PCTuning fórum

zdravim opet me dostihl skolni vir (ctfmon.exe) je to mrcha ktera znepristupni disky atd musi se otevirat pres funkci otevrit a je to otravny vim ze je s atributem skryty ale nevim jak ho mam najit vyhledavac ve win ho nenajde... avast ho najde ale ve slozce ktera neexistuje pokusi se ho smazat ale nikdy ho nesmaze


tady je jeste log.

Logfile of HijackThis v1.99.1
Scan saved at 13:33:28, on 5.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Razer Pro Solutions\ProClick v1.6\razerhid.exe
C:\Program Files\RivaTuner v2.06\RivaTuner.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\Program Files\Razer Pro Solutions\ProClick v1.6\razertra.exe
C:\Program Files\Razer Pro Solutions\ProClick v1.6\razerofa.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\kulik\Plocha\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://dt-updates.com/activate?query=ax ... Y8hU3GA%3d
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [razer] "C:\Program Files\Razer Pro Solutions\ProClick v1.6\razerhid.exe"
O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.06\RivaTuner.exe" /T
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.06\RivaTuner.exe" /S
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Pokud je ctfmon.exe v system32, tak je vše v pořádku, je to důležitý systémový proces a z tohoto umístění jen rozhodně nedoporučuju mazat.

V logu nic špatnýho není. Chybí ovšem firewall, ten ve Windows nestačí.

Zkus teda CF:

Stáhněte a uložte na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

spusťte aplikaci pod účtem s administrátorským oprávněním - následuje licenční ujednání, stiskněte klávesu 1 pro pokračování - začne se testovat (celá akce trvá cca. 5-10 minut, někdy i trochu déle) - během skenu se nepokoušejte spouštět žádne jiné aplikace a neklikejte do okna ComboFixu - po dokončení se automaticky otevře okno poznámkového bloku s textem (pokud se tak nestane, log je v C:\ComboFix.txt), který sem pomocí známých klávesových zkratek Ctrl + A (označení celého textu) -> Ctrl + C (uložení do jakési schránky) -> Ctrl + V (vložení textu) zkopírujte - a počkejte na další postup

diky za pomoc uz sem ten smejd samzal bylo to trochu slozity ale nejak nahodne se mi to povedlo jinak diky za pomoc jen jakej firewall byste doporucili aby byl jednoduchej na obsluhu a aby nedal paseku s hrama po LAN a netu? proste musi bejt co nejvic userfree a freeware

No být tebou tak bych ten log z ComboFixu se dal, protože toho worma co jsi tam měl tak se šíří po výměnných médií.

ComboFix 08-01-04.1 - kulik 2008-01-06 16:03:45.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1430 [GMT 1:00]
Running from: D:\DownloadS\FireFoX\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\system32\rlvknlg.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-06 to 2008-01-06 )))))))))))))))))))))))))))))))
.

2008-01-06 16:03 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-06 13:53 . 2008-01-06 13:53 <DIR> d-------- C:\WINDOWS\LastGood
2008-01-06 13:53 . 2008-01-06 13:57 <DIR> d-------- C:\Program Files\OneStepSearch
2008-01-06 13:53 . 2007-07-13 21:33 266,240 --a------ C:\WINDOWS\system32\rkupginstaller.exe
2008-01-05 19:30 . 2008-01-05 19:30 <DIR> d--h----- C:\WINDOWS\PIF
2008-01-05 13:31 . 2008-01-05 13:31 <DIR> d-------- C:\Documents and Settings\kulik\Data aplikací\Locktime
2008-01-05 13:31 . 2008-01-05 13:31 <DIR> d-------- C:\Documents and Settings\kulik\Data aplikací\Locktime
2008-01-05 13:31 . 2008-01-05 13:31 <DIR> d-------- C:\Documents and Settings\kulik\Data aplikací\Locktime
2008-01-05 13:29 . 2008-01-05 13:29 <DIR> d-------- C:\Program Files\NetLimiter 2 Pro
2008-01-05 13:29 . 2008-01-05 13:29 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Locktime
2008-01-05 12:12 . 2008-01-05 12:12 <DIR> d-------- C:\Program Files\Alwil Software
2008-01-04 18:45 . 2008-01-04 18:45 <DIR> d-------- C:\Program Files\PowerQuest
2008-01-04 16:19 . 2008-01-05 11:48 <DIR> d-------- C:\Program Files\DiskInternals
2008-01-02 16:20 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-12-29 19:58 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
2007-12-29 19:58 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax
2007-12-29 19:52 . 2007-12-29 19:52 <DIR> d-------- C:\Program Files\Codemasters
2007-12-28 20:48 . 2008-01-06 14:31 <DIR> d---s---- C:\Program Files\HLSW
2007-12-28 20:23 . 2007-12-28 20:23 <DIR> d-------- C:\Program Files\THQ
2007-12-28 20:16 . 2007-12-28 20:16 1,158 --a------ C:\WINDOWS\mozver.dat
2007-12-28 16:10 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-12-28 16:10 . 2008-01-06 14:31 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-28 16:10 . 2007-12-28 16:10 22,328 --a------ C:\Documents and Settings\kulik\Data aplikací\PnkBstrK.sys
2007-12-28 16:10 . 2007-12-28 16:10 22,328 --a------ C:\Documents and Settings\kulik\Data aplikací\PnkBstrK.sys
2007-12-28 16:10 . 2007-12-28 16:10 22,328 --a------ C:\Documents and Settings\kulik\Data aplikací\PnkBstrK.sys
2007-12-28 16:09 . 2007-12-28 16:09 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-12-28 16:09 . 2008-01-06 14:31 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-12-28 16:09 . 2007-12-28 20:42 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-12-28 16:09 . 2007-12-28 16:09 319 --a------ C:\WINDOWS\game.ini
2007-12-28 16:00 . 2007-12-28 16:00 <DIR> d-------- C:\Program Files\Activision
2007-12-28 15:52 . 2007-12-28 15:52 <DIR> d--hs---- C:\WINDOWS\ftpcache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-05 22:54 --------- d-----w C:\Program Files\Warcraft III
2008-01-04 17:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-04 17:43 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-30 13:18 --------- d---a-w C:\Program Files\Miranda IM
2007-12-28 14:52 --------- d-----w C:\Program Files\WC3Banlist
2007-12-28 13:33 --------- d-----w C:\Program Files\Winamp Remote
2007-12-28 13:33 --------- d-----w C:\Program Files\Winamp
2007-12-28 13:33 --------- d-----w C:\Documents and Settings\kulik\Data aplikací\Winamp
2007-12-28 13:33 --------- d-----w C:\Documents and Settings\kulik\Data aplikací\Winamp
2007-12-28 13:33 --------- d-----w C:\Documents and Settings\kulik\Data aplikací\Winamp
2007-12-28 13:33 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\OrbNetworks
2007-12-28 13:26 --------- d-----w C:\Program Files\RivaTuner v2.06
2007-12-28 13:22 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2007-12-28 13:13 --------- d-----w C:\Program Files\WinPcap
2007-12-28 13:11 --------- d-----w C:\Program Files\Ventrilo
2007-12-28 13:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-28 13:10 --------- d-----w C:\Program Files\Webteh
2007-12-28 13:10 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-28 13:10 --------- d-----w C:\Program Files\Combined Community Codec Pack
2007-12-28 13:08 --------- d-----w C:\Program Files\Razer Pro Solutions
2007-12-28 13:08 --------- d-----w C:\Documents and Settings\kulik\Data aplikací\InstallShield
2007-12-28 13:08 --------- d-----w C:\Documents and Settings\kulik\Data aplikací\InstallShield
2007-12-28 13:08 --------- d-----w C:\Documents and Settings\kulik\Data aplikací\InstallShield
2007-12-28 13:07 --------- d-----w C:\Program Files\DAEMON Tools Lite
2007-12-28 13:05 --------- d-----w C:\Documents and Settings\kulik\Data aplikací\DAEMON Tools
2007-12-28 13:05 --------- d-----w C:\Documents and Settings\kulik\Data aplikací\DAEMON Tools
2007-12-28 13:05 --------- d-----w C:\Documents and Settings\kulik\Data aplikací\DAEMON Tools
2007-12-28 13:03 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-12-28 13:03 --------- d-----w C:\Program Files\AMD
2007-12-28 13:02 --------- d-----w C:\Program Files\ATI Technologies
2007-12-28 13:00 --------- d-----w C:\Program Files\Realtek
2007-12-28 12:58 --------- d-----w C:\Program Files\DIFX
2007-12-28 12:43 558,142 ----a-w C:\WINDOWS\java\Packages\XV7NF53B.ZIP
2007-12-28 12:43 155,995 ----a-w C:\WINDOWS\java\Packages\LB9FX7NV.ZIP
2007-12-28 12:43 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-05 13:17 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
2007-12-05 05:26 2,782,208 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 03:05 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:54 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 02:53 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:53 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 02:48 9,535,488 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:44 3,175,584 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-12-05 02:33 1,640,192 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-05 02:19 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:16 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-05 02:14 180,224 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 15:49 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2007-12-19 21:13 486856]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-12-18 02:02 471040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 03:04 2879488 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 04:49 16269312 C:\WINDOWS\RTHDCPL.exe]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06 77824]
"razer"="C:\Program Files\Razer Pro Solutions\ProClick v1.6\razerhid.exe" [2007-03-02 14:39 126976]
"RivaTuner"="C:\Program Files\RivaTuner v2.06\RivaTuner.exe" [2007-10-30 19:05 2650112]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.06\RivaTuner.exe" [2007-10-30 19:05 2650112]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-17 15:49 15360]

R1 nltdi;nltdi;C:\WINDOWS\system32\drivers\nltdi.sys [2007-04-23 12:03]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 23:04]
R3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys [2005-04-24 22:43]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 22:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{49e8f389-b946-11dc-8ecd-001a4d80d5c9}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(0)\command - Recycled\ctfmon.exe

*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-06 16:04:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-06 16:04:31
ComboFix-quarantined-files.txt 2008-01-06 15:04:30

Do poznamkoveho bloku skopirujte nasledovne:

File::
C:\WINDOWS\NirCmd.exe
C:\Recycled\ctfmon.exe
D:\Recycled\ctfmon.exe
C:\AUTORUN.INF
D:\AUTORUN.INF

Folder::
C:\Recycled
D:\Recycled

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{49e8f389-b946-11dc-8ecd-001a4d80d5c9}]

Ulozte ho na plochu ako CFScript.txt Cytte s mysou a presunte ho nad combofix a nasledne ho pustite ako na obrazku dole.Program nacita script a zacne sken. Po nom sem dajte log ktory vam naskoci.




Po tom, ako to urobite, urobte sken s MWAVOM:
http://www.viry.cz/forum/viewtopic.php?t=4097
Stiahnite si program, nezabudnite updatovat a spravne ho nastavit podla manuala !
Po skene sem dajte log, ktory je v dolnom okne, nie v hornom !








Otestujte na virustotal.com:
C:\WINDOWS\system32\rkupginstaller.exe
C:\WINDOWS\mozver.dat
C:\WINDOWS\game.ini

Ahoj, muzu se zeptat jak jste ten soubor teda odstranili? Neustale se mi objevuje.. NOD32 hlasi WIN32/VB.AQT Trojan... autorun.inf smazano,ale CTFMON.EXE nevim jak smazat, a nemuzu ho najit, stale se objevuje, ani total commander ho nevidi. Jak jste ten virus teda odstranili? diky

já žil v dojmu že ctfmon.exe je legitimní součást windows, a normálně vypnout nejde, tohle je nějaká věc co se maskuje pod stejným názvem?

jo jeste jedno CTFMON.EXE je v system32.. a pak je jeste dalsi pod stejnym nazvem a to je vir!

Budeš sem muset vložit log z ComboFixu.