Task Manager, Start i Run komande

Uradio ono sta je magna rekao evo rezultate :

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\winxp.exe" deleted successfully.
File "C:\WINDOWS\system32\wscript.exe" deleted successfully.
File "C:\WINDOWS\system32\winjpg.jpg" deleted successfully.
Registry value "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run|regdiit" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:50:58, on 09.03.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\DynDNS Updater\DynDNS.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Kolev Gjoke\My Documents\MY_DOWNLOADS\BlaBlaTrojann.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTFMON] C:\WINDOWS\system32\wscript.exe /E:vbs C:\WINDOWS\system32\winjpg.jpg
O4 - HKCU\..\Run: [DynDNS Updater] "C:\Program Files\DynDNS Updater\DynDNS.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Windows Live Family Safety (fsssvc) - Unknown owner - C:\Program Files\Windows Live\Family Safety\fsssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

--
End of file - 3225 bytes



za neko vreme pokusacu opet na ovo od @nebojse


Sad prilikom pisanja komande u RUN-u kaze da ne moze da nadje to sto pokusavam .dll...

A od Task Manager-a jos uvek ni traga ni glasa :)

Ok. Posto je Avenger obrisao one fajlove FIX-uj sa HijackThis-om sledeci red:

O4 - HKLM\..\Run: [CTFMON] C:\WINDOWS\system32\wscript.exe /E:vbs C:\WINDOWS\system32\winjpg.jpg

Posle toga preuzmi ovu alatku:

http://www.symantec.com/conten...l/threat_writeups/FxBeagle.exe

1. Snimi program na Desktop
2. Zatvori sve tekuce programe
3. Diskonektuj se sa interneta
4. Ugasi System Restore ako je upaljen
5. Pokreni program FxBeagle.exe i pritisni Start.
6. Ako dobijas neke greske ili program ne moze da izvrsi skeniranje restartuj racunar u Safe mode, pa probaj iz njega.

Kada program zavrsi sa skeniranjem dobices neke rezultate. Molim te postavi ih ovde (mozes i kao sliku).

Posle toga idi u Run (Start > Run, ako ne radi Run udji u Command Prompt*) i kucaj gpedit.msc Otvara ti se prozor za editovanje Group Policy-a. Sa leve strane klikni na User configuration pa na Administrative Templates pa na System pa na CTRL+ALT+DEL Options. Kada to poslednje selektujes sa desne strane imas stavku Remove Task Manager. Klikni dva puta na njega (otvara se novi prozor) i oznaci Disabled i potvrdi sa Apply i OK i izadji iz ovog prozora. To bo trebalo da bude to.

Tek kad sve ovo zavrsis restartuj racunar, nemoj nikako pre ili izmedju ovih procesa!

Javi ako je negde zapelo i gde tacno...

*U Command Prompt se ulazi na sledeci nacin: Start -> All programs -> Accessories -> Command Prompt

Sve od gore napisano sam probao, isto, nema nista, sve je isto :(

Sad nema one linije, ali se ne pokrece nista preko RUN, nema ni TM-a...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:06:04, on 09.03.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\DynDNS Updater\DynDNS.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\Kolev Gjoke\My Documents\MY_DOWNLOADS\BlaBlaTrojann.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [DynDNS Updater] "C:\Program Files\DynDNS Updater\DynDNS.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Windows Live Family Safety (fsssvc) - Unknown owner - C:\Program Files\Windows Live\Family Safety\fsssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

--
End of file - 3213 bytes

Ajde probaj opet ovo, posto sada nema one linije u HijackThis-u:

Skines ovaj program: http://www.dougknox.com/xp/utils/xp_secconsole.zip Kad ga preuzmes otpakuj ga i pokreni xp_secconsole.exe. Kad ga pokrenes sa leve strane odaberi Start Menu and Taskbar pa sa desne stikliraj Remove Run i pritisni Apply. Sada restartuj racunar. Posle restarta ponovo pokreni ovaj program idi pod istu stavku pa bi trebalo da je ostalo stiklirano Remove Run. Ako jeste deselektuj ga pritisni Apply i opet restartuj racunar. Ovo bi trebalo da resi problem.

Imao sam takvu situaciju na nekoliko racunara u firmi, kombinacija koja je meni pomogla je ComboFix + MBAM + Spybot Search & Destroy + HiJackThis + Sysinternals-ovi Process Explorer i AutoRuns, uz rucno brisanje ili menjanje odredjenih kljuceva u registryju, kao i rucno gasenje nekih servisa. Naravno, na kraju sledi detaljan scan nekim AV programom. Cest je problem da malware promeni prava pristupa na fajlovima (najcesce na cmd.exe postave samo "everyone" i njemu zabrane svaki pristup) i registry kljucevima, i onda su ovi alati nemocni dok im rucno "ne otkljucas" pristup tim fajlovima i registry kljucevima (uglavnom moras da preuzmes vlasnistvo nad tim fajlom, ako ne znas kako se to radi javi pa da ti posaljem uputstvo).

Takodje se malware cesto maskira kao sistemski servis, ali ja jos nijednom nisam naisao na tako maskirani malware koji nije imao bar neku slovnu ili gramaticku gresku u opisu servisa pa ih veoma lako otkrijem, pa ako bas dobro znas engleski, procesljaj spisak pokrenutih servisa (probaj da li funkcionise desni klik na My Computer > Manage > Services and Applications > Services, pa sortiraj po statusu) i disable-uj i zaustavi sve one koji imaju na bilo koji nacin deformisan opis ("hijeroglifi" umesto teksta, skracen tekst - vidljivo je da nedostaje jedan deo, pogresno ispisane reci - npr. netwark umesto network, itd.).

Koliko vidim iz tvojih izvestaja, tebi je jos uvek stalno aktivan

C:\Documents and Settings\Kolev Gjoke\My Documents\MY_DOWNLOADS\BlaBlaTrojann.exe

Posto ne mozes da pokrenes Task Manager, probaj sa Sysinternalsovim ProcesExplorerom http://live.sysinternals.com/procexp.exe pa nadji na spisku & ubi doticnog trojanca (desni klik i Kill), i onda pokusaj sa onim izmenama u HJT-u koje su ti predlagali. Proveri i ostale procese, pa ako ti neki deluje sumnjivo klikni desnim na njega i odaberi "Search Online" opciju - ako neki od linkova kaze da postoji mogucnost da se radi o virusu, slobodno i njega kill-uj.

Jos ako uspes da pokrenes AutoRuns sa http://live.sysinternals.com/autoruns.exe (mada i on cesto bude blokiran) idi odmah na "Image Hijacks" jezicak i obrisi sve osim "Your Image File Name Here without a path Symbolic Debugger for Windows 2000 Microsoft Corporation c:\windows\system32\ntsd.exe", a onda mozes da bacis pogled i na Services jezicak pa pogledaj vidis li nesto sumnjivo (svi koji imaju cudan description, nemaju publishera ili je neobicno ime, path im je neki podfolder ispod c:\windows\system32\ i sl. pa probaj da ga disableujes tako sto odstikliras kucicu na pocetku reda.

Nece nikako, najbolje format i cao :), worm je : VBS/AutoRun.BX.worm

Hvala svima na pomocu.

Ako vec znas da se radi o VBS/AutoRun.BX.worm, sta te sprecava da mu rucno uklonis njegove fajlove? Imas detaljan opis na

http://vil.nai.com/vil/content/v_144151.htm

pa samo odradis kontra proces i obrises najpre registry kljuceve koje on dodaje, a zatim i fajlove koje je kreirao. Ako ti treba pomoc, javi...

@valjan ajd da probam jos sa tebe :), ovaj link nosi me da download-ujem McAfee ?
Ako ne, daj reci kako si mislio rucno da uklonim registre ?

Pogledaj da li imas neke od sledecih fajlova na racunaru:

c:\WINDOWS\system32\amvo.exe
c:\WINDOWS\system32\amvo0.dll
c:\xn1i9x.com
c:\2ifetri.cmd
c:\x.com
c:\3wcxx91.cmd
c:\awda2.exe

Ako nemas uzmi ovaj program (http://www.hotlinkfiles.com/files/2368685_wrlsp/ScanTool.rar), pokreni ga, pritisni Scan i postavi rezultate ovde.

Evo sta kaze na onom linku:



E sad, bilo bi pozeljno da probas da pokrenes http://live.sysinternals.com/procexp.exe i ako uspes da ga otvoris idi na View > Select Columns pa stikliraj Image Path.

Onda u koloni Image Path probaj da pronadjes c:\WINDOWS\system32\amvo.exe i/ili c:\WINDOWS\system32\amvo0.dll, pa klikni desnim dugmetom na te stavke i odaberi Kill Process. Takodje, ako negde u toj koloni vidis smss.exe a da nije u c:\windows\system32 folderu, likvidiraj ga odmah, a isto vazi i za fajlove pobrojane pri kraju citata.

Ako ne uspes da pokrenes ProcessExplorer, pokusaj fizicki da obrises te fajlove (ako su zakljucani, imaju i MBAM i HiJackThis alate za brisanje takvih fajlova), ali to najverovatnije nece proci bez restarta, tako da ti jos preostaje da pokrenes regedit (C:\Windows\regedit.exe - probaj da ga preimenujes ako nece, ili skini besplatni RegAlyzer koji su razvili autori Spybota sa http://www.spybot-updates.biz/files/regalyz.exe) pa lociraj HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run i iz njega obrisi vrednost amva (koja ukazuje do C:\WINDOWS\System32\amvo.exe), i sve ostale gorepomenute fajlove. Ne bi bilo lose da odradis search u registry-ju na sve .com, .dll i .exe fajlove koji se spominju u gornjem citatu, pa da ih pobrises. Ako neka stavka ne dozvoljava brisanje, onda klikni desnim dugmetom na ime kljuca (otvorena zuta "fascikla" u levom prozoru), odaberi Permissions, klikni na Advanced dugme, pa na jezicak Owner, selektuj Administrators i stikliraj dole kucicu "Replace owner on Subcontainer and objects", klikni na OK, pa kad se zatvori taj prozor klikni na dugme Add i dodaj svoj nalog na spisak i daj mu Full Control prava, klikni na OK i onda pokusaj brisanje one "neposlusne stavke".

Ako uspes da pokrenes i http://live.sysinternals.com/autoruns.exe verovatno ces sve stavke iz citata pronaci i tamo, pa ih obrisi, i kao sto rekoh obavezno poseti jezicak Image Hijacks i obrisi sve osim one jedne stavke sto sam spomenuo u ranijim postovima.

Ako ne uspes da pokrenes bilo sta od pobrojanog, javi se pa da krenemo detaljnije korak po korak.

Evo rezultate za @nemanja, kasnije cu da probam ono od @valjan :


================= Boot.ini =================
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
================= Process =================
[4] system
[1184] c:\windows\system32\smss.exe
[1312] c:\windows\system32\csrss.exe
[1336] c:\windows\system32\winlogon.exe
[1380] c:\windows\system32\services.exe
[1392] c:\windows\system32\lsass.exe
[1564] c:\windows\system32\svchost.exe
[1660] c:\windows\system32\svchost.exe
[236] c:\windows\system32\svchost.exe
[276] c:\windows\system32\svchost.exe
[376] c:\windows\system32\svchost.exe
[1064] c:\windows\explorer.exe
[1200] c:\windows\system32\spoolsv.exe
[1272] c:\program files\eset\eset smart security\egui.exe
[1824] c:\program files\dyndns updater\dyndns.exe
[1840] c:\windows\system32\ctfmon.exe
[328] c:\program files\bonjour\mdnsresponder.exe
[584] c:\program files\eset\eset smart security\ekrn.exe
[852] c:\program files\java\jre6\bin\jqs.exe
[832] c:\windows\system32\nvsvc32.exe
[616] c:\program files\alcohol soft\alcohol 120\starwind\starwindserviceae.exe
[932] c:\windows\system32\alg.exe
[3188] c:\program files\skype\phone\skype.exe
[3200] c:\program files\mozilla firefox\firefox.exe
[3632] c:\documents and settings\kolev gjoke\my documents\amsnportable\app\amsn\bin\wish.exe
[2804] c:\documents and settings\kolev gjoke\desktop\scantool.exe
================= Hidden =================
[4] <--- HIDDEN
================= %PATH% =================
C:\WINDOWS\system32
C:\WINDOWS
C:\WINDOWS\system32\wbem
C:\Program Files\QuickTime\QTSystem
C:\Program Files\Common Files\Adobe\AGL
================= Explorer - File =================
C:\WINDOWS\explorer.exe
================= Explorer - Registry=================
DefaultDomainName=KOLEV-BB31A84F7
DefaultUserName=Kolev Gjoke
LegalNoticeCaption=
LegalNoticeText=
PowerdownAfterShutdown=0
ReportBootOk=1
Shell=Explorer.exe
ShutdownWithoutLogon=0
System=
Userinit=C:\WINDOWS\system32\userinit.exe,
VmApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
allocatecdroms=0
allocatedasd=0
allocatefloppies=0
cachedlogonscount=10
scremoveoption=0
UIHost=LogonUI.EXE
Background=0 0 0
DebugServerCommand=no
WinStationsDisabled=0
AltDefaultUserName=Kolev Gjoke
AltDefaultDomainName=KOLEV-BB31A84F7