Prosze o pomoc!

[Gość: Marek]

Po kazdorazowym polaczeniu z netem "nod32" wywala mi komunikat:
"Win32/TrojanDownloader.Qoologic.I trojan".

Do przeskanowania komputera uzylam juz Ad-Aware, Trend-Micro, Nod-32, Mks-
vir, SpyBot, XoftSpy, ale to nic nie pomoglo.

Tak wyglada log z HijackThis 1.99.1
=================
Logfile of HijackThis v1.99.1
Scan saved at 22:03:57, on 19/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMPAQ\EASYAC~1\BTTNSERV.EXE
C:\PROGRA~1\COMPAQ\EASYAC~1\EAUSBKBD.EXE
C:\Documents and Settings\default\My Documents\hijackthis1.99.1\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
desktop.presario.net/scripts/redirectors/presario/deskredir.dll?c=3c00&s=consumer&LC=1009
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
desktop.presario.net/scripts/redirectors/presario/deskredir.dll?c=3c00&s=consumer&LC=1009
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
search.presario.net/scripts/redirectors/presario/srchredir.dll?c=3c00&s=searchbar&LC=1009
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
search.presario.net/scripts/redirectors/presario/srchredir.dll?c=3c00&s=searchbar&LC=1009
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft
Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button
Support\cpqeadm.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money
Express.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PopUpStopperProfessional] C:\PROGRA~1\PANICW~1\SURECL~1
\PopUpStopperProfessional.exe
O8 - Extra context menu item: E&xport to Microsoft Office Excel -
res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avlinksearch&c=3c00&LC=1009 (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-
11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avlinksearch&c=3c00&LC=1009 (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avhostsearch&c=3c00&LC=1009 (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-
11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avhostsearch&c=3c00&LC=1009 (file missing)
O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=altavista&c=3c00&LC=1009 (file missing)
O9 - Extra 'Tools' menuitem: AV Live - {06FE5D04-8F11-11d2-804F-
00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=altavista&c=3c00&LC=1009 (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avbabelfish&c=3c00&LC=1009 (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-
00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avbabelfish&c=3c00&LC=1009 (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wmv: C:\Program
Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -
static.windupdates.com/cab/DownloadAccess/ie/bridge-c18.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112566446889
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7F7E093-1E30-403E-AC04-
E32C26C7DBC3}: NameServer = ***.***.***.***
O23 - Service: hpdj - HP - C:\DOCUME~1\default\LOCALS~1\Temp\hpdj.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program
Files\Eset\nod32krn.exe
O23 - Service: PCTEL Speaker P

[Gość: Kolobos]

Odinstaluj: Media Access

Uzyj:
cwshredder.net/bin/CWShredder.exe

Zaznacz w hijackthis te wpisy:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
desktop.presario.net/scripts/redirectors/presario/deskredir.dll?
c=3c00&s=consumer&LC=1009
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
desktop.presario.net/scripts/redirectors/presario/deskredir.dll?
c=3c00&s=consumer&LC=1009
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
search.presario.net/scripts/redirectors/presario/srchredir.dll?
c=3c00&s=searchbar&LC=1009
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
search.presario.net/scripts/redirectors/presario/srchredir.dll?
c=3c00&s=searchbar&LC=1009
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
C:\WINDOWS\SYSTEM\blank.htm
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avlinksearch&c=3c00&LC=1009 (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-
11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avlinksearch&c=3c00&LC=1009 (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avhostsearch&c=3c00&LC=1009 (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-
11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avhostsearch&c=3c00&LC=1009 (file missing)
O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=altavista&c=3c00&LC=1009 (file missing)
O9 - Extra 'Tools' menuitem: AV Live - {06FE5D04-8F11-11d2-804F-
00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=altavista&c=3c00&LC=1009 (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avbabelfish&c=3c00&LC=1009 (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-
00105A133818} -
search.presario.net/scripts/redirectors/presario/srchredir.dll?
s=avbabelfish&c=3c00&LC=1009 (file missing)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -
static.windupdates.com/cab/DownloadAccess/ie/bridge-c18.cab

Kto wpisal gwiazdki zamiast adresu dns'a? ;-)
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7F7E093-1E30-403E-AC04-
E32C26C7DBC3}: NameServer = ***.***.***.***

O23 - Service: hpdj - HP - C:\DOCUME~1\default\LOCALS~1\Temp\hpdj.exe

I Fix Checked, nastepnie reset i wklej nowy log.


Gdzie nod znajduje tego trojana?

[Gość: Marek]

"Gdzie nod znajduje tego trojana?"

1.W pierwszej kolejnosci wyswietla mi sie okno noda z wpisem:
u.urllogic.com/content/download/i 282.exe
I pisze, ze IMON nie moze tego wyczyscic.

2.Nastepnie wpada kolejne okno z wpisem:
C:\Documents and Settings\default\Local Settings\Temporary Internet Files
-robie delitte

3.W kolejnym oknie otrzymuje :
C:\DOCUME~1\default\LOCALS~1\Temp\tp7543.exe
-rowniez delitte

Skanowalem komputer rowniez TrojanRemouver-em i nic nie pomoglo (nic nie
znalazl).
Nie wiem.....moze trzeba go wywalic i zainstalowac jeszcze raz???


Jezeli chodzi o HijacThis to log wyglada teraz tak:

Logfile of HijackThis v1.99.1
Scan saved at 05:16:58, on 20/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMPAQ\EASYAC~1\BTTNSERV.EXE
C:\PROGRA~1\COMPAQ\EASYAC~1\EAUSBKBD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\default\My Documents\hijackthis1.99.1\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft
Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button
Support\cpqeadm.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money
Express.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PopUpStopperProfessional] C:\PROGRA~1\PANICW~1\SURECL~1
\PopUpStopperProfessional.exe
O8 - Extra context menu item: E&xport to Microsoft Office Excel -
res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wmv: C:\Program
Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112566446889
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7F7E093-1E30-403E-AC04-E32C26C7DBC3}:
NameServer = ***.***.***.***
(NIE WIEM DLACZEGO WPIS "017" MAM PONOWNIE PRZECIEZ GO ZAZNACZYLEM W
HIJACTHIS)!!!

O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program
Files\Eset\nod32krn.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32
\pctspk.exe

A tak na marginesie mowiac to bardzo serdecznie dziekuje "Kolobos" za pomoc :)

[Gość: Kolobos]

Usun wszystko z:
dysk:\Documents and Settings\twojanazwauzytkownika\Ustawienia lokalne\Temp
tak samo z:
IE->Narzedzia->Opcje Internetowe->Usun Pliki...

I nie wchodz juz na rozne dziwne strony, bo Ci sie caly czas cos bedzie sciagac
do temp'a.

O17 zostaw w spokoju to nie jest "zly" wpis ale tam powinien byc adres servera
dns,a nie gwiazdki ;-)

Zainstaluj sobie:
www.safer-networking.org/pl/mirrors/index.html <- SpyBot S&D
www.javacoolsoftware.com/spywareblaster.html <- SpywareBlaster
W obu wlacz ochrone przegladarki.