|
|
|||||||
| Registrovať | Site Spy | Zoznam členov | Darovanie | Hľadať | Dnešné príspevky | Označiť témy ako prečítané | Pravidlá fóra |
|
 |
|
|
Thread Tools |
|
#1
9. septembra 2008, 10:31
|
|||
|
|||
|
LSASSMGR.exe (& ďalší) infikovanej! Akékoľvek informácie / pomoc?
Zdravím všetkých,
Som veľmi pre vaše nové stránky, ale neuveriteľne vďačná, že ste tu. Som klopýtl na neho kvôli nedávnej infekcie na mámu to notebooku (zdieľame ju) a som neistý, ako ho vyriešiť. O štyri dni, IE okien s pop-up reklamy by sa náhle stalo s balonem na mojom Deskbar, ktorý znie: "Spyware detekoval! Kliknite tu pre stiahnutie anti-spyware" Bežal som Symantec a Spybot S & D Úplné Kontroluje (nie ste istí, ako sa tento vírus vyklouzlo ako ty) a nenašli nič! Potom som začal googling a prevzali Malwarebyte to Anti-Malware a trvalo to. Zistilo sa, že niektoré veci, ale to nie je problém opraviť. I stiahnuty PrevxCSI ale nemám dosť $ $ $ zatiaľ kúpiť License (ale ak bude treba) a uvádza nasledovné: C: \ WINDOWS \ system32 \ ds fmon.dll - škodlivého softvéru C: \ WINDOWS \ system32 \ CSRLT.exe - Malware kvapkadlo C: \ WINDOWS \ MSBLT.exe - Malware kvapkadlo C: \ WINDOWS \ system32 \ LSASSMGR.exe - Cloaked Malware C: \ Program Files \ Mozilla Firefox \ firefoxe.exe - Cloaked Malware C: \ Program Files \ Internet Explorer \ iexplor.exe - Cloaked Malware C: \ WINDOWS \ system32 \ spool.exe - Cloaked Malware C: \ WINDOWS \ system32 \ srtsrv32.exe - Cloaked Malware C: \ WINDOWS \ system32 \ LSSMON.exe - Malware kvapkadlo C: \ WINDOWS \ divx32.dll - Malware kvapkadlo C: \ WINDOWS \ system32 \ msupd32.exe - Malware kvapkadlo C: \ WINDOWS \ system32 \ upd01.exe - Malware kvapkadlo , Ktorý vyzerá a znie ako veľa mi to a som veľmi obáva.  Má niekto mať akékoľvek užitočné podnety pre mňa? Budem to musieť minúť veľa peňazí na to spravit?Díky moc! |
|
#2
9. septembra 2008, 11:32
|
|||
|
|||
|
LSASSMGR.exe (& ďalší) infikovanej! Akékoľvek informácie / pomoc?
Dobrý deň teddynicholas. Vitajte na CJ.
Stiahnite ComboFix by subs z jedného z nižšie uvedených odkazov. Isteže top uložiť do Desktop. Link # 1 Link # 2 ** Poznámka: Je dôležité, že je uložený priamo na váš Desktop Zavrieť všetky otvorené webové prehliadače. (Firefox, Internet Explorer, atď) pred začatím ComboFix. Dočasne znemožniť tvoj antivirus, A akékoľvek Anti-Spyware Ochrana v reálnom čase pred vykonávajúci kontrolu. Kliknite tento odkaz zobraziť zoznam bezpečnostných programov, ktoré by mali byť zakázané, a ako je zakázať. Dvojitým kliknutím combofix.exe & sledovať inštrukcie. Po dokončení bude vyrábať ComboFix log pre vás. Post ComboFix log V ďalšej odpovedi. Dôležité upozornenie: Don't mouseclick ComboFix okná, ak je v chode. To môže spôsobiť, že na stánku. Nezabudnite re-umožní váš antivírus a antispyware ochrany pri ComboFix je kompletná.
__________________
 |
|
#3
16. September 2008, 14:27
|
|||
|
|||
|
LSASSMGR.exe (& ďalší) infikovanej! Akékoľvek informácie / pomoc?
ComboFix 08-09-15.02 - Teddy 2008-09-16 16:34:04.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.550 [GMT -4:00] Spustenie z: C: \ Documents and Settings \ Teddy \ Desktop \ ComboFix.exe * Vznik nového bodu obnovenia POZOR-Tento stroj nemá konzoly na obnovenie namontovanom! . ((((((((((((((((((((((((((((((((((((((( Ostatné Vymazanie ))))))))) )))))))))))))))))))))))))))))))))))))))) . C: \ Documents and Settings \ LocalService \ Cookies \ system@ad.yieldmanag er [1]. Txt C: \ Documents and Settings \ Teddy \ Cookies \ teddy@ad.yieldmanager [1]. Txt C: \ WINDOWS \ Downloaded Program Files \ setup.inf C: \ WINDOWS \ system32 \ spool.exe . ((((((((((((((((((((((((( Súbory vytvorené od 2008-08-16 do 2008-09-16 ))))))))))) )))))))))))))))))))) . 2008-09-16 16:21. 2008-09-16 16:50 <DIR> d -------- C: \ WINDOWS \ system32 \ CatRoot_bak 2008-09-16 13:23. 2008-09-16 13:23 <DIR> d -------- C: \ WINDOWS \ LastGood 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Program Files \ iTunes 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Program Files \ iPod 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Documents and Settings \ All Users \ Data aplikací \ () 3276BE95_AF08_429F_A64F_CA64CB79BCF6 2008-09-13 13:12. 2008-09-13 13:16 <DIR> d -------- C: \ Program Files \ Common Files \ Apple 2008-09-08 16:10. 2008-09-08 16:10 <DIR> d -------- C: \ Program Files \ Easy SpyRemover 2008-09-08 15:45. 2008-09-06 00:59 741376 - a ------ C: \ WINDOWS \ system32 \ LSSMON.EXE 2008-09-08 15:45. 2008-09-04 21:59 17920 - a ------ C: \ WINDOWS \ system32 \ LSASSMGR.EXE 2008-09-07 22:34. 2008-09-02 00:16 38528 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbamswissarmy.sys 2008-09-07 22:33. 2008-09-07 22:34 <DIR> d -------- C: \ Program Files \ Malwarebytes' Anti-Malware 2008-09-07 22:33. 2008-09-07 22:33 <DIR> d -------- C: \ Documents and Settings \ Teddy \ Data aplikací \ Malwarebytes 2008-09-07 22:33. 2008-09-07 22:33 <DIR> d -------- C: \ Documents and Settings \ All Users \ Data aplikací \ Malwarebytes 2008-09-07 22:33. 2008-09-02 00:16 17200 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbam.sys 2008-09-06 15:09. 2008-09-06 15:09 90112 - a ------ C: \ WINDOWS \ system32 \ QuickTimeVR.qtx 2008-09-06 15:09. 2008-09-06 15:09 57344 - a ------ C: \ WINDOWS \ system32 \ QuickTime.qts 2008-09-05 10:44. 2008-09-06 00:59 741376 - a ------ C: \ WINDOWS \ system32 \ msupd32.exe 2008-09-04 21:59. 2008-09-07 12:59 741376 - a ------ C: \ WINDOWS \ system32 \ upd01.exe 2008-09-04 21:59. 2008-09-06 00:59 741376 - a ------ C: \ WINDOWS \ divx32.dll 2008-09-04 21:59. 2008-09-04 21:59 17920 - a ------ C: \ WINDOWS \ system32 \ srtsrv32.exe 2008-09-04 21:59. 2008-09-16 16:24 5903 - a ------ C: \ WINDOWS \ system32 \ mssc32.dll 2008-09-04 21:59. 2008-09-16 16:24 5903 - a ------ C: \ WINDOWS \ system32 \ bsc32.dll 2008-09-02 13:23. 2008-09-02 13:23 <DIR> d -------- C: \ Program Files \ PrevxCSI 2008-09-02 13:23. 2008-09-16 13:32 <DIR> d -------- C: \ Documents and Settings \ All Users \ Data aplikací \ PrevxCSI 2008-09-02 13:23. 2008-09-02 13:23 17408 - a ------ C: \ WINDOWS \ system32 \ drivers \ pxark.sys 2008-09-01 01:30. 2008-09-02 13:10 <DIR> da ------ C: \ Documents and Settings \ All Users \ Data aplikací \ TEMP 2008-09-01 01:20. 2008-09-07 22:19 0 - a ------ C: \ WINDOWS \ system32 \ sc02.sc 2008-08-31 01:46. 2007-02-20 16:04 2463976 - a ------ C: \ WINDOWS \ system32 \ NPSWF32.dll 2008-08-31 01:46. 2007-02-20 16:04 190696 - a ------ C: \ WINDOWS \ system32 \ NPSWF32_FlashUtil.exe 2008-08-30 09:59. 2008-08-30 21:34 <DIR> d -------- C: \ Program Files \ Macromedia 2008-08-30 09:59. 2008-08-30 21:27 <DIR> d -------- C: \ Program Files \ Common Files \ Macromedia 2008-08-30 01:25. 2008-09-13 13:18 <DIR> d -------- C: \ Program Files \ Bonjour 2008-08-29 14:33. 2006-09-18 17:55 109744 - a ------ C: \ WINDOWS \ system32 \ drivers \ SYMEVENT.SYS 2008-08-29 14:33. 2006-09-18 17:55 48816 - a ------ C: \ WINDOWS \ system32 \ S32EVNT1.DLL 2008-08-29 10:18. 2008-08-29 10:18 87336 - a ------ C: \ WINDOWS \ system32 \ dns-sd.exe 2008-08-29 09:53. 2008-08-29 09:53 61440 - a ------ C: \ WINDOWS \ system32 \ dnssd.dll 2008-08-27 04:05. 2008-04-07 05:38 45392-ra ------ C: \ WINDOWS \ system32 \ AdobePDF.dll 2008-08-27 04:05. 2008-04-07 05:38 22872-ra ------ C: \ WINDOWS \ system32 \ AdobePDFUI.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Správa )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2008-09-16 20:53 --------- d ----- w C: \ Program Files \ Symantec AntiVirus 2008-09-13 17:17 --------- d ----- w C: \ Program Files \ QuickTime 2008-09-13 17:13 --------- d ----- w C: \ Program Files \ Apple Software Update 2008-09-08 18:53 249.956 ---- aw C: \ WINDOWS \ system32 \ dsfMon.dll 2008-09-01 07:50 --------- d ----- w C: \ Documents and Settings \ All Users \ Data aplikací \ Spybot - Search & Destroy 2008-09-01 05:56 --------- d ----- w C: \ Program Files \ Spybot - Search & Destroy 2008-08-30 05:24 --------- d ----- w C: \ Program Files \ Common Files \ Adobe 2008-08-29 18:34 --------- d ----- w C: \ Program Files \ Common Files \ Symantec Zdieľaná 2008-08-29 18:33 --------- d ----- w C: \ Program Files \ Symantec 2008-08-29 18:32 --------- d ----- w C: \ Documents and Settings \ All Users \ Data aplikací \ Symantec 2008-08-27 08:22 --------- d ----- w C: \ Documents and Settings \ All Users \ Data aplikací \ FLEXnet 2008-08-26 00:52 --------- d ----- w C: \ Documents and Settings \ Teddy \ Data aplikací \ OpenOffice.org2 2008-08-13 21:33 --------- d ----- w C: \ Program Files \ Microsoft Silverlight 2008-08-12 02:46 --------- d ----- w C: \ Program Files \ PHM 2008-07-26 08:55 --------- d ----- w C: \ Program Files \ OpenOffice.org 2.4 2008-07-26 08:54 --------- d ----- w C: \ Program Files \ Java 2008-07-19 02:10 94.920 ---- aw C: \ WINDOWS \ system32 \ cdm.dll 2008-07-19 02:10 53.448 ---- aw C: \ WINDOWS \ system32 \ wuauclt.exe 2008-07-19 02:09 563.912 ---- aw C: \ WINDOWS \ system32 \ wuapi.dll 2008-07-19 02:09 325.832 ---- aw C: \ WINDOWS \ system32 \ wucltui.dll 2008-07-19 02:09 205.000 ---- aw C: \ WINDOWS \ system32 \ wuweb.dll 2008-07-19 02:09 1.811.656 ---- aw C: \ WINDOWS \ system32 \ Wuaueng.dll 2008-07-07 20:32 253.952 ---- aw C: \ WINDOWS \ system32 \ es.dll 2008-06-24 22:12 295.936 ------ w C: \ WINDOWS \ system32 \ wmpeffects.dll 2008-06-24 16:23 74.240 ---- aw C: \ WINDOWS \ system32 \ mscms.dll 2008-06-23 16:57 826.368 ---- aw C: \ WINDOWS \ system32 \ Wininet.dll 2008-06-20 17:41 245.248 ---- aw C: \ WINDOWS \ system32 \ mswsock.dll 2008-04-19 16:57 32 ---- aw C: \ Documents and Settings \ All Users \ Data aplikací \ ezsid.dat . ((((((((((((((((((((((((((((((((((((( Reg Načítavam Body )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Poznámka * prázdné záznamy & dôveryhodne východiskové údaje nie sú zobrazené REGEDIT4 [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curr ntVersion \ Run] "SWG" = "C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe" [2007-04-02 68856] "QuickTime Úloha" = "C: \ Program Files \ QuickTime \ qttask.exe" [2008-09-06 413696] "H / PC pripojenie Agent" = "C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe" [2006-11-13 1289000] "Ctfmon.exe" = "C: \ WINDOWS \ system32 \ Ctfmon.exe" [2004-08-04 15360] "IndxStoreSvr_ (79662E04-7C6C-4d9f-84C7-88D8A56B10AA)" = "C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexStoreSvr.exe" [2008-02-28 1828136] "SpybotSD TeaTimer" = "C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe" [2008-08-18 1832272] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "RemoteControl" = "C: \ Program Files \ Cyberlink \ PowerDVD \ PDVDServ.exe" [2004-05-14 32768] "RoxioEngineUtility" = "C: \ Program Files \ Common Files \ Roxio Shared \ System \ EngUtil.exe" [2003-05-01 65536] "RoxioAudioCentral" = "C: \ Program Files \ Roxio \ Easy CD Creator 6 \ AudioCentral \ RxMon.exe" [2003-07-15 319488] "SiS Windows KeyHook" = "C: \ WINDOWS \ system32 \ keyhook.exe" [2004-09-02 249856] "SiSUSBRG" = "C: \ WINDOWS \ SiSUSBrg.exe" [2004-09-22 106496] "Apoint" = "C: \ Program Files \ Apoint2K \ Apoint.exe" [2003-12-05 159744] "SunJavaUpdateSched" = "C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe" [2008-06-10 144784] "DSFHost" = "C: \ Program Files \ Staples \ easyprint \ dsfhost.exe" [2006-01-05 2142301] "Synchronization Manager" = "C: \ WINDOWS \ system32 \ mobsync.exe" [2004-08-04 143360] "Zune Launcher" = "C: \ Program Files \ Zune \ ZuneLauncher.exe" [2007-03-14 24104] "GrooveMonitor" = "C: \ Program Files \ Microsoft Office \ Office12 \ GrooveMonitor.exe" [2006-10-27 31016] "Adobe Reader Speed Launcher" = "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ reader_sl.exe" [2008-01-11 39792] "NeroFilterCheck" = "C: \ Program Files \ Common Files \ Nero \ Lib \ NeroCheck.exe" [2008-02-28 570664] "NBKeyScan" = "C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBKeyScan.exe" [2008-02-18 2221352] "Adobe Acrobat Speed Launcher" = "C: \ Program Files \ Adobe \ Acrobat 9.0 \ Acrobat \ Acrobat_sl.exe" [2008-06-12 37232] "ccApp" = "C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe" [2006-07-19 52896] "vptray" = "C: \ PROGRA ~ 1 \ SYMANT ~ 1 \ VPTray.exe" [2006-09-27 125168] "Layersecurity Servicemonitor" = "C: \ WINDOWS \ system32 \ LSSMON.EXE" [2008-09-06 741376] "iTunesHelper" = "C: \ Program Files \ iTunes \ iTunesHelper.exe" [2008-09-10 289576] "SoundMan" = "SOUNDMAN.EXE" [2004-09-22 C: \ WINDOWS \ SOUNDMAN.EXE] "AGRSMMSG" = "AGRSMMSG.exe" [2004-09-22 C: \ WINDOWS \ AGRSMMSG.exe] "SiSPower" = "SiSPower.dll" [2004-09-22 C: \ WINDOWS \ system32 \ SiSPower.dll] C: \ Documents and Settings \ Teddy \ Start Menu \ Programs \ Startup \ Adobe Gamma.lnk - C: \ Program Files \ Common Files \ Adobe \ Kalibračná \ Adobe Gamma Loader.exe [2005-03-16 113664] OneNote 2007 Clipper obrazovky a Launcher.lnk - C: \ Program Files \ Microsoft Office \ Office12 \ ONENOTEM.EXE [2006-10-26 98632] C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Startup \ Windows Desktop Search.lnk - C: \ Program Files \ Windows Desktop Search \ WindowsSearch.exe [2007-02-05 118784] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entversion \ Explorer \ ShellExecuteHooks] "(56F9679E-7826-4C84-81F3-532071A8BCC5)" = "C: \ Program Files \ Windows Desktop Search \ MSNLNamespaceMgr.dll" [2007-02-05 294400] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Windows] "AppInit_DLLs" = acaptuser32.dll [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ súbor s obrázkom vykonanie voľby \ firefox.exe] "Debugger" = C: \ Program Files \ Mozilla Firefox \ firefoxe.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ súbor s obrázkom vykonanie voľby \ iexplore.exe] "Debugger" = C: \ Program Files \ Internet Explorer \ iexplor.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ súbor s obrázkom vykonanie voľby \ Spoolsv.exe] "Debugger" = C: \ WINDOWS \ system32 \ spool.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ security center \ Monitorovanie \ SymantecAntiVirus] "DisableMonitoring" = dword: 00000001 [HKLM \ ~ \ services \ sharedaccess \ Parameters \ firewallpo antonny \ standardprofile \ AuthorizedApplications \ List] "% Windir% \ \ system32 \ \ Sessmgr.exe" = "C: \ \ Program Files \ \ Common Files \ \ AOL \ \ Loader \ \ aolload.exe" = "C: \ \ Program Files \ \ Bitlord \ \ BitLord.exe" = "C: \ \ Program Files \ \ Soulseek \ \ slsk.exe" = "C: \ \ Program Files \ \ Mozilla Firefox \ \ firefox.exe" = "C: \ \ StubInstaller.exe" = "C: \ \ Program Files \ \ LimeWire \ \ LimeWire.exe" = "% Windir% \ \ Network Diagnostické \ \ xpnetdiag.exe" = "C: \ \ Program Files \ \ Messenger \ \ Msmsgs.exe" = "C: \ \ Program Files \ \ AIM \ \ aim.exe" = "C: \ Program Files \ Microsoft ActiveSync \ rapimgr.exe" = C: \ Program Files \ Microsoft ActiveSync \ rapimgr.exe: 169.254.2.0/255.255.255.0: Povolené: ActiveSync RAPI Manager "C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe" = C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe: 169.254.2.0/255.255.255.0: Enabled: ActiveSync Connection Manager "C: \ Program Files \ Microsoft ActiveSync \ WCESMgr.exe" = C: \ Program Files \ Microsoft ActiveSync \ WCESMgr.exe: 169.254.2.0/255.255.255.0: Povolené: Aplikácia ActiveSync "C: \ \ Program Files \ \ Microsoft Office \ \ Office12 \ \ Outlook.exe" = "C: \ \ Program Files \ \ Microsoft Office \ \ Office12 \ \ GROOVE.EXE" = "C: \ \ Program Files \ \ Microsoft Office \ \ Office12 \ \ ONENOTE.EXE" = "C: \ \ Program Files \ \ Isadora \ \ isadora.exe" = "C: \ \ Program Files \ \ Skype \ \ Telefón \ \ Skype.exe" = "C: \ \ Program Files \ \ Bonjour \ \ mDNSResponder.exe" = "C: \ \ Program Files \ \ iTunes \ \ iTunes.exe" = [HKLM \ ~ \ services \ sharedaccess \ Parameters \ firewallpo antonny \ standardprofile \ GloballyOpenPorts \ List] "3389: TCP" = 3389: TCP: @ xpsp2res.dll, -22009 "1500: TCP" = 1500: TCP: bezpečný prístup Agent Port "26675: TCP" = 26675: TCP: 169.254.2.0/255.255.255.0: Enabled: ActiveSync Service * Novo vytvorené Service * - CATCH * Novo vytvorené Service * - PROCEXP90 . Obsah tejto 'Naplánované úlohy' priečinku . - - - - SIROTY ZNEŠKODNENIU - - - -- HKLM-Spustiť-CSRLT.EXE - C: \ WINDOWS \ system32 \ CSRLT.EXE . ------- Doplnkový Scan ------- . FireFox -: Profil - C: \ Documents and Settings \ Teddy \ Data aplikací \ Mozilla \ Firefox \ Profiles \ 6xzfp0sa.default \ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp: / / www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q = . ************************************************** ************************ catchme 0.3.1361 W2K/XP/Vista - rootkit / stealth malware detektor by Gmer, http://www.gmer.net Rootkit scan 2008-09-16 16:51:46 Windows 5.1.2600 Service Pack 2 NTFS skenování skrytých procesov ... skenování skrytých položiek autostart ... skenování skrytých súborov ... scan úspešne dokončená skryté súbory: 0 ************************************************** ************************ . Dokončenie čas: 2008-09-16 17:15:59 ComboFix-karantény-files.txt 2008-09-16 21:15:16 Pre-Spustiť: 10478669824 bytes zdarma Post-Spustiť: 10446106624 bytes zdarma 190 --- EOF --- 2008-09-11 20:07:51 |
|
#4
16. September 2008, 14:45
|
|||
|
|||
|
LSASSMGR.exe (& ďalší) infikovanej! Akékoľvek informácie / pomoc?
Poznámka: nižšie uvedených pokynov boli vytvorené špeciálne pre tohto užívateľa. Ak si nie ste týmto užívateľom DON'T postupujte podľa týchto pokynov, ktoré by mohli poškodiť chod vášho systému
Odstrániť tieto súbory / adresáre, takto: 1. Prejsť na Začať > Plynúť > Typ Notepad.exe a kliknite OK otvorte Poznámkový blok. To musieť potrebné Poznámkový blok, WordPad nie. 2. Skopírujte text v nižšie kód do kolónky zvýraznenie celý text a stlačením Ctrl + C Kód:
Killall:: File:: C: \ Program Files \ Easy SpyRemover C: \ WINDOWS \ system32 \ LSSMON.EXE C: \ WINDOWS \ system32 \ LSASSMGR.EXE C: \ WINDOWS \ system32 \ msupd32.exe C: \ WINDOWS \ system32 \ upd01.exe C: \ WINDOWS \ system32 \ srtsrv32.exe C: \ WINDOWS \ system32 \ mssc32.dll C: \ WINDOWS \ system32 \ bsc32.dll Registry:: [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ obrazu file vykonanie voľby \ iexplore.exe] "Debugger" =- [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ súbor s obrázkom vykonanie voľby \ Spoolsv.exe] "Debugger" =- 4. Potom kliknite na Súbor > Uložiť 5. Názov súboru CFScript.txt - Uložte súbor do počítača 6. Potom presunieme CFScript (držte ľavé tlačidlo myši a zároveň pretiahnutím súboru) a pusť ju (uvoľnite ľavé tlačidlo myši) do ComboFix.exe, ako vidíte na obrázku nižšie. Dôležité upozornenie: Vykoná pokyny pozorne!  ComboFix začne vykonávať, stačí sledovať pokyny. Po reštarte (v prípade, že požiada o reštart systému), bude produkovať záznam pre vás. Posta, že log (Combofix.txt) vo svojej budúcej odpoveď. Poznámka: Don't mouseclick ComboFix okná, ak je v chode. To môže spôsobiť váš systém zmraziť
__________________
|
|
#5
16. September 2008, 15:32
|
|||
|
|||
|
LSASSMGR.exe (& ďalší) infikovanej! Akékoľvek informácie / pomoc?
ComboFix 08-09-15.02 - Teddy 2008-09-16 17:49:20.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.850 [GMT -4:00] Spustenie z: C: \ Documents and Settings \ Teddy \ Desktop \ ComboFix.exe Command prepínačov používa:: C: \ Documents and Settings \ Teddy \ Desktop \ CFScript.txt * Vznik nového bodu obnovenia POZOR-Tento stroj nemá konzoly na obnovenie namontovanom! . ((((((((((((((((((((((((((((((((((((((( Ostatné Vymazanie ))))))))) )))))))))))))))))))))))))))))))))))))))) . C: \ WINDOWS \ system32 \ bsc32.dll C: \ WINDOWS \ system32 \ LSASSMGR.EXE C: \ WINDOWS \ system32 \ LSSMON.EXE C: \ WINDOWS \ system32 \ mssc32.dll C: \ WINDOWS \ system32 \ msupd32.exe C: \ WINDOWS \ system32 \ spool.exe C: \ WINDOWS \ system32 \ srtsrv32.exe C: \ WINDOWS \ system32 \ upd01.exe . ((((((((((((((((((((((((( Súbory vytvorené od 2008-08-16 do 2008-09-16 ))))))))))) )))))))))))))))))))) . 2008-09-16 16:21. 2008-09-16 16:50 <DIR> d -------- C: \ WINDOWS \ system32 \ CatRoot_bak 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Program Files \ iTunes 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Program Files \ iPod 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Documents and Settings \ All Users \ Data aplikací \ () 3276BE95_AF08_429F_A64F_CA64CB79BCF6 2008-09-13 13:12. 2008-09-13 13:16 <DIR> d -------- C: \ Program Files \ Common Files \ Apple 2008-09-08 16:10. 2008-09-08 16:10 <DIR> d -------- C: \ Program Files \ Easy SpyRemover 2008-09-07 22:34. 2008-09-02 00:16 38528 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbamswissarmy.sys 2008-09-07 22:33. 2008-09-07 22:34 <DIR> d -------- C: \ Program Files \ Malwarebytes' Anti-Malware 2008-09-07 22:33. 2008-09-07 22:33 <DIR> d -------- C: \ Documents and Settings \ Teddy \ Data aplikací \ Malwarebytes 2008-09-07 22:33. 2008-09-07 22:33 <DIR> d -------- C: \ Documents and Settings \ All Users \ Data aplikací \ Malwarebytes 2008-09-07 22:33. 2008-09-02 00:16 17200 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbam.sys 2008-09-06 15:09. 2008-09-06 15:09 90112 - a ------ C: \ WINDOWS \ system32 \ QuickTimeVR.qtx 2008-09-06 15:09. 2008-09-06 15:09 57344 - a ------ C: \ WINDOWS \ system32 \ QuickTime.qts 2008-09-04 21:59. 2008-09-06 00:59 741376 - a ------ C: \ WINDOWS \ divx32.dll 2008-09-02 13:23. 2008-09-02 13:23 <DIR> d -------- C: \ Program Files \ PrevxCSI 2008-09-02 13:23. 2008-09-16 13:32 <DIR> d -------- C: \ Documents and Settings \ All Users \ Data aplikací \ PrevxCSI 2008-09-02 13:23. 2008-09-02 13:23 17408 - a ------ C: \ WINDOWS \ system32 \ drivers \ pxark.sys 2008-09-01 01:30. 2008-09-02 13:10 <DIR> da ------ C: \ Documents and Settings \ All Users \ Data aplikací \ TEMP 2008-09-01 01:20. 2008-09-07 22:19 0 - a ------ C: \ WINDOWS \ system32 \ sc02.sc 2008-08-31 01:46. 2007-02-20 16:04 2463976 - a ------ C: \ WINDOWS \ system32 \ NPSWF32.dll 2008-08-31 01:46. 2007-02-20 16:04 190696 - a ------ C: \ WINDOWS \ system32 \ NPSWF32_FlashUtil.exe 2008-08-30 09:59. 2008-08-30 21:34 <DIR> d -------- C: \ Program Files \ Macromedia 2008-08-30 09:59. 2008-08-30 21:27 <DIR> d -------- C: \ Program Files \ Common Files \ Macromedia 2008-08-30 01:25. 2008-09-13 13:18 <DIR> d -------- C: \ Program Files \ Bonjour 2008-08-29 14:33. 2006-09-18 17:55 109744 - a ------ C: \ WINDOWS \ system32 \ drivers \ SYMEVENT.SYS 2008-08-29 14:33. 2006-09-18 17:55 48816 - a ------ C: \ WINDOWS \ system32 \ S32EVNT1.DLL 2008-08-29 10:18. 2008-08-29 10:18 87336 - a ------ C: \ WINDOWS \ system32 \ dns-sd.exe 2008-08-29 09:53. 2008-08-29 09:53 61440 - a ------ C: \ WINDOWS \ system32 \ dnssd.dll 2008-08-27 04:05. 2008-04-07 05:38 45392-ra ------ C: \ WINDOWS \ system32 \ AdobePDF.dll 2008-08-27 04:05. 2008-04-07 05:38 22872-ra ------ C: \ WINDOWS \ system32 \ AdobePDFUI.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Správa )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2008-09-16 21:33 --------- d ----- w C: \ Program Files \ Symantec AntiVirus 2008-09-13 17:17 --------- d ----- w C: \ Program Files \ QuickTime 2008-09-13 17:13 --------- d ----- w C: \ Program Files \ Apple Software Update 2008-09-01 07:50 --------- d ----- w C: \ Documents and Settings \ All Users \ Data aplikací \ Spybot - Search & Destroy 2008-09-01 05:56 --------- d ----- w C: \ Program Files \ Spybot - Search & Destroy 2008-08-30 05:24 --------- d ----- w C: \ Program Files \ Common Files \ Adobe 2008-08-29 18:34 --------- d ----- w C: \ Program Files \ Common Files \ Symantec Zdieľaná 2008-08-29 18:33 --------- d ----- w C: \ Program Files \ Symantec 2008-08-29 18:32 --------- d ----- w C: \ Documents and Settings \ All Users \ Data aplikací \ Symantec 2008-08-27 08:22 --------- d ----- w C: \ Documents and Settings \ All Users \ Data aplikací \ FLEXnet 2008-08-26 00:52 --------- d ----- w C: \ Documents and Settings \ Teddy \ Data aplikací \ OpenOffice.org2 2008-08-13 21:33 --------- d ----- w C: \ Program Files \ Microsoft Silverlight 2008-08-12 02:46 --------- d ----- w C: \ Program Files \ PHM 2008-07-26 08:55 --------- d ----- w C: \ Program Files \ OpenOffice.org 2.4 2008-07-26 08:54 --------- d ----- w C: \ Program Files \ Java 2008-04-19 16:57 32 ---- aw C: \ Documents and Settings \ All Users \ Data aplikací \ ezsid.dat . ((((((((((((((((((((((((((((( Snapshot@2008-09-16_17.03.48.82 )))))))))) ))))))))))))))))))))))))))))))) . - 2007-07-30 23:18:40 33.624-c - aw C: \ WINDOWS \ system32 \ dllcache \ wups.dll + 2008-07-19 02:10:20 36.552-c - aw C: \ WINDOWS \ system32 \ dllcache \ wups.dll - 2007-07-30 23:18:40 33.624 ---- aw C: \ WINDOWS \ system32 \ wups.dll + 2008-07-19 02:10:20 36.552 ---- aw C: \ WINDOWS \ system32 \ wups.dll - 2007-07-30 23:19:12 43.352 ---- aw C: \ WINDOWS \ system32 \ wups2.dll + 2008-07-19 02:10:40 45.768 ---- aw C: \ WINDOWS \ system32 \ wups2.dll . ((((((((((((((((((((((((((((((((((((( Reg Načítavam Body )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Poznámka * prázdné záznamy & dôveryhodne východiskové údaje nie sú zobrazené REGEDIT4 [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curr ntVersion \ Run] "SWG" = "C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe" [2007-04-02 68856] "QuickTime Úloha" = "C: \ Program Files \ QuickTime \ qttask.exe" [2008-09-06 413696] "H / PC pripojenie Agent" = "C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe" [2006-11-13 1289000] "Ctfmon.exe" = "C: \ WINDOWS \ system32 \ Ctfmon.exe" [2004-08-04 15360] "IndxStoreSvr_ (79662E04-7C6C-4d9f-84C7-88D8A56B10AA)" = "C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexStoreSvr.exe" [2008-02-28 1828136] "SpybotSD TeaTimer" = "C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe" [2008-08-18 1832272] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "RemoteControl" = "C: \ Program Files \ Cyberlink \ PowerDVD \ PDVDServ.exe" [2004-05-14 32768] "RoxioEngineUtility" = "C: \ Program Files \ Common Files \ Roxio Shared \ System \ EngUtil.exe" [2003-05-01 65536] "RoxioAudioCentral" = "C: \ Program Files \ Roxio \ Easy CD Creator 6 \ AudioCentral \ RxMon.exe" [2003-07-15 319488] "SiS Windows KeyHook" = "C: \ WINDOWS \ system32 \ keyhook.exe" [2004-09-02 249856] "SiSUSBRG" = "C: \ WINDOWS \ SiSUSBrg.exe" [2004-09-22 106496] "Apoint" = "C: \ Program Files \ Apoint2K \ Apoint.exe" [2003-12-05 159744] "SunJavaUpdateSched" = "C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe" [2008-06-10 144784] "DSFHost" = "C: \ Program Files \ Staples \ easyprint \ dsfhost.exe" [2006-01-05 2142301] "Synchronization Manager" = "C: \ WINDOWS \ system32 \ mobsync.exe" [2004-08-04 143360] "Zune Launcher" = "C: \ Program Files \ Zune \ ZuneLauncher.exe" [2007-03-14 24104] "GrooveMonitor" = "C: \ Program Files \ Microsoft Office \ Office12 \ GrooveMonitor.exe" [2006-10-27 31016] "Adobe Reader Speed Launcher" = "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ reader_sl.exe" [2008-01-11 39792] "NeroFilterCheck" = "C: \ Program Files \ Common Files \ Nero \ Lib \ NeroCheck.exe" [2008-02-28 570664] "NBKeyScan" = "C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBKeyScan.exe" [2008-02-18 2221352] "Adobe Acrobat Speed Launcher" = "C: \ Program Files \ Adobe \ Acrobat 9.0 \ Acrobat \ Acrobat_sl.exe" [2008-06-12 37232] "ccApp" = "C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe" [2006-07-19 52896] "vptray" = "C: \ PROGRA ~ 1 \ SYMANT ~ 1 \ VPTray.exe" [2006-09-27 125168] "iTunesHelper" = "C: \ Program Files \ iTunes \ iTunesHelper.exe" [2008-09-10 289576] "CSRLT.EXE" = "C: \ WINDOWS \ system32 \ CSRLT.EXE" [BU] "SoundMan" = "SOUNDMAN.EXE" [2004-09-22 C: \ WINDOWS \ SOUNDMAN.EXE] "AGRSMMSG" = "AGRSMMSG.exe" [2004-09-22 C: \ WINDOWS \ AGRSMMSG.exe] "SiSPower" = "SiSPower.dll" [2004-09-22 C: \ WINDOWS \ system32 \ SiSPower.dll] C: \ Documents and Settings \ Teddy \ Start Menu \ Programs \ Startup \ Adobe Gamma.lnk - C: \ Program Files \ Common Files \ Adobe \ Kalibračná \ Adobe Gamma Loader.exe [2005-03-16 113664] OneNote 2007 Clipper obrazovky a Launcher.lnk - C: \ Program Files \ Microsoft Office \ Office12 \ ONENOTEM.EXE [2006-10-26 98632] C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Startup \ Windows Desktop Search.lnk - C: \ Program Files \ Windows Desktop Search \ WindowsSearch.exe [2007-02-05 118784] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entversion \ Explorer \ ShellExecuteHooks] "(56F9679E-7826-4C84-81F3-532071A8BCC5)" = "C: \ Program Files \ Windows Desktop Search \ MSNLNamespaceMgr.dll" [2007-02-05 294400] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Windows] "AppInit_DLLs" = acaptuser32.dll [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ súbor s obrázkom vykonanie voľby \ firefox.exe] "Debugger" = C: \ Program Files \ Mozilla Firefox \ firefoxe.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ security center \ Monitorovanie \ SymantecAntiVirus] "DisableMonitoring" = dword: 00000001 [HKLM \ ~ \ services \ sharedaccess \ Parameters \ firewallpo antonny \ standardprofile \ AuthorizedApplications \ List] "% Windir% \ \ system32 \ \ Sessmgr.exe" = "C: \ \ Program Files \ \ Common Files \ \ AOL \ \ Loader \ \ aolload.exe" = "C: \ \ Program Files \ \ Bitlord \ \ BitLord.exe" = "C: \ \ Program Files \ \ Soulseek \ \ slsk.exe" = "C: \ \ Program Files \ \ Mozilla Firefox \ \ firefox.exe" = "C: \ \ StubInstaller.exe" = "C: \ \ Program Files \ \ LimeWire \ \ LimeWire.exe" = "% Windir% \ \ Network Diagnostické \ \ xpnetdiag.exe" = "C: \ \ Program Files \ \ Messenger \ \ Msmsgs.exe" = "C: \ \ Program Files \ \ AIM \ \ aim.exe" = "C: \ Program Files \ Microsoft ActiveSync \ rapimgr.exe" = C: \ Program Files \ Microsoft ActiveSync \ rapimgr.exe: 169.254.2.0/255.255.255.0: Povolené: ActiveSync RAPI Manager "C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe" = C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe: 169.254.2.0/255.255.255.0: Enabled: ActiveSync Connection Manager "C: \ Program Files \ Microsoft ActiveSync \ WCESMgr.exe" = C: \ Program Files \ Microsoft ActiveSync \ WCESMgr.exe: 169.254.2.0/255.255.255.0: Povolené: Aplikácia ActiveSync "C: \ \ Program Files \ \ Microsoft Office \ \ Office12 \ \ Outlook.exe" = "C: \ \ Program Files \ \ Microsoft Office \ \ Office12 \ \ GROOVE.EXE" = "C: \ \ Program Files \ \ Microsoft Office \ \ Office12 \ \ ONENOTE.EXE" = "C: \ \ Program Files \ \ Isadora \ \ isadora.exe" = "C: \ \ Program Files \ \ Skype \ \ Telefón \ \ Skype.exe" = "C: \ \ Program Files \ \ Bonjour \ \ mDNSResponder.exe" = "C: \ \ Program Files \ \ iTunes \ \ iTunes.exe" = [HKLM \ ~ \ services \ sharedaccess \ Parameters \ firewallpo antonny \ standardprofile \ GloballyOpenPorts \ List] "3389: TCP" = 3389: TCP: @ xpsp2res.dll, -22009 "1500: TCP" = 1500: TCP: bezpečný prístup Agent Port "26675: TCP" = 26675: TCP: 169.254.2.0/255.255.255.0: Enabled: ActiveSync Service R0 pxark; pxark, C: \ WINDOWS \ system32 \ drivers \ pxark.sys [2008-09-02 17408] R2 CSIScanner; CSIScanner, C: \ Program Files \ PrevxCSI \ prevxcsi.exe [2008-09-02 618040] R2 SafeAccessAgent; bezpečný prístup Agent, C: \ Program Files \ StillSecure \ bezpečný prístup Agent \ SAService.exe [2006-01-27 880640] R2 hľadiska Manager Service; hľadiska Service Manager, C: \ Program Files \ hľadiska \ Common \ ViewpointService.exe [2007-01-04 24652] S3 HwIOctl; HwIOctl, C: \ Documents and Settings \ Vlastník \ Plocha \ HwIOctl.sys [] S3 Ktp3; Elantech Touchpad (KTP3), C: \ WINDOWS \ system32 \ DRIVERS \ Ktp3.sy s [2004-09-22 24704] S3 Memctl; Memctl, C: \ Documents and Settings \ Vlastník \ Plocha \ Memctl.sys [] . Obsah tejto 'Naplánované úlohy' priečinku . - - - - SIROTY ZNEŠKODNENIU - - - -- HKLM-Spustiť-Layersecurity Servicemonitor - C: \ WINDOWS \ system32 \ LSSMON.EXE HKLM-RunOnce-MSBLT.EXE - C: \ WINDOWS \ MSBLT.EXE ************************************************** ************************ catchme 0.3.1361 W2K/XP/Vista - rootkit / stealth malware detektor by Gmer, http://www.gmer.net Rootkit scan 2008-09-16 18:00:27 Windows 5.1.2600 Service Pack 2 NTFS skenování skrytých procesov ... skenování skrytých položiek autostart ... skenování skrytých súborov ... ************************************************** ************************ . ------------------------ Iné spustených procesov ----------------------- -- . C: \ Program Files \ Common Files \ Symantec Shared \ ccSetMgr.exe C: \ Program Files \ Common Files \ Symantec Shared \ ccEvtMgr.exe C: \ Program Files \ Common Files \ Symantec Shared \ SPBBC \ SPBBCSvc.exe C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ Symantec \ LiveUpdate \ AluSchedulerSvc.exe C: \ Program Files \ Bonjour \ mDNSResponder.exe C: \ Program Files \ Symantec AntiVirus \ DefWatch.exe C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe C: \ WINDOWS \ system32 \ IoctlSvc.exe C: \ WINDOWS \ system32 \ MsPMSPSv.exe C: \ WINDOWS \ system32 \ searchindexer.exe C: \ Program Files \ hľadiska \ hľadiska Manager \ ViewMgr.exe C: \ WINDOWS \ system32 \ rundll32.exe C: \ PROGRA ~ 1 \ micros ~ 3 \ rapimgr.exe C: \ Program Files \ Roxio \ Easy CD Creator 6 \ AudioCentral \ Playlist.exe C: \ Program Files \ Apoint2K \ ApntEx.exe C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexingService.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ WINDOWS \ system32 \ searchprotocolhost.exe C: \ WINDOWS \ system32 \ searchfilterhost.exe . ************************************************** ************************ . Dokončenie čas: 2008-09-16 18:24:56 - stroj bol reštartuje ComboFix-karantény-files.txt 2008-09-16 22:23:49 ComboFix2.txt 2008-09-16 21:16:14 Pre-Spustiť: 10626510848 bytes zdarma Post-Spustiť: 10616803328 bytes zdarma 205 --- EOF --- 2008-09-11 20:07:51 |
|
#6
16. September 2008, 15:50
|
|||
|
|||
|
LSASSMGR.exe (& ďalší) infikovanej! Akékoľvek informácie / pomoc?
Stiahnuť TrendMicro HijackThis.exe (Hjt) na ploche.
__________________
|
|
#7
23. September 2008, 09:24
|
|||
|
|||
|
LSASSMGR.exe (& ďalší) infikovanej! Akékoľvek informácie / pomoc?
Logfile Trend Micro HijackThis v2.0.2
Scan uložené v 12:21:04 dňa 9.23.2008 Platforma: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Zavádzacia mód: Normálny Bežiace procesy: C: \ WINDOWS \ System32 \ Smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Common Files \ Symantec Shared \ ccSetMgr.exe C: \ Program Files \ Common Files \ Symantec Shared \ ccEvtMgr.exe C: \ Program Files \ Common Files \ Symantec Shared \ SPBBC \ SPBBCSvc.exe C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe C: \ WINDOWS \ system32 \ Spoolsv.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ Symantec \ LiveUpdate \ ALUSchedulerSvc.exe C: \ Program Files \ PrevxCSI \ prevxcsi.exe C: \ Program Files \ Symantec AntiVirus \ DefWatch.exe C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe C: \ WINDOWS \ system32 \ IoctlSvc.exe C: \ Program Files \ StillSecure \ bezpečný prístup Agent \ SAService.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ hľadiska \ Common \ ViewpointService.exe C: \ WINDOWS \ system32 \ MsPMSPSv.exe C: \ WINDOWS \ system32 \ SearchIndexer.exe C: \ WINDOWS \ Explorer.exe C: \ Program Files \ PrevxCSI \ prevxcsi.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Cyberlink \ PowerDVD \ PDVDServ.exe C: \ WINDOWS \ SOUNDMAN.EXE C: \ WINDOWS \ system32 \ keyhook.exe C: \ Program Files \ Apoint2K \ Apoint.exe C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe C: \ Program Files \ Staples \ easyprint \ dsfhost.exe C: \ Program Files \ Zune \ ZuneLauncher.exe C: \ Program Files \ Microsoft Office \ Office12 \ GrooveMonitor.exe C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ Apoint2K \ Apntex.exe C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexStoreSvr.exe C: \ PROGRA ~ 1 \ micros ~ 3 \ rapimgr.exe C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexingService.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ Program Files \ hľadiska \ hľadiska Manager \ ViewMgr.exe C: \ Program Files \ Adobe \ Acrobat 9.0 \ Acrobat \ AcroTray.exe C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Nakladateľ \ FNPLicensingService.exe C: \ WINDOWS \ system32 \ Taskmgr.exe C: \ WINDOWS \ lsass.exe C: \ WINDOWS \ system32 \ SPOOLER.EXE C: \ WINDOWS \ system32 \ wscntfy.exe C: \ WINDOWS \ system32 \ Ctfmon.exe C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis.exe C: \ WINDOWS \ system32 \ SearchProtocolHost.exe R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.averatec.com R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU \ Software \ Microsoft \ Internet Sprievodca pripojením, ShellNext = http://oqaserver-a/ R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Nastavenia, ProxyOverride = *. miestnej O2 - BHO: Yahoo! Toolbar Helper - (02478D38-C3F9-4EFB-9B51-7695ECA05670) - C: \ Program Files \ Yahoo! \ Companion \ Inštalácia \ CPN \ yt.dll O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - (18DF081C-E8AD-4283-A596-FA578C2EBDC3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelperShim.dll O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O2 - BHO: Groove GFS Browser Helper - (72853161-30C5-4D22-B7F9-0BBC1D38A37E) - C: \ PROGRA ~ 1 \ micros ~ 4 \ Office12 \ GRA8E1 ~ 1.DLL O2 - BHO: SSVHelper triedy - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O2 - BHO: AOL Toolbar Launcher - (7C554162-8CB7-45A4-B8F4-8EA1C75885F9) - C: \ Program Files \ AOL \ AOL Toolbar 2.0 \ aoltb.dll O2 - BHO: hľadiska Toolbar BHO - (A7327C09-B521-4EDB-8509-7D2660C9EC98) - C: \ Program Files \ hľadiska \ hľadiska Toolbar \ 3.8.0 \ ViewBarBHO.dll O2 - BHO: Google Toolbar Helper - (AA58ED58-01DD-4d91-8333-CF10577473F7) - c: \ program files \ google \ googletoolbar2.dll O2 - BHO: Adobe PDF Preškoľovací Toolbar Helper - (AE7CD045-E861-484f-8273-0445EE161910) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 3.1.807.1746 \ sw g.dll O2 - BHO: SmartSelect - (F4971EE7-DAA0-4053-9964-665D8EE6A077) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll O3 - Toolbar: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Inštalácia \ CPN \ yt.dll O3 - Toolbar: & Google - (2318C2B1-4965-11D4-9B18-009027A5CD4F) - c: \ program files \ google \ googletoolbar2.dll O3 - Toolbar: AOL Toolbar - (DE9C389F-3316-41A7-809B-AA305ED9D922) - C: \ Program Files \ AOL \ AOL Toolbar 2.0 \ aoltb.dll O3 - Toolbar: hľadiska Toolbar - (F8AD5AA5-D966-4667-9DAF-2561D68B2012) - C: \ Program Files \ Common Files \ hľadiska \ Toolbar Runtime \ 3.8.0 \ IEViewBar.dll O3 - Toolbar: Adobe PDF - (47833539-D0C5-4125-9FA8-0819E2EAAC93) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll O4 - HKLM \ .. \ Run: [RemoteControl] "C: \ Program Files \ Cyberlink \ PowerDVD \ PDVDServ.exe" O4 - HKLM \ .. \ Run: [RoxioEngineUtility] "C: \ Program Files \ Common Files \ Roxio Shared \ System \ EngUtil.exe" O4 - HKLM \ .. \ Run: [RoxioAudioCentral] "C: \ Program Files \ Roxio \ Easy CD Creator 6 \ AudioCentral \ RxMon.exe" O4 - HKLM \ .. \ Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM \ .. \ Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM \ .. \ Run: [SiSPower] rundll32.exe SiSPower.dll, ModeAgent O4 - HKLM \ .. \ Run: [SiS Windows KeyHook] C: \ WINDOWS \ system32 \ keyhook.exe O4 - HKLM \ .. \ Run: [SiSUSBRG] C: \ WINDOWS \ SiSUSBrg.exe O4 - HKLM \ .. \ Run: [Apoint] C: \ Program Files \ Apoint2K \ Apoint.exe O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe" O4 - HKLM \ .. \ Run: [DSFHost] C: \ Program Files \ Staples \ easyprint \ dsfhost.exe O4 - HKLM \ .. \ Run: [Synchronization Manager]% SystemRoot% \ system32 \ mobsync.exe / prihlásenie O4 - HKLM \ .. \ Run: [Zune Launcher] "C: \ Program Files \ Zune \ ZuneLauncher.exe" O4 - HKLM \ .. \ Run: [GrooveMonitor] "C: \ Program Files \ Microsoft Office \ Office12 \ GrooveMonitor.exe" O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ reader_sl.exe" O4 - HKLM \ .. \ Run: [NeroFilterCheck] C: \ Program Files \ Common Files \ Nero \ Lib \ NeroCheck.exe O4 - HKLM \ .. \ Run: [NBKeyScan] "C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBKeyScan.exe" O4 - HKLM \ .. \ Run: [Adobe Acrobat Speed Launcher] "C: \ Program Files \ Adobe \ Acrobat 9.0 \ Acrobat \ Acrobat_sl.exe" O4 - HKLM \ .. \ Run: [ccApp] "C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe" O4 - HKLM \ .. \ Run: [vptray] C: \ PROGRA ~ 1 \ SYMANT ~ 1 \ VPTray.exe O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKLM \ .. \ Run: [Layersecurity Servicemonitor] C: \ WINDOWS \ system32 \ LSSMON.EXE O4 - HKLM \ .. \ Run: [Print Spooler] C: \ WINDOWS \ system32 \ SPOOLER.EXE O4 - HKCU \ .. \ Run: [SWG] C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe O4 - HKCU \ .. \ Run: [QuickTime Úloha] "C: \ Program Files \ QuickTime \ qttask.exe"-atboottime O4 - HKCU \ .. \ Run: [H / PC pripojenie Agent] "C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe" O4 - HKCU \ .. \ Run: [Cttfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe O4 - HKCU \ .. \ Run: [IndxStoreSvr_ (79662E04-7C6C-4d9f-84C7-88D8A56B10AA)] "C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F -39A1E5104020 O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe O4 - HKCU \ .. \ Run: [AdobeUpdater] C: \ Program Files \ Common Files \ Adobe \ Updater \ AdobeUpdater.exe O4 - HKLM \ .. \ Policies \ Explorer \ Run: [LocalSecurityAuthoritySubsystem] C: \ WINDOWS \ lsass.exe O4 - spustenie: Adobe Gamma.lnk = C: \ Program Files \ Common Files \ Adobe \ Kalibračná \ Adobe Gamma Loader.exe O4 - spustenie: OneNote 2007 Clipper obrazovky a Launcher.lnk = C: \ Program Files \ Microsoft Office \ Office12 \ ONENOTEM.EXE O4 - Global spustení: Windows Desktop Search.lnk = C: \ Program Files \ Windows Desktop Search \ WindowsSearch.exe O8 - Extra kontextového menu položku: & AOL Toolbar Hľadať - C: \ Program Files \ AOL \ AOL Toolbar 2.0 \ zdroje \ en-US \ local \ search.html O8 - Extra kontextového menu položku: Append Link Cieľ Existujúce PDF - res: / / C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll / AcroIEAppendSelLinks.html O8 - Extra kontextového menu položku: Pripojí k Existujúce PDF - res: / / C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll / AcroIEAppend.html O8 - Extra kontextového menu položku: Previesť cieľ odkazu do Adobe PDF - res: / / C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll / AcroIECaptureSelLinks.html O8 - Extra kontextového menu položku: Previesť do Adobe PDF - res: / / C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll / AcroIECapture.html O8 - Extra kontextového menu položku: E & xportovať do programu Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ micros ~ 4 \ Office12 \ EXCEL.EXE/3000 O9 - Extra tlačidlá: (bez názvu) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O9 - Extra tlačidlá: Send to OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 1 \ micros ~ 4 \ Office12 \ ONBttnIE.dll O9 - Extra 'Tools' menuitem: S & konca OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 1 \ micros ~ 4 \ Office12 \ ONBttnIE.dll O9 - Extra tlačidlá: Vytvoriť mobilnú obľúbenú položku - (2EAF5BB1-070F-11D3-9307-00C04FAE2D4F) - C: \ PROGRA ~ 1 \ micros ~ 3 \ INetRepl.dll O9 - Extra tlačidlá: (bez názvu) - (2EAF5BB2-070F-11D3-9307-00C04FAE2D4F) - C: \ PROGRA ~ 1 \ micros ~ 3 \ INetRepl.dll O9 - Extra 'Tools' menuitem: Vytvoriť mobilnú obľúbenú položku ... - (2EAF5BB2-070F-11D3-9307-00C04FAE2D4F) - C: \ PROGRA ~ 1 \ micros ~ 3 \ INetRepl.dll O9 - Extra tlačidlá: AOL Toolbar - (3369AF0D-62E9-4bda-8103-B4C75499B578) - C: \ Program Files \ AOL \ AOL Toolbar 2.0 \ aoltb.dll O9 - Extra tlačidlá: Výskum - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ MIC273 ~ 1 \ Office12 \ REFIEBAR.DLL O9 - Extra tlačidlá: AIM - (AC9E2541-2814-11d5-BC6D-00B0D0A1DE45) - C: \ Program Files \ AIM \ aim.exe O9 - Extra tlačidlá: (bez názvu) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Konfigurácia - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O9 - Extra tlačidlá: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ Msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ Msmsgs.exe O14 - IERESET.INF: START_PAGE_URL = http://www.averatec.com O16 - DPF: (0D6BB8B8-0257-420C-B9EB-CFA90DB1026C) -- http://svrnsec01.purchase.edu:88/setup.cab O16 - DPF: (6414512B-B978-451D-A0D8-FCFDF33E833C) (WUWebControl Class) -- http://v5.windowsupdate.microsoft.co...?1096453339343 O18 - Protokol: grooveLocalGWS - (88FED34C-F0CA-4636-A375-3CB6248B04CD) - C: \ PROGRA ~ 1 \ micros ~ 4 \ Office12 \ GR99D3 ~ 1.DLL O18 - Protokol: skype4com - (FFC8B962-9B40-4DFF-9458-1830C7DD7F5D) - C: \ PROGRA ~ 1 \ Common ~ 1 \ Skype \ SKYPE4 ~ 1.DLL O20 - AppInit_DLLs: acaptuser32.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C: \ Program Files \ Common Files \ Adobe Systems Shared \ Service \ Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple Inc - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: Plánovač automatické LiveUpdate - Symantec Corporation - C: \ Program Files \ Symantec \ LiveUpdate \ ALUSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc - C: \ Program Files \ Bonjour \ mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccSetMgr.exe O23 - Service: CSIScanner - Prevx - C: \ Program Files \ PrevxCSI \ prevxcsi.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C: \ Program Files \ Symantec AntiVirus \ DefWatch.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd - C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Nakladateľ \ FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe O23 - Service: InstallDriver Tabuľka Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C: \ PROGRA ~ 1 \ Symantec \ LIVEUP ~ 1 \ LUCOMS ~ 1.EXE O23 - Service: Nero BackItUp Plánovač 3 - Nero AG - C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe O23 - Service: NMIndexingService - Nero AG - C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - plodným Technology Inc - C: \ WINDOWS \ system32 \ IoctlSvc.exe O23 - Service: bezpečný prístup Agent (SafeAccessAgent) - StillSecure - C: \ Program Files \ StillSecure \ bezpečný prístup Agent \ SAService.exe O23 - Service: SAVRoam (SavRoam) - Symantec - C: \ Program Files \ Symantec AntiVirus \ SavRoam.exe O23 - Service: Symantec sieť Ovládače Service (SNDSrvc) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ SPBBC \ SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C: \ Program Files \ Symantec AntiVirus \ Rtvscan.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ Centrum zabezpečenia \ SymWSC.exe O23 - Service: Service Manager vyhliadka - vyhliadka Corporation - C: \ Program Files \ hľadiska \ Common \ ViewpointService.exe -- Koniec súboru - 14719 bytes |
|
#8
23. September 2008, 10:25
|
|||
|
|||
|
LSASSMGR.exe (& ďalší) infikovanej! Akékoľvek informácie / pomoc?
Stiahnuť Malwarebytes' Anti-Malware (MBAM)
Extra Poznámka: Ak narazia na MBAM súbor, ktorý je ťažké odstrániť, bude predložená v 1 z 2 výzva, kliknite na tlačidlo OK a nechajte MBAM buď pokračovať s dezinfekčné proces, je-li vyzvaní k reštartu počítača, urobte tak ihneď. ---------- Teraz stačí spustiť nový HijackThis skenovať a po prihlásení spolu s MBAM log.
__________________
|
