Kontrola logu

Prosím o kontrolu logu:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:20:05, on 18.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\Analog Devices\SoundMAX\Smax4.exe
D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
D:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\AntiVir PersonalEdition Classic\sched.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\Documents and Settings\Andrea\Plocha\HiJackThis.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:9090 ftp=localhost:9093 https=localhost:9092
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost; 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - D:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMax] "D:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Ashampoo FireWall] "D:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Startup: AutorunsDisabled
O4 - Global Startup: AutorunsDisabled
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Načítať použitie &BitSpirit - E:\Program files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 9987751171
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://128.173.200.174/activex/AMC.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{070262ED-32C1-4A58-802F-02DEDC6E7021}: NameServer = ...........
O17 - HKLM\System\CS1\Services\Tcpip\..\{070262ED-32C1-4A58-802F-02DEDC6E7021}: NameServer = .............
O17 - HKLM\System\CS2\Services\Tcpip\..\{070262ED-32C1-4A58-802F-02DEDC6E7021}: NameServer = ...........
O18 - Protocol: AutorunsDisabled - (no CLSID) - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5221 bytes

Ahoj, fixni:

O2 - BHO: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O18 - Protocol: AutorunsDisabled - (no CLSID) - (no file)


Tu mi chýba IP:

O17 - HKLM\System\CCS\Services\Tcpip\..\{070262ED-32C1-4A58-802F-02DEDC6E7021}: NameServer = ...........
O17 - HKLM\System\CS1\Services\Tcpip\..\{070262ED-32C1-4A58-802F-02DEDC6E7021}: NameServer = .............
O17 - HKLM\System\CS2\Services\Tcpip\..\{070262ED-32C1-4A58-802F-02DEDC6E7021}: NameServer = ...........

Zmazal si ju sám?

Áno zmazal
Toto mi tam zostalo aj po tom čo som to fixol
O18 - Protocol: AutorunsDisabled - (no CLSID) - (no file)

Fixni aj toto:

O17 - HKLM\System\CCS\Services\Tcpip\..\{070262ED-32C1-4A58-802F-02DEDC6E7021}: NameServer = ...........
O17 - HKLM\System\CS1\Services\Tcpip\..\{070262ED-32C1-4A58-802F-02DEDC6E7021}: NameServer = .............
O17 - HKLM\System\CS2\Services\Tcpip\..\{070262ED-32C1-4A58-802F-02DEDC6E7021}: NameServer = ...........

+
O18 - Protocol: AutorunsDisabled - (no CLSID) - (no file)


Skús núdzový režim.

To 017......mi tam asi nastavil provaider keď zapnem komp tak sa mi pripojí na net len vtedy keď otvorím prehliadač a tam ma to hodí na tu stránku stou IP ktorú som zmazal a potom ma pripojí.

Do núdzového režimu ma nepustí lebo sa mi stále reštartne komp asi niečo s winom

Použi toto:
ftp://ftp.microworldsystems.com/download/tools/mwav.exe

Zvoľ všetky možnosti, aktualizuj a vlož výpis z poľa "Informace o nalezených hrozbách".

Objekt´´grokster Spyware/Adware´´ nalezen v souborovém systému! Provedené akce Nic nebylo provedeno.
Objekt´´grokster Spyware/Adware´´ nalezen v souborovém systému! Provedené akce Nic nebylo provedeno.
Objekt´´conducent flexpak Spyware/Adware´´ nalezen v souborovém systému! Provedené akce Nic nebylo provedeno.
Objekt´´dealhelper.com Spyware/Adware´´ nalezen v souborovém systému! Provedené akce Nic nebylo provedeno.
Objekt´´powerreg scheduler Spyware/Adware´´ nalezen v souborovém systému! Provedené akce Nic nebylo provedeno.
Objekt´´powerreg scheduler Spyware/Adware´´ nalezen v souborovém systému! Provedené akce Nic nebylo provedeno.
Objekt´´powerreg scheduler Spyware/Adware´´ nalezen v souborovém systému! Provedené akce Nic nebylo provedeno.
Objekt´´savenow Adware´´ nalezen v souborovém systému! Provedené akce Nic nebylo provedeno.
Objekt´´Possible Fujacks-type Worm´´ nalezen v souborovém systému! Provedené akce Nic nebylo provedeno.
Zaznam´´HKCR/KM Player.kpl´´odkazuje na neplatný objekt´´9EB4CB-74C2-4BE9-AA5D-8249F16020AD´´Provedené akce Nic nebylo provedeno.
Zaznam´´HKCR/KM Player.kpl´´odkazuje na neplatný objekt´´9EB4CB-74C2-4BE9-AA5D-8249F16020AD´´Provedené akce Nic nebylo provedeno.
Zaznam´´HKCR/SharePoint.WebPartPage.Document1.0´´odkazuje na neplatný objekt´´388ED91D-7FD2-11DO-A60B-00A0C90A43FF´´Provedené akce Nic nebylo provedeno.

Stiahnite ComboFix –->
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Riaďte sa inštrukciami na obrazovke, neklikajte, počítač môže byť reštartovaný. Vlož sem log D:\ComboFix.txt

ComboFix 07-08-25.2 - "xxxxx" 2007-08-25 13:24:59.1 - FAT32x86
Syst‚m Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.260 [GMT 2:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


D:\DOCUME~1\xxxxx\ravmonlog
D:\WINDOWS\regedit.com
D:\WINDOWS\system32\taskmgr.com
D:\WINDOWS\system32\tmp18.tmp
D:\WINDOWS\system32\tmp24.tmp
D:\WINDOWS\system32\tmp25.tmp


((((((((((((((((((((((((( Files Created from 2007-07-25 to 2007-08-25 )))))))))))))))))))))))))))))))


2007-08-25 13:21 51,200 --a------ D:\WINDOWS\nircmd.exe
2007-08-23 21:32 <DIR> d--hs---- D:\FOUND.020
2007-08-23 20:34 <DIR> d--hs---- D:\FOUND.019
2007-08-23 20:17 <DIR> d--hs---- D:\FOUND.018
2007-08-22 22:56 <DIR> d--hs---- D:\FOUND.017
2007-08-18 13:26 <DIR> d-a------ D:\WINDOWS\zts2.exe
2007-08-18 13:26 <DIR> d-a------ D:\WINDOWS\system32\vcmgcd32.dll
2007-08-18 13:26 <DIR> d-a------ D:\WINDOWS\system32\iifgfgf.dll
2007-08-18 13:26 <DIR> d-a------ D:\WINDOWS\rundll16.exe
2007-08-18 13:26 <DIR> d-a------ D:\WINDOWS\rundl132.dll
2007-08-18 13:26 <DIR> d-a------ D:\WINDOWS\logo1_.exe
2007-08-18 13:19 147,968 --a------ D:\WINDOWS\R.COM
2007-08-18 13:19 137,216 --a------ D:\WINDOWS\system32\T.COM
2007-08-17 23:36 <DIR> d--hs---- D:\FOUND.016
2007-08-15 00:02 <DIR> d--hs---- D:\FOUND.015
2007-08-14 23:48 <DIR> d--hs---- D:\FOUND.014
2007-08-14 20:10 <DIR> d--hs---- D:\FOUND.013
2007-08-14 09:03 552 --a------ D:\WINDOWS\system32\d3d8caps.dat
2007-08-13 23:09 <DIR> d--hs---- D:\FOUND.012
2007-08-13 19:17 <DIR> d--hs---- D:\FOUND.011
2007-08-13 14:46 <DIR> d--hs---- D:\FOUND.010
2007-08-13 10:42 <DIR> d--hs---- D:\FOUND.009
2007-08-13 10:03 <DIR> d--hs---- D:\FOUND.008
2007-08-13 04:26 <DIR> d--hs---- D:\FOUND.007
2007-08-13 02:48 <DIR> d--hs---- D:\FOUND.006
2007-08-13 02:33 <DIR> d--hs---- D:\FOUND.005
2007-08-13 00:51 <DIR> d-------- D:\Remote Programs
2007-08-13 00:51 <DIR> d-------- D:\Program Files\Common Files\PocketSoft
2007-08-13 00:19 <DIR> d--hs---- D:\FOUND.004
2007-08-13 00:08 <DIR> d-------- D:\Program Files\RivaTuner v2.02
2007-08-12 23:20 <DIR> d-------- D:\Program Files\Common Files\InterVideo
2007-08-12 23:15 <DIR> d-------- D:\Program Files\Common Files\LightScribe
2007-08-06 16:46 <DIR> d-------- D:\Program Files\Wolfenstein - Enemy Territory
2007-08-03 22:54 89,360 -ra------ D:\WINDOWS\system32\VB5DB.DLL
2007-08-03 22:54 69,632 -ra------ D:\WINDOWS\system32\xmltok.dll
2007-08-03 22:54 36,864 -ra------ D:\WINDOWS\system32\xmlparse.dll
2007-08-03 22:54 26,096 -ra------ D:\WINDOWS\system32\xmlinst.exe
2007-08-03 22:54 <DIR> d-------- D:\Program Files\Ubi Soft
2007-08-03 22:53 185,344 --a------ D:\WINDOWS\patchw32.dll
2007-08-03 22:53 <DIR> d-------- D:\Program Files\ubi.com
2007-08-01 10:29 68 --a------ D:\WINDOWS\GPlrLanc.dat
2007-08-01 10:28 53,316 --------- D:\WINDOWS\ExentInfo.exe
2007-08-01 10:28 117,760 --a------ D:\WINDOWS\GPlrLanc.exe
2007-08-01 10:28 <DIR> d-------- D:\Program Files\T-Station Herny Klient
2007-07-29 19:35 <DIR> d-------- D:\Program Files\MSXML 4.0
2007-07-28 20:16 <DIR> d-------- D:\Program Files\ICQLite


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-25 11:14 9344 --a------ D:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-25 11:14 8320 --a------ D:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-13 00:50 --------- d-------- D:\DOCUME~1\xxxxx\DATAAP~1\ubi.com
2007-07-18 16:15 --------- d-------- D:\DOCUME~1\xxxxx\DATAAP~1\Apple Computer
2007-07-18 16:10 --------- d-------- D:\Program Files\QuickTime
2007-07-18 16:09 --------- d-------- D:\DOCUME~1\ALLUSE~1.WIN\DATAAP~1\Apple Computer
2007-07-18 16:00 --------- d-------- D:\DOCUME~1\xxxxx\DATAAP~1\Teleca
2007-07-18 16:00 --------- d-------- D:\DOCUME~1\xxxxx\DATAAP~1\Sony Ericsson
2007-07-18 15:52 --------- d-------- D:\DOCUME~1\ALLUSE~1.WIN\DATAAP~1\Sony Ericsson
2007-07-18 15:51 --------- d-------- D:\Program Files\Sony Ericsson
2007-07-18 15:51 --------- d-------- D:\Program Files\Common Files\Teleca Shared
2007-07-18 15:51 --------- d-------- D:\DOCUME~1\ALLUSE~1.WIN\DATAAP~1\Teleca
2007-07-15 13:37 --------- d-------- D:\DOCUME~1\xxxxx\DATAAP~1\Schmap
2007-06-29 22:27 --------- d-------- D:\DOCUME~1\xxxxx\DATAAP~1\Printer Info Cache
2007-06-29 22:27 --------- d-------- D:\DOCUME~1\xxxxx\DATAAP~1\Image Zone Express
2007-06-29 22:18 --------- d-------- D:\DOCUME~1\ALLUSE~1.WIN\DATAAP~1\WEBREG
2007-06-29 22:11 --------- d-------- D:\DOCUME~1\xxxxx\DATAAP~1\HP
2007-06-29 22:10 --------- d-------- D:\DOCUME~1\ALLUSE~1.WIN\DATAAP~1\Hewlett-Packard
2007-06-29 21:57 --------- d-------- D:\DOCUME~1\ALLUSE~1.WIN\DATAAP~1\HP
2007-06-29 21:56 --------- d-------- D:\Program Files\Common Files\HP
2007-06-29 21:56 --------- d-------- D:\DOCUME~1\ALLUSE~1.WIN\DATAAP~1\HPSSUPPLY
2007-06-29 21:55 --------- d-------- D:\Program Files\Hewlett-Packard
2007-06-29 21:54 --------- d-------- D:\Program Files\Common Files\Hewlett-Packard
2007-06-29 21:51 --------- d-------- D:\Program Files\HP
2007-06-28 16:34 --------- d-------- D:\DOCUME~1\ALLUSE~1.WIN\DATAAP~1\AntiVir PersonalEdition Classic
2007-06-28 13:15 --------- d-------- D:\DOCUME~1\ALLUSE~1.WIN\DATAAP~1\AntiVir PersonalEdition Classic(2)
2007-06-28 11:32 --------- d-------- D:\DOCUME~1\xxxxx\DATAAP~1\Eset
2007-06-28 06:53 --------- d-------- D:\DOCUME~1\ALLUSE~1.WIN\DATAAP~1\Eset
2007-06-11 09:55 2864 --a------ D:\WINDOWS\system32\winsock.dll
2007-06-11 09:55 2864 --a------ D:\WINDOWS\system32\dllcache\winsock.dll
2007-05-31 08:45 524288 --a------ D:\WINDOWS\system32\DivXsm.exe
2007-05-31 08:44 823296 --a------ D:\WINDOWS\system32\divx_xx0c.dll
2007-05-31 08:44 823296 --a------ D:\WINDOWS\system32\divx_xx07.dll
2007-05-31 08:44 802816 --a------ D:\WINDOWS\system32\divx_xx11.dll
2007-05-31 08:44 740442 --a------ D:\WINDOWS\system32\DivX.dll
2007-05-25 11:59 43520 --a------ D:\WINDOWS\system32\CmdLineExt03.dll
2007-01-01 02:46 1194 --a------ D:\Program Files\NettGain Client setup.log
2006-11-15 17:30 2177 --a------ D:\Program Files\SMART.txt
2006-11-15 16:15 133 --a------ D:\Program Files\mail.ini
2006-10-06 22:24 467033 --a------ D:\Program Files\registry-defrag.exe
2006-07-14 08:18 427584 --a------ D:\Program Files\Regmon.exe
2006-07-10 13:22 398912 --a------ D:\Program Files\autoruns.exe
2006-06-26 21:10 382464 --a------ D:\Program Files\HDDScan.exe
2006-05-27 16:27 2901464 --a------ D:\Program Files\mkvtoolnix-unicode-1.6.5-setup.exe
2006-05-27 16:26 1044480 --a------ D:\Program Files\AVIMux_GUI.exe
2006-05-27 14:35 929280 --a------ D:\Program Files\VirtualDubMod.exe
2006-05-27 12:08 35970241 --a------ D:\Program Files\klmcodec152.exe
2006-05-23 03:09 2855080 --a------ D:\Program Files\aawsepersonal.exe
2006-05-14 12:18 836783 --a------ D:\Program Files\7z442.exe
2006-02-13 21:29 17027947 --a------ D:\Program Files\The FilmMachine 1.5.0.173 beta.exe
2006-01-27 14:47 278695200 --a------ D:\Program Files\TmNationsESWC_Setup.exe
2006-01-12 19:08 533131 --a------ D:\Program Files\glview223.exe
2006-01-12 11:19 1425253 --a------ D:\Program Files\rmma361bin.exe
2005-12-23 12:15 905216 --a------ D:\Program Files\iview398.exe
2005-12-11 17:55 2173479 --a------ D:\Program Files\pcw2006_v1661.exe
2005-10-20 22:45 638789 --a------ D:\Program Files\hdtune_251.exe
2005-07-14 11:12 345600 --a------ D:\Program Files\SafeXP.exe
2004-10-16 22:03 1291643 --a------ D:\Program Files\winxp_simulator.exe
2005-10-13 19:27:00 422,400 --sha-r D:\WINDOWS\x2.64.exe
2005-05-13 15:12:00 217,073 --sha-r D:\WINDOWS\meta4.exe
2005-10-24 09:13:58 66,560 --sha-r D:\WINDOWS\MOTA113.exe
2005-10-07 17:14:52 308,224 --sha-r D:\WINDOWS\system32\avisynth.dll
2005-06-26 13:32:28 616,448 --sha-r D:\WINDOWS\system32\cygwin1.dll
2005-06-21 20:37:42 45,568 --sha-r D:\WINDOWS\system32\cygz.dll
2004-01-24 22:00:00 70,656 --sha-r D:\WINDOWS\system32\i420vfw.dll
2005-02-28 11:16:22 240,128 --sha-r D:\WINDOWS\system32\x.264.exe
2005-07-14 10:31:20 27,648 --sha-r D:\WINDOWS\system32\AVSredirect.dll
2006-04-27 08:24:24 2,945,024 --sha-r D:\WINDOWS\system32\Smab.dll
2004-01-24 22:00:00 70,656 --sha-r D:\WINDOWS\system32\yv12vfw.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 17:20]
"NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2005-06-15 17:20]
"SoundMax"="D:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-03-26 14:40]
"SoundMAXPnP"="D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-04-01 10:52]
"avgnt"="D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-02 10:35]
"Ashampoo FireWall"="D:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 14:57]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-02-07 15:39]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"=0 (0x0)
"SynchronousMachineGroupPolicy"=0 (0x0)
"SynchronousUserGroupPolicy"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=0 (0x0)
"NoColorChoice"=0 (0x0)
"NoDispBackgroundPage"=0 (0x0)
"NoDispCPL"=0 (0x0)
"NoDispSettingsPage"=0 (0x0)
"NoDispScrSavPage"=0 (0x0)
"NoVisualStyleChoice"=0 (0x0)
"NoSizeChoice"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"=1 (0x1)
"NoClose"=0 (0x0)
"NoRecentDocsMenu"=1 (0x1)
"NoFavoritesMenu"=0 (0x0)
"NoSMMyDocs"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoStartMenuMyMusic"=0 (0x0)
"NoRecentDocsHistory"=1 (0x1)
"NoRecentDocsNetHood"=0 (0x0)
"NoSMHelp"=0 (0x0)
"NoRun"=0 (0x0)
"NoInstrumentation"=0 (0x0)
"NoSimpleStartMenu"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"=1 (0x1)
"MemCheckBoxInRunDlg"=0 (0x0)
"NoClose"=0 (0x0)
"NoAutoTrayNotify"=0 (0x0)
"NoResolveTrack"=0 (0x0)
"NoResolveSearch"=1 (0x1)
"NoWelcomeScreen"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
"NoThemesTab"=0 (0x0)
"NoRecentDocsMenu"=1 (0x1)
"NoFavoritesMenu"=0 (0x0)
"NoSMMyDocs"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoStartMenuMyMusic"=0 (0x0)
"NoRecentDocsHistory"=1 (0x1)
"NoRecentDocsNetHood"=0 (0x0)
"NoSMHelp"=0 (0x0)
"NoUserNameInStartMenu"=1 (0x1)
"NoInstrumentation"=0 (0x0)
"NoStartMenuPinnedList"=0 (0x0)
"ForceStartMenuLogoff"=0 (0x0)
"NoSharedDocuments"=1 (0x1)

R0 viamraid;viamraid;D:\WINDOWS\system32\DRIVERS\viamraid.sys
R1 avgio;avgio;\??\D:\Program Files\AntiVir PersonalEdition Classic\avgio.sys
R1 avipbb;avipbb;D:\WINDOWS\system32\DRIVERS\avipbb.sys
R1 ssmdrv;ssmdrv;D:\WINDOWS\system32\DRIVERS\ssmdrv.sys
R2 AntiVirScheduler;AntiVir PersonalEdition Classic Scheduler;"D:\Program Files\AntiVir PersonalEdition Classic\sched.exe"
R2 Dnscache;Klient DNS;D:\WINDOWS\system32\svchost.exe -k NetworkService
R2 X4HSX32;X4HSX32;\??\D:\Program Files\T-Station Herny Klient\X4HSX32.Sys
R3 avgntflt;avgntflt;\??\D:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys
R3 PSched;Plánovač paketů technologie QoS;D:\WINDOWS\system32\DRIVERS\psched.sys
S3 ASFWHide;ASFWHide;\??\D:\DOCUME~1\xxxxx\LOCALS~1\Temp\ASFWHide
S3 DCamUSBDXGTech;Trust 350FS PowerC@m Flash (Video Camera);D:\WINDOWS\system32\Drivers\GT891x1.SYS
S3 FlyPCI;FlyPCI;\??\D:\WINDOWS\system32\drivers\FlyPCI.sys
S3 GT890x;Trust 350FS PowerC@m Flash (Still Camera);D:\WINDOWS\system32\Drivers\GT890x.SYS
S3 MSIRCOMM;Microsoft IR Communications Driver;D:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
S3 pmxscan;USB ScanModule V5.1 Driver;D:\WINDOWS\system32\DRIVERS\usbscan.sys
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB;D:\WINDOWS\system32\DRIVERS\usbccgp.sys
S3 usbscan;Ovladač skeneru USB;D:\WINDOWS\system32\DRIVERS\usbscan.sys
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
S3 w200bus;Sony Ericsson W200 driver (WDM);D:\WINDOWS\system32\DRIVERS\w200bus.sys
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;D:\WINDOWS\system32\DRIVERS\w200mdfl.sys
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;D:\WINDOWS\system32\DRIVERS\w200mdm.sys
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);D:\WINDOWS\system32\DRIVERS\w200mgmt.sys
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;D:\WINDOWS\system32\DRIVERS\w200obex.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Schedule


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aae8d3dc-b141-11db-94bd-f18bbb34a9d3}]
Auto\command- L:\bittorrent.exe e
AutoRun\command- D:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e

*Newly Created Service* - CATCHME

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-25 13:27:02
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\AntiVirScheduler]
"ImagePath"=""D:\Program Files\AntiVir PersonalEdition Classic\sched.exe""

Completion time: 2007-08-25 13:27:51
D:\ComboFix-quarantined-files.txt ... 2007-08-25 13:27

--- E O F ---

Otestuj postupne na http://www.virustotal.com


Výsledky daj sem.


Stiahnite Avenger -–>
http://swandog46.geekstogo.com/avenger.exe

Spustiť – „Input script manually“ – Lupa – Skopírovať kód – „Done“ – Semafor – Potvrdiť – Nasleduje reštart PC


Mohli by ste mi zaslať na mail zálohu avengeru, ktorá bude na D v priečinku Avenger ---> backup.zip

Zabaľte súbor do archívu RAR s heslom "infected" (menu možnosti - nastaviť heslo) a pošlite ho na adresu threat.samples@gmail.com


+ Otázka:

Tie exáče máš zámerne "len tak" v Program Files?

GPlrLanc.exe našlo

CAT-QuickHeal 9.00 2007.08.25 (Suspicious) - DNAScan
eSafe 7.0.15.0 2007.08.23 Suspicious Trojan/Worm
Sunbelt 2.2.907.0 2007.08.25 VIPRE.Suspicious

CmdLineExt03.dll našlo

eSafe 7.0.15.0 2007.08.23 Win32.Small.asx

ostatné bolo čisté

Čo sa týka tých exáčov viem že niektoré som si tam dal sám ale na tieto :\Program Files\glview223.exe
D:\Program Files\rmma361bin.exe
D:\Program Files\iview398.exe
si nespomínam ale možné to je.
Zálohu avengeru som Ti poslal na mail

Cez Avenger by som ešte zmazal toto:


Nech to tam nestraší.