PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

Win32/TrojanDownloader.Small.BUY trojan

https://pc-help.cnews.cz/viewtopic.php?f=47&t=7280

Stránka 1 z 1

Win32/TrojanDownloader.Small.BUY trojan

Napsal: 28 srp 2006 21:22
od petar
Prosím, prosím moc o pomoc. I když mám v PC nainstalenej NOD32, přesto se podařiro synovi stáhnout trojana (Win32/TrojanDownloader.Small.BUY trojan), kterého se mi nedaří z PC odstranit. Zasílám log z HijackThisu. Budu rád za každou radu a mockrát předem děkuji.

Logfile of HijackThis v1.99.1
Scan saved at 21:01:52, on 28.8.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Generic\USB Card Reader Driver v2.2c\Disk_Monitor.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Nokia 6600\PC Suite for Nokia 6600\ECTaskScheduler.exe
C:\Program Files\Nokia 6600\PC Suite for Nokia 6600\ConnMngmntBox.exe
C:\PROGRA~1\NOKIA6~1\PCSUIT~1\Elogerr.exe
C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\NOKIA6~1\PCSUIT~1\BROADC~1.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\NOKIA6~1\PCSUIT~1\SCRFS.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Documents and Settings\Administrator\Plocha\Táta\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.seznam.cz/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://server.proxy.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\MartinK\ICQToolbar\toolbaru.dll
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\MartinK\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Disk Monitor] C:\Program Files\Generic\USB Card Reader Driver v2.2c\Disk_Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ICQ Lite] "C:\MartinK\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [lsjwm.exe] C:\WINDOWS\system32\lsjwm.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\MartinK\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = C:\Program Files\Nokia 6600\PC Suite for Nokia 6600\ECTaskScheduler.exe
O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = C:\Program Files\Nokia 6600\PC Suite for Nokia 6600\ConnMngmntBox.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\MartinK\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download all by Rapidown... - C:\Program Files\Rapidown\rapidownGetAll.htm
O8 - Extra context menu item: Download by Rapidown... - C:\Program Files\Rapidown\rapidownGet.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Rapidown - {57E91B47-F40A-11D1-B792-444553540011} - C:\Program Files\Rapidown\rapidown.exe (file missing)
O9 - Extra 'Tools' menuitem: Rapidown - {57E91B47-F40A-11D1-B792-444553540011} - C:\Program Files\Rapidown\rapidown.exe (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\MartinK\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\MartinK\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {50E43D86-A74D-11D0-98CE-004005249458} (AnimatedGif Control) - https://www.mojebanka.cz/jars/confwiz/MVSGif.cab
O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - http://xtraz.icq.com/xtraz/activex/MISBH.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{79758192-DAA5-4EC2-9948-CD7962E485B4}: NameServer = 85.255.116.117,85.255.112.190
O17 - HKLM\System\CCS\Services\Tcpip\..\{808C7142-E6CB-4B08-9672-0A0A4F4C46D4}: NameServer = 85.255.116.117,85.255.112.190
O17 - HKLM\System\CCS\Services\Tcpip\..\{A2734D76-5376-4E87-A91E-72795831A624}: NameServer = 85.255.116.117,85.255.112.190
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.117 85.255.112.190
O17 - HKLM\System\CS1\Services\Tcpip\..\{79758192-DAA5-4EC2-9948-CD7962E485B4}: NameServer = 85.255.116.117,85.255.112.190
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.117 85.255.112.190
O17 - HKLM\System\CS2\Services\Tcpip\..\{79758192-DAA5-4EC2-9948-CD7962E485B4}: NameServer = 85.255.116.117,85.255.112.190
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.117 85.255.112.190
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Napsal: 29 srp 2006 10:50
od mikel
v Hijacku fixnout:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.seznam.cz/
O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ICQ Lite] "C:\MartinK\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [lsjwm.exe] C:\WINDOWS\system32\lsjwm.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\MartinK\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = C:\Program Files\Nokia 6600\PC Suite for Nokia 6600\ECTaskScheduler.exe
O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = C:\Program Files\Nokia 6600\PC Suite for Nokia 6600\ConnMngmntBox.exe

Většina jsou programy, které není třeba spouštět se startem woken, ale stačí je spustit, až budou potřeba.
Ten červený soubor je šmejd, který je po fixnutí nutno najít na disku a smazat! Vypnout Obnovení systému, vyčistit disk CCleanerem a restartovat.
Pak se dej nový log.

Napsal: 29 srp 2006 12:54
od sakiri
ty tvoje ip adresy jsou podezřelý protože jedna mě odkazuje do Ukrajiny a ta druhá do Ameriky

Jestli jsi si jistý, že to NENÍ tvůj poskytovatel internetu, tak to fixni také ale pře fixnutím budeš muse restartovat Pc do nouzového režimu:
No a pokud jsi si jistý že to není tvůj poskytovatel internetu tak jak jsem psal restart do nouzáku a v HJT fixni:
O17 - HKLM\System\CCS\Services\Tcpip\..\{79758192-DAA5-4EC2-9948-CD7962E485B4}: NameServer = 85.255.116.117,85.255.112.190
O17 - HKLM\System\CCS\Services\Tcpip\..\{808C7142-E6CB-4B08-9672-0A0A4F4C46D4}: NameServer = 85.255.116.117,85.255.112.190
O17 - HKLM\System\CCS\Services\Tcpip\..\{A2734D76-5376-4E87-A91E-72795831A624}: NameServer = 85.255.116.117,85.255.112.190
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.117 85.255.112.190
O17 - HKLM\System\CS1\Services\Tcpip\..\{79758192-DAA5-4EC2-9948-CD7962E485B4}: NameServer = 85.255.116.117,85.255.112.190
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.117 85.255.112.190
O17 - HKLM\System\CS2\Services\Tcpip\..\{79758192-DAA5-4EC2-9948-CD7962E485B4}: NameServer = 85.255.116.117,85.255.112.190
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.117 85.255.112.190

Ale opakuji za předpokladu že to není tvůj poskytovatel internetu.

Napsal: 29 srp 2006 21:17
od fredik
Tak tam máš adware Wareout
Časové pásmo: UTC+02:00
Stránka 1 z 1
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/