generic HOst Process Win32 Services

Bol som na nete, zrazu mi napisalo toto: generic HOst Process Win32 Services (v tom okne neodosielat, ladit...) vzplo mi icq nedalo sa ist na net. Restartol som komp a hned este pred prihlasenim nieco vzpisal avast, nastartoval win XP a hned ze trojsky kon, potom virus celz szstem ide pomaly nic sa neda robit, ale mam nastastie aj Kubuntu tak pisem y toho. Co sa da robit s tym zavirenym Winom XP ?? pls surne

posli vypis z utility Hijackthis.
http://www.trendsecure.com/portal/en-US ... ckthis.php
Spusti [Scan a Save log] a potom cely obsah(Ctrl+A) skopirujes(Ctrl+C) a
vloz(CTrl+V) do fora .

tu ulitku mam spustit na XP-cku ?? no snad to spustim ked tam pomaly ide

Hej, musíš ho spustiť na napadnutom počítači. Aj keď pôjde pomaly, len tak to ide naspäť opraviť, keby si to spustil na Kubuntu, log by bol naprd.

horko tazko som to spustil dal som Scan a Save log, yacalo robit a potom vzpisalo ze nemoze dokoncit lebo nejkaa aplikacia je zaneprezdnena, tak to vidim ze asi tu pomoze len reinstall

koli upresneniu


mam ten isty problem, pustil som na to ten hijack, uvidime

Skús ho premenovať alebo spustiť v núdzovom režime.

ok tak skuste vy

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:50:48, on 12. 9. 2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Opera\Opera.exe
D:\majso\mIRC v6.15 sk\mirc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O17 - HKLM\System\CCS\Services\Tcpip\..\{6F09428A-CF8F-434C-B8E4-57A14F0DA5A1}: NameServer = 85.237.0.65 85.237.1.66
O17 - HKLM\System\CS1\Services\Tcpip\..\{6F09428A-CF8F-434C-B8E4-57A14F0DA5A1}: NameServer = 85.237.0.65 85.237.1.66
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 1437 bytes

To je log z normálneho režimu a celý?


Stiahnite ComboFix –->
http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe

Riaďte sa inštrukciami na obrazovke, neklikajte, počítač môže byť reštartovaný. Vložte na fórum obsah súbora C:\ComboFix.txt

ano..

Tak už tu na mňa mal "kukať" ten z ComboFixu.

toto?

ComboFix 07-09-13.1 - "majso" 2007-09-12 20:39:42.1 - NTFSx86
Syst‚m Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.109 [GMT 2:00]
* Created a new restore point
.

Áno

vsetko okej..hm zatial len last.fm < softwer na zaznamenavanie pesniciek na net a katalogizaciu mi zahlasil ze mam problem zo systemovym casom a nemoze pokracovat..hm

ten log...

nespravilo mi ho

Sprav to v núdzovom režime.

fajn idem na to lebo zas sa mi objavila ta hovadina

ComboFix 07-09-13.1 - "majso" 2007-09-13 17:18:34.2 - NTFSx86 MINIMAL
Syst‚m Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.379 [GMT 2:00]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\FunWebProducts
C:\Program Files\inetget2
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\winpop
C:\Program Files\winpop\UnInstall.exe
C:\WINDOWS\wr.txt

.
((((((((((((((((((((((((( Files Created from 2007-08-13 to 2007-09-13 )))))))))))))))))))))))))))))))
.

2007-09-12 20:38 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-12 20:02 82,061 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-09-12 20:02 81,549 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-09-12 20:01 2,444,320 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-09-12 20:01 11,296 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-09-12 20:01 <DIR> d-------- C:\Program Files\Kaspersky Lab
2007-09-12 20:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Kaspersky Lab
2007-09-12 20:00 <DIR> d-------- C:\Program Files\kav7.0
2007-09-12 18:09 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-09-09 19:59 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-09 15:37 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-09-06 22:22 <DIR> d-------- C:\Program Files\Orbitdownloader
2007-09-06 22:22 <DIR> d-------- C:\Downloads
2007-09-01 10:43 <DIR> d-------- C:\fotky
2007-08-28 23:28 <DIR> dr------- C:\DOCUME~1\ocko\Oblˇben‚ polo§ky
2007-08-28 21:33 <DIR> d-------- C:\DOCUME~1\ocko\foto
2007-08-13 18:52 <DIR> d-------- C:\Program Files\i2p

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-13 17:09 34856 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-09-13 17:09 3176 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-09-13 16:27 --------- d-------- C:\Program Files\Last.fm
2007-09-09 15:37 --------- d-------- C:\Program Files\Skype
2007-09-06 22:34 --------- d-------- C:\Program Files\IrfanView
2007-08-21 20:36 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-21 20:36 --------- d-------- C:\Program Files\Creative
2007-08-01 10:12 --------- d-------- C:\Program Files\Linearteam
2007-07-21 09:48 --------- d-------- C:\Program Files\SpeedFan
2007-07-13 17:05 --------- d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Creative
2007-07-04 14:41 94208 --a------ C:\WINDOWS\DIIUnin.exe
2007-06-28 12:51 206088 --a------ C:\WINDOWS\system32\klogon.dll
2006-12-06 17:51 1 --a------ C:\DOCUME~1\majso\SI.bin
1999-05-19 08:56 36864 --a------ C:\DOCUME~1\majso\VOLUMEID.EXE
1997-10-24 14:20 25088 --a--c--- C:\WINDOWS\inf\regl3acm.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-09 16:29]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51]
"SoundMan"="SOUNDMAN.EXE" [2002-08-02 13:00 C:\WINDOWS\SOUNDMAN.EXE]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-03-09 16:29]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"ICQ Lite"=C:\Program Files\ICQLite\ICQLite.exe -trayboot

C:\DOCUME~1\ALLUSE~1\NABDKA~1\Programy\POSPUT~1\
Akceler tor spuçtŘnˇ AutoCADu.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2004-02-25 02:35:22]
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-12 17:08:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Orbit.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Orbit.lnk
backup=C:\WINDOWS\pss\Orbit.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^majso^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
path=C:\Documents and Settings\majso\Nabídka Start\Programy\Po spuštění\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^majso^Nabídka Start^Programy^Po spuštění^CPU Meter.lnk]
path=C:\Documents and Settings\majso\Nabídka Start\Programy\Po spuštění\CPU Meter.lnk
backup=C:\WINDOWS\pss\CPU Meter.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^majso^Nabídka Start^Programy^Po spuštění^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\majso\Nabídka Start\Programy\Po spuštění\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
"C:\Program Files\ICQLite\ICQLite.exe" -minimize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
D:\Games\Valve\Steam\\Steam.exe -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
"C:\Program Files\Save\Save.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SandraTheSrv"=3 (0x3)
"SandraDataSrv"=3 (0x3)
"CiSvc"=3 (0x3)
"AVGEMS"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys
S3 cglptnt;cglptnt;\??\C:\totalcmd\cglptnt.sys
S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt
S3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
S3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
S3 RivaTunerEx;RivaTunerEx;\??\C:\Program Files\RivaTuner v2.0 RC 15.4\RivaTunerEx.sys
S3 SANDRA;SANDRA;\??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\Sandra.sys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Schedule

.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-13 17:20:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-13 17:21:57
C:\ComboFix-quarantined-files.txt ... 2007-09-13 17:21
.
--- E O F ---

Otestuj na http://www.virustotal.com a výsledky vlož sem:

C:\DOCUME~1\majso\VOLUMEID.EXE
C:\WINDOWS\inf\regl3acm.exe



Stiahnite Avenger -–>
http://swandog46.geekstogo.com/avenger.exe

Spustiť – „Input script manually“ – Lupa – Skopírovať kód – „Done“ – Semafor – Potvrdiť – Nasleduje reštart PC



+ Mohol by si mi zaslať na mail zálohu, ktorá je na C ---> qoobox

Zabaľ adresár do archívu RAR s heslom "infected" (menu rozšírené - nastaviť heslo) a pošlite ho na adresu threat.samples@gmail.com

toto volumeid jem i zname a mozem ho v pohode odmazat, je to program na zmenu labelu disku a nema by obsahovat ziaden vir, preveroval som ho, ten druhy subor otestujem..

mozem ti to poslat na icQ

Na mail mi to je lepšie. /nezabudni heslo/



Ako sa správa počítač ?
Ide už HijackThis v pohode ?


Ešte by som urobil sken cez MWAV:

Zatial ide vsetko v pohode, pokial nebude problem necham to tak

Stale mi vyhadzuje to okno, skusal som aj aktualzaciu a nepomohlo. Virom to nebude. Zas nejaka drbnuta chyba v XP