Prośba o sprawdzenie log'a z hijack'a i combofixa

[arasso12]

Witam, brat wczoraj chcial pograc na prywatnym serverze w Tibie... jak wiadomo tam jest wiecej hakerow niz graczy no i ipchangera pobral z nieoficjalnej strony, w tym samym archiwum kaspersky u kolegi wykryl trojana ;/. Ja uzywam microsoft essentials i nic nie piszczal... do tego mam comodo firewall+firewall systemowy+dzialam na koncie ograniczonym, na konto admina jest haslo, uzywam win 7 professional z aktualizacjami. Mimo to boje sie o swoje hasla allegro itp, prosze o sprawdzenie logow.

 

Aha, ta strona z trojanem to ot-changer.com

 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:57:11, on 2010-10-10

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Microsoft Security Essentials\msseces.exe

F:\Program Files\COMODO\COMODO Internet Security\cfp.exe

F:\Program Files\Winamp\winampa.exe

F:\Program Files\AutorunRemover\AutorunRemover.exe

F:\Program Files\VMware\VMware Workstation\vmware-tray.exe

F:\Program Files\Gadu-Gadu\gg.exe

F:\Program Files\Mozilla Firefox\firefox.exe

F:\Program Files\Winamp\winamp.exe

F:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN : Hotmail, Messenger, Bing, Actualité et Sport

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey

O4 - HKLM\..\Run: [COMODO Internet Security] "F:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h

O4 - HKLM\..\Run: [WinampAgent] F:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [AutorunRemover.exe] F:\Program Files\AutorunRemover\AutorunRemover.exe -Hide

O4 - HKLM\..\Run: [vmware-tray] "F:\Program Files\VMware\VMware Workstation\vmware-tray.exe"

O4 - HKCU\..\Run: [Gadu-Gadu] "F:\Program Files\Gadu-Gadu\gg.exe" /tray

O10 - Unknown file in Winsock LSP: f:\program files\vmware\vmware workstation\vsocklib.dll

O10 - Unknown file in Winsock LSP: f:\program files\vmware\vmware workstation\vsocklib.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{B5417093-1578-41B8-A8B2-04477DA5FC76}: NameServer = 156.154.70.22,156.154.71.22

O20 - AppInit_DLLs: C:\Windows\System32\guard32.dll

O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - F:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Steam Client Service - Valve Corporation - F:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - Unknown owner - F:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (file missing)

O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - F:\Program Files\VMware\VMware Workstation\vmware-ufad.exe

O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - F:\Program Files\VMware\VMware Workstation\vmware-authd.exe

O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe

O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - F:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe

O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

 

--

End of file - 3842 bytes

 

COMBOFIX

 

ComboFix 10-10-09.04 - arek 2010-10-10 10:19:37.2.2 - x86

Microsoft Windows 7 Professional 6.1.7600.0.1250.48.1045.18.2047.1324 [GMT 2:00]

Uruchomiony z: d:\aaaa firefox download\ComboFix.exe

.

 

((((((((((((((((((((((((( Pliki utworzone od 2010-09-10 do 2010-10-10 )))))))))))))))))))))))))))))))

.

 

2010-10-09 20:02 . 2010-10-09 20:02 -------- d-----w- c:\users\aras\AppData\Roaming\Tibia

2010-10-09 19:53 . 2010-09-09 22:52 6084944 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5BFF72D3-7F36-41E1-924A-FC2EF60A8AF1}\mpengine.dll

2010-10-09 09:54 . 2010-10-09 09:54 -------- d-----w- C:\FPC

2010-10-08 21:57 . 2010-10-08 21:57 -------- d-----w- c:\users\aras\AppData\Local\Adobe

2010-10-08 17:07 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys

2010-10-08 16:38 . 2010-10-08 16:38 -------- d-----w- c:\users\aras\AppData\Roaming\Gadu-Gadu

2010-10-08 15:15 . 2010-10-09 19:52 -------- d-----w- c:\users\aras\AppData\Local\VMware

2010-10-08 15:15 . 2010-10-09 19:52 -------- d-----w- c:\users\aras\AppData\Roaming\VMware

2010-10-08 13:26 . 2010-08-01 10:55 334384 ----a-w- c:\windows\system32\vmnetdhcp.exe

2010-10-08 13:26 . 2010-08-01 10:55 399920 ----a-w- c:\windows\system32\vmnat.exe

2010-10-08 13:26 . 2010-08-01 10:52 26288 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys

2010-10-08 13:26 . 2010-08-01 10:55 760368 ----a-w- c:\windows\system32\vnetlib.dll

2010-10-08 13:25 . 2010-08-01 10:54 24624 ----a-w- c:\windows\system32\drivers\VMkbd.sys

2010-10-08 13:24 . 2010-10-10 06:26 -------- d-----w- c:\programdata\VMware

2010-10-08 13:02 . 2010-08-21 05:32 316928 ----a-w- c:\windows\system32\spoolsv.exe

2010-10-08 13:02 . 2010-06-19 06:15 2048 ----a-w- c:\windows\system32\tzres.dll

2010-10-08 13:00 . 2010-10-08 13:00 -------- d-----w- c:\windows\system32\Wat

2010-10-08 13:00 . 2010-09-09 22:52 6084944 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2010-10-03 08:06 . 2010-10-03 08:06 -------- d-----w- f:\program files\Common Files\VMware

2010-10-03 08:05 . 2010-10-03 08:05 -------- d-----w- f:\program files\VMware

2010-10-02 09:04 . 2010-10-02 09:05 -------- d-----w- f:\program files\Nmap

2010-10-02 09:00 . 2010-10-09 07:27 -------- d-----w- f:\program files\Metasploit

2010-10-02 08:06 . 2010-10-02 08:06 -------- d-----w- f:\program files\Advanced LAN Scanner

2010-10-02 06:40 . 2010-09-13 15:29 120296 ----a-w- f:\program files\Mozilla Firefox\plugins\npganymedenet.dll

2010-10-02 06:40 . 2010-10-02 06:40 -------- d-----w- f:\program files\Ganymede

2010-09-29 15:33 . 2010-09-29 15:33 -------- d-----w- f:\program files\Blender Foundation

2010-09-29 15:32 . 2010-09-29 15:32 -------- d-----w- f:\program files\Sweet Home 3D

2010-09-24 21:11 . 2010-10-08 12:05 -------- d-----w- f:\program files\Windows XP Mode

2010-09-24 21:08 . 2010-09-24 21:08 -------- d-----w- f:\program files\Windows Virtual PC

2010-09-19 19:00 . 2010-09-19 19:00 -------- d-----w- f:\program files\mIRC

2010-09-14 11:04 . 2010-09-14 11:04 -------- d-----w- f:\program files\Microsoft ActiveSync

2010-09-14 07:30 . 2010-09-14 07:30 -------- d-----w- f:\program files\AmoK Playlist Copy

2010-09-11 20:15 . 2010-09-11 20:15 -------- d-----w- f:\program files\CodeGear

2010-09-11 20:15 . 2010-09-11 20:15 -------- d-----w- f:\program files\Common Files\Borland Shared

2010-09-10 21:18 . 2007-12-21 01:00 81920 ----a-w- f:\program files\Mozilla Firefox\plugins\nprpjplug.dll

2010-09-10 21:18 . 2007-12-21 01:00 144720 ----a-w- f:\program files\Mozilla Firefox\plugins\nppl3260.dll

2010-09-10 21:18 . 2010-10-09 20:39 -------- d-----w- f:\program files\Real Alternative

 

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

 

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Gadu-Gadu"="f:\program files\Gadu-Gadu\gg.exe" [2007-04-17 2113536]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208]

"COMODO Internet Security"="f:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-06-01 2039240]

"WinampAgent"="f:\program files\Winamp\winampa.exe" [2003-12-13 33792]

"AutorunRemover.exe"="f:\program files\AutorunRemover\AutorunRemover.exe" [2009-10-21 1360896]

"vmware-tray"="f:\program files\VMware\VMware Workstation\vmware-tray.exe" [2010-08-01 129584]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\guard32.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]

2009-09-21 17:40 1681408 ----a-r- f:\program files\VIA\VIAudioi\VDeck\VDeck.exe

 

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;f:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-08 1343400]

S0 hotcore3;Hotcore helper;c:\windows\system32\DRIVERS\hotcore3.sys [2008-12-13 40496]

S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2010-06-04 224240]

S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2010-06-01 30112]

S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [2010-08-01 70704]

S2 VMUSBArbService;VMware USB Arbitration Service;f:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-08-01 539184]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]

S3 RTL8167;Sterownik Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-09-17 1086976]

 

 

--- Inne Usługi/Sterowniki w Pamięci ---

 

*NewlyCreated* - FASTFAT

*NewlyCreated* - WUDFPF

.

.

------- Skan uzupełniający -------

.

LSP: f:\program files\VMware\VMware Workstation\vsocklib.dll

TCP: {B5417093-1578-41B8-A8B2-04477DA5FC76} = 156.154.70.22,156.154.71.22

FF - ProfilePath -

 

---- FIREFOX - SPOSÓB POSTĘPOWANIA ----

f:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

f:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

.

.

--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

 

- - - - - - - > 'Explorer.exe'(2232)

f:\program files\Gadu-Gadu\ggwhook.dll

.

Czas ukończenia: 2010-10-10 10:24:01

ComboFix-quarantined-files.txt 2010-10-10 08:24

ComboFix2.txt 2010-10-09 20:35

 

Przed: 8 747 671 552 bajtów wolnych

Po: 8 706 207 744 bajtów wolnych

 

- - End Of File - - 0F67E470E6E3274726E767D7290E5364

 

Z gory dzieki 8O

Jest tu kto?

 

EDIT

Teraz bawilem sie jeszcze ettercapem z backtracka, zrobilem przekierowanie wszystkich stron *.pl i *.com na adres xx.xx.xx.xx no i zonk, ja wpisuje w przegladarke o2.pl a w backtracku pokazuje mi ze chcialem sie laczyc najpierw z o2.pl i zostalo przekierowane a pozniej z "rozciach!le.com", musi to byc wina tego trojana, prosze o jak najszybsza pomoc ...

Edytowane 12 Października 2010 przez arasso12

[Kolobos]

Zrob skan przy pomocy mbam oraz cureit i usun to co znajda. Daj log z OTL.

[arasso12]

Z tymi przekierowaniami doszlem dlaczego, a z tym trojanem to jeszcze nie wiem. Jutro przeskanuje kompa tym softem co podales i napisze rezultat.

 

EDIT

nbam w szybkim skanowaniu 0 wykrytych zagrozen

Edytowane 12 Października 2010 przez arasso12