Jump to content
СофтФорум - всё о компьютерах и не только

Что-то неопнятное сидит в автозагрузке

Spaniard
 Share

Recommended Posts

Spaniard

Spaniard

Posted
Posted

Посмотрите логи пожалуйста.

Прикреплены архивы после выполнения 2 и 3 скриптов в утилите AVZ.

Также лог HiJackThis.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:03:02, on 21.06.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Eset\nod32kui.exe

C:\Documents and Settings\LocalService.NT AUTHORITY\cftmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Eset\nod32krn.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Program Files\HHVcdV5Sys\VC5SecS.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

D:\Amber\Installs\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe

O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Alex.MIB-F14CD047F27\cftmon.exe

O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe

O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Alex.MIB-F14CD047F27\cftmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Start HASP-Emu.lnk = C:\Program Files\Sable\WINNT\startnt.bat

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Экспорт в Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Закачать ВСЕ при помощи Download Master - C:\Program Files\Download Master\dmieall.htm

O8 - Extra context menu item: Закачать при помощи Download Master - C:\Program Files\Download Master\dmie.htm

O9 - Extra button: Mail.Ru Агент - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Program Files\Mail.Ru\Agent\magent.exe

O9 - Extra 'Tools' menuitem: Mail.Ru Агент - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Program Files\Mail.Ru\Agent\magent.exe

O9 - Extra button: Download Master - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - C:\Program Files\Download Master\dmaster.exe

O9 - Extra 'Tools' menuitem: &Download Master - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - C:\Program Files\Download Master\dmaster.exe

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{E0740679-ED46-489D-B94B-DF0EB6190695}: NameServer = 81.95.224.146 81.95.224.65

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe

O23 - Service: Virtual CD v5 Security service (VC5SecS) - H+H Software GmbH - C:\Program Files\HHVcdV5Sys\VC5SecS.exe

--

End of file - 4720 bytes

virusinfo_syscheck.zip

virusinfo_syscure.zip

virusinfo_syscheck.zip

virusinfo_syscure.zip

Link to comment
Share on other sites
akoK

akoK

Posted
Posted (edited)

AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".

beginSearchRootkit(true, true);SetAVZGuardStatus(true);StopService('Wmdifsvww');SetServiceStart('Schedule', 4);QuarantineFile('Wmdifsvww.sys','');QuarantineFile('c:\windows\system32\drivers\spools.exe','');QuarantineFile('C:\Program Files\Sable\WINNT\startnt.bat','');QuarantineFile('C:\Documents and Settings\Alex.MIB-F14CD047F27\cftmon.exe','');DeleteFile('c:\windows\system32\drivers\spools.exe');DeleteFile('C:\WINDOWS\system32\drivers\spools.exe');DeleteFile('C:\Documents and Settings\Alex.MIB-F14CD047F27\cftmon.exe');DeleteFile('C:\Documents and Settings\LocalService.NT AUTHORITY\cftmon.exe');RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 1);DeleteService('Schedule');BC_ImportALL;ExecuteRepair(1);BC_Activate;ExecuteSysClean;RebootWindows(true);end.

После выполнения скрипта компьютер перезагрузится.

beginCreateQurantineArchive(GetAVZDirectory+'quarantine.zip');end.

Полученный архив отправьте на akok<at>pisem.net с указанной ссылкой на тему. (at=@)

Повторите логи.

Edited by akoK
Link to comment
Share on other sites
akoK

akoK

Posted
Posted (edited)

c:\windows\system32\drivers\spools.exe - Trojan-Downloader.Win32.Small.vtn

C:\Documents and Settings\Alex.MIB-F14CD047F27\cftmon.exe - Trojan-Downloader.Win32.Small.vtn

AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".

beginClearQuarantine;SearchRootkit(true, true);SetAVZGuardStatus(true);QuarantineFile('C:\WINDOWS\system32\ftp34.dll','');QuarantineFile('C:\Documents and Settings\LocalService.NT AUTHORITY\ftp34.dll','');DeleteFile('C:\WINDOWS\system32\ftp34.dll');DeleteFile('C:\Documents and Settings\LocalService.NT AUTHORITY\ftp34.dll');RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3); BC_ImportALL;BC_Activate;ExecuteSysClean;RebootWindows(true);end.

После выполнения скрипта компьютер перезагрузится.

beginCreateQurantineArchive(GetAVZDirectory+'quarantine.zip');end.

Полученный архив отправьте на akok<at>pisem.net с указанной ссылкой на тему. (at=@)

Повторите лог syscheck

Edited by akoK
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...