALS~1\Temp\ac8zt2\msmdev.dll

 

Win32:Trojan-gen {Other}

C:\DOCUME~1\Owner\LOCALS~1\Temp\ac8zt2\nsduo.dll

 

Win32:Trojan-gen {Other}

C:\DOCUME~1\Owner\LOCALS~1\Temp\ac8zt2\rmv.exe

 

Win32:Trojan-gen {Other}

C:\DOCUME~1\Owner\LOCALS~1\Temp\ac8zt2\main_uninstaller.exe

 

Log:

C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exeC:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\VistaDrive\VistaDrive.exeC:\Program Files\Analog Devices\Core\smax4pnp.exeC:\Program Files\Analog Devices\SoundMAX\smax4.exeC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Java\jre1.6.0_03\bin\jusched.exeC:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exeC:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exeC:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\WINDOWS\system32\wscntfy.exeD:\foobar2000\foobar2000\foobar2000.exeC:\Program Files\BitComet\BitComet.exeD:\Programy\mIRC\mirc.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Skype\Plugin Manager\skypePM.exeC:\WINDOWS\explorer.exeC:\Documents and Settings\Owner\Desktop\hijackthis_199\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896O2 - BHO: (no name) - {0ADB2036-054E-C176-4E7C-0045F62A1ED7} - C:\Program Files\bqwhdpbl\cpbybhdw.dllO2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dllO2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dllO2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlflm.dllO3 - Toolbar: The nssfrch - {61AB8A39-FCCB-47CC-BAF3-750D1834E773} - C:\WINDOWS\nssfrch.dllO4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exeO4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exeO4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /trayO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osbootO4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [qbidstur] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\qbidstur.dll"O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htmO8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htmO8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dllO9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dllO9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)O17 - HKLM\System\CCS\Services\Tcpip\..\{42C5CDE5-8421-439D-92CE-CF8648721252}: NameServer = 194.204.159.1 217.98.63.164O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dllO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLLO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dllO21 - SSODL: bxsbang - {07A90506-F087-47BA-ABFC-C58F8232C126} - C:\WINDOWS\bxsbang.dllO21 - SSODL: ocgrep - {7C0917D9-1D14-4ECA-8694-D551E4166671} - (no file)O21 - SSODL: msmhost - {CA2589A7-5370-427C-8E1B-BBFEB93C7B40} - C:\WINDOWS\msmhost.dllO21 - SSODL: msmdev - {5F3F4642-3C23-4447-9967-69DCD391CB07} - C:\WINDOWS\msmdev.dll (file missing)O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exeO23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Moglby ktos poradzic jak mam to pazerstwo usunąć?

 

Pzdr

[Kolobos]

Zrob skan przy pomocy SuperAntiSpyware, uzyj combofix oraz log z nowej wersji hijackthis (2.x) razem z naglowkiem, a nie jakis obciety.

Wszystkie logi wklej na http://wklej.org i daj link.

[elmonk]

SuperAntiSpyware chyba najwidoczniej zalatwil sprawe bo komp po gruntownym skanie (znalazl te smieci) dziala juz od 40 min i zaden alert nie wyskakuje wiec chyba problem rozwiazany.

 

Wielkie dzieki Kolobos

 

Pzdr

[Kolobos]

Watpie zeby usunal wszystko ale rob jak chcesz.

[elmonk]

http://wklej.org/id/c505600761 <-- obydwa logi juz po przeskanowaniu przez SuperAntiSpyware Edytowane 22 Października 2007 przez elmonk

[Kolobos]

W jaki sposob zainfekowales sobie system? Data plikow to 2007-10-23 14:50, co wtedy robiles?

Ciekawi mnie to poniewaz jestes dzisiaj juz ktoras z kolei osoba z ta sama infekcja.

 

Zamiast Avast zainstaluj AntiVir PE.

 

W hjt usun:

O3 - Toolbar: The nssfrch - {61AB8A39-FCCB-47CC-BAF3-750D1834E773} - C:\WINDOWS\nssfrch.dll

O21 - SSODL: bxsbang - {07A90506-F087-47BA-ABFC-C58F8232C126} - C:\WINDOWS\bxsbang.dll

O21 - SSODL: ocgrep - {7C0917D9-1D14-4ECA-8694-D551E4166671} - (no file)

O21 - SSODL: msmhost - {C3B704B8-51D4-4DAA-A83E-32D6150B533A} - C:\WINDOWS\msmhost.dll (file missing)

O21 - SSODL: msmdev - {A291B2FF-C71D-4BDC-8AB0-C17B55B742BA} - C:\WINDOWS\msmdev.dll (file missing)

 

Wklej do notatnika to:

 

Folder::

C:\Program Files\bqwhdpbl

 

File::

C:\WINDOWS\bxsbang.dll

C:\WINDOWS\kthemup.exe

C:\WINDOWS\nssfrch.dll

C:\WINDOWS\system32\buyurl_rm.dat

 

Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{61AB8A39-FCCB-47CC-BAF3-750D1834E773}"=-

 

[-HKEY_CLASSES_ROOT\CLSID\{61AB8A39-FCCB-47CC-BAF3-750D1834E773}]

 

[-HKEY_CLASSES_ROOT\nssfrch.ToolBar.1]

 

[-HKEY_CLASSES_ROOT\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}]

 

[-HKEY_CLASSES_ROOT\nssfrch.ToolBar]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"bxsbang"=-

 

Plik zapisz w katalogu z combofix pod nazwa CFScript.txt, nastepnie przeciagnij plik CFScript.txt na ikone combofix.exe (tak jak to masz pokazane tutaj i12.tinypic.com/4l761r5.gif ). Po wszystkim daj log na wklej + nowy log z hjt.

[elmonk]

http://wklej.org/id/3e1407cd88

 

Mlodszy brat "duren" probowal zainstalowac jakas piracka gre i w craku ktory gdzies tam znalazl sie to gniezdzilo. dostal juz w zeby

[Kolobos]

Do kasacji w hjt zostalo juz tylko to:

O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

 

Dla pewnosci mozesz jeszcze uzyc SmitFraudfix opcja 2. Clean.

[elmonk]

Robi skan i wyskakuje cos takiego: http://img141.imageshack.us/img141/9131/clipboard01hi7.jpg

 

Chyba nie tak powinno sie konczyc...

[Kolobos]

Moze antywirus Ci zablokowal plik? Sciagnij jeszcze raz i wylacz antywirus na czas skanowania.

[elmonk]

To samo.

[ddmar]

a nie prościej wyczyścić wszystkie tymczasowe (Temp itp)? 8O