smitfraud-c.coreservice

huffy · Příspěvekod **huffy** » 27 led 2008 12:32

Prosím o pomoc, nemůžu se zbavit tohoto viru smitfraud-c.coreservice, spybot jej vždy najde, odstraní, ale on se zase objeví. Stále se mi, patrně díky tomu, otevírá Iexplorer. Děkuji.

Reklama

Příspěvekod **fredik** » 27 led 2008 12:45

Vítej na fóru

Vlož sem pro začátek log z HijackThis

huffy · Příspěvekod **huffy** » 27 led 2008 12:49

To je tedy rychlost :) Posílám log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:48:11, on 27.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\totalcmd\TOTALCMD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7437] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4499] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6674] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8242] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5577] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5270] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3748] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3219] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett Packard Company - C:\Program Files\HPQ\SHARED\HPQWMI.exe

--
End of file - 4129 bytes

Příspěvekod **fredik** » 27 led 2008 12:51

Stáhni si ComboFix (by sUBs) a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem klávesy 1
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

huffy · Příspěvekod **huffy** » 27 led 2008 13:05

ComboFix 08-01-23.1C - Master 2008-01-27 12:56:04.1 - NTFSx86
Running from: C:\Documents and Settings\Master\Plocha\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.

2008-01-27 12:55 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-27 12:13 . 2008-01-27 12:13 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-26 19:58 . 2008-01-27 12:00 165 --a------ C:\WINDOWS\wininit.ini
2008-01-26 19:23 . 2008-01-26 19:22 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-01-26 19:22 . 2008-01-26 19:22 <DIR> d-------- C:\Program Files\Foxit Software
2008-01-26 19:22 . 2008-01-26 19:23 <DIR> d-------- C:\Program Files\Codec Pack - All In 1
2008-01-26 18:23 . 2008-01-26 18:23 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-01-26 18:23 . 2008-01-26 18:23 <DIR> d-------- C:\Program Files\ACD Systems
2008-01-26 18:18 . 2008-01-26 18:18 <DIR> d-------- C:\Program Files\Webteh
2008-01-26 18:18 . 2008-01-26 18:18 86,144 --a------ C:\WINDOWS\system32\drivers\CmBattt.sys
2008-01-26 18:18 . 2008-01-27 12:59 932 --------- C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-26 18:07 . 2008-01-26 18:07 <DIR> d-------- C:\Program Files\QIP
2008-01-26 18:02 . 2008-01-26 18:06 <DIR> d-------- C:\Program Files\Winamp
2008-01-26 17:52 . 2008-01-26 17:52 <DIR> d-------- C:\Program Files\Nero
2008-01-26 17:52 . 2008-01-26 17:57 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-01-26 17:46 . 2008-01-26 17:46 390 --a------ C:\WINDOWS\ODBC.INI
2008-01-26 17:44 . 2008-01-26 17:45 <DIR> d-------- C:\WINDOWS\ShellNew
2008-01-26 17:37 . 2008-01-26 17:37 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-26 14:28 . 2008-01-26 14:31 <DIR> d-a------ C:\IDOS
2008-01-26 14:20 . 2008-01-27 12:51 <DIR> d-------- C:\Program Files\Mozilla Thunderbird
2008-01-26 14:19 . 2008-01-26 14:19 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-26 14:14 . 2008-01-26 14:14 <DIR> d-------- C:\Program Files\TBBackup
2008-01-26 14:06 . 2004-08-17 16:43 58,240 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-01-26 14:06 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-01-26 14:05 . 2004-08-17 16:49 75,264 --a------ C:\WINDOWS\system32\usbui.dll
2008-01-26 14:05 . 2004-08-03 23:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2008-01-26 14:05 . 2004-08-04 00:07 14,080 --a------ C:\WINDOWS\system32\drivers\CmBatt.sys
2008-01-26 14:05 . 2001-08-17 22:57 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys
2008-01-26 14:05 . 2001-08-17 22:58 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys
2008-01-26 14:05 . 2004-08-04 00:07 8,832 --a------ C:\WINDOWS\system32\drivers\wmiacpi.sys
2008-01-26 14:05 . 2004-08-17 16:44 5,504 --a------ C:\WINDOWS\system32\drivers\intelide.sys
2008-01-26 14:02 . 2008-01-26 18:03 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-01-26 14:02 . 2008-01-26 14:02 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2008-01-26 14:02 . 2004-08-17 15:45 1,896,102 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT
2008-01-26 14:02 . 2004-08-17 15:46 1,086,058 --a--c--- C:\WINDOWS\system32\dllcache\NTPRINT.CAT
2008-01-26 14:02 . 2004-08-17 15:46 1,086,058 -ra------ C:\WINDOWS\SET4.tmp
2008-01-26 14:02 . 2004-08-17 15:50 1,014,483 --a--c--- C:\WINDOWS\system32\dllcache\SP2.CAT
2008-01-26 14:02 . 2004-08-17 15:50 1,014,483 -ra------ C:\WINDOWS\SET3.tmp
2008-01-26 14:02 . 2004-08-17 15:46 621,080 --a--c--- C:\WINDOWS\system32\dllcache\NT5INF.CAT
2008-01-26 14:02 . 2004-08-17 15:46 14,043 -ra------ C:\WINDOWS\SET8.tmp
2008-01-26 14:01 . 2008-01-26 13:20 261 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-01-26 14:01 . 2008-01-26 13:09 211 ---hs---- C:\boot.ini
2008-01-26 14:00 . 2006-03-17 01:38 28,672 --------- C:\WINDOWS\system32\verclsid.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-26 12:49 --------- d-----w C:\Program Files\SP31140
2008-01-26 12:48 --------- d-----w C:\Program Files\Altiris
2008-01-26 12:45 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-26 12:42 1,594 --sha-r C:\WINDOWS\system32\drivers\HP_compaq nx9020 (PG641ES#AKB)_YN_0U_QCNF4441QGB_EU_45JL_I3084_SQuanta_V41.0D_BF.16_T050803_WXP2_L405_M223_J40_7Intel_8Celeron M_91.4_#080126_N10EC8139_()_XMOBILE_CN10_RHewlett-Packard_2Rev 1_G.MRK
2008-01-26 12:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-26 12:41 --------- d-----w C:\Program Files\HPQ
2008-01-26 12:26 --------- d--h--w C:\Program Files\Uninstall Information
2008-01-26 12:17 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-11-14 15:05 1410304]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-05-27 20:28 278528]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-08 07:31 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-08 07:27 126976]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 14:49 15360]

R1 CmBattt;CmBattt;C:\WINDOWS\system32\drivers\CmBattt.sys [2008-01-26 18:18]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 12:59:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-27 13:02:52 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-27 12:02:11
.
2008-01-26 14:21:59 --- E O F ---

huffy · Příspěvekod **huffy** » 27 led 2008 14:00

Ie se stále otevírá

Příspěvekod **fredik** » 27 led 2008 14:16

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

File:: 
C:\WINDOWS\system32\drivers\core.cache.dsk

Suspect::
C:\WINDOWS\system32\drivers\CmBattt.sys

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť
Obrázek

- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

Na ploše se ti vytvoří soubor Submit(Datum+Čas).zip, vlož ho jako přílohu ke svému dalšímu příspěvku.

huffy · Příspěvekod **huffy** » 27 led 2008 14:32

ComboFix 08-01-23.1C - Master 2008-01-27 14:23:11.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.87 [GMT 1:00]
Running from: C:\Documents and Settings\Master\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\Master\Plocha\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\drivers\core.cache.dsk
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.

2008-01-27 13:58 . 2008-01-27 13:58 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2008-01-27 13:57 . 2008-01-27 13:57 649 --a------ C:\WINDOWS\cclean13.ini
2008-01-27 13:43 . 2008-01-27 13:57 6,861 --a------ C:\WINDOWS\ccscan6.ini
2008-01-27 13:42 . 2008-01-27 13:57 <DIR> d-------- C:\Program Files\Complete Cleanup Trial
2008-01-27 12:55 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-27 12:13 . 2008-01-27 12:13 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-26 19:58 . 2008-01-27 12:00 165 --a------ C:\WINDOWS\wininit.ini
2008-01-26 19:23 . 2008-01-26 19:22 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-01-26 19:22 . 2008-01-26 19:22 <DIR> d-------- C:\Program Files\Foxit Software
2008-01-26 19:22 . 2008-01-26 19:23 <DIR> d-------- C:\Program Files\Codec Pack - All In 1
2008-01-26 18:23 . 2008-01-26 18:23 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-01-26 18:23 . 2008-01-26 18:23 <DIR> d-------- C:\Program Files\ACD Systems
2008-01-26 18:18 . 2008-01-26 18:18 <DIR> d-------- C:\Program Files\Webteh
2008-01-26 18:18 . 2008-01-26 18:18 86,144 --a------ C:\WINDOWS\system32\drivers\CmBattt.sys
2008-01-26 18:18 . 2008-01-27 14:26 932 --------- C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-26 18:07 . 2008-01-26 18:07 <DIR> d-------- C:\Program Files\QIP
2008-01-26 18:02 . 2008-01-26 18:06 <DIR> d-------- C:\Program Files\Winamp
2008-01-26 17:52 . 2008-01-26 17:52 <DIR> d-------- C:\Program Files\Nero
2008-01-26 17:52 . 2008-01-26 17:57 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-01-26 17:46 . 2008-01-26 17:46 390 --a------ C:\WINDOWS\ODBC.INI
2008-01-26 17:44 . 2008-01-26 17:45 <DIR> d-------- C:\WINDOWS\ShellNew
2008-01-26 17:37 . 2008-01-26 17:37 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-26 14:28 . 2008-01-26 14:31 <DIR> d-a------ C:\IDOS
2008-01-26 14:20 . 2008-01-27 13:39 <DIR> d-------- C:\Program Files\Mozilla Thunderbird
2008-01-26 14:19 . 2008-01-26 14:19 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-26 14:14 . 2008-01-26 14:14 <DIR> d-------- C:\Program Files\TBBackup
2008-01-26 14:06 . 2004-08-17 16:43 58,240 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-01-26 14:06 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-01-26 14:05 . 2004-08-17 16:49 75,264 --a------ C:\WINDOWS\system32\usbui.dll
2008-01-26 14:05 . 2004-08-03 23:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2008-01-26 14:05 . 2004-08-04 00:07 14,080 --a------ C:\WINDOWS\system32\drivers\CmBatt.sys
2008-01-26 14:05 . 2001-08-17 22:57 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys
2008-01-26 14:05 . 2001-08-17 22:58 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys
2008-01-26 14:05 . 2004-08-04 00:07 8,832 --a------ C:\WINDOWS\system32\drivers\wmiacpi.sys
2008-01-26 14:05 . 2004-08-17 16:44 5,504 --a------ C:\WINDOWS\system32\drivers\intelide.sys
2008-01-26 14:02 . 2008-01-27 13:59 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-01-26 14:02 . 2008-01-26 14:02 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2008-01-26 14:02 . 2004-08-17 15:45 1,896,102 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT
2008-01-26 14:02 . 2004-08-17 15:46 1,086,058 --a--c--- C:\WINDOWS\system32\dllcache\NTPRINT.CAT
2008-01-26 14:02 . 2004-08-17 15:46 1,086,058 -ra------ C:\WINDOWS\SET4.tmp
2008-01-26 14:02 . 2004-08-17 15:50 1,014,483 --a--c--- C:\WINDOWS\system32\dllcache\SP2.CAT
2008-01-26 14:02 . 2004-08-17 15:50 1,014,483 -ra------ C:\WINDOWS\SET3.tmp
2008-01-26 14:02 . 2004-08-17 15:46 621,080 --a--c--- C:\WINDOWS\system32\dllcache\NT5INF.CAT
2008-01-26 14:02 . 2004-08-17 15:46 14,043 -ra------ C:\WINDOWS\SET8.tmp
2008-01-26 14:01 . 2008-01-26 13:20 261 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-01-26 14:01 . 2008-01-26 13:09 211 ---hs---- C:\boot.ini
2008-01-26 14:00 . 2006-03-17 01:38 28,672 --------- C:\WINDOWS\system32\verclsid.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 12:41 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-26 12:49 --------- d-----w C:\Program Files\SP31140
2008-01-26 12:48 --------- d-----w C:\Program Files\Altiris
2008-01-26 12:42 1,594 --sha-r C:\WINDOWS\system32\drivers\HP_compaq nx9020 (PG641ES#AKB)_YN_0U_QCNF4441QGB_EU_45JL_I3084_SQuanta_V41.0D_BF.16_T050803_WXP2_L405_M223_J40_7Intel_8Celeron M_91.4_#080126_N10EC8139_()_XMOBILE_CN10_RHewlett-Packard_2Rev 1_G.MRK
2008-01-26 12:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-26 12:41 --------- d-----w C:\Program Files\HPQ
2008-01-26 12:26 --------- d--h--w C:\Program Files\Uninstall Information
2008-01-26 12:17 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-11-14 15:05 1410304]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-05-27 20:28 278528]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-08 07:31 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-08 07:27 126976]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 14:49 15360]

R1 CmBattt;CmBattt;C:\WINDOWS\system32\drivers\CmBattt.sys [2008-01-26 18:18]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 14:26:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-27 14:29:32 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-27 13:28:57
ComboFix2.txt 2008-01-27 12:02:53
.
2008-01-26 14:21:59 --- E O F ---

Příspěvekod **fredik** » 27 led 2008 15:13

Vytvoř si nový CFScript a tentokrát vlož do něho toto:

Kód: Vybrat vše

Driver::
CmBattt

File::
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\CmBattt.sys

Vlož sem pak znovu log co se zobrazí + nový log z HJT.

huffy · Příspěvekod **huffy** » 27 led 2008 15:30

ComboFix 08-01-23.1C - Master 2008-01-27 15:23:25.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.79 [GMT 1:00]
Running from: C:\Documents and Settings\Master\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\Master\Plocha\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\drivers\CmBattt.sys
C:\WINDOWS\system32\drivers\core.cache.dsk
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\CmBattt.sys
C:\WINDOWS\system32\drivers\core.cache.dsk

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CMBATTT
-------\CmBattt

((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.

2008-01-27 13:57 . 2008-01-27 13:57 649 --a------ C:\WINDOWS\cclean13.ini
2008-01-27 13:43 . 2008-01-27 13:57 6,861 --a------ C:\WINDOWS\ccscan6.ini
2008-01-27 13:42 . 2008-01-27 13:57 <DIR> d-------- C:\Program Files\Complete Cleanup Trial
2008-01-27 12:55 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-27 12:13 . 2008-01-27 12:13 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-26 19:58 . 2008-01-27 12:00 165 --a------ C:\WINDOWS\wininit.ini
2008-01-26 19:23 . 2008-01-26 19:22 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-01-26 19:22 . 2008-01-26 19:22 <DIR> d-------- C:\Program Files\Foxit Software
2008-01-26 19:22 . 2008-01-26 19:23 <DIR> d-------- C:\Program Files\Codec Pack - All In 1
2008-01-26 18:23 . 2008-01-26 18:23 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-01-26 18:23 . 2008-01-26 18:23 <DIR> d-------- C:\Program Files\ACD Systems
2008-01-26 18:18 . 2008-01-26 18:18 <DIR> d-------- C:\Program Files\Webteh
2008-01-26 18:07 . 2008-01-26 18:07 <DIR> d-------- C:\Program Files\QIP
2008-01-26 18:02 . 2008-01-26 18:06 <DIR> d-------- C:\Program Files\Winamp
2008-01-26 17:52 . 2008-01-26 17:52 <DIR> d-------- C:\Program Files\Nero
2008-01-26 17:52 . 2008-01-26 17:57 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-01-26 17:46 . 2008-01-26 17:46 390 --a------ C:\WINDOWS\ODBC.INI
2008-01-26 17:44 . 2008-01-26 17:45 <DIR> d-------- C:\WINDOWS\ShellNew
2008-01-26 17:37 . 2008-01-26 17:37 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-26 14:28 . 2008-01-26 14:31 <DIR> d-a------ C:\IDOS
2008-01-26 14:20 . 2008-01-27 13:39 <DIR> d-------- C:\Program Files\Mozilla Thunderbird
2008-01-26 14:19 . 2008-01-26 14:19 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-26 14:14 . 2008-01-26 14:14 <DIR> d-------- C:\Program Files\TBBackup
2008-01-26 14:06 . 2004-08-17 16:43 58,240 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-01-26 14:06 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-01-26 14:05 . 2004-08-17 16:49 75,264 --a------ C:\WINDOWS\system32\usbui.dll
2008-01-26 14:05 . 2004-08-03 23:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2008-01-26 14:05 . 2004-08-04 00:07 14,080 --a------ C:\WINDOWS\system32\drivers\CmBatt.sys
2008-01-26 14:05 . 2001-08-17 22:57 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys
2008-01-26 14:05 . 2001-08-17 22:58 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys
2008-01-26 14:05 . 2004-08-04 00:07 8,832 --a------ C:\WINDOWS\system32\drivers\wmiacpi.sys
2008-01-26 14:05 . 2004-08-17 16:44 5,504 --a------ C:\WINDOWS\system32\drivers\intelide.sys
2008-01-26 14:02 . 2008-01-27 13:59 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-01-26 14:02 . 2008-01-26 14:02 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2008-01-26 14:02 . 2004-08-17 15:45 1,896,102 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT
2008-01-26 14:02 . 2004-08-17 15:46 1,086,058 --a--c--- C:\WINDOWS\system32\dllcache\NTPRINT.CAT
2008-01-26 14:02 . 2004-08-17 15:46 1,086,058 -ra------ C:\WINDOWS\SET4.tmp
2008-01-26 14:02 . 2004-08-17 15:50 1,014,483 --a--c--- C:\WINDOWS\system32\dllcache\SP2.CAT
2008-01-26 14:02 . 2004-08-17 15:50 1,014,483 -ra------ C:\WINDOWS\SET3.tmp
2008-01-26 14:02 . 2004-08-17 15:46 621,080 --a--c--- C:\WINDOWS\system32\dllcache\NT5INF.CAT
2008-01-26 14:02 . 2004-08-17 15:46 14,043 -ra------ C:\WINDOWS\SET8.tmp
2008-01-26 14:01 . 2008-01-26 13:20 261 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-01-26 14:01 . 2008-01-26 13:09 211 ---hs---- C:\boot.ini
2008-01-26 14:00 . 2006-03-17 01:38 28,672 --------- C:\WINDOWS\system32\verclsid.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 12:41 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-26 12:49 --------- d-----w C:\Program Files\SP31140
2008-01-26 12:48 --------- d-----w C:\Program Files\Altiris
2008-01-26 12:42 1,594 --sha-r C:\WINDOWS\system32\drivers\HP_compaq nx9020 (PG641ES#AKB)_YN_0U_QCNF4441QGB_EU_45JL_I3084_SQuanta_V41.0D_BF.16_T050803_WXP2_L405_M223_J40_7Intel_8Celeron M_91.4_#080126_N10EC8139_()_XMOBILE_CN10_RHewlett-Packard_2Rev 1_G.MRK
2008-01-26 12:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-26 12:41 --------- d-----w C:\Program Files\HPQ
2008-01-26 12:26 --------- d--h--w C:\Program Files\Uninstall Information
2008-01-26 12:17 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-11-14 15:05 1410304]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-05-27 20:28 278528]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-08 07:31 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-08 07:27 126976]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 14:49 15360]

R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 15:26:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-27 15:29:12 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-27 14:28:56
ComboFix2.txt 2008-01-27 13:29:33
ComboFix3.txt 2008-01-27 12:02:53
.
2008-01-26 14:21:59 --- E O F ---

huffy · Příspěvekod **huffy** » 27 led 2008 15:32

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:31:06, on 27.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett Packard Company - C:\Program Files\HPQ\SHARED\HPQWMI.exe

--
End of file - 3282 bytes

Příspěvekod **fredik** » 27 led 2008 19:01

Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře ComboFix /u (mezi comobofix a /u musí být mezera) a dej Ok.

Logy vypadají dobře, máš ještě problémy?

smitfraud-c.coreservice

smitfraud-c.coreservice

Děkuji za přivítání :)

hotovo

Problém stále přetrvává

LOG z ComboFix

LOG z HijackThis

Kdo je online