[bobby] Log na prvojeru

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Nije meni trka,samo polako i prijatno

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Preuzmi The Avenger na Desktop.
Raspakuj arhivu u neki folder

Dvoklikom pokreni avenger.exe

Iskopiraj tekst koji se nalazi unutar Kod polja u (beli) prozor programa:

Files to delete:
C:\WINDOWS\system32\amvo0.dll


Obeleži kvadratiće ispred sledećih opcija:
Scan for rootkits
Automatically disable any rootkits found

Klikni Execute, a zatim Yes u sledeća dva prozora koji će se otvoriti

Kompjuter će se restartovati (u određenim slučajevima: dva puta) i započeti će proces čišćenja/skeniranja

Kada proces bude završen, logfile C:\avenger.txt će se otvoriti u Notepad-u
Iskopiraj sadržaj dobijenog loga u temu na forumu.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\amvo0.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Dobro.

Sada cemo probati da dezinfikujemo USB stickove.
Preuzmi program Flash_Disinfector.

program se pokreće dvoklikom na Flash_Disinfector.exe
kada se pojavi poruka sa obaveštenjem, potrebno je priključiti inficirane USB flash drive-ove (pri tome držati pritisnut taster Shift kako bi se izbegao autoplay)
kliknuti na OK i sačekati da se proces završi
kada se pojavi poruka Done !!, kliknuti na OK.


Nakon toga pusti ponovo Gmer da uradi onaj treci log:
Dupli klik na gmer.exe za početak: Izaberi Rootkit/Malware Tab na vrhu.
Desni klik na sred forme programa. Pojaviće se menij u kojem je potrebno otići na Options i tu štiklirati opciju Only non MS files
Klikni na Scan.
Kada je skeniranje završeno, klik na Copy dugme ispod - ovo će sačuvati rezultate skeniranja u Clipboard.
Iskoristi opciju Paste u Notepad-u da bi to prebacio u tekst. Snimi taj tekst iz Notepada kao fajl file3.txt

Iskoristi opciju Prikači fajl ispod polja za pisanje poruke na forumu, i prikači nam ovde fajl koji smo malopre snimili

Dopuna: 02 Jun 2008 15:54

Izvini, zaboravih nesto.
Daj mi i svez ComboFix log.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

stickovi ocisceni,gmer ga evo a combo stize za par min


https://www.mycity.rs/must-login.png

Dopuna: 02 Jun 2008 16:08

ComboFix 08-06-01.3 - erin 2008-06-02 16:02:50.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.80 [GMT 2:00]
Running from: C:\Documents and Settings\erin\Desktop\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.

2008-06-02 14:54 . 2008-06-02 16:00 250 --a------ C:\WINDOWS\gmer.ini
2008-06-01 22:34 . 2008-02-05 17:06 103,367 -r-hs---- C:\2ifetri.cmd
2008-05-30 06:55 . 2008-05-30 06:55 6,144 --ahs---- C:\WINDOWS\Thumbs.db
2008-05-25 22:44 . 2008-05-25 22:44 <DIR> d-------- C:\Documents and Settings\erin\Application Data\ABBYY
2008-05-25 22:43 . 2008-05-25 22:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ABBYY
2008-05-25 22:40 . 2008-05-25 22:46 <DIR> d-------- C:\Program Files\ABBYY FineReader 7.0 Professional Edition
2008-05-22 22:36 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2008-05-22 22:36 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2008-05-22 22:36 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2008-05-22 22:36 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2008-05-22 22:36 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2008-05-22 22:36 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2008-05-22 22:36 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2008-05-22 22:36 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2008-05-21 12:27 . 2008-05-21 12:27 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-05-21 12:27 . 2008-05-21 12:28 <DIR> d-------- C:\Documents and Settings\erin\Application Data\Skype
2008-05-21 12:27 . 2008-05-21 12:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2008-05-21 12:26 . 2008-05-21 12:27 <DIR> d-------- C:\Program Files\Skype
2008-05-20 14:09 . 2008-06-01 20:59 <DIR> d-------- C:\Program Files\Sony Ericsson
2008-05-20 13:55 . 2008-05-20 14:00 <DIR> d-------- C:\Program Files\Fma
2008-05-14 00:11 . 2004-08-04 00:56 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-13 10:57 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-05-13 10:57 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-05-13 10:57 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-05-12 16:08 . 2008-05-12 16:08 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-12 16:08 . 2008-05-25 12:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-12 16:03 . 2008-05-12 16:04 <DIR> d-------- C:\Program Files\Winamp
2008-05-05 19:38 . 2008-05-27 16:52 316 --a------ C:\WINDOWS\win.ini
2008-05-05 19:23 . 2006-10-18 23:47 8,231,936 --a------ C:\WINDOWS\system32\wmploc.backup
2008-05-05 19:23 . 2006-10-17 13:05 105,984 --a------ C:\WINDOWS\system32\url.backup
2008-05-05 19:21 . 2004-08-04 00:56 8,384,000 --a------ C:\WINDOWS\system32\shell32.backup
2008-05-05 19:20 . 2004-08-04 00:56 983,552 --a------ C:\WINDOWS\system32\setupapi.backup
2008-05-05 19:20 . 2004-08-04 00:56 657,920 --a------ C:\WINDOWS\system32\rasdlg.backup
2008-05-05 19:20 . 2004-08-04 00:56 343,040 --a------ C:\WINDOWS\system32\cmdial32.backup
2008-05-05 19:20 . 2004-08-04 00:56 298,496 --a------ C:\WINDOWS\system32\sysdm.backup
2008-05-05 19:20 . 2004-08-04 00:56 163,840 --a------ C:\WINDOWS\system32\credui.backup
2008-05-05 19:20 . 2004-08-04 00:56 10,752 --a------ C:\WINDOWS\hh.backup
2008-05-05 19:17 . 2008-05-10 18:11 <DIR> d-------- C:\WINDOWS\VIPv3

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 12:50 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-01 19:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\RFA_Backups
2008-06-01 12:43 --------- d-----w C:\Documents and Settings\erin\Application Data\LimeWire
2008-06-01 11:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-01 11:39 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2008-05-17 17:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-04-28 23:10 --------- d-----w C:\Program Files\Common Files\NSV
2008-04-28 18:36 --------- d-----w C:\Documents and Settings\erin\Application Data\ESET
2008-04-28 18:33 --------- d-----w C:\Program Files\ESET
2008-04-28 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-04-28 11:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-28 11:46 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-04-26 11:50 --------- d-----w C:\Program Files\Opera
2008-04-20 16:36 --------- d-----w C:\Documents and Settings\erin\Application Data\Teleca
2008-04-16 18:11 --------- d-----w C:\Program Files\Audacity 1.3 Beta
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
.

------- Sigcheck -------

2004-08-04 00:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
2004-08-04 00:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\dllcache\svchost.exe

2004-08-04 00:56 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 00:56 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll

2004-08-04 00:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\winlogon.exe
2004-08-04 00:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\dllcache\winlogon.exe

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys

2004-08-04 00:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\system32\services.exe
2004-08-04 00:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\system32\dllcache\services.exe

2004-08-04 00:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\system32\lsass.exe
2004-08-04 00:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\system32\dllcache\lsass.exe

2004-08-04 00:56 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\system32\ctfmon.exe
2004-08-04 00:56 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-06-01_21.55.41.28 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-01 19:49:34 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-02 13:46:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-02 12:54:31 884,736 ----a-w C:\WINDOWS\gmer.dll
+ 2008-04-17 19:13:02 811,008 ----a-w C:\WINDOWS\gmer.exe
+ 2008-06-02 12:54:31 85,969 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
+ 2008-06-02 13:47:14 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_27c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R3 SNPHV71;PC Camera (602a VGA);C:\WINDOWS\system32\DRIVERS\snphv71.sys [2002-11-08 18:24]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cecfcedf-c68c-11dc-97c8-f84ff3382347}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Autorun.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-02 16:05:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-02 16:07:31
ComboFix-quarantined-files.txt 2008-06-02 14:07:12
ComboFix2.txt 2008-06-01 19:56:10

Pre-Run: 16,249,528,320 bytes free
Post-Run: 16,239,013,888 bytes free

141 --- E O F --- 2008-06-01 11:45:49

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Obrisi opet C:\2ifetri.cmd.
Pogledaj, mozda ga ima i na ostalim particijama.

Restartuj komp, ubacuj stickove, pa opet restart, pa mi daj opet onaj treci GMER log, da vidim da li se vratio amvo ili ne.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

obrisem taj faj sa obije particije,restartujem komp,ubacim prvi stik( na stick je bio gore pomenuti fajl i autorun i ja obrish oboje) i amvo se vrati(druge stickove nisam ni pokusavao).

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Imas li neki Linux komp pri ruci?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

e to vec nemam

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Postoji li na USB sticku fajl Desktop.ini?
Ako postoji, otvori Notepadom i iskopiraj mi sadrzaj ovde.
Ako smo uspeli da blokiramo Autorun drzanjem Shifta, onda ostaje jedino desktop.ini kao moguci pokretac infekcije.

Dopuna: 02 Jun 2008 16:31

E, ajde mi posalji onaj C:\2ifetri.cmd kada se ponovo pojavi.
Uploaduj ga preko sledece forme:
http://www.mycity.rs/ambulanta-upload.php

Pusticu ga u sandboxu, da vidim sta to tacno kreira i odakle se startuje.