Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

RSIT log security tool/s

Návody, recenze, diskuze, řešení problémů

Moderátor: Moderátoři

Pravidla fóra
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
Zamčeno
Zpráva
Autor
mik99
Návštěvník
Návštěvník
Příspěvky: 2
Registrován: 28 úno 2010 17:45

RSIT log security tool/s

#1 Příspěvek od mik99 »

zdravim mam problem s falesnym antivirusem security tool/s presel sem do nouzoveho rezimu s praci v siti .. RSIT log mam ale co dal?? prosim poradte RSIT log:Logfile of random's system information tool 1.06 (written by random/random)
Run by Lyon at 2010-02-28 17:40:34
Systém Microsoft Windows XP Professional Service Pack 3
System drive H: has 21 GB (42%) free of 50 GB
Total RAM: 1022 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:44:24, on 28.2.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Safe mode with network support

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\Explorer.EXE
H:\Program Files\Internet Explorer\iexplore.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Documents and Settings\Lyon\Local Settings\Temporary Internet Files\Content.IE5\O0VMTPAU\RSIT[1].exe
H:\Program Files\trend micro\Lyon.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... tbid=60327
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qip.ru/search?query=%s&from=IE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 193.188.119.981:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
O1 - Hosts: 85.135.28.70 l2authd.lineage2.com
O1 - Hosts: 85.135.28.70 testauthd.lineage2.com
O1 - Hosts: 216.107.250.194 nprotect.lineage2.com
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [lsass] C:\Program Files\lsass.exe
O4 - HKLM\..\Run: [SpywareTerminator] "H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [Kone] "H:\Program Files\ROCCAT\Kone Mouse\KoneHID.EXE"
O4 - HKLM\..\Run: [95223122] H:\Documents and Settings\All Users\Data aplikací\95223122\95223122.exe
O4 - HKLM\..\Run: [92159834] H:\Documents and Settings\All Users\Data aplikací\92159834\92159834.exe
O4 - HKLM\..\Run: [86381733] H:\DOCUME~1\ALLUSE~1\DATAAP~1\86381733\86381733.exe
O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "h:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Skype] "H:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ICQ] "H:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: ImpulseNow.lnk = H:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - H:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - H:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 2939439312
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - H:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - H:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: NBService - Nero AG - H:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - H:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - H:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Ventrilo - Unknown owner - H:\Program Files\VentSrv\ventrilo_svc.exe (file missing)

--
End of file - 7621 bytes

======Scheduled tasks folder======

H:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=RTHDCPL.EXE []
"Alcmtr"=ALCMTR.EXE []
"Kernel and Hardware Abstraction Layer"=KHALMNPR.EXE []
"lsass"=C:\Program Files\lsass.exe []
"SpywareTerminator"=H:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2009-03-10 1783808]
"Kone"=H:\Program Files\ROCCAT\Kone Mouse\KoneHID.EXE [2008-10-06 151552]
"95223122"=H:\Documents and Settings\All Users\Data aplikací\95223122\95223122.exe [2010-02-28 1049600]
"92159834"=H:\Documents and Settings\All Users\Data aplikací\92159834\92159834.exe [2010-02-28 1049600]
"86381733"=H:\DOCUME~1\ALLUSE~1\DATAAP~1\86381733\86381733.exe [2010-02-28 1049600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=H:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"Steam"=h:\program files\valve\steam\steam.exe [2010-02-20 1217872]
"Skype"=H:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]
"ICQ"=H:\Program Files\ICQ7.0\ICQ.exe [2010-02-11 133368]
"ctfmon.exe"=H:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
H:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
H:\Program Files\QuickTime\QTTask.exe -atboottime []

H:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Gamma Loader.exe.lnk - H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
BTTray.lnk - H:\Program Files\Widcomm\Bluetooth Software\BTTray.exe

H:\Documents and Settings\Lyon\Nabídka Start\Programy\Po spuštění
Adobe Gamma.lnk - H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
ImpulseNow.lnk - H:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
H:\WINDOWS\system32\Ati2evxx.dll [2006-11-29 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
H:\WINDOWS\system32\WgaLogon.dll [2008-09-05 267304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - H:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"H:\Program Files\GIGABYTE\@BIOS\gwflash.exe"="H:\Program Files\GIGABYTE\@BIOS\gwflash.exe:*:Enabled:gwflash"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"I:\Program Files\Warcraft III\Warcraft III.exe"="I:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"I:\Program Files\Warcraft III\War3.exe"="I:\Program Files\Warcraft III\War3.exe:*:Enabled:Warcraft III"
"H:\Program Files\Opera\Opera.exe"="H:\Program Files\Opera\Opera.exe:*:Enabled:Opera Internet Browser"
"H:\Documents and Settings\Veruš\Plocha\Warcraft III.exe"="H:\Documents and Settings\Veruš\Plocha\Warcraft III.exe:*:Enabled:Warcraft III"
"I:\Program Files\Counter-Strike\hl.exe"="I:\Program Files\Counter-Strike\hl.exe:*:Enabled:Half-Life Launcher"
"I:\Program Files\Counter-Strike\hltv.exe"="I:\Program Files\Counter-Strike\hltv.exe:*:Enabled:HLTV Launcher"
"I:\Program Files\Counter-Strike\hlds.exe"="I:\Program Files\Counter-Strike\hlds.exe:*:Enabled:HLDS Launcher"
"H:\Program Files\Warcraft III\Warcraft III.exe"="H:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"H:\WINDOWS\system32\dplaysvr.exe"="H:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"H:\Program Files\Firefly Studios\Stronghold Crusader Multiplayer Demo\Stronghold Crusader multiplayer demo.exe"="H:\Program Files\Firefly Studios\Stronghold Crusader Multiplayer Demo\Stronghold Crusader multiplayer demo.exe:*:Enabled:Stronghold Crusader multiplayer demo"
"H:\Program Files\uTorrent\utorrent.exe"="H:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"H:\Program Files\Warcraft III\War3.exe"="H:\Program Files\Warcraft III\War3.exe:*:Enabled:Warcraft III"
"I:\Program Files\Valve\Steam\SteamApps\jack_dollar\counter-strike\hl.exe"="I:\Program Files\Valve\Steam\SteamApps\jack_dollar\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"I:\Program Files\Valve\Steam\SteamApps\jack_dollar\condition zero\hl.exe"="I:\Program Files\Valve\Steam\SteamApps\jack_dollar\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"H:\Program Files\Valve\Steam\SteamApps\jack_dollar\counter-strike\hl.exe"="H:\Program Files\Valve\Steam\SteamApps\jack_dollar\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"H:\Program Files\Hamachi\hamachi.exe"="H:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"H:\Program Files\Valve\hltv.exe"="H:\Program Files\Valve\hltv.exe:*:Enabled:HLTV Launcher"
"H:\Program Files\Valve\hl.exe"="H:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"H:\Program Files\Valve\hlds.exe"="H:\Program Files\Valve\hlds.exe:*:Enabled:HLDS Launcher"
"H:\Program Files\ICQ6\ICQ.exe"="H:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"H:\Program Files\Cs_Cz\hl.exe"="H:\Program Files\Cs_Cz\hl.exe:*:Enabled:Half-Life Launcher"
"H:\Program Files\CSS\hl2.exe"="H:\Program Files\CSS\hl2.exe:*:Enabled:hl2"
"H:\WINDOWS\system32\dpvsetup.exe"="H:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"H:\WINDOWS\system32\rundll32.exe"="H:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"H:\Program Files\THQ\FSW Ten Hammers\fsw2.exe"="H:\Program Files\THQ\FSW Ten Hammers\fsw2.exe:*:Enabled:"Full Spectrum Warrrior 2: Ten Hammers" Game"
"H:\Program Files\mIRC\mirc.exe"="H:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"H:\WINDOWS\system32\dxdiag.exe"="H:\WINDOWS\system32\dxdiag.exe:*:Enabled:Microsoft DirectX Diagnostic Tool"
"H:\WINDOWS\system32\dpnsvr.exe"="H:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"H:\Program Files\SmartFTP Client\SmartFTP.exe"="H:\Program Files\SmartFTP Client\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"
"H:\Program Files\Warcraft III Demo\War3Demo.exe"="H:\Program Files\Warcraft III Demo\War3Demo.exe:*:Enabled:Warcraft III Demo"
"H:\Program Files\Warcraft III\ftinst.tmp\Warcraft III.exe"="H:\Program Files\Warcraft III\ftinst.tmp\Warcraft III.exe:*:Enabled:Warcraft III"
"H:\Documents and Settings\m-at-e-s\Plocha\WoW-BurningCrusade-enGB-Installer-downloader.exe"="H:\Documents and Settings\m-at-e-s\Plocha\WoW-BurningCrusade-enGB-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"H:\Program Files\FlashFXP\FlashFXP.exe"="H:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"
"H:\Program Files\DNA\btdna.exe"="H:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"H:\Program Files\BitTorrent\bittorrent.exe"="H:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"H:\Program Files\Counter-Strike Source\hl2.exe"="H:\Program Files\Counter-Strike Source\hl2.exe:*:Enabled:hl2"
"H:\Documents and Settings\m-at-e-s\Plocha\Counter-Strike Source\hl2.exe"="H:\Documents and Settings\m-at-e-s\Plocha\Counter-Strike Source\hl2.exe:*:Enabled:hl2"
"H:\Program Files\Valve\Steam\SteamApps\jack_dollar\dedicated server\hlds.exe"="H:\Program Files\Valve\Steam\SteamApps\jack_dollar\dedicated server\hlds.exe:*:Enabled:HLDS Launcher"
"H:\WINDOWS\system32\usmt\migwiz.exe"="H:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Průvodce přenesením souborů a nastavení"
"H:\Program Files\Sony\Vegas Pro 8.0\VegSrv80.exe"="H:\Program Files\Sony\Vegas Pro 8.0\VegSrv80.exe:*:Enabled:Sony Vegas Network Render Service Control"
"H:\Program Files\Miranda IM\miranda32.exe"="H:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"H:\Documents and Settings\Lyon\Plocha\Notor!C\MirandaPortable\App\miranda\miranda32.exe"="H:\Documents and Settings\Lyon\Plocha\Notor!C\MirandaPortable\App\miranda\miranda32.exe:*:Enabled:Miranda IM"
"H:\Documents and Settings\Mamka\Plocha\Veruš\Plocha\Warcraft III.exe"="H:\Documents and Settings\Mamka\Plocha\Veruš\Plocha\Warcraft III.exe:*:Enabled:Warcraft III"
"H:\Program Files\ICQ6.5\ICQ.exe"="H:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"H:\Program Files\VentSrv\ventrilo_srv.exe"="H:\Program Files\VentSrv\ventrilo_srv.exe:*:Enabled:ventrilo_srv"
"H:\Program Files\Vuze\Azureus.exe"="H:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus"
"H:\WINDOWS\system32\PnkBstrA.exe"="H:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"H:\WINDOWS\system32\PnkBstrB.exe"="H:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"H:\Program Files\Valve\Steam\Steam.exe"="H:\Program Files\Valve\Steam\Steam.exe:*:Enabled:Steam"
"H:\Program Files\Valve\Steam\SteamApps\jack_dollar\condition zero\hl.exe"="H:\Program Files\Valve\Steam\SteamApps\jack_dollar\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"H:\Documents and Settings\Lyon\Local Settings\Temp\Rar$EX01.906\[psy] Counter-Strike Source\hl2.exe"="H:\Documents and Settings\Lyon\Local Settings\Temp\Rar$EX01.906\[psy] Counter-Strike Source\hl2.exe:*:Enabled:hl2"
"H:\WINDOWS\system32\services.exe"="H:\WINDOWS\system32\services.exe:*:Enabled:services"
"H:\Program Files\Sony\Vegas 7.0\VegSrv70.exe"="H:\Program Files\Sony\Vegas 7.0\VegSrv70.exe:*:Enabled:Sony Vegas Network Render Service Control"
"H:\Program Files\Valve\Steam\SteamApps\pratelicek\counter-strike\hl.exe"="H:\Program Files\Valve\Steam\SteamApps\pratelicek\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"H:\Program Files\Skype\Plugin Manager\skypePM.exe"="H:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"H:\Program Files\ICQ7.0\ICQ.exe"="H:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"H:\Program Files\ICQ7.0\aolload.exe"="H:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"
"H:\Program Files\Skype\Phone\Skype.exe"="H:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"H:\Program Files\FlashFXP\FlashFXP.exe"="H:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"
"H:\Program Files\ICQ7.0\ICQ.exe"="H:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"H:\Program Files\ICQ7.0\aolload.exe"="H:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"

======List of files/folders created in the last 1 months======

2010-02-28 17:40:34 ----D---- H:\rsit
2010-02-28 17:40:34 ----D---- H:\Program Files\trend micro
2010-02-28 17:37:53 ----A---- H:\WINDOWS\ntbtlog.txt
2010-02-28 15:50:42 ----D---- H:\Documents and Settings\All Users\Data aplikací\Alwil Software
2010-02-28 15:45:11 ----D---- H:\Documents and Settings\All Users\Data aplikací\86381733
2010-02-28 15:44:47 ----D---- H:\Documents and Settings\All Users\Data aplikací\92159834
2010-02-28 15:44:17 ----D---- H:\Documents and Settings\All Users\Data aplikací\95223122
2010-02-27 23:51:17 ----A---- H:\WINDOWS\system32\psisdecd.dll
2010-02-27 23:51:12 ----A---- H:\WINDOWS\system32\dxdllreg.exe
2010-02-27 23:30:14 ----D---- H:\Program Files\Audacity
2010-02-27 17:38:05 ----D---- H:\Documents and Settings\All Users\Data aplikací\Google
2010-02-27 15:51:04 ----D---- H:\Program Files\select_path_to_counter-strike
2010-02-26 20:36:11 ----D---- H:\Program Files\Vstplugins
2010-02-26 16:39:13 ----D---- H:\Documents and Settings\Lyon\Data aplikací\Publish Providers
2010-02-24 18:00:21 ----HDC---- H:\WINDOWS\$NtUninstallKB979306$
2010-02-21 19:53:11 ----D---- H:\Documents and Settings\All Users\Data aplikací\ROCCAT
2010-02-21 19:52:51 ----D---- H:\Program Files\ROCCAT
2010-02-13 10:10:42 ----HD---- H:\$AVG
2010-02-13 10:09:47 ----D---- H:\Documents and Settings\All Users\Data aplikací\avg9
2010-02-10 18:04:00 ----HDC---- H:\WINDOWS\$NtUninstallKB978262$
2010-02-10 18:03:55 ----HDC---- H:\WINDOWS\$NtUninstallKB971468$
2010-02-10 18:01:28 ----HDC---- H:\WINDOWS\$NtUninstallKB978037$
2010-02-10 18:01:22 ----HDC---- H:\WINDOWS\$NtUninstallKB975713$
2010-02-10 18:01:16 ----HDC---- H:\WINDOWS\$NtUninstallKB978251$
2010-02-10 18:01:10 ----HDC---- H:\WINDOWS\$NtUninstallKB975560$
2010-02-10 18:01:01 ----HDC---- H:\WINDOWS\$NtUninstallKB977914$
2010-02-10 18:00:52 ----HDC---- H:\WINDOWS\$NtUninstallKB978706$
2010-02-10 18:00:39 ----HDC---- H:\WINDOWS\$NtUninstallKB977165$
2010-02-10 15:58:35 ----D---- H:\Program Files\Widcomm
2010-02-07 14:24:42 ----D---- H:\WINDOWS\Sun
2010-02-07 14:17:21 ----D---- H:\Documents and Settings\All Users\Data aplikací\Sun
2010-02-07 14:17:10 ----A---- H:\WINDOWS\system32\deploytk.dll
2010-02-07 14:16:10 ----D---- H:\Documents and Settings\Lyon\Data aplikací\Sun

======List of files/folders modified in the last 1 months======

2010-02-28 17:40:34 ----RD---- H:\Program Files
2010-02-28 17:38:13 ----D---- H:\WINDOWS\system32\CatRoot2
2010-02-28 17:37:53 ----D---- H:\WINDOWS
2010-02-28 17:37:11 ----A---- H:\WINDOWS\SchedLgU.Txt
2010-02-28 17:21:39 ----D---- H:\WINDOWS\Prefetch
2010-02-28 17:19:55 ----D---- H:\Documents and Settings\Lyon\Data aplikací\Skype
2010-02-28 17:05:41 ----D---- H:\WINDOWS\Temp
2010-02-28 17:05:37 ----HD---- H:\WINDOWS\inf
2010-02-28 17:03:37 ----D---- H:\WINDOWS\system32\config
2010-02-28 17:03:16 ----D---- H:\WINDOWS\system32\wbem
2010-02-28 17:03:15 ----D---- H:\WINDOWS\Registration
2010-02-28 17:03:05 ----D---- H:\WINDOWS\system32
2010-02-28 17:02:57 ----SHD---- H:\WINDOWS\Installer
2010-02-28 17:02:57 ----SHD---- H:\Config.Msi
2010-02-28 17:02:57 ----RSHDC---- H:\WINDOWS\system32\dllcache
2010-02-28 15:51:02 ----D---- H:\WINDOWS\system32\drivers
2010-02-28 15:50:42 ----D---- H:\Program Files\Alwil Software
2010-02-28 15:32:43 ----A---- H:\WINDOWS\NeroDigital.ini
2010-02-28 15:17:03 ----D---- H:\Documents and Settings\Lyon\Data aplikací\Adobe
2010-02-28 15:00:07 ----D---- H:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2010-02-28 12:56:26 ----D---- H:\Documents and Settings\Lyon\Data aplikací\ICQ
2010-02-28 01:30:17 ----D---- H:\Documents and Settings\Lyon\Data aplikací\skypePM
2010-02-27 23:57:40 ----D---- H:\Program Files\Adobe
2010-02-27 23:53:47 ----D---- H:\Program Files\Common Files\Adobe
2010-02-27 23:51:57 ----D---- H:\WINDOWS\system32\DirectX
2010-02-27 23:51:49 ----D---- H:\WINDOWS\RegisteredPackages
2010-02-27 21:09:59 ----D---- H:\Program Files\AV Vcs 4.0
2010-02-27 21:07:08 ----D---- H:\Program Files\Eset
2010-02-27 21:06:54 ----D---- H:\Program Files\Miranda IM
2010-02-27 20:42:57 ----D---- H:\Program Files\Valve
2010-02-27 20:42:10 ----D---- H:\Program Files\Stardock
2010-02-27 20:42:07 ----RSD---- H:\WINDOWS\assembly
2010-02-27 19:09:33 ----D---- H:\WINDOWS\system
2010-02-27 17:38:05 ----D---- H:\Program Files\Google
2010-02-27 17:38:04 ----SD---- H:\WINDOWS\Tasks
2010-02-27 17:02:00 ----D---- H:\Program Files\Common Files\DVDVideoSoft
2010-02-27 17:00:21 ----D---- H:\Program Files\Goto Software
2010-02-27 17:00:21 ----D---- H:\Documents and Settings\All Users\Data aplikací\VadeRetro
2010-02-27 16:59:58 ----D---- H:\WINDOWS\system32\Macromed
2010-02-27 16:56:06 ----D---- H:\Program Files\Common Files
2010-02-27 16:55:12 ----D---- H:\Program Files\IrfanView
2010-02-27 15:27:42 ----D---- H:\Documents and Settings\Lyon\Data aplikací\Sony
2010-02-27 15:17:21 ----D---- H:\Documents and Settings\All Users\Data aplikací\Sony
2010-02-26 23:08:06 ----D---- H:\Program Files\Sony
2010-02-26 23:07:27 ----D---- H:\Program Files\totalcmd
2010-02-26 22:17:30 ----D---- H:\Program Files\Spyware Terminator
2010-02-26 22:14:55 ----D---- H:\Documents and Settings\Lyon\Data aplikací\Spyware Terminator
2010-02-26 16:35:31 ----D---- H:\WINDOWS\WinSxS
2010-02-25 19:33:13 ----D---- H:\WINDOWS\Minidump
2010-02-25 19:33:13 ----D---- H:\WINDOWS\Debug
2010-02-25 19:32:44 ----D---- H:\Documents and Settings\All Users\Data aplikací\EPS
2010-02-25 19:32:28 ----D---- H:\Fraps
2010-02-21 19:53:02 ----DC---- H:\WINDOWS\system32\DRVSTORE
2010-02-21 19:52:51 ----HD---- H:\Program Files\InstallShield Installation Information
2010-02-21 17:28:24 ----AD---- H:\Documents and Settings\All Users\Data aplikací\TEMP
2010-02-20 16:27:18 ----D---- H:\Program Files\ICQ7.0
2010-02-13 15:53:50 ----SD---- H:\Documents and Settings\Lyon\Data aplikací\Microsoft
2010-02-13 10:10:42 ----D---- H:\Documents and Settings
2010-02-13 10:09:37 ----D---- H:\Program Files\Common Files\Microsoft Shared
2010-02-10 18:04:00 ----HD---- H:\WINDOWS\$hf_mig$
2010-02-08 18:00:44 ----D---- H:\WINDOWS\system32\cs-cz
2010-02-08 18:00:44 ----D---- H:\Program Files\Internet Explorer
2010-02-01 20:26:20 ----A---- H:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 kbdhid;Ovladač klávesnice standardu HID; H:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; H:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;HID Class Driver; H:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 KoneFltr;ROCCAT Kone; H:\WINDOWS\system32\drivers\Kone.sys [2008-09-22 12672]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; H:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2007-04-11 20496]
R3 mouhid;Ovladač myši standardu HID; H:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; H:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-08-07 98944]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; H:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; H:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; H:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; H:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; H:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 8374c414;8374c414; H:\WINDOWS\System32\drivers\8374c414.sys []
S1 intelppm;Řadič procesoru Intel; H:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
S1 sp_rsdrv2;Spyware Terminator Driver 2; \??\H:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
S3 ati2mtag;ati2mtag; H:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-11-29 2830336]
S3 BTDriver;Bluetooth Virtual Communications Driver; H:\WINDOWS\system32\DRIVERS\btport.sys [2001-09-11 28324]
S3 BTWDNDIS;Bluetooth LAN Access Server; H:\WINDOWS\system32\DRIVERS\btwdndis.sys [2001-09-11 67248]
S3 cpuz132;cpuz132; \??\H:\WINDOWS\system32\drivers\cpuz132_x32.sys []
S3 ET5Drv;ET5Drv; \??\H:\WINDOWS\system32\Drivers\ET5Drv.sys []
S3 gdrv;gdrv; \??\H:\WINDOWS\gdrv.sys []
S3 hamachi;Hamachi Network Interface; H:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-04-26 25280]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); H:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-18 4547584]
S3 L8042mou;SetPoint PS/2 Mouse Filter Driver; H:\WINDOWS\system32\DRIVERS\L8042mou.Sys [2007-04-11 63248]
S3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; H:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2007-04-11 34832]
S3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; H:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2007-04-11 36112]
S3 LMouKE;SetPoint Mouse Filter Driver; H:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2007-04-11 79376]
S3 PnkBstrK;PnkBstrK; \??\H:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 ROOTMODEM;Microsoft Legacy Modem Driver; H:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-18 5888]
S3 usbprint;Třída USB Printer; H:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 Wdf01000;Wdf01000; H:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 win32x;win32x; \??\H:\WINDOWS\system32\drivers\win32x.sys []
S3 WpdUsb;WpdUsb; H:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; H:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; H:\WINDOWS\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; H:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-18 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 Ati HotKey Poller;Ati HotKey Poller; H:\WINDOWS\system32\Ati2evxx.exe [2006-11-29 430080]
S2 ATI Smart;ATI Smart; H:\WINDOWS\system32\ati2sgag.exe [2006-11-28 520192]
S2 ICQ Service;ICQ Service; H:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-10-19 222456]
S2 IJPLMSVC;PIXMA Extended Survey Program; H:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 97432]
S2 MDM;Machine Debug Manager; H:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
S2 PnkBstrA;PnkBstrA; H:\WINDOWS\system32\PnkBstrA.exe [2009-07-26 75064]
S2 PnkBstrB;PnkBstrB; H:\WINDOWS\system32\PnkBstrB.exe [2009-07-26 189784]
S2 sp_rssrv;Spyware Terminator Realtime Shield Service; H:\Program Files\Spyware Terminator\sp_rsser.exe [2009-03-10 570880]
S2 Ventrilo;Ventrilo; H:\Program Files\VentSrv\ventrilo_svc.exe []
S2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; H:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 Adobe LM Service;Adobe LM Service; H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-02-12 72704]
S3 aspnet_state;Stavová služba ASP.NET; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; H:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-20 137200]
S3 idsvc;Služba Windows CardSpace; H:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 mssql$sony_mediamgr;MSSQL$SONY_MEDIAMGR; H:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe [2002-12-17 7520337]
S3 mssqlserveradhelper;MSSQLServerADHelper; H:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2002-12-17 66112]
S3 NBService;NBService; H:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-04-13 792112]
S3 NMIndexingService;NMIndexingService; H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-01 271920]
S3 ose;Office Source Engine; H:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 sqlagent$sony_mediamgr;SQLAgent$SONY_MEDIAMGR; H:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE [2002-12-17 311872]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; H:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; H:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: RSIT log security tool/s

#2 Příspěvek od motji »

Dobrý večer :)
V nouzovém režimu:

:arrow: Combofix stahněte takto:
- pravým myšítkem klikněte na odkaz combofixu --uložit jako.. ,a teď ho přejmenujte na Potvora.com a uložte.


:arrow: Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna :!:

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.

mik99
Návštěvník
Návštěvník
Příspěvky: 2
Registrován: 28 úno 2010 17:45

Re: RSIT log security tool/s

#3 Příspěvek od mik99 »

diky moc problem je vyresen :) PC zase jede jak ma :-)

Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: RSIT log security tool/s

#4 Příspěvek od motji »

:o A jak jste ho vyřešil?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.

Zamčeno