Virus som "slår ut" Internet och dator överlag

17 februari, 2010

Råkade på en annan som hade en mycket lik infektion och så hjälpte följande.

Kopiera alla rader i rutan:
Killall::
Rootkit::
c:\windows\system32\cmpropsj.dll
och klistra in i Anteckningar.

Spara filen på Skrivbordet med namnet CFScript.

Förbered datorn på samma sätt som tidigare för ComboFix.

Dra CFScript med musen och släpp den ovanpå ComboFix-ikonen på Skrivbordet så startar programmet på ett särskilt sätt.

Klistra in loggen som kommer ut.

Här kommer loggen;

ComboFix 10-02-16.03 - HP_Ägaren 17/02/2010 23:18:38.17.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.2046.1456 [GMT 1:00]

Körs från: c:\documents and settings\HP_Ägaren\Skrivbord\ComboFix.exe

Använda kommandoväxlar :: c:\documents and settings\HP_Ägaren\Skrivbord\CFScript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

(((((((((((((((((((((((( Filer Skapade från 2010-01-17 till 2010-02-17 ))))))))))))))))))))))))))))))

.

2010-02-09 15:50 . 2010-02-09 15:50 11591888 ----a-w- c:\documents and settings\All Users\Application Data\Voddler\VoddlerPlayer.exe

2010-01-31 07:57 . 2010-01-31 07:57 119808 --sha-r- c:\windows\system32\cmpropsj.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-02-17 19:11 . 2009-01-02 09:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2010-02-14 09:17 . 2009-11-13 17:27 520340 ----a-w- c:\documents and settings\All Users\Application Data\Voddler\Uninstall.exe

2010-02-13 12:17 . 2009-01-06 16:13 -------- d-----w- c:\program\Malwarebytes' Anti-Malware

2010-02-13 09:59 . 2005-01-01 19:48 -------- d-----w- c:\program\Google

2010-02-11 18:16 . 2009-09-12 05:58 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-02-11 17:27 . 2007-10-08 20:23 -------- d-----w- c:\program\SUPERAntiSpyware

2010-01-30 14:19 . 2006-10-15 15:07 -------- d-----w- c:\documents and settings\All Users\Application Data\ZoomBrowser

2010-01-07 15:07 . 2009-01-06 16:13 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-07 15:07 . 2009-01-06 16:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-31 16:50 . 2004-08-04 04:00 353792 ------w- c:\windows\system32\drivers\srv.sys

2009-12-27 10:49 . 2009-12-03 17:16 -------- d-----w- c:\program\iTunes

2009-12-21 19:09 . 2004-08-04 04:00 916480 ------w- c:\windows\system32\wininet.dll

2009-12-17 11:39 . 2009-12-17 11:39 499712 ----a-w- c:\documents and settings\All Users\Application Data\Voddler\MSVCP71.DLL

2009-12-17 11:39 . 2009-12-17 11:39 348160 ----a-w- c:\documents and settings\All Users\Application Data\Voddler\msvcr71.dll

2009-12-17 11:39 . 2009-12-17 11:39 339968 ----a-w- c:\documents and settings\All Users\Application Data\Voddler\SDL.dll

2009-12-17 11:39 . 2009-12-17 11:39 212992 ----a-w- c:\documents and settings\All Users\Application Data\Voddler\glew32.dll

2009-12-17 07:42 . 2004-08-04 04:00 343552 ----a-w- c:\windows\system32\mspaint.exe

2009-12-14 07:10 . 2004-08-04 04:00 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-10 18:24 . 2005-12-04 20:48 64822 ----a-w- c:\windows\system32\perfc01D.dat

2009-12-10 18:24 . 2005-12-04 20:48 387910 ----a-w- c:\windows\system32\perfh01D.dat

2009-12-09 10:11 . 2004-08-04 04:00 2146304 ------w- c:\windows\system32\ntoskrnl.exe

2009-12-09 10:11 . 2004-08-04 04:00 2024960 ------w- c:\windows\system32\ntkrnlpa.exe

2009-12-07 18:26 . 2009-09-20 06:29 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-12-04 18:22 . 2004-08-04 04:00 455424 ------w- c:\windows\system32\drivers\mrxsmb.sys

2009-12-03 17:11 . 2009-12-03 17:11 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe

2009-12-03 17:07 . 2009-12-03 17:07 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe

2009-11-27 17:14 . 2004-08-04 04:00 17920 ----a-w- c:\windows\system32\msyuv.dll

2009-11-27 17:14 . 2004-08-04 04:00 1293824 ----a-w- c:\windows\system32\quartz.dll

2009-11-27 16:10 . 2004-08-04 04:00 8704 ----a-w- c:\windows\system32\tsbyuv.dll

2009-11-27 16:10 . 2004-08-04 04:00 85504 ----a-w- c:\windows\system32\avifil32.dll

2009-11-27 16:10 . 2004-08-04 04:00 48128 ----a-w- c:\windows\system32\iyuv_32.dll

2009-11-27 16:10 . 2004-08-04 04:00 28672 ----a-w- c:\windows\system32\msvidc32.dll

2009-11-27 16:10 . 2004-08-04 04:00 11264 ----a-w- c:\windows\system32\msrle32.dll

2009-11-21 16:03 . 2004-08-04 04:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll

2006-08-13 20:19 . 2006-08-13 20:19 22 --sha-w- c:\windows\SMINST\HPCD.sys

.

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))

.

*Not* Tomma poster & legitima standardposter visas inte.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"updateMgr"="c:\program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

"SUPERAntiSpyware"="c:\program\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 1318912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ftutil2"="ftutil2.dll" [2004-06-07 106496]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]

"nwiz"="nwiz.exe" [2006-10-31 1622016]

"CTDVDDET"="c:\program\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]

"VolPanel"="c:\program\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-07-11 122880]

"AudioDrvEmulator"="c:\program\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 49152]

"CTHelper"="CTHELPER.EXE" [2005-08-08 16384]

"CTxfiHlp"="CTXFIHLP.EXE" [2005-08-08 18944]

"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

"HPHUPD08"="c:\program\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]

"PCMService"="c:\program\CyberLink\PowerCinema\PCMService.exe" [2006-02-24 147456]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]

"HPBootOp"="c:\program\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 249856]

"HP Software Update"="c:\program\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]

"TkBellExe"="c:\program\Delade filer\Real\Update_OB\realsched.exe" [2005-01-01 180269]

"Net iD"="c:\windows\system32\iid.exe" [2008-02-22 74992]

"avgnt"="c:\program\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"AppleSyncNotifier"="c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"VoddlerNet Manager"="c:\program\Voddler\service\VNetManager.exe" [2010-02-09 573640]

"QuickTime Task"="c:\program\QuickTime\qttask.exe" [2009-11-10 417792]

"iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2009-11-12 141600]

c:\documents and settings\HP_Žgaren\Start-meny\Program\Autostart\

Monitor My eRooms (V7).lnk - c:\program\eRoom 7\ERClient7.exe [2009-1-21 153096]

c:\documents and settings\All Users\Start-meny\Program\Autostart\

Adobe Reader Speed Launch.lnk - c:\program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

HP Digital Imaging Monitor.lnk - c:\program\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]

Personal.lnk - c:\program\Personal\bin\Personal.exe [2009-1-11 910864]

WinZip Quick Pick.lnk - c:\program\WinZip\WZQKPICK.EXE [2009-6-19 525640]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2007-04-19 11:41 294912 ----a-w- c:\program\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program\\uTorrent\\uTorrent.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program\\Spotify\\spotify.exe"=

"c:\\Program\\RagTime 6.5\\Win32\\RagTime 6.5.exe"=

"c:\\Program\\Bonjour\\mDNSResponder.exe"=

"c:\\Program\\iTunes\\iTunes.exe"=

"c:\\Program\\Voddler\\service\\voddler.exe"=

R1 SASDIFSV;SASDIFSV;c:\program\SUPERAntiSpyware\sasdifsv.sys [10/10/2006 12:53 5632]

R1 SASKUTIL;SASKUTIL;c:\program\SUPERAntiSpyware\SASKUTIL.SYS [27/02/2007 11:39 32256]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program\Avira\AntiVir Desktop\sched.exe [20/09/2009 07:29 108289]

R2 PWSYSDRV;PWSYSDRV;c:\windows\system32\drivers\pwsysdrv.sys [12/10/2006 17:08 17072]

R2 VoddlerNet;VoddlerNet;c:\program\Voddler\service\voddler.exe [09/02/2010 16:51 1235664]

R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [01/01/2005 20:20 2799488]

R3 SASENUM;SASENUM;c:\program\SUPERAntiSpyware\SASENUM.SYS [16/02/2006 16:51 4096]

S2 Automatisk LiveUpdate-schemaläggare;Automatisk LiveUpdate-schemaläggare;"c:\program\Symantec\LiveUpdate\ALUSchedulerSvc.exe" --> c:\program\Symantec\LiveUpdate\ALUSchedulerSvc.exe [?]

S2 gupdate;Tjänsten Google Update (gupdate);c:\program\Google\Update\GoogleUpdate.exe [05/01/2010 13:52 135664]

S3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\drivers\wn5301.sys [01/01/2005 20:19 468768]

.

Innehållet i mappen 'Schemalagda aktiviteter':

2010-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-04-11 10:34]

2010-02-17 c:\windows\Tasks\Google Software Updater.job

- c:\program\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-24 18:46]

2010-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program\Google\Update\GoogleUpdate.exe [2010-01-05 12:52]

2010-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program\Google\Update\GoogleUpdate.exe [2010-01-05 12:52]

.

------- Extra genomsökning -------

.

uStart Page = hxxp://www.newsnow.co.uk/newsfeed/?name=Liverpool

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = http=127.0.0.1:5555

uInternet Settings,ProxyOverride = <local>

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xportera till Microsoft Excel - c:\program\MICROS~2\OFFICE11\EXCEL.EXE/3000

DPF: {6E2510E6-BF2D-4C78-9F28-2F5C8760F124} - hxxps://solid.seb.se/eRoomSetup/,DanaInfo=SEB-eRoom.sebank.se,SSL,CT=java+client.cab

DPF: {D9CDEFE3-51BB-4737-A12C-53D9814A148C} - hxxps://solid.seb.se/exchweb/controls/,DanaInfo=skcc020a.sebank.se,CT=java+DAX.cab

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-02-17 23:27

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLer som "laddats" under processer som körs ---------------------

- - - - - - - > 'winlogon.exe'(676)

c:\program\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(308)

c:\windows\system32\nview.dll

c:\windows\system32\NVWRSENG.DLL

c:\windows\system32\nvwddi.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andra processer som körs ------------------------

.

c:\program\Avira\AntiVir Desktop\avguard.exe

c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program\Bonjour\mDNSResponder.exe

c:\program\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

c:\windows\system32\CTsvcCDA.EXE

c:\program\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe

c:\program\Juniper Networks\Common Files\dsNcService.exe

c:\program\Java\jre6\bin\jqs.exe

c:\program\Delade filer\LightScribe\LSSrvc.exe

c:\program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\SYSTEM32\CTXFISPI.EXE

c:\windows\system32\rundll32.exe

c:\windows\system32\nvsvc32.exe

c:\program\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

c:\program\Canon\CAL\CALMAIN.exe

c:\windows\System32\SCardSvr.exe

c:\program\iPod\bin\iPodService.exe

c:\windows\system\hpsysdrv.exe

.

**************************************************************************

.

Sluttid: 2010-02-17 23:32:29 - datorn startades om.

ComboFix-quarantined-files.txt 2010-02-17 22:32

ComboFix2.txt 2010-02-14 20:35

ComboFix3.txt 2010-02-14 19:19

ComboFix4.txt 2010-02-13 23:02

Före genomsökningen: 160,245,108,736 byte ledigt

Efter genomsökningen: 160,289,624,064 byte ledigt

- - End Of File - - BFC39E8B11B6EBAC6912F06042793C1B

17 februari, 2010

Men det hjälpte inte i ditt fall. Filen finns fortfarande kvar i loggen. Ser CFScript.txt ut precis som jag skrev med de tre raderna?

Om den gör det så får vi försöka med Avenger i stället för ComboFix.

Spara Avenger på Skrivbordet och packa upp filen där:

http://swandog46.geekstogo.com/avenger2/download.php

Kopiera in följande i Anteckningar:

Files to replace with dummy:
c:\windows\system32\cmpropsj.dll

Starta Avenger.

I den stora rutan så klistrar du in de två raderna som finns i Anteckningar.

Bocka i rutan Scan for rootkits om den inte redan är ibockad.

Tryck på Execute för att starta det.

Datorn startar nu om (kanske två gånger).

Efter en liten stund så kommer loggen (C:\avenger.txt) upp, klistra in den här.

18 februari, 2010

Men det hjälpte inte i ditt fall. Filen finns fortfarande kvar i loggen. Ser CFScript.txt ut precis som jag skrev med de tre raderna?

Om den gör det så får vi försöka med Avenger i stället för ComboFix.

Spara Avenger på Skrivbordet och packa upp filen där:

http://swandog46.geekstogo.com/avenger2/download.php

Kopiera in följande i Anteckningar:
Files to replace with dummy:
c:\windows\system32\cmpropsj.dll
Starta Avenger.

I den stora rutan så klistrar du in de två raderna som finns i Anteckningar.

Bocka i rutan Scan for rootkits om den inte redan är ibockad.

Tryck på Execute för att starta det.

Datorn startar nu om (kanske två gånger).

Efter en liten stund så kommer loggen (C:\avenger.txt) upp, klistra in den här.

testade igen, tidigare hade jag inte lagt texten på 3 rader;

ComboFix 10-02-17.02 - HP_Ägaren 18/02/2010 17:36:35.18.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.2046.1526 [GMT 1:00]

Körs från: c:\documents and settings\HP_Ägaren\Skrivbord\ComboFix.exe

Använda kommandoväxlar :: c:\documents and settings\HP_Ägaren\Skrivbord\CFScript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\pchealth\UploadLB\Binaries\uploadm.exe

c:\windows\pchealth\UploadLB\Config\config.xml

c:\windows\system32\H

c:\windows\pchealth\UploadLB . . . . misslyckades radera

.

(((((((((((((((((((((((( Filer Skapade från 2010-01-18 till 2010-02-18 ))))))))))))))))))))))))))))))

.

2010-02-09 15:50 . 2010-02-09 15:50 11591888 ----a-w- c:\documents and settings\All Users\Application Data\Voddler\VoddlerPlayer.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-02-18 16:20 . 2009-11-13 17:27 520340 ----a-w- c:\documents and settings\All Users\Application Data\Voddler\Uninstall.exe