Зараза ли е PlatinumAdvertise?

defteros · Януари 30, 2010

Търсех, но така и не открих информация за това? Знае ли някой, какво е и как се маха? От форума попаднах само на една тема, която споменава, че е някакъв рууткит,а Гугъл не извежда никаква информация на български.

Появиха се следните проблеми:

1. Браузърът Молица Фаербох спря да работи

2. Някои програми направо отказват да работят или се зареждат със закъснение. Компютъра ми често зацепва и се налага да рестартирам и излизам.

3. При опит да обновя дефинициите на Аваст ми изписва -There is not enough space on the disk.

4. При сканиране единствено Spybot S&D открива гадината и уж ги "поправя", но при ново сканиране отново е налице.

Ето и лог:

-- Search result list ---

PlatinumAdvertiser: Отметка (Firefox: Guest (default)) (Отметка, nothing done)

Когато се опитам да ги отворя се появява прозорец на Spybot S&D чията единствена възможна опция е Deny, а тази гадина стои изписана отдолу!

Някакви идеи?

B-boy/StyLe/ · Януари 30, 2010

СТЪПКА 1

Изтегли GMER и го разархивирай на десктопа.

Преди да сканираш се увери, че всички останали работещи програми в момента са изключени и антивирусния софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвай компютъра си, докато трае сканирането.

Кликни два пъти пъти върху gmer.exe , за да стартираш програмата.

Тя ще направи начално сканиране за секунди. След като то приключи НЕ натискайте бутона Scan, а избери бутона Copy и постави съдържанието на лог файла в следващия си пост.

СТЪПКА 2

Изтегли DDS от тук.

Запази го на десктопа.

Изключи защитата в реално време на антивирусната си програма (ако е инсталирана такава).Накрая, стартирай инструмента.

Когато DDS приключи успешно анализа на системата ще отвори два лог файла.

DDS.txt
Attach.txt

Запази ги на десктопа и след това ги прикачи към следващия си пост.

defteros · Януари 30, 2010

Направих каквото ми казахте.Ето и логовете.

GMER

1. GMER 1.0.15.15281 - http://www.gmer.net

Rootkit quick scan 2010-01-30 20:51:56

Windows 5.1.2600 Service Pack 2

Running: gmer.exe; Driver: C:\DOCUME~1\User\LOCALS~1\Temp\pxtdipow.sys

---- System - GMER 1.0.15 ----

SSDT sptd.sys ZwEnumerateKey [0xF7357FB2]

SSDT sptd.sys ZwEnumerateValueKey [0xF7358340]

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 859651E8

DDS (Ver_09-12-01.01) - NTFSx86

Run by User at 21:48:56,84 on 30.01.2010 Ј.

Internet Explorer: 6.0.2900.2180

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.959.463 [GMT 2:00]

AV: avast! antivirus 4.8.1335 [VPS 100122-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

D:\Avast 8.0\aswUpdSv.exe

D:\Avast 8.0\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

D:\AVAST8~1.0\ashDisp.exe

C:\WINDOWS\FixCamera.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Messenger\msmsgs.exe

D:\Музика\Albumi\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Datecs\Flex2K.exe

C:\Program Files\Internet Explorer\iexplore.exe

D:\Музика\Albumi\2009г\Временни Интернет файлове\Временни Интернет файлове\Content.IE5\EI08A7S0\dds[1].scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.bg/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: DefaultSearchHook Class: {c94e154b-1459-4a47-966b-4b843befc7db} - c:\program files\asksearch\bin\DefaultSearch.dll

BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - d:\музика\albumi\spybot - search & destroy\SDHelper.dll

TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll

uRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [spybotSD TeaTimer] d:\музика\albumi\spybot - search & destroy\TeaTimer.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [avast!] d:\avast8~1.0\ashDisp.exe

mRun: [FixCamera] c:\windows\FixCamera.exe

mRun: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\windows\datecs\Flex2K.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - d:\му·ёє°\albumi\spybot - search & destroy\SDHelper.dll

DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: {EB86C5AF-AF2D-47FE-BC09-989271DEF20E} = 212.39.90.42,212.39.90.43

SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-4-27 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-4-27 20560]

R2 avast! Antivirus;avast! Antivirus;d:\avast 8.0\ashServ.exe [2008-4-27 138680]

S3 avast! Mail Scanner;avast! Mail Scanner;d:\avast 8.0\ashMaiSv.exe [2008-4-27 254040]

S3 avast! Web Scanner;avast! Web Scanner;d:\avast 8.0\ashWebSv.exe [2008-4-27 352920]

S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [2010-1-11 89256]

S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [2010-1-11 15016]

S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [2010-1-11 120744]

S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [2010-1-11 114216]

S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [2010-1-11 110632]

S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [2010-1-11 115752]

=============== Created Last 30 ================

2010-01-11 08:54:56 115752 ----a-r- c:\windows\system32\drivers\s0016unic.sys

2010-01-11 08:54:56 10792 ----a-r- c:\windows\system32\drivers\s0016cr.sys

2010-01-11 08:53:55 114216 ----a-r- c:\windows\system32\drivers\s0016mgmt.sys

2010-01-11 08:53:27 110632 ----a-r- c:\windows\system32\drivers\s0016obex.sys

2010-01-11 08:52:57 15016 ----a-r- c:\windows\system32\drivers\s0016mdfl.sys

2010-01-11 08:52:57 12200 ----a-r- c:\windows\system32\drivers\s0016cmnt.sys

2010-01-11 08:52:57 12200 ----a-r- c:\windows\system32\drivers\s0016cm.sys

2010-01-11 08:52:57 120744 ----a-r- c:\windows\system32\drivers\s0016mdm.sys

2010-01-11 08:42:05 12200 ----a-r- c:\windows\system32\drivers\s0016whnt.sys

2010-01-11 08:42:05 12200 ----a-r- c:\windows\system32\drivers\s0016wh.sys

2010-01-11 08:42:04 89256 ----a-r- c:\windows\system32\drivers\s0016bus.sys

==================== Find3M ====================

2010-01-07 14:07:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-07 14:07:04 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys

============= FINISH: 21:49:16,65 ===============

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

Още един лог от GMER:GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-01-30 21:45:11

Windows 5.1.2600 Service Pack 2

Running: gmer.exe; Driver: C:\DOCUME~1\User\LOCALS~1\Temp\pxtdipow.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xF3CC56B8]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xF3CC5574]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xF3CC5A52]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xF3CC514C]

SSDT sptd.sys ZwEnumerateKey [0xF7357FB2]

SSDT sptd.sys ZwEnumerateValueKey [0xF7358340]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xF3CC564E]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xF3CC508C]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xF3CC50F0]

SSDT sptd.sys ZwQueryKey [0xF7358418]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xF3CC576E]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xF3CC572E]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xF3CC58AE]

---- Kernel code sections - GMER 1.0.15 ----

? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6DC4360, 0x20469D, 0xE8000020]

.text USBPORT.SYS!DllUnload F6D9162C 5 Bytes JMP 8567F1C8

? System32\Drivers\a4vk55e7.SYS The system cannot find the path specified. !

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F7352AD4] sptd.sys

IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F7352C1A] sptd.sys

IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F7352B9C] sptd.sys

IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F7353748] sptd.sys

IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F735361E] sptd.sys

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F736829A] sptd.sys

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[796] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00380002

IAT C:\WINDOWS\system32\services.exe[796] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00380000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 859651E8

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\PCI_NTPNP6246 \Device\00000040 sptd.sys

Device \Driver\usbohci \Device\USBPDO-0 8579E1E8

Device \Driver\dmio \Device\DmControl\DmIoDaemon 859D31E8

Device \Driver\dmio \Device\DmControl\DmConfig 859D31E8

Device \Driver\dmio \Device\DmControl\DmPnP 859D31E8

Device \Driver\dmio \Device\DmControl\DmInfo 859D31E8

Device \Driver\usbehci \Device\USBPDO-1 8579A1E8

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Ftdisk \Device\HarddiskVolume1 859671E8

Device \Driver\Ftdisk \Device\HarddiskVolume2 859671E8

Device \Driver\Cdrom \Device\CdRom0 856731E8

Device \Driver\Cdrom \Device\CdRom1 856731E8

Device \Driver\atapi \Device\Ide\IdePort0 859661E8

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 859661E8

Device \Driver\atapi \Device\Ide\IdePort1 859661E8

Device \Driver\atapi \Device\Ide\IdePort2 859661E8

Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c 859661E8

Device \Driver\atapi \Device\Ide\IdePort3 859661E8

Device \Driver\NetBT \Device\NetBt_Wins_Export 850181E8

Device \Driver\NetBT \Device\NetbiosSmb 850181E8

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbohci \Device\USBFDO-0 8579E1E8

Device \Driver\usbehci \Device\USBFDO-1 8579A1E8

Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 84BBE1E8

Device \FileSystem\MRxSmb \Device\LanmanRedirector 84BBE1E8

Device \Driver\NetBT \Device\NetBT_Tcpip_{EB86C5AF-AF2D-47FE-BC09-989271DEF20E} 850181E8

Device \Driver\Ftdisk \Device\FtControl 859671E8

Device \Driver\a4vk55e7 \Device\Scsi\a4vk55e71Port4Path0Target0Lun0 85669440

Device \Driver\a4vk55e7 \Device\Scsi\a4vk55e71 85669440

Device \FileSystem\Cdfs \Cdfs 859256F0

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001167000000

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0018e40a49d1

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x63 0x2A 0x42 0x40 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xC5 0x27 0xBA 0xEA ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x68 0xA6 0x2B 0x80 ...

Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001167000000 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0018e40a49d1 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x63 0x2A 0x42 0x40 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xC5 0x27 0xBA 0xEA ...

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x68 0xA6 0x2B 0x80 ...

---- EOF - GMER 1.0.15 ----

Този на DDS