kontrola combofix - nejde sluzba centrum bezpecnosti

[liam]

ComboFix 12-01-23.02 - DURISS51 24.01.2012 13:09:20.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.1013.629 [GMT 1:00]
Running from: c:\documents and settings\duriss51\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((( Files Created from 2011-12-24 to 2012-01-24 )))))))))))))))))))))))))))))))
.
.
2012-01-24 09:46 . 2001-08-17 12:28 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys
2012-01-24 09:45 . 2001-08-17 12:28 113762 -c--a-w- c:\windows\system32\dllcache\usrpda.sys
2012-01-24 09:44 . 2001-08-17 21:36 525568 -c--a-w- c:\windows\system32\dllcache\tridxp.dll
2012-01-24 09:43 . 2001-08-17 13:56 172768 -c--a-w- c:\windows\system32\dllcache\t2r4disp.dll
2012-01-24 09:42 . 2001-08-17 12:56 7552 -c--a-w- c:\windows\system32\dllcache\sonypvu1.sys
2012-01-24 09:41 . 2001-08-17 11:12 91294 -c--a-w- c:\windows\system32\dllcache\skfpwin.sys
2012-01-24 09:40 . 2001-08-17 12:51 17280 -c--a-w- c:\windows\system32\dllcache\scr111.sys
2012-01-24 09:39 . 2008-04-13 23:10 79104 -c--a-w- c:\windows\system32\dllcache\rocket.sys
2012-01-24 09:38 . 2001-08-17 12:51 16128 -c--a-w- c:\windows\system32\dllcache\pscr.sys
2012-01-24 09:37 . 2001-08-17 13:05 25216 -c--a-w- c:\windows\system32\dllcache\ovsound2.sys
2012-01-24 09:36 . 2008-04-13 21:05 132695 -c--a-w- c:\windows\system32\dllcache\netwlan5.sys
2012-01-24 09:35 . 2001-08-17 13:02 35200 -c--a-w- c:\windows\system32\dllcache\msgame.sys
2012-01-24 09:34 . 2001-08-17 21:36 58368 -c--a-w- c:\windows\system32\dllcache\m3091dc.dll
2012-01-24 09:33 . 2001-08-17 12:49 26624 -c--a-w- c:\windows\system32\dllcache\irstusb.sys
2012-01-24 09:32 . 2001-08-17 11:11 28700 -c--a-w- c:\windows\system32\dllcache\ibmexmp.sys
2012-01-24 09:31 . 2001-08-17 21:36 93696 -c--a-w- c:\windows\system32\dllcache\hpgt42.dll
2012-01-24 09:30 . 2001-08-17 11:10 22090 -c--a-w- c:\windows\system32\dllcache\fem556n5.sys
2012-01-24 09:29 . 2001-08-17 11:10 69692 -c--a-w- c:\windows\system32\dllcache\el575nd5.sys
2012-01-24 09:28 . 2001-08-17 11:12 117760 -c--a-w- c:\windows\system32\dllcache\d100ib5.sys
2012-01-24 09:27 . 2001-08-17 12:51 13824 -c--a-w- c:\windows\system32\dllcache\bulltlp3.sys
2012-01-24 09:26 . 2001-08-17 13:07 101888 -c--a-w- c:\windows\system32\dllcache\adpu160m.sys
2012-01-24 09:19 . 2012-01-24 09:19 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2012-01-24 08:46 . 2012-01-24 08:46 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-23 07:22 . 2001-08-17 12:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2012-01-23 07:22 . 2001-08-17 12:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2012-01-17 10:06 . 2012-01-17 10:06 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-17 10:06 . 2012-01-17 10:06 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-17 10:06 . 2012-01-17 10:06 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-01-17 10:06 . 2012-01-17 10:06 43992 ----a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-01-16 13:40 . 2012-01-16 13:40 -------- d-----w- c:\program files\DRSR
2012-01-16 13:38 . 2012-01-16 13:38 -------- d-----w- c:\documents and settings\duriss51\Local Settings\Application Data\Daňové_riaditeľstvo_SR
2012-01-16 13:37 . 2012-01-19 12:10 -------- d-----w- c:\documents and settings\duriss51\Local Settings\Application Data\Deployment
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-13 12:00 . 2011-04-18 11:45 16 ----a-w- c:\documents and settings\duriss51\pcUM31.dll
2011-12-10 14:24 . 2011-05-10 08:25 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-25 21:57 . 2006-02-28 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 13:25 . 2006-02-28 12:00 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-18 12:35 . 2006-02-28 12:00 60416 ----a-w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2006-02-28 12:00 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2006-02-28 12:00 152064 ----a-w- c:\windows\system32\schannel.dll
2011-11-04 19:20 . 2006-02-28 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2006-02-28 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2006-02-28 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2006-02-28 12:00 385024 ----a-w- c:\windows\system32\html.iec
2011-11-03 15:28 . 2006-02-28 12:00 386048 ----a-w- c:\windows\system32\qdvd.dll
2011-11-03 15:28 . 2006-02-28 12:00 1292288 ----a-w- c:\windows\system32\quartz.dll
2011-11-01 16:07 . 2006-02-28 12:00 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2006-02-28 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2012-01-17 10:06 . 2011-05-19 12:36 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" [2011-12-29 620376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-13 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-13 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-13 138008]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-18 2247]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 5]
2011-12-29 15:43 620376 ----a-w- c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2011-02-24 06:31 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"HP LaserJet Service"=2 (0x2)
"gusvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"602XML Updater"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Teamware\\Office\\twnoti32.exe"=
"c:\\WINDOWS\\system32\\ntvdm.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [24.01.2012 8:50 14776]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [06.02.2009 14:23 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [06.02.2009 14:24 94872]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12.01.2011 15:41 810144]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10.05.2011 9:25 652872]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10.05.2011 9:25 20464]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 13:16 130384]
S3 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [23.01.2012 8:50 497496]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [28.02.2006 13:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 13:16 753504]
S4 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [14.04.2010 11:28 73728]
S4 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [24.02.2011 7:32 136176]
S4 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [24.02.2011 7:32 136176]
S4 HP LaserJet Service;HP LaserJet Service;c:\program files\HP\HPLaserJetService\HPLaserJetService.exe [12.04.2010 8:13 142336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-24 c:\windows\Tasks\At1.job
- c:\program files\HP\HPLJUT\HPLJUTSCH.exe [2010-05-02 17:02]
.
2011-04-21 c:\windows\Tasks\At2.job
- c:\program files\HP\HPLJUT\HPLJUTSCH.exe [2010-05-02 17:02]
.
2012-01-23 c:\windows\Tasks\At3.job
- c:\program files\HP\HPLJUT\HPLJUTSCH.exe [2010-05-02 17:02]
.
2012-01-23 c:\windows\Tasks\At4.job
- c:\program files\HP\HPLJUT\HPLJUTSCH.exe [2010-05-02 17:02]
.
2012-01-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-24 06:32]
.
2012-01-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-24 06:32]
.
2012-01-24 c:\windows\Tasks\User_Feed_Synchronization-{F028743B-85F8-4F6F-B16E-A07B54D7A632}.job
- c:\windows\system32\msfeedssync.exe [2010-07-26 02:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = XXXXX:3128
uInternet Settings,ProxyOverride = <local>
Trusted Zone: ask.com\eu
Trusted Zone: disig.sk\www
Trusted Zone: drsr.sk\www
Trusted Zone: vszp.sk\portal
Trusted Zone: vszp.sk\www
TCP: Interfaces\{9CCFD200-E6C5-484C-86F7-B3E03F6EF7CC}: NameServer = XXXXXXX
TCP: Interfaces\{DC4A3982-0DCF-491D-91E9-6AE8F39FF60B}: NameServer = XXXXXXXDPF: {CF2BD3ED-F1CE-11D4-9B98-005004CA7085} - hxxps://eportal.apollo.sk/dll/SignForm.dll
FF - ProfilePath - c:\documents and settings\duriss51\Application Data\Mozilla\Firefox\Profiles\i5bzj0uw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q=
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FXTV5&o=101699&locale=en_EU&apn_uid=4F52A3B2-3EA5-4043-BD1C-2B5725CB37B3&apn_ptnrs=F4&apn_sauid=6E20E539-D8E7-49F9-BBF6-DDA63EE199E6&apn_dtid=YYYYYYYYSK&q=
FF - prefs.js: network.proxy.ftp - XXX
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.gopher - XXX
FF - prefs.js: network.proxy.gopher_port - 3128
FF - prefs.js: network.proxy.http - XXX
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.socks - XXXX
FF - prefs.js: network.proxy.socks_port - 3128
FF - prefs.js: network.proxy.ssl - XXX
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 0
pref('extensions.shownSelectionUI',true); pref('extensions.autoDisableScopes',0);
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-24 13:12
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2384)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2012-01-24 13:13:46
ComboFix-quarantined-files.txt 2012-01-24 12:13
.
Pre-Run: 84 079 943 680 bytes free
Post-Run: 84 112 617 472 bytes free
.
- - End Of File - - 4982D95A9DCBC4AB663669793C02FC75

[vyosek]

Zdravim a pekny den preji

Jedna se o domaci PC nebo nejaky pracovni PC

vy umite pracovat s ComboFixem

Zda se mi to, nebo jste ten log nejak upravoval

[liam]

pracovne pc , combofix klasika ulozene na plochu, pustene a nechane dobehnut , log upravovany neni

[vyosek]

Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

CF tohle takhle detekoval

uInternet Settings,ProxyServer = XXXXX:3128
TCP: Interfaces\{9CCFD200-E6C5-484C-86F7-B3E03F6EF7CC}: NameServer = XXXXXXX

Pravidla fora, vsak hovori ohleden pomoci s firemnimi PC jasne, coz jako vzorny navstevnik byste mel vedet - i prot mate hodnost vn a ocekava se znalost pravidel fora

6. Fórum viry.cz se nezabývá odvirováním firemních PC - na toto jsou ve firmách placení (a někdy až hodně nadstandardně) IT technici, případně si je firma může najmou. My jsme tu zdarma a ve svém volném čase, nehodláme dělat práci za někoho jiného, kdo si pak jen slízne smetánku a plat. Taktéž ani neposkytujeme poradenství v oblasti zabezpečení firemních sítí či nastavení firemních sítí. Zkrátka a jednoduše, naše fórum poskytuje podporu domácím uživatelům.

[liam]

ok dik, tie " xxxx " som premenoval lokalnu ip adresu , neni potrebna vidiet

mozte lock , skusim sa s tym este nejak pohrat

[vyosek]

ok dik, tie " xxxx " som premenoval lokalnu ip adresu , neni potrebna vidiet

Proto jsem se ptal, jestli jste log upravoval A vy mi reknete ze ne

Tema zamykam