Smitfraud-c.msvps

**guccijana** · #1 Sausis 29, 2008, 09:16

Here We Go Again

Logfile Trend Micro HijackThis v2.0.2
Skaitymo išsaugotas 11:13:49, on 1/29/2008
Platforma: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Veikia procesus:
C: \ WINDOWS \ System32 \ smss.exe
C: \ WINDOWS \ system32 \ winlogon.exe
C: \ WINDOWS \ system32 \ services.exe
C: \ WINDOWS \ system32 \ lsass.exe
C: \ WINDOWS \ system32 \ Ati2evxx.exe
C: \ WINDOWS \ System32 \ svchost.exe
C: \ WINDOWS \ System32 \ svchost.exe
C: \ Program Files \ Avast4Software \ Avast4 \ aswUpdSv.exe
C: \ Program Files \ Avast4Software \ Avast4 \ ashServ.exe
C: \ WINDOWS \ system32 \ Spoolsv.exe
C: \ WINDOWS \ system32 \ brss01a.exe
C: \ WINDOWS \ explorer.exe
C: \ Program Files \ Intel \ Intel Application Accelerator \ iaanotif.exe
C: \ Program Files \ Intel \ Modem Įvykio Monitor \ IntelMEM.exe
C: \ Program Files \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe
C: \ WINDOWS \ system32 \ rundll32.exe
C: \ Program Files \ dell \ Žiniasklaida Patirtis \ PCMService.exe
C: \ Program Files \ CyberLink \ PowerDVD \ DVDLauncher.exe
C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe
C: \ PROGRA ~ 1 \ Yahoo! \ Browser \ ybrwicon.exe
C: \ Program Files \ BroadJump \ Client fondas \ CFD.exe
C: \ PROGRA ~ 1 \ Yahoo! \ Browser \ ycommon.exe
C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe
C: \ WINDOWS \ System32 \ spool \ drivers \ W32x86 \ 3 \ E_FATIA JA.EXE
C: \ PROGRA ~ 1 \ AVAST4 ~ 1 \ Avast4 \ ashDisp.exe
C: \ Program Files \ QuickTime \ QTTask.exe
C: \ Program Files \ iTunes \ iTunesHelper.exe
C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe
C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe
C: \ WINDOWS \ system32 \ Ctfmon.exe
C: \ Program Files \ LINKSYS EasyLink patarėjas \ LinksysAgent.exe
C: \ WINDOWS \ SYSTEM32 \ WTablet \ TabUserW.exe
C: \ Program Files \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe
C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe
C: \ PROGRA ~ 1 \ COMMON ~ 1 \ AOL \ ACS \ acsd.exe
C: \ Program Files \ APC \ APC PowerChute Personal Edition \ mainserv.exe
C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
C: \ Program Files \ Grisoft \ AVG Anti-spyware 7,5 \ guard.exe
C: \ Program Files \ CIFPFiltering \ CIFPLogAggregator.exe
C: \ WINDOWS \ system32 \ CTsvcCDA.EXE
C: \ Program Files \ CIFPFiltering \ FilterService.exe
C: \ Program Files \ Intel \ Intel Application Accelerator \ iaantmon.exe
C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe
C: \ WINDOWS \ System32 \ svchost.exe
C: \ WINDOWS \ system32 \ Tablet.exe
C: \ WINDOWS \ wanmpsvc.exe
C: \ WINDOWS \ system32 \ MsPMSPSv.exe
C: \ Program Files \ Avast4Software \ Avast4 \ ashMaiSv.exe
C: \ Program Files \ Avast4Software \ Avast4 \ ashWebSv.exe
C: \ Program Files \ iPod \ bin \ iPodService.exe
C: \ Program Files \ APC \ APC PowerChute Personal Edition \ apcsystray.exe
C: \ Program Files \ Avast4Software \ Avast4 \ ashSimpl.exe
C: \ Program Files \ Mozilla Firefox \ firefox.exe
C: \ Program Files \ Spybot - Search & Destroy \ SpybotSD.exe
C: \ Program Files \ Windows NT \ Accessories \ wordpad.exe
C: \ Documents and Settings \ Tatjana Blazevic \ Desktop \ sniper.exe.exe

R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.yahoo.com/
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Žiniasklaida ernet Nustatymai, ProxyServer = 127.0.0.1:8080
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Žiniasklaida ernet Parametrai ProxyOverride = vietos
N3 - Netscape 7: user_pref ( "browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C: \ Documents and Settings \ TATJANA BLAZEVIC \ Application Data \ Mozilla \ Profiles \ default \ mhiwv3o3.slt \ prefs.js)
N3 - Netscape 7: user_pref ( "browser.search.defaultengine", "Variklis: / / C% 3A% 5CPROGRA% 7E1% 5CNETSCAPE% 5CNETSCAPE% 5Csearchpl ugins% 5CSBWeb_01.src"); (C: \ Documents and Settings \ Tatjana Blazevic \ Application Data \ Mozilla \ Profiles \ default \ mhiwv3o3.slt \ prefs.js)
O2 - BHO: AcroIEHlprObj Class - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 6.0 \ Reader \ ActiveX \ AcroIEHelper.dll
O2 - BHO: (no name) - (0D5227BF-0C5B-4EA8-833C-FE09F1496F39) - (no file)
O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O2 - BHO: (no name) - (549B5CA7-4A86-11D7-A4DF-000874180BB3) - (no file)
O2 - BHO: UberButton Class - (5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897) - C: \ Program Files \ Yahoo! \ Common \ yiesrvc.dll
O2 - BHO: DriveLetterAccess - (5CA3D70E-1895-11CF-8E15-001234567890) - C: \ WINDOWS \ system32 \ dla \ tfswshx.dll
O2 - BHO: YahooTaggedBM Class - (65D886A2-7CA7-479B-BB95-14D1EFB7946A) - C: \ Program Files \ Yahoo! \ Common \ YIeTagBm.dll
O2 - BHO: SidebarAutoLaunch Class - (F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D) - C: \ Program Files \ Yahoo! \ Browser \ YSidebarIEBHO.dll
O2 - BHO: (no name) - (FDD3B846-8D59-4ffb-8758-209B6AD74ACC) - (no file)
O3 - Toolbar: McAfee VirusScan - (BA52B914-B692-46c4-B683-905236F6F655) - C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcvsshl.dll
O4 - HKLM \ .. \ Run: [IAAnotif] "C: \ Program Files \ Intel \ Intel Application Accelerator \ iaanotif.exe"
O4 - HKLM \ .. \ Run: [ATIPTA] "C: \ Program Files \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe"
O4 - HKLM \ .. \ Run: [IntelMeM] "C: \ Program Files \ Intel \ Modem Įvykio Monitor \ IntelMEM.exe"
O4 - HKLM \ .. \ Run: [CTSysVol] "C: \ Program Files \ Creative \ Sound Blaster Live 24-bit \ Surround Mixer \ CTSysVol.exe" / R
O4 - HKLM \ .. \ Run: [P17Helper] Rundll32 P17.dll, P17Helper
O4 - HKLM \ .. \ Run: [PCMService] "C: \ Program Files \ dell \ Žiniasklaida Patirtis \ PCMService.exe"
O4 - HKLM \ .. \ Run: [DVDLauncher] "C: \ Program Files \ CyberLink \ PowerDVD \ DVDLauncher.exe"
O4 - HKLM \ .. \ Run: [UpdateManager] "C: \ Program Files \ Common Files \ Sonic \ Update Manager \ sgtray.exe" / R
O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe
O4 - HKLM \ .. \ Run: [YBrowser] C: \ PROGRA ~ 1 \ Yahoo! \ Browser \ ybrwicon.exe
O4 - HKLM \ .. \ Run: [BJCFD] "C: \ Program Files \ BroadJump \ Client fondas \ CFD.exe"
O4 - HKLM \ .. \ Run: [VSOCheckTask] "C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcmnhdlr.exe" / checktask
O4 - HKLM \ .. \ Run: [Adobe Photo Downloader] "C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe"
O4 - HKLM \ .. \ Run: [Epson Stylus Photo R340 Series] "C: \ WINDOWS \ System32 \ spool \ drivers \ W32x86 \ 3 \ E_FATI AJA.EXE" / P30 "Epson Stylus Photo R340 serija" / O6 "USB002 "/ M" Stylus Photo R340 "
O4 - HKLM \ .. \ Run: [avast!] C: \ PROGRA ~ 1 \ AVAST4 ~ 1 \ Avast4 \ ashDisp.exe
O4 - HKLM \ .. \ Run: [! AVG Anti-Spyware] "C: \ Program Files \ Grisoft \ AVG Anti-Spyware 7,5 \ avgas.exe" / mažinimą
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe"
O4 - HKCU \ .. \ Run: [Yahoo! Pager] "C: \ PROGRA ~ 1 \ Yahoo! \ Messen ~ 1 \ ypager.exe"-tyliai
O4 - HKCU \ .. \ Run: [SUPERAntiSpyware] C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe
O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe
O4 - HKCU \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe
O4 - HKCU \ .. \ Run: [EasyLinkAdvisor] "C: \ Program Files \ LINKSYS EasyLink patarėjas \ LinksysAgent.exe" / startup
O4 - Global Startup: UPS APC Status.lnk =?
O4 - Global Startup: TabUserW.exe.lnk = C: \ WINDOWS \ SYSTEM32 \ WTablet \ TabUserW.exe
O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O9 - Extra 'Tools' MENUITEM: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O9 - Extra 'Tools' MENUITEM: @ Xpsp3res.dll, -20.001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O16 - DPF: (215B8138-A3CF-44C5-803F-8226143CFC0A) (Trend Micro "ActiveX" Scan Konsultantas 6,6) -- http://prerelease.trendmicro-europe....vex/hcImpl.cab
O16 - DPF: (9A9307A0-7DA4-4DAF-B042-5009F29E09E1) --
O16 - DPF: (DBA230D1-8467-4e69-987E-5FAE815A3B45) --
O23 - Service: Adobe Aktyvus File Monitor (AdobeActiveFileMonitor) - Unknown owner - C: \ Program Files \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc - C: \ PROGRA ~ 1 \ COMMON ~ 1 \ AOL \ ACS \ acsd.exe
O23 - Service: UPS APC Service - American Power Conversion Corporation - C: \ Program Files \ APC \ APC PowerChute Personal Edition \ mainserv.exe
O23 - Service: Apple Mobile Device - Apple, Inc - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
O23 - Service: ASP.NET valstybės tarnyba (aspnet_state) - Unknown owner - C: \ WINDOWS \ Microsoft.NET \ Framework \ v2.0.50727 \ aspn et_state.exe (file missing)
O23 - Service: avast! iAVS4 kontrolės tarnybos (aswUpdSv) - ALWIL Software - C: \ Program Files \ Avast4Software \ Avast4 \ aswUpdSv.exe
O23 - Service: ATI HotKey Rinkėjas - Unknown owner - C: \ WINDOWS \ system32 \ Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C: \ Program Files \ Avast4Software \ Avast4 \ ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C: \ Program Files \ Avast4Software \ Avast4 \ ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C: \ Program Files \ Avast4Software \ Avast4 \ ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - Grisoft sro - C: \ Program Files \ Grisoft \ AVG Anti-Spyware 7,5 \ guard.exe
O23 - Service: BrSplService (Brolis SPL XP Service) - Brother Industries Ltd - C: \ WINDOWS \ system32 \ brsvc01a.exe
O23 - Service: CIFPLogAggregator - Unknown owner - C: \ Program Files \ CIFPFiltering \ CIFPLogAggregator.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C: \ WINDOWS \ system32 \ CTsvcCDA.EXE
O23 - Service: CyclopeInternetFilter - Unknown owner - C: \ Program Files \ CIFPFiltering \ FilterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C: \ Program Files \ Intel \ Intel Application Accelerator \ iaantmon.exe
O23 - Service: InstallDriver lentelė Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe
O23 - Service: iPod Service - Apple Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling tarnybos (LightScribeService) - Unknown owner - C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Variklis (MCVSRte) - Networks Associates Technology, Inc - C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcvsrte.exe
O23 - Service: TabletService - Wacom Technology, Corp - C: \ WINDOWS \ system32 \ Tablet.exe
O23 - Service: WAN miniprievado (ATW) Paslaugos (WANMiniportService) - America Online, Inc - C: \ WINDOWS \ wanmpsvc.exe

--
End of file - 11.218 baitų

**evilfantasy** · #2 Sausis 29, 2008, 09:30

Atidaryti HijackThis ir pasirinkite Ar sistema nuskaito tik.

Vieta varnelė prie šių įrašų:

O2 - BHO: (no name) - (0D5227BF-0C5B-4EA8-833C-FE09F1496F39) - (no file)
O2 - BHO: (no name) - (549B5CA7-4A86-11D7-A4DF-000874180BB3) - (no file)
O2 - BHO: (no name) - (FDD3B846-8D59-4ffb-8758-209B6AD74ACC) - (no file)

Uždaryti visus išskyrus HijackThis ir spustelėkite Windows Fix patikrinta.

Išeitis HijackThis.

----------

Atsisiųsti DrWeb CureIt Ir išsaugokite jį savo kompiuteryje.

Skaitymo su DrWeb-CureIt taip:

Dukart spustelėkite DrWeb-cureit.exe tada Pradžia.
Express Scan kompiuterio pranešimas bus rodomas.
Po Pradėti Express Scan Now Spauskite Gerai pradėti.
- Tai trumpas, kad nuskaitymas bus nuskaityti failus metu veikia atmintis.
- Jei ir kai kas nors nustatyta, paspauskite Taip mygtuką, kai jis paklaus, ar norite, kad išgydyti ją.
Po trumpo skenavimas bus baigtas, spustelėkite Funkcijos> Keisti nustatymus
Pasirinkite Skaitymo skirtuką ir Nuimkite Euristinė analizė ir paspauskite Gerai
Grįžti į pagrindinį langą, pažymėkite Pilnas skenavimas mygtuką.
Tada spustelėkite Green Arrow Pradėti skenavimas mygtuką dešinėje ir nuskaitymo prasidės.
- Spauskite Taip, visus jei jis prašo, jei norite išgydyti / perkelti bet failas (-ai).
Kai nuskaitymas bus baigtas.
Be Dr.Web CureIt meniu viršuje kairėje, paspauskite Failas ir pasirinkite Prisiminti pranešimą sąrašą.
Prisiminti DrWeb.csv praneškite savo Desktop.
Išeitis Dr.Web CureIt.

Svarbu! Perkraukite kompiuterį, nes tai galėtų būti įmanoma, kad failai naudojami bus perkelti / pašalinti per naujo.

Po perkrovimo, Dešiniuoju pelės mygtuku spustelėkite Dr.Web prisijungti darbalaukyje ir pasirinkite Open With> Notepad
Nukopijuokite ir įklijuokite kad prisijungti Kitas atsakymas

----------

Sekantis
Dr Web Prisijungti

**guccijana** · #3 Sausis 29, 2008, 09:47

OKI jo skenavimo dabar - rasti virusas CFd.exe! Atrodo, kad jos ketina imtis, o?

aš ieškojau per forumą ir woooow yra tiek daug žmonių su virusais hehe

**evilfantasy** · #4 Sausis 29, 2008, 09:50

CFd.exe jei jos faktiškai nėra virusas, bet jis gali būti užsikrėtę viena ir bus padaryti jokios žalos, nes yra pašalinamas.

**guccijana** · #5 Sausis 29, 2008, 09:56

reikia pašalinti rankiniu būdu? ar?

**evilfantasy** · #6 Sausis 29, 2008, 10:00

Nr skaitytuvas pasirūpinti.

**guccijana** · #7 Sausis 29, 2008, 10:14

pažanga 27% skenerio rasti du failai, vienas "

-cfd.exe-(Adware) veiksmų skirtuką --- nesustabdomi trinti>> tai bus ištrinti?
-REG-ubp2b Tatjana b.reg (Trojan pagrindiniu)-action tab Išbraukta

**guccijana** · #8 Sausis 29, 2008, 10:17

Ką

Svarbu! Perkraukite kompiuterį, nes tai galėtų būti įmanoma, kad failai naudojami bus perkelti / pašalinti per naujo. reiškia?

Kaip man tai padaryti?

**evilfantasy** · #9 Sausis 29, 2008, 10:20

Tiesiog paleiskite kompiuterį iš naujo, jei dr Web nedaro tai už Jus.

Mes turite pamatyti žurnalas turi būti tikrai viskas dingo. Tai neturėtų užtrukti daug ilgiau dabar.

**guccijana** · #10 Sausis 29, 2008, 10:33

ohh okay, jos iki 70% beveik baigta

Panašios Temos
Siūlas	Thread Starter	Forumas	Atsakymai	Last Post
Smitfraud-C Jis nenori mirti!	PlatSpin	Virus, Spyware & Security	13	Rugpjūtis 19, 2008 10:24
Smitfraud virusas	PK28	Virus, Spyware & Security	12	5 vasaris 2008 16:17
Smitfraudfix.exe - Smitfraud-C.Toolbar888	Hybr! D	Virus, Spyware & Security	1	29 spalis 2007 11:02
Zlob, Smitfraud, iššokančių langų, raudonas ekrano pakeitimai	guccijana	Virus, Spyware & Security	20	30 rugsėjis 2007 20:26