kontrola logu (vyřešeno)

[filous06]

Prosím o kontrolu logu. Měl jsem problém s Trojan-gen. {Other} tak nevím už je vše v pořádku. Předem dík.
Logfile of HijackThis v1.99.1
Scan saved at 12:19:56, on 30.1.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Microsoft Office\Office10\POWERPNT.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Documents and Settings\Ondra\Plocha\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\system32\qttask.exe
O4 - HKLM\..\Run: [Agent] C:\WINDOWS\system32\alsys.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{381F9B89-2418-4061-8761-DBF4E269A8F6}: NameServer = 10.30.1.1,82.202.115.2
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

[Reklama]

[filous06]

Moc se v tom nevyznám, ale někde na diskuzi jsem našel že by tohle měl bejt šmejd:
O4 - HKLM\..\Run: [Agent] C:\WINDOWS\system32\alsys.exe
Mám to fixnout?

[Baron Prášil]

fixni
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [Agent] C:\WINDOWS\system32\alsys.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

tučný smaž

[filous06]

Vypadá to dobře, moc dík Barone !

[filous06]

bohužel už ho tam mám zase Win32:Trojan-gen. {Other} Název souboru: adir.dll Kerio po mě chtělo povolit c:\windows\system32\taskdir.exe tak jsem to zakázal. Jinak jsem to projel Mwavem a pořád se drží. Posílám log z hjt či to bude platné:

Logfile of HijackThis v1.99.1
Scan saved at 14:20:17, on 1.2.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\system32\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\WINDOWS\system32\taskdir.exe
C:\Documents and Settings\Ondra\Plocha\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\system32\qttask.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{381F9B89-2418-4061-8761-DBF4E269A8F6}: NameServer = 10.30.1.1,82.202.115.2
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

[fredik]

Ukonči v TaskManageru (zmáčkni zároveň klávesy ctrl+alt+delete) otevře se ti okno a v něm se přepni na záložku Procesy a v ní ukonči:
qttask.exe
taskdir.exe

Spusť znovu HijackThis a zaškrtni v něm okénka před řádky:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\system32\qttask.exe
po zaškrtnutí klikni na tlačítko Fix Checked

pak najdi a smaž červeně označený soubor C:\WINDOWS\system32\taskdir.exe

Zapni si zobrazení skrytých a systémových souboru a najdi tu knihovnu: adir.dll měla by se nacházet <System>\adir.dll a jestli tam ještě nebude tato knihovna <System>\zlbw.dll.

Pak ji otestuj na VirusTotall a napiš její přesné umístění a odstraníme ji.

[filous06]

C:\WINDOWS\system32\zlbw.dll
virustotal:
CAT-QuickHeal 9.00 01.31.2007 TrojanProxy.Lager.aq
eSafe 7.0.14.0 02.01.2007 Win32.StartPage.J
Fortinet 2.85.0.0 02.01.2007 SPY/LdPinch
Ikarus T3.1.0.31 02.01.2007 Trojan.Win32.Crypt.I
Sunbelt 2.2.907.0 02.01.2007 NetPumper
UNA 1.83 01.31.2007 TrojanProxy.Win32.Lager.73C3

Ten adir.dll nikde není, ale našel jsem adir.dll.vir ale nevím jestli to není pouze nějaký pozůstatek z truhly.
C:\Program Files\Alwil Software\Avast4\DATA\moved\adir.dll.vir
virustotal:
AntiVir 7.3.1.33 02.01.2007 Worm/Banwarum.F.17
Authentium 4.93.8 02.01.2007 W32/Trojan.MRM
Avast 4.7.936.0 02.01.2007 Win32:Trojan-gen. {Other}
AVG 386 02.01.2007 I-Worm/Generic.AJK
BitDefender 7.2 02.01.2007 Trojan.Spy.Agent.LH
CAT-QuickHeal 9.00 01.31.2007 I-Worm.Banwarum.f
ClamAV devel-20060426 02.01.2007 Trojan.Agent-846
DrWeb 4.33 02.01.2007 Trojan.PWS.Micro
eSafe 7.0.14.0 02.01.2007 Win32.Banwarum.f
eTrust-InoculateIT 30.4.3363 02.01.2007 Win32/Banwarum.1ws!DLL!Trojan
eTrust-Vet 30.4.3363 02.01.2007 Win32/Sinteri
Ewido 4.0 02.01.2007 Worm.Banwarum.f
Fortinet 2.85.0.0 02.01.2007 no virus found
F-Prot 4.2.1.29 02.01.2007 W32/Trojan.MRM
Ikarus T3.1.0.31 02.01.2007 Email-Worm.Win32.Banwarum.f
Kaspersky 4.0.2.24 02.01.2007 Email-Worm.Win32.Banwarum.f
McAfee 4953 01.31.2007 Downloader-ZQ
Microsoft 1.2101 02.01.2007 Galapop.A (threat-c)
NOD32v2 2026 02.01.2007 Win32/Nuwar
Norman 5.80.02 02.01.2007 W32/Malware.AJF
Panda 9.0.0.4 02.01.2007 Rootkit/Alanchum.JF
Prevx1 V2 02.01.2007 Trojan.Taskdir
Sophos 4.13.0 01.31.2007 Troj/HideDl-B
Sunbelt 2.2.907.0 02.01.2007 Trojan-Proxy.Win32.Lager.gen
Symantec 10 02.01.2007 Trojan.Abwiz.F
TheHacker 6.0.3.161 02.01.2007 W32/Banwarum.f
UNA 1.83 01.31.2007 I-Worm.Glowa.f
VBA32 3.11.2 02.01.2007 Email-Worm.Win32.Banwarum.f
VirusBuster 4.3.19:9 02.01.2007 I-Worm.Banwarum.J

[fredik]

Podívej se tedy do truhly avastu jestli tam bude tak ji vymaž.

ještě se podívej jestli v tom System32\taskdir.dll není tato knihovna a jestli jo tak ji otestuj na VirusTotal a ještě řekni jestli se ti podařilo smazat ten taskdir.exe. Pak to vezmeme všechno jedním vrzem.

[filous06]

Takže v truhle nic není ten C:\Program Files\Alwil Software\Avast4\DATA\moved\adir.dll.vir jsem vymazal. tasdir.exe se mi podařilo vymazat.
tasdir.dll nikde není.

[fredik]

Stáhněte si a spusťte pod účtem administrátora Avenger
- zvol možnost Input script manually a klikni na ikonku lupy
- Do nového okna zkopíruj celý tento zelený text:
Files to delete:
C:\WINDOWS\System32\taskdir.dll
C:\WINDOWS\System32\zlbw.dll

- Po vložení textu klikni na Done
- Klikni na ikonku semaforu ke spuštění programu, vyskočí ti hláška tu povol
- Nakonec stiskni OK a počítač se restartuje.

Po restartu by ti měl vyskočit výpis Avengeru tak ho sem zkopíruj.

[filous06]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\iocywacv

*******************

Script file located at: \??\C:\WINDOWS\uqtxqctx.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\System32\taskdir.dll not found!
Deletion of file C:\WINDOWS\System32\taskdir.dll failed!

Could not process line:
C:\WINDOWS\System32\taskdir.dll
Status: 0xc0000034

File C:\WINDOWS\System32\zlbw.dll deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[fredik]

Soubor smazán, takže by to mělo být v pořádku. Dej sem ještě pro jistotu nový log z HJT.