Zdravím, neviem ako a akým spôsobom som schytal pravdepodobne vír/malware ktorý proces systému explorer.exe najprv vypne a potom zapne pričom sa to približne v 10sek. intervaloch opakuje (zvyčajne už od nabootovania do GUI). Pregooglil som mnoho fór ale jednoznačnú odpoveď som nenašiel. Po čase keď som to prebehol NOD-om, Ad-Aware 07 Free a SpyBot-om S&D na nič som nedošiel ale za tým som skúsil rôzne iné utility ako Vundofix, Hijackthis a Combofix. Dospel som k záveru, že v zložke %windir%/system32 sa generujú 3x súbory náhodného názvu.. konkrétne vždy jeden povedzme XYZ.ini ďalší XYZ.ini2 a ešte ZYX.dll (áno presne vždy má *.dll súbor rovnaký názov ako *.ini súbory ale odzadu). Combofix ich aj odstránil lenže po reboote sa vygenerovali nové a s iným názvom. Všimol som si tiež že v bežiacich procesoch sa zvykne usadiť rundll32.exe, čo sa mi bežne nestávalo (nakoľko tento proces môže mať veľkú súvislosť s napadnutím PC pomocou spywaru, inak súvisí myslým z pripojenými zariadeniami) - okrem neho sa mi zdá podozrivý aj winlogon.exe lenže neviem zistiť aké dll súbory si volá na pomoc. Teda ako som vravel aj po premenovaní 2x ini a 1x dll súboru vo win recovery konzole a následnom zmazaní sa vygenerovali nové, poslednou záhadnou vecou čo som si všimol je súbor taktiež v system32 zložke a to tuvsRlLe.dll = na 60% som si istý že nepatrí k systému (google o ňom samozrejme nič nevie, a najlepšie na tom je že znak ktorý vyzerá ako toto I prípadne | je nejaký špeciálny, tento súbor nejde zmazať ani v safe móde). Prikladám logy z hijackthis a combofix - posledných pár hodín sa systém zdá byť OKay ale potrebujem nejakého experta ktorý by mi logy preveril a prípadne ešte niečo poradil - je veľmi možné že za tým je ešte aj iný súbor/proces. THX
Log z Hijackthis
Kód:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:20:44, on 25.5.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trust\Trust R-series Mouse And Keyboard\KMWDSrv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\explorer.exe
D:\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\PROGRA~1\PCTRAN~1\webie.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CanonSolutionMenu] "C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" /logon
O4 - HKLM\..\Run: [CanonMyPrinter] "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon
O4 - HKLM\..\Run: [CTSysVol] "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" /r
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: WebTran - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: &Nastaviť prekladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: Preložiť &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PROGRA~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: Preložiť &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PROGRA~1\PCTRAN~1\webie.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Trust\Trust R-series Mouse And Keyboard\KMWDSrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 6372 bytes
Log z ComboFix
Kód:
ComboFix 08-05-21.3 - IT'S NOT IMPORTANT FOR YOU WHO'S USER 2008-05-25 17:08:35.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.705 [GMT 2:00]
Running from: D:\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\SrYyyyxx.ini
C:\WINDOWS\system32\SrYyyyxx.ini2
C:\WINDOWS\system32\xxyyyYrS.dll
.
((((((((((((((((((((((((( Files Created from 2008-04-25 to 2008-05-25 )))))))))))))))))))))))))))))))
.
2008-05-25 10:12 . 2008-05-25 12:36 <DIR> d-------- C:\Program Files\Miranda IM
2008-05-24 19:54 . 2008-05-25 17:12 612,384 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-24 19:54 . 2008-05-25 17:12 10,268 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-24 19:51 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-05-24 19:50 . 2008-05-24 19:50 <DIR> d-------- C:\Program Files\Zone Labs
2008-05-24 19:50 . 2008-04-02 21:07 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2008-05-24 19:50 . 2008-05-25 17:14 352,918 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-05-24 19:49 . 2008-05-25 17:00 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-05-24 18:08 . 2008-05-24 18:08 <DIR> d-------- C:\Program Files\CCleaner
2008-05-24 17:02 . 2008-05-24 17:06 82 --a------ C:\WINDOWS\winDecrypt.INI
2008-05-24 14:50 . 2008-05-24 14:50 <DIR> d-------- C:\WINDOWS\java
2008-05-24 14:45 . 2008-05-24 13:00 <DIR> d--h----- C:\Documents and Settings\Administrator\ćabl˘ny
2008-05-24 14:45 . 2008-05-24 13:00 <DIR> d-------- C:\Documents and Settings\Administrator\Pracovn plocha
2008-05-24 14:45 . 2008-05-24 13:00 <DIR> d---s---- C:\Documents and Settings\Administrator\Ponuka ćtart
2008-05-24 14:45 . 2008-05-24 13:00 <DIR> d-------- C:\Documents and Settings\Administrator\Ob–Łben‚ polo§ky
2008-05-24 14:45 . 2008-05-24 13:00 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-24 14:45 . 2008-05-24 14:45 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-24 14:30 . 2004-08-04 14:00 571,392 --a--c--- C:\WINDOWS\system32\dllcache\tintlgnt.ime
2008-05-24 14:29 . 2004-08-04 14:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-05-24 14:28 . 2004-08-04 14:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-05-24 14:27 . 2004-08-04 14:00 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-05-24 14:26 . 2004-08-04 14:00 290,816 --a--c--- C:\WINDOWS\system32\dllcache\adsiis51.dll
2008-05-24 14:20 . 2008-05-24 14:24 <DIR> d--hs---- C:\Documents and Settings\All Users\DRM
2008-05-24 14:18 . 2008-05-24 14:18 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-05-24 14:18 . 2008-05-24 14:18 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-05-24 14:18 . 2008-05-24 14:18 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-05-24 14:18 . 2008-05-24 14:18 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-05-24 14:18 . 2008-05-24 14:18 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-05-24 14:18 . 2008-05-24 14:18 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-05-24 14:17 . 2004-08-04 14:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe
2008-05-24 13:51 . 2004-08-04 14:00 1,086,058 -ra------ C:\WINDOWS\SETD4.tmp
2008-05-24 13:51 . 2004-08-04 14:00 1,042,903 -ra------ C:\WINDOWS\SETD1.tmp
2008-05-24 13:51 . 2004-08-04 14:00 13,753 -ra------ C:\WINDOWS\SETE0.tmp
2008-05-24 13:15 . 2008-05-24 13:15 <DIR> d-------- C:\WINDOWS\NV720268.TMP
2008-05-24 13:10 . 2008-05-24 13:10 <DIR> d-------- C:\WINDOWS\NV7202028.TMP
2008-05-24 13:00 . 2008-05-24 13:00 <DIR> d--h----- C:\Documents and Settings\Default User\ćabl˘ny
2008-05-24 13:00 . 2008-05-24 13:00 <DIR> d-------- C:\Documents and Settings\Default User\Pracovn plocha
2008-05-24 13:00 . 2008-05-24 13:00 <DIR> d---s---- C:\Documents and Settings\Default User\Ponuka ćtart
2008-05-24 13:00 . 2008-05-24 13:00 <DIR> d-------- C:\Documents and Settings\Default User\Ob–Łben‚ polo§ky
2008-05-24 13:00 . 2008-05-24 13:00 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty
2008-05-24 13:00 . 2008-05-24 13:00 <DIR> d--h----- C:\Documents and Settings\All Users\ćabl˘ny
2008-05-24 13:00 . 2008-05-25 13:45 <DIR> d-------- C:\Documents and Settings\All Users\Pracovn plocha
2008-05-24 13:00 . 2008-05-24 15:03 <DIR> d---s---- C:\Documents and Settings\All Users\Ponuka ćtart
2008-05-24 13:00 . 2008-05-24 13:00 <DIR> d-------- C:\Documents and Settings\All Users\Ob–Łben‚ polo§ky
2008-05-24 13:00 . 2008-05-24 13:00 <DIR> d---s---- C:\Documents and Settings\All Users\Dokumenty
2008-05-24 12:59 . 2004-08-04 14:00 1,086,058 -ra------ C:\WINDOWS\SETEE.tmp
2008-05-24 12:59 . 2004-08-04 14:00 1,042,903 -ra------ C:\WINDOWS\SETEB.tmp
2008-05-24 12:59 . 2004-08-04 14:00 13,753 -ra------ C:\WINDOWS\SETFA.tmp
2008-05-24 12:09 . 2008-05-24 12:23 <DIR> d-------- C:\i386
2008-05-23 18:37 . 2008-05-23 18:37 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-23 18:37 . 2008-05-23 19:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-23 15:34 . 2008-05-23 15:34 59,392 --------- C:\WINDOWS\system32\tuvsRlLe.dll
2008-05-22 21:20 . 2008-05-24 17:52 14,400 --a------ C:\WINDOWS\SLEX99.BMS
2008-05-22 21:20 . 2008-05-24 17:52 27 --a------ C:\WINDOWS\SLEX99.INI
2008-05-22 21:20 . 2008-05-22 21:20 4 --a------ C:\WINDOWS\SLEX99.ANS
2008-05-21 15:47 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll
2008-05-21 15:46 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-05-21 15:46 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
2008-05-21 15:46 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
2008-05-21 15:46 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
2008-05-19 17:22 . 2008-05-19 17:22 <DIR> d-------- C:\Program Files\Winamp
2008-05-19 17:22 . 2008-05-19 17:34 <DIR> d-------- C:\Documents and Settings\IT'S NOT IMPORTANT FOR YOU WHO'S USER\Application Data\Winamp
2008-05-15 22:34 . 2008-05-15 23:39 <DIR> d-------- C:\Temp\Graf-tab praca
2008-05-12 19:01 . 2008-05-12 19:01 <DIR> d-------- C:\Program Files\OpenSSL
2008-04-30 20:51 . 2008-05-01 18:04 <DIR> d-------- C:\Temp\_cd potlaź
2008-04-25 21:49 . 2008-04-25 22:12 <DIR> d-------- C:\Temp\biosoz
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-24 17:36 --------- d-----w C:\Documents and Settings\IT'S NOT IMPORTANT FOR YOU WHO'S USER\Application Data\Comodo
2008-05-24 16:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-24 15:08 --------- d-----w C:\Documents and Settings\IT'S NOT IMPORTANT FOR YOU WHO'S USER\Application Data\Graphisoft
2008-05-21 11:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\TrackMania
2008-04-26 19:31 --------- d-----w C:\Program Files\Opera
2008-04-22 20:21 --------- d-----w C:\Program Files\ClipMate7
2008-04-22 15:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-22 15:41 --------- d-----w C:\Program Files\LG Soft India
2008-04-22 15:41 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-19 18:02 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2008-04-19 18:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-04-19 18:01 --------- d-----w C:\Program Files\Sony Ericsson
2008-04-19 17:57 94,064 ----a-w C:\WINDOWS\system32\drivers\k510mdm.sys
2008-04-19 17:57 85,408 ----a-w C:\WINDOWS\system32\drivers\k510mgmt.sys
2008-04-19 17:57 83,344 ----a-w C:\WINDOWS\system32\drivers\k510obex.sys
2008-04-19 17:57 8,336 ----a-w C:\WINDOWS\system32\drivers\k510mdfl.sys
2008-04-19 17:57 6,176 ----a-w C:\WINDOWS\system32\drivers\k510cmnt.sys
2008-04-19 17:57 6,176 ----a-w C:\WINDOWS\system32\drivers\k510cm.sys
2008-04-19 17:57 58,288 ----a-w C:\WINDOWS\system32\drivers\k510bus.sys
2008-04-19 17:57 5,808 ----a-w C:\WINDOWS\system32\drivers\k510whnt.sys
2008-04-19 17:57 5,808 ----a-w C:\WINDOWS\system32\drivers\k510wh.sys
2008-03-26 20:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-26 20:07 --------- d-----w C:\Program Files\Common Files\Merge Modules
2008-03-26 20:04 --------- d-----w C:\Program Files\Microsoft SDKs
2008-03-26 20:03 --------- d-----w C:\Program Files\Reference Assemblies
2008-03-26 20:03 --------- d-----w C:\Program Files\MSBuild
2008-03-26 19:58 --------- d-----w C:\Program Files\MSXML 6.0
2007-12-31 15:55 47,360 ----a-w C:\Documents and Settings\IT'S NOT IMPORTANT FOR YOU WHO'S USER\Application Data\pcouffin.sys
2008-01-26 14:12 8 --sha-r C:\WINDOWS\system32\6B09D056F6.sys
2007-04-13 20:26 88 -csha-r C:\WINDOWS\system32\7007FFB19F.sys
.
------- Sigcheck -------
2008-05-24 15:03 502272 6225f14b8ce08ccba8b25ad27843c674 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-25_13.42.25.95 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-25 11:36:25 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-25 15:13:56 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="mHotkey.exe" [2002-07-05 17:37 491008 C:\WINDOWS\mHotkey.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-17 16:27 950664]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 14:00 33280 C:\WINDOWS\system32\rundll32.exe]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 03:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 03:50 1603152]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 11:51 57344]
"nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 14:00 33280 C:\WINDOWS\system32\rundll32.exe]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]
"NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2005-01-17 14:43 84480]
C:\Documents and Settings\IT'S NOT IMPORTANT FOR YOU WHO'S USER\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
"DisableCAD"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoAutoTrayNotify"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 relog_ap
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^forteManager.lnk]
backup=C:\WINDOWS\pss\forteManager.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
--a--c--- 2004-12-14 03:12 483328 C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a--c--- 2005-12-16 13:57 94208 C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a--c--- 2006-11-12 12:48 157592 C:\Program Files\DAEMON Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FinePrint Dispatcher v5]
--a--c--- 2006-10-27 15:48 507904 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FmctrlTray]
--a--c--- 2001-08-20 22:47 270336 C:\WINDOWS\system32\fmctrl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a--c--- 2004-11-02 21:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRFirstRun]
--a------ 2004-08-04 14:00 67584 C:\WINDOWS\system32\srclient.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"CiSvc"=3 (0x3)
"gusvc"=3 (0x3)
"ERSvc"=2 (0x2)
"AcrSch2Svc"=3 (0x3)
"aawservice"=3 (0x3)
"RemoteRegistry"=2 (0x2)
"RDSessMgr"=3 (0x3)
"mnmsrvc"=3 (0x3)
"helpsvc"=2 (0x2)
"BITS"=3 (0x3)
"ose"=3 (0x3)
"Adobe LM Service"=3 (0x3)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"nwiz"=nwiz.exe /install
"NVRaidService"=C:\WINDOWS\system32\nvraidservice.exe
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R2 DLPortIO;DriverLINX Port I/O Driver;C:\WINDOWS\system32\DRIVERS\DLPortIO.sys [1999-01-10 12:00]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Trust\Trust R-series Mouse And Keyboard\KMWDSrv.exe [2007-02-28 19:12]
R2 RadPciNT;RadPciNT;C:\WINDOWS\system32\Drivers\RadPciNT.sys [2000-04-24 18:26]
R3 PSched;QoS Packet Scheduler;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-04 14:00]
S3 FlarionDTM;Flarion DTM Network Interface;C:\WINDOWS\system32\DRIVERS\FlrnDTM.sys [2005-05-26 16:06]
S3 gameport;FM801 PCI Joystick;C:\WINDOWS\system32\DRIVERS\fmjoy.sys []
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2008-04-19 19:57]
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys [2008-04-19 19:57]
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys [2008-04-19 19:57]
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys [2008-04-19 19:57]
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys [2008-04-19 19:57]
S3 LGDDCDevice;LGDDCDevice;C:\Program Files\LG Soft India\forteManager\bin\I2CDriver.sys [2007-11-20 10:07]
S3 LGII2CDevice;LGII2CDevice;C:\Program Files\LG Soft India\forteManager\bin\PII2CDriver.sys [2007-11-20 10:07]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-02-08 22:26]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 00:01]
S3 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 14:00]
S3 wdm_fm801;FM801 PCI Audio (WDM);C:\WINDOWS\system32\drivers\fm801.sys []
S3 WPRO_40_755;WinPcap Packet Driver (WPRO_40_755);C:\WINDOWS\system32\drivers\WPRO_40_755.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0181eda8-5711-11dc-82aa-806d6172696f}]
\shell\PlayWithPowerDVD\Command - "C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" "%l"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ba9d42ce-f1d5-11dc-ad98-82bc5d5e55e4}]
\Shell\AutoRun\command - F:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5d506a8-4cce-11dc-a61f-bea6d7e5d8a2}]
\Shell\AutoRun\command - F:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-05-02 15:17:40 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-25 17:14:39
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2008-05-25 17:19:58 - machine was rebooted [IT'S NOT IMPORTANT FOR YOU WHO'S USER]
ComboFix-quarantined-files.txt 2008-05-25 15:19:50
ComboFix2.txt 2008-05-25 11:43:14
Pre-Run: 5,753,303,040 bytes free
Post-Run: 5,743,120,384 bytes free
268
Na požiadanie zašlem ďalšie logy...
