win32 rootkit.kryptik.af trojan [РЕШЕН]

27 февруари 201016 г.

Здравейте,

четвъртък вечерта ( 25 02 2010 ) антивирусната ми (nod32) алармира за наличието на троянски кон. алармира за около 10 файла със съобщение че ги вкарва под карантина. няколко часа по късно установих че вируса е изпратил моите юзернаме и парола за фтп достъп към сайт който подържам и беше инсталирал кодове в source на някои файлове на сървъра. оправих това сканирах отново този път не излезе нищо, инсталирах и spyware doctor който откри около 20 проблема и ги поправи. преди малко обаче антивирусната отново сигнализира за наличието на win32 rootkit.kryptik.af trojan във файлове в директория system32. системата работи тромаво, при процесите имам един svhost който заема на 100% процесора. това мога да дам като информация, логовете ще пусна във следващия си пост

Редактирано 27 февруари 201016 г. от poslushen (преглед на промените)

27 февруари 201016 г.

*. Временно спрете защитата на антивирусната си програма!.

*. Изтеглете Combofix.

*. Запазете го на на декстопа.

*. Стартирайте инструмента с двукратен клик на мишката.

*. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

27 февруари 201016 г.

Автор

Логовете от Malwarebytes и HijackThis:

Malwarebytes' Anti-Malware 1.44

Database version: 3799

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

27.2.2010 г. 05:14:07

mbam-log-2010-02-27 (05-14-07).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 203241

Time elapsed: 33 minute(s), 15 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Adrian\Start Menu\Programs\Startup\winesm32.exe (Worm.KoobFace) -> Delete on reboot.

C:\Documents and Settings\Adrian\Favorites\Free Porn Sex Porno - a group of young one have a sex party.url (Rogue.Link) -> Quarantined and deleted successfully.

C:\Documents and Settings\Adrian\Favorites\Free Porn Sex Porno - Cute girl with Rodney Moore does anal and receives facial.url (Rogue.Link) -> Quarantined and deleted successfully.

C:\Documents and Settings\Adrian\Application Data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.

--------------------------------------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 05:22:58, on 27.2.2010 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Spyware Doctor\swdoctor.exe

C:\Program Files\Rainlendar\Rainlendar.exe

C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\HJT\kaldata.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: (no name) - - (no file)

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1211800259437

O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} (ContactExtractor Class) - http://www.facebook.com/controls/contactx.dll

O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://193.68.31.137/activex/AMC.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Control) - https://plugins.valueactive.eu/flashax/iefax.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{C969EE38-2110-4871-8507-43738E67EC08}: NameServer = 212.25.58.229 212.25.58.2

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: XAMPP Service (XAMPP) - Unknown owner - c:\xampp\service.exe (file missing)

--

End of file - 6638 bytes

----------------------------------------------------------------------------------------------------------------

От инструкциите не разбрах дали да избера FIX CHEKED на HijackThis затова извличам само лог-а. Ако е нужно ще повторя сканирането и ще поправя грешките които дава.

27 февруари 201016 г.

От инструкциите не разбрах дали да избера FIX CHEKED на HijackThis затова извличам само лог-а. Ако е нужно ще повторя сканирането и ще поправя грешките които дава.

Нищо не натискайте в HijackThis без да сме ви дали някакви допълнителни инструкции !

Също така очаквам от вас лог от Combofix. (вижте предишния ми пост).

27 февруари 201016 г.

Автор

ComboFix 10-02-26.01 - Adrian 02.2010 г. 5:43.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.447.165 [GMT 2:00]

Running from: c:\documents and settings\Adrian\Desktop\ComboFix.exe

AV: ESET NOD32 antivirus system 2.70 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

.

((((((((((((((((((((((((( Files Created from 2010-01-27 to 2010-02-27 )))))))))))))))))))))))))))))))

.

2010-02-27 03:21 . 2010-02-27 03:22 -------- d-----w- C:\HJT

2010-02-27 02:38 . 2010-02-27 02:38 -------- d-----w- c:\documents and settings\Adrian\Application Data\Malwarebytes

2010-02-27 02:38 . 2010-01-07 14:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-02-27 02:38 . 2010-02-27 02:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-02-27 02:38 . 2010-01-07 14:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-02-27 02:38 . 2010-02-27 02:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-27 00:09 . 2005-12-13 13:18 50048 ----a-w- c:\windows\system32\drivers\ikhlayer.sys

2010-02-27 00:08 . 2010-02-27 01:16 -------- d-----w- c:\program files\Spyware Doctor

2010-02-27 00:08 . 2010-02-27 00:08 -------- d-----w- c:\documents and settings\Adrian\Application Data\PC Tools

2010-02-26 21:55 . 2010-02-26 23:51 -------- d-----w- c:\windows\BDOSCAN8

2010-02-26 16:15 . 2010-02-26 16:15 -------- d-sh--w- c:\documents and settings\Adrian\PrivacIE

2010-02-26 16:15 . 2010-02-26 16:15 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2010-02-26 16:14 . 2010-02-26 16:14 -------- d-sh--w- c:\documents and settings\Adrian\IETldCache

2010-02-26 16:05 . 2010-02-26 16:05 -------- dc-h--w- c:\windows\ie8

2010-02-26 04:22 . 2004-08-03 21:00 8192 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys

2010-02-26 04:22 . 2004-08-03 21:00 8192 ----a-w- c:\windows\system32\drivers\i2omgmt.sys

2010-02-26 04:22 . 2004-08-03 20:59 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys

2010-02-26 04:22 . 2004-08-03 20:59 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys

2010-02-26 04:22 . 2004-08-03 21:00 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys

2010-02-26 04:22 . 2004-08-03 21:00 8192 ----a-w- c:\windows\system32\drivers\Changer.sys

2010-02-26 03:09 . 2010-02-26 03:10 5515984 ----a-w- c:\documents and settings\Adrian\Application Data\TVU Networks\AutoUpgrade\TVUPlayer2.5.2.1.exe

2010-02-26 02:46 . 2010-02-26 02:46 -------- d-----w- c:\program files\Photodex

2010-02-26 02:46 . 2010-02-26 02:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Photodex

2010-02-26 02:46 . 2010-02-26 02:46 -------- d-----w- c:\documents and settings\Adrian\Application Data\Photodex

2010-02-11 19:25 . 2010-02-26 22:29 -------- d-----w- c:\program files\PokerStars

2010-02-07 12:56 . 2010-02-27 01:55 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-02-05 20:22 . 2008-03-05 14:03 479752 ----a-w- c:\windows\system32\XAudio2_0.dll

2010-02-05 20:22 . 2008-03-05 14:03 238088 ----a-w- c:\windows\system32\xactengine3_0.dll

2010-02-05 20:22 . 2008-03-05 14:00 25608 ----a-w- c:\windows\system32\X3DAudio1_3.dll

2010-02-05 20:22 . 2008-03-05 13:56 1420824 ----a-w- c:\windows\system32\D3DCompiler_37.dll

2010-02-05 20:22 . 2008-02-05 21:07 462864 ----a-w- c:\windows\system32\d3dx10_37.dll

2010-02-05 20:22 . 2008-03-05 13:56 3786760 ----a-w- c:\windows\system32\D3DX9_37.dll

2010-01-30 17:21 . 2010-02-27 01:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton

2010-01-30 17:21 . 2010-01-30 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2010-01-30 17:21 . 2010-01-30 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller

2010-01-30 14:20 . 2010-01-30 14:24 -------- d-----w- c:\windows\system32\Adobe

2010-01-29 17:06 . 2010-02-06 23:35 -------- d-----w- c:\program files\Videos

2010-01-29 16:37 . 2010-01-29 16:37 -------- d-----w- c:\documents and settings\Adrian\Application Data\FastStone

2010-01-29 16:37 . 2010-01-29 16:37 -------- d-----w- c:\program files\FastStone Capture

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-02-27 02:26 . 2010-02-27 02:26 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat

2010-02-27 02:22 . 2009-02-07 00:35 -------- d-----w- c:\program files\Pazera_Free_FLV_to_AVI_Converter

2010-02-27 01:23 . 2009-07-03 06:47 -------- d-----w- c:\documents and settings\Adrian\Application Data\FileZilla

2010-02-26 16:01 . 2010-02-26 16:01 8 ----a-w- c:\documents and settings\NetworkService\Application Data\rbuwzv.dat

2010-02-26 12:40 . 2008-10-29 18:30 14 ----a-w- c:\windows\popcinfo.dat

2010-02-26 04:20 . 2010-02-26 04:20 12 ----a-w- c:\documents and settings\LocalService\Application Data\rbuwzv.dat

2010-02-25 21:52 . 2008-05-23 16:55 -------- d-----w- c:\documents and settings\Adrian\Application Data\skypePM

2010-02-23 16:51 . 2008-05-23 16:55 -------- d-----w- c:\documents and settings\Adrian\Application Data\Skype

2010-02-11 19:23 . 2010-01-21 22:10 -------- d-----w- c:\program files\PokerStars.NET

2010-01-21 19:01 . 2008-05-23 16:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2010-01-18 13:42 . 2010-01-18 13:42 -------- d-----w- c:\documents and settings\Adrian\Application Data\Media Player Classic

2010-01-18 13:42 . 2010-01-18 13:42 -------- d-----w- c:\program files\K-Lite Codec Pack

2010-01-18 13:41 . 2010-01-18 13:00 -------- d-----w- c:\program files\ACE Mega CoDecS Pack

2010-01-18 13:41 . 2010-02-27 01:12 831 ----a-w- c:\windows\system.tmp

2010-01-18 12:51 . 2010-01-18 12:07 -------- d-----w- c:\program files\BSR Screen Recorder 4

2010-01-18 12:13 . 2010-01-18 12:07 2048 ----a-w- c:\windows\system32\Tr_sttool.dat

2009-12-29 06:38 . 2009-12-29 06:33 -------- d-----w- c:\program files\TGIANT

2009-12-22 14:56 . 2008-05-23 14:46 38664 ----a-w- c:\documents and settings\Adrian\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-10-02 19:40 . 2009-10-02 19:33 120566929 ----a-w- c:\program files\Championship Manager 01-02.rar

2008-07-31 16:59 . 2008-06-03 20:20 61038 ----a-w- c:\program files\mozilla firefox\components\jar50.dll

2008-07-31 16:59 . 2008-06-03 20:20 49256 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll

2008-07-31 16:59 . 2008-06-03 20:20 166000 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll

2005-05-13 15:12 . 2005-05-13 15:12 217073 --sha-r- c:\windows\meta4.exe

2005-10-24 09:13 . 2005-10-24 09:13 66560 --sha-r- c:\windows\MOTA113.exe

2005-10-13 19:27 . 2005-10-13 19:27 422400 --sha-r- c:\windows\x2.64.exe

2005-10-07 17:14 . 2005-10-07 17:14 308224 --sha-r- c:\windows\system32\avisynth.dll

2005-07-14 10:31 . 2005-07-14 10:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll

2005-06-26 13:32 . 2005-06-26 13:32 616448 --sha-r- c:\windows\system32\cygwin1.dll

2005-06-21 20:37 . 2005-06-21 20:37 45568 --sha-r- c:\windows\system32\cygz.dll

2004-01-24 22:00 . 2004-01-24 22:00 70656 --sha-r- c:\windows\system32\i420vfw.dll

2006-04-27 08:24 . 2006-04-27 08:24 2945024 --sha-r- c:\windows\system32\Smab.dll

2005-02-28 11:16 . 2005-02-28 11:16 240128 --sha-r- c:\windows\system32\x.264.exe

2004-01-24 22:00 . 2004-01-24 22:00 217088 --sha-r- c:\windows\system32\yv12vfw.dll

.

------- Sigcheck -------

[-] 2008-05-22 . 6E266AAF4168B3569A330C61AB01F6B4 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Spyware Doctor"="c:\program files\Spyware Doctor\swdoctor.exe" [2005-12-13 1976544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]

"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-05-24 950664]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

"nwiz"="nwiz.exe" [2006-10-22 1622016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

"Spyware Doctor"="c:\program files\Spyware Doctor\swdoctor.exe" [2005-12-13 1976544]

c:\documents and settings\Adrian\Start Menu\Programs\Startup\

Rainlendar.lnk - c:\program files\Rainlendar\Rainlendar.exe [2008-5-23 118784]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-10-6 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe"

"VX1000"=c:\windows\vVX1000.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=

"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"21362:TCP"= 21362:TCP:BitComet 21362 TCP

"21362:UDP"= 21362:UDP:BitComet 21362 UDP

R2 XAMPP;XAMPP Service;c:\xampp\service.exe [x]

R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]

S0 d346bus;d346bus;c:\windows\system32\DRIVERS\d346bus.sys [2004-03-12 156800]

S0 d346prt;d346prt;c:\windows\System32\Drivers\d346prt.sys [2004-03-12 5248]

S1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-05-24 15424]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

2010-02-26 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2007en\SystemOptimizer.exe [2007-04-26 19:51]

.

------- Supplementary Scan -------

.

uStart Page = about:blank

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe

LSP: c:\windows\system32\imon.dll

TCP: {C969EE38-2110-4871-8507-43738E67EC08} = 212.25.58.229 212.25.58.2

DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://193.68.31.137/activex/AMC.cab

DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab

.

- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

AddRemove-HijackThis - c:\hjt\HijackThis.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-02-27 05:54

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]

"ImagePath"="\??\c:\docume~1\Adrian\LOCALS~1\Temp\mc21.tmp"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(648)

c:\windows\system32\imon.dll

- - - - - - - > 'explorer.exe'(1788)

c:\windows\system32\msi.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2010-02-27 05:57:22

ComboFix-quarantined-files.txt 2010-02-27 03:57

Pre-Run: 2 827 997 184 bytes free

Post-Run: 4 655 624 192 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - D5E4C859C16C4D0DACB57E4F3ED1B4B9

27 февруари 201016 г.

Определено някои от програмите с които сте почиствали (NOD32 или Spyware Doctor) явно са се справили с рууткита.

Все пак има някои остатъци в лог файла които е добре да премахнем:

*. Отворете notepad.exe и с copy/paste въведете следната информация:


http://www.kaldata.com/forums/index.php?showtopic=150464


KILLALL::

Collect::

c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat

c:\documents and settings\NetworkService\Application Data\rbuwzv.dat

c:\windows\popcinfo.dat

c:\documents and settings\LocalService\Application Data\rbuwzv.dat

c:\windows\system.tmp

SRPeek::

c:\windows\system32\sfcfiles.dll

Registry::

NetSvc::

sysrst::

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

*. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

27 февруари 201016 г.

Автор

да, и натоварването от svhost на процесора изчезна, ето лога:

ComboFix 10-02-26.01 - Adrian 02.2010 г. 6:24.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.447.200 [GMT 2:00]

Running from: c:\documents and settings\Adrian\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Adrian\Desktop\CFScript.txt

AV: ESET NOD32 antivirus system 2.70 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

* Resident AV is active

file zipped: c:\documents and settings\LocalService\Application Data\rbuwzv.dat

file zipped: c:\documents and settings\NetworkService\Application Data\rbuwzv.dat

file zipped: c:\windows\popcinfo.dat

file zipped: c:\windows\system.tmp

file zipped: c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat

.

The following files were disabled during the run:

c:\progra~1\SPYWAR~1\Tools\swpg.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\LocalService\Application Data\rbuwzv.dat

c:\documents and settings\NetworkService\Application Data\rbuwzv.dat

c:\windows\popcinfo.dat

c:\windows\system.tmp

c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat