VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Backdoor.NetWiredRC.E

https://forum.viry.cz:443/viewtopic.php?t=157676

Stránka 1 z 1

Backdoor.NetWiredRC.E

Napsal: 16 pro 2020 23:58
od mino_85
Zdravím,
hľadám pomoc s odstránením tohto backdooru.
Skenované a odstránené cez Malwarebytes, po reštarte PC je znovu aktívny (aj po offline reštarte). Je to v registroch, jeden nález ako kľúč databázy, druhý ako hodnota.
V prílohe zbalené výpisy logov z FRST a nižšie screen zo skenu Malwarebytes.
Ďakujem za pomoc.
Desktop.zip
(33.93 KiB) Staženo 91 x
Obrázek

Re: Backdoor.NetWiredRC.E

Napsal: 17 pro 2020 02:44
od Conder
Ahoj :)

:arrow: Urob v Malwarebytes uplny sken:
  • Otvor Malwarebytes a klikni na "Skener"
  • Klikni na "Rozsirene skenery" a potom na "Nakonfigurovat skenovanie"
  • Vpravo oznac vsetky disky v PC a vlavo oznac moznost "Vyhladavat rootkity"
  • Klikni na "Skenovat" a pockaj na dokoncenie
  • Po dokonceni klikni na "Zobrazit spravu" -> "Exportovat" -> "Skopirovat do schranky"
  • Skopirovany log vloz do dalsej odpovede

Re: Backdoor.NetWiredRC.E

Napsal: 17 pro 2020 20:35
od mino_85
Tu je výpis z Malwarebytes:
Malwarebytes
www.malwarebytes.com

-Podrobnosti denníka-
Dátum skenovania: 17. 12. 2020
Čas skenovania: 18:45
Súbor denníka: b7c30e8c-408f-11eb-a4d9-3c7c3fd7cfdf.json

-Údaje o softvéri-
Verzia: 4.3.0.98
Verzia súčastí: 1.0.1130
Aktualizovať verziu balíka: 1.0.34463
Licencia: Skúšobná verzia

-Systémové informácie-
OS: Windows 10 (Build 19041.685)
Procesor: x64
Systém súborov: NTFS
Používateľ: MARIAN-PC\Marian

-Zhrnutie skenovania-
Typ skenovania: Vlastné skenovanie
Skenovanie bolo spustené: Manuálne
Výsledok: Dokončené
Preskenované objekty: 941607
Zistené hrozby: 2
Hrozby umiestnené do karantény: 0
Uplynulý čas: 1 h, 7 min, 48 s

-Možnosti skenovania-
Pamäť: Povolené
Spúšťanie: Povolené
Systém súborov: Povolené
Archívy: Povolené
Rootkity: Povolené
Heuristika: Povolené
PUP: Zistiť
PUM: Zistiť

-Podrobnosti skenovania-
Proces: 0
(Nezistili sa nijaké škodlivé položky)

Modul: 0
(Nezistili sa nijaké škodlivé položky)

Kľúč databázy Registry: 1
Backdoor.NetWiredRC.E, HKU\S-1-5-21-4254316458-2841474531-1994623767-1001\SOFTWARE\NETWIRE, Bez zásahu používateľa, 8721, 778974, 1.0.34463, , ame, , ,

Hodnota databázy Registry: 1
Backdoor.NetWiredRC.E, HKU\S-1-5-21-4254316458-2841474531-1994623767-1001\SOFTWARE\NETWIRE|HOSTID, Bez zásahu používateľa, 8721, 778974, 1.0.34463, , ame, , ,

Údaje databázy Registry: 0
(Nezistili sa nijaké škodlivé položky)

Prúd údajov: 0
(Nezistili sa nijaké škodlivé položky)

Priečinok: 0
(Nezistili sa nijaké škodlivé položky)

Súbor: 0
(Nezistili sa nijaké škodlivé položky)

Fyzický sektor: 0
(Nezistili sa nijaké škodlivé položky)

WMI: 0
(Nezistili sa nijaké škodlivé položky)


(end)

Re: Backdoor.NetWiredRC.E

Napsal: 19 pro 2020 03:11
od Conder
Sprav este sken cez KVRT: https://www.kaspersky.com/downloads/tha ... moval-tool
Stiahni cez cervene tlacitko "Download Now" a stiahnuty program spusti ako spravca
Klikni na "Change Parameters" a oznac moznost "System Drive"
Klikin na "Start Scan" a pockaj na dokoncenie
V pripade nalezov urob screenshot/snimku obrazovky - stlac klavesu Print Screen, otvor program Malovani / Skicar, stlac Ctrl+V a uloz obrazok na plochu (KVRT neumoznuje vytvorit skopirovatelny log)
Nalezy nechaj zmazat - klikni na "Neutralize all" a nasledne na "Continue" (moze byt tiez nutne restartovat PC)
Vytvoreny obrazok posli ako prilohu k dalsiemu prispevku alebo ho nahraj na nejake webove ulozisko a posli odkaz

Re: Backdoor.NetWiredRC.E

Napsal: 19 pro 2020 12:10
od mino_85
Tak update, podarilo sa mi toho zbaviť už predvčerom... Kaspersky našiel nejaké dll-ko, to som zmazal, bohužiaľ som to nescreenshotol pre účely dokumentácie.
Následne som ešte raz zmazal tie dve veci z registrov cez Malwarebytes, predtým som sa pre istotu dal offline a zmazal som aj všetky staršie body obnovy systému.
Po reštarte vyzerá byť všetko čisté, preskenované Kasperskym aj Malwarebytes. Priebežne kontrolujem a budem to sledovať.
Ak by sa niečo zmenilo, ozvem sa. Dík za ochotu každopádne.

Re: Backdoor.NetWiredRC.E

Napsal: 20 pro 2020 03:58
od Conder
Islo o Kaspersky Virus Removal Tool? Detekovane a zmazane subory by sa mali dat zobrazit cez moznost Quarantine alebo Report.

Re: Backdoor.NetWiredRC.E

Napsal: 25 pro 2020 16:25
od mino_85
Hej, bolo to KVRT, konkretne na screene, teda nie dll, ale au3. Nejaký skript ak dobre chápem.

Obrázek

Re: Backdoor.NetWiredRC.E

Napsal: 27 pro 2020 23:58
od Conder
OK, malware uz zrejme nie je aktivny, ale v PC este ostali nejake pozostatky tohto malwaru, ktore je potrebne docistit rucne - poprosim teda o obidva nove logy z FRST.

Re: Backdoor.NetWiredRC.E

Napsal: 28 pro 2020 22:16
od mino_85
Logy v zipe v prílohe, ďakujem.
FRST.zip
(33.84 KiB) Staženo 76 x

Re: Backdoor.NetWiredRC.E

Napsal: 30 pro 2020 01:31
od Conder
:arrow: Otvor poznamkovy blok (Win+R -> notepad -> enter)
  • Skopiruj nasledujuci text a vloz ho do poznamkoveho bloku:

    Kód: Vybrat vše

    Start
CloseProcesses:
CreateRestorePoint:

PowerShell: Get-ChildItem -Path "$ENV:USERPROFILE\Desktop" -Recurse -Force | Measure-Object -Property Length -Sum
File: C:\Program Files (x86)\ASUS\ArmouryDevice\dll\AIOFanSDK\ArmouryAIOFanServer.exe
File: C:\Program Files\ACD Systems\ACDSee Ultimate\10.0\ACDSeeCommanderUltimate10.exe
File: C:\Users\maria\AppData\Roaming\4kDownload\Backup files\CorelRun.exe
File: C:\Windows\System32\drivers\BthA2dp.sys
Folder: C:\Users\maria\AppData\Roaming\winini
Folder: C:\Windows\winini

2020-12-16 12:27 - 2020-12-17 18:25 - 000000000 ____D C:\Users\maria\AppData\Roaming\winini
2020-12-16 00:46 - 2020-12-17 21:47 - 000000000 ____D C:\Windows\winini

HKU\S-1-5-21-4254316458-2841474531-1994623767-1001\...\MountPoints2: E - "E:\Autoplay.exe" -auto
HKU\S-1-5-21-4254316458-2841474531-1994623767-1001\...\MountPoints2: G - "G:\setup.exe" 
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
AlternateDataStreams: C:\ProgramData\TEMP:4FC01C57 [140]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\02455493.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\02455493.sys => ""="Driver"

Hosts:
EmptyTemp:
End
  • Uloz na plochu s nazvom fixlist.txt
  • Spusti znovu FRST a klikni na Fix
  • Po dokonceni si FRST vyziada restart PC, potvrd kliknutim na OK
  • Po restartovani PC bude na ploche subor Fixlog.txt, jeho obsah skopiruj a vloz do dalsej odpovede

Re: Backdoor.NetWiredRC.E

Napsal: 30 pro 2020 19:03
od mino_85
Fixlist nizsie...

Kód: Vybrat vše

Fix result of Farbar Recovery Scan Tool (x64) Version: 14-12-2020
Ran by Marian (30-12-2020 18:59:31) Run:1
Running from C:\Users\maria\Desktop
Loaded Profiles: Marian
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:

PowerShell: Get-ChildItem -Path "$ENV:USERPROFILE\Desktop" -Recurse -Force | Measure-Object -Property Length -Sum
File: C:\Program Files (x86)\ASUS\ArmouryDevice\dll\AIOFanSDK\ArmouryAIOFanServer.exe
File: C:\Program Files\ACD Systems\ACDSee Ultimate\10.0\ACDSeeCommanderUltimate10.exe
File: C:\Users\maria\AppData\Roaming\4kDownload\Backup files\CorelRun.exe
File: C:\Windows\System32\drivers\BthA2dp.sys
Folder: C:\Users\maria\AppData\Roaming\winini
Folder: C:\Windows\winini

2020-12-16 12:27 - 2020-12-17 18:25 - 000000000 ____D C:\Users\maria\AppData\Roaming\winini
2020-12-16 00:46 - 2020-12-17 21:47 - 000000000 ____D C:\Windows\winini

HKU\S-1-5-21-4254316458-2841474531-1994623767-1001\...\MountPoints2: E - "E:\Autoplay.exe" -auto
HKU\S-1-5-21-4254316458-2841474531-1994623767-1001\...\MountPoints2: G - "G:\setup.exe" 
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} =>  -> No File
AlternateDataStreams: C:\ProgramData\TEMP:4FC01C57 [140]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\02455493.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\02455493.sys => ""="Driver"

Hosts:
EmptyTemp:
End
*****************

Processes closed successfully.
Restore point was successfully created.

========= Get-ChildItem -Path "$ENV:USERPROFILE\Desktop" -Recurse -Force | Measure-Object -Property Length -Sum =========



Count    : 49
Average  : 
Sum      : 24627377
Maximum  : 
Minimum  : 
Property : Length




========= End of Powershell: =========


========================= File: C:\Program Files (x86)\ASUS\ArmouryDevice\dll\AIOFanSDK\ArmouryAIOFanServer.exe ========================

C:\Program Files (x86)\ASUS\ArmouryDevice\dll\AIOFanSDK\ArmouryAIOFanServer.exe
File not signed
MD5: 55F58960BA0EC63608BB8D0D56D8F6B6
Creation and modification date: 2020-11-28 21:28 - 2020-11-10 11:41
Size: 001039360
Attributes: ----A
Company Name: TODO: <Company name>
Internal Name: AacAIOFa.exe
Original Name: AacAIOFa.exe
Product: TODO: <Product name>
Description: ArmouryAIOFanServer.exe
File Version: 1.0.0.1
Product Version: 1.0.0.1
Copyright: Copyright (C) 2020
VirusTotal: https://www.virustotal.com/gui/file/d415de4c38efb72749a1dbc44453455cb55786aaf4d9d99b827c0468374b58fe/detection/f-d415de4c38efb72749a1dbc44453455cb55786aaf4d9d99b827c0468374b58fe-1609266597

====== End of File: ======


========================= File: C:\Program Files\ACD Systems\ACDSee Ultimate\10.0\ACDSeeCommanderUltimate10.exe ========================

C:\Program Files\ACD Systems\ACDSee Ultimate\10.0\ACDSeeCommanderUltimate10.exe
File not signed
MD5: C9197D8B1BB2764BA5D85B60EFD295E9
Creation and modification date: 2017-04-25 05:04 - 2017-05-07 08:49
Size: 003427272
Attributes: ----A
Company Name: ACD Systems International -> ACD Systems
Internal Name: ACDSee Commander Ultimate 10
Original Name: ACDSeeCommanderUltimate10.exe
Product: ACDSee Commander Ultimate 10
Description: ACDSee Commander Ultimate 10
File Version: 10,4,0,912
Product Version: 10,4,0,912
Copyright: Copyright (c) 2016
VirusTotal: 0

====== End of File: ======


========================= File: C:\Users\maria\AppData\Roaming\4kDownload\Backup files\CorelRun.exe ========================

C:\Users\maria\AppData\Roaming\4kDownload\Backup files\CorelRun.exe
File not signed
MD5: 2AA83DF02C3703461EAE74DE9548CE97
Creation and modification date: 2020-11-29 10:37 - 2020-08-09 01:40
Size: 004640826
Attributes: ----A
Company Name: Admin
Internal Name: Corel Draw
Original Name: CorelRun.exe
Product: Corel Draw
Description: Runtime Broker
File Version: 1.0.0.0
Product Version: 1.0.0
Copyright: Admin
VirusTotal: 0

====== End of File: ======


========================= File: C:\Windows\System32\drivers\BthA2dp.sys ========================

C:\Windows\System32\drivers\BthA2dp.sys
File not signed
MD5: 7F09708B8C651A0C0E2A2725136BA254
Creation and modification date: 2019-12-07 10:07 - 2019-12-07 10:07
Size: 000279040
Attributes: ----A
Company Name: Microsoft Corporation
Internal Name: btha2dp.sys
Original Name: btha2dp.sys
Product: Microsoft® Windows® Operating System
Description: Bluetooth A2DP Driver
File Version: 10.0.19041.1 (WinBuild.160101.0800)
Product Version: 10.0.19041.1
Copyright: © Microsoft Corporation. All rights reserved.
VirusTotal: https://www.virustotal.com/gui/file/0442a18bbed4e323265c66561c8f8c171d8e934e9089c12b94d1dfdbb057b737/detection/f-0442a18bbed4e323265c66561c8f8c171d8e934e9089c12b94d1dfdbb057b737-1609349560

====== End of File: ======


========================= Folder: C:\Users\maria\AppData\Roaming\winini ========================

2020-12-16 12:27 - 2020-12-16 23:09 - 000014303 ____A [1FE6F3FF975D2F63A80D51B4CFD7352E] () C:\Users\maria\AppData\Roaming\winini\16-12-2020
2020-12-17 18:25 - 2020-12-17 20:28 - 000001741 ____A [4D8963DC5E3C0AAD5A2929E7F40CAE50] () C:\Users\maria\AppData\Roaming\winini\17-12-2020

====== End of Folder: ======


========================= Folder: C:\Windows\winini ========================

2020-12-16 00:46 - 2020-11-13 04:44 - 000156672 ____A [4503240A78160799926022C4B1F327F4] () C:\Windows\winini\2.exe
2020-12-16 00:46 - 2018-03-15 06:17 - 000971944 ____A [5324F6F00C2055139DA89E3B93629878] (AutoIt Team) C:\Windows\winini\main_dll.exe

====== End of Folder: ======

C:\Users\maria\AppData\Roaming\winini => moved successfully
C:\Windows\winini => moved successfully
HKU\S-1-5-21-4254316458-2841474531-1994623767-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E => removed successfully
HKU\S-1-5-21-4254316458-2841474531-1994623767-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G => removed successfully
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\PowerISO => removed successfully
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\PowerISO => removed successfully
C:\ProgramData\TEMP => ":4FC01C57" ADS removed successfully
HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\02455493.sys => removed successfully
HKLM\System\CurrentControlSet\Control\SafeBoot\Network\02455493.sys => removed successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 9199616 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 486337686 B
Java, Flash, Steam htmlcache => 405123120 B
Windows/system/drivers => 29458985 B
Edge => 0 B
Chrome => 966101828 B
Firefox => 72796017 B
Opera => 417413161 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 432 B
LocalService => 130392 B
NetworkService => 333012 B
maria => 716825850 B
Marián => 716825850 B

RecycleBin => 0 B
EmptyTemp: => 3.6 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 19:00:15 ====

Re: Backdoor.NetWiredRC.E

Napsal: 02 led 2021 04:48
od Conder
Tak zmazane. Su s PC este nejake problemy?

:arrow: Ak ne, tak este upraceme po pouzitych nastrojoch:

Re: Backdoor.NetWiredRC.E

Napsal: 02 led 2021 12:37
od mino_85
Vykonané. :)

Kód: Vybrat vše

# DelFix v1.013 - Logfile created 02/01/2021 at 12:35:54
# Updated 17/04/2016 by Xplode
# Username : Marian - MARIAN-PC
# Operating System : Windows 10 Enterprise  (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST

########## - EOF - ##########
S PC nie sú žiadne problémy odkedy som postol ten príspevok o zmazaní z 19.12.
Vďaka ešte raz za pomoc.

Re: Backdoor.NetWiredRC.E

Napsal: 03 led 2021 02:58
od Conder
Nie je zaco, rad som pomohol :)
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz