Trojan zero access

[majkelqwe]

Witam,

 

To usunalem sam:

 

Usuniete z WIN_INSTALLER

80000000@

00000001@

 

Zalaczam loga FSS ze wzgledu na brak usług.

 

Dziekuje za poswiecony czas.

 

Pozdrowienia

Extras.Txt

FSS.txt

OTL.Txt

Gmer.txt

[Landuss]

Potrzebny będzie log dodatkowy pod kątem ZeroAccess. Uruchom SystemLook, w oknie wklej:

 

:reg
HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
 
:filefind
services.exe

 

Klik w Look. Przedstaw wynikowy raport.

[majkelqwe]

zalaczam plik

 

SystemLook 30.07.11 by jpshortstuff

Log created at 19:42 on 14/08/2012 by ABC

Administrator - Elevation successful

 

========== reg ==========

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

(No values found)

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32]

"ThreadingModel"="Both"

@="C:\Documents and Settings\ABC\Ustawienia lokalne\Dane aplikacji\{47a2a3b4-f83b-e88d-61e6-c09642e670c3}\n."

 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}]

@="Microsoft WBEM New Event Subsystem"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]

@="wbemess.dll"

"ThreadingModel"="Both"

 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

@="MruPidlList"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

@="%SystemRoot%\system32\shdocvw.dll"

"ThreadingModel"="Apartment"

 

 

========== filefind ==========

 

Searching for "services.exe"

C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe --a---- 111104 bytes [10:46 21/08/2010] [09:55 09/02/2009] 245A46964D7F534E1D20563ACF215E80

C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe --a---- 111104 bytes [10:46 21/08/2010] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F

C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe --a---- 111104 bytes [09:20 15/04/2009] [11:19 09/02/2009] 8816E60BF654353E8E0D35ED98875445

C:\WINDOWS\$NtServicePackUninstall$\services.exe -----c- 111104 bytes [11:38 21/08/2010] [10:10 09/02/2009] ED4E5391100287B9EABF8F2CF4B42235

C:\WINDOWS\$NtUninstallKB956572$\services.exe -----c- 109056 bytes [11:47 21/08/2010] [17:21 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA

C:\WINDOWS\$NtUninstallKB956572_0$\services.exe -----c- 108544 bytes [11:19 21/08/2010] [12:00 02/08/2007] 3DA8D964D2CC12EF8E8C342471A37917

C:\WINDOWS\ServicePackFiles\i386\services.exe ------- 109056 bytes [17:21 14/04/2008] [17:21 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA

C:\WINDOWS\system32\services.exe --a---- 111104 bytes [12:00 02/08/2007] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F

C:\WINDOWS\system32\dllcache\services.exe -----c- 111104 bytes [10:46 21/08/2010] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F

 

-= EOF =-

[Landuss]

1. Start > uruchom > cmd i wklep:

 

reg delete HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /f

 

2. Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej następujący tekst:

 

:Files
C:\WINDOWS\Installer\{47a2a3b4-f83b-e88d-61e6-c09642e670c3}
C:\Documents and Settings\All Users\Dane aplikacji\19AA37440000D0566BEACF0881CB3EF3
 
:Commands
[emptytemp]

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Kliknij w Wykonaj skrypt. Zatwierdź restart komputera.

 

3. Pobierz na dysk tego fixa i zaimportuj uruchamiając go: KLIK. Po tej czynności zrestartuj system.

 

4. Wklejasz nowy log z OTL ze skanowania, nowy z SystemLook i z FSS.

[majkelqwe]

ok

 

SystemLook 30.07.11 by jpshortstuff

Log created at 12:09 on 15/08/2012 by ABC

Administrator - Elevation successful

 

========== reg ==========

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

(Unable to open key - key not found)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}]

@="Microsoft WBEM New Event Subsystem"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]

@="wbemess.dll"

"ThreadingModel"="Both"

 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

@="MruPidlList"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

@="%SystemRoot%\system32\shdocvw.dll"

"ThreadingModel"="Apartment"

 

 

========== filefind ==========

 

Searching for "services.exe"

C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe --a---- 111104 bytes [10:46 21/08/2010] [09:55 09/02/2009] 245A46964D7F534E1D20563ACF215E80

C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe --a---- 111104 bytes [10:46 21/08/2010] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F

C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe --a---- 111104 bytes [09:20 15/04/2009] [11:19 09/02/2009] 8816E60BF654353E8E0D35ED98875445

C:\WINDOWS\$NtServicePackUninstall$\services.exe -----c- 111104 bytes [11:38 21/08/2010] [10:10 09/02/2009] ED4E5391100287B9EABF8F2CF4B42235

C:\WINDOWS\$NtUninstallKB956572$\services.exe -----c- 109056 bytes [11:47 21/08/2010] [17:21 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA

C:\WINDOWS\$NtUninstallKB956572_0$\services.exe -----c- 108544 bytes [11:19 21/08/2010] [12:00 02/08/2007] 3DA8D964D2CC12EF8E8C342471A37917

C:\WINDOWS\ServicePackFiles\i386\services.exe ------- 109056 bytes [17:21 14/04/2008] [17:21 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA

C:\WINDOWS\system32\services.exe --a---- 111104 bytes [12:00 02/08/2007] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F

C:\WINDOWS\system32\dllcache\services.exe -----c- 111104 bytes [10:46 21/08/2010] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F

 

-= EOF =-

Usuw.txt

FSS.txt

OTL.Txt

[Landuss]

ZeroAccess to już historia, powinno być po problemie.

 

1. Użyj opcji Sprzątanie z OTL.

 

2. Opróżnij przywracanie systemu: KLIK

 

3. Zaktualizuj Jave do wersji najnowszej 7 Update 5: KLIK

 

4. Dla bezpieczeństwa zmień hasła logowania do serwisów w sieci.