Prosím o kontrolu logu

[zahry]

Avast mi pořád hlásí trojského koníka.Prosím o pomoc nejde s ním nic udělat.
Děkuji

Logfile of random's system information tool 1.06 (written by random/random)
Run by petr at 2010-02-10 18:29:13
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 829 MB (4%) free of 20 GB
Total RAM: 1279 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:29:41, on 10.2.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programy\Avast4\aswUpdSv.exe
C:\Programy\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programy\Avast4\ashMaiSv.exe
C:\Programy\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Documents and Settings\petr\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\petr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\Programy\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programy\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Documents and Settings\petr\Dokumenty\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programy\Acrobat 7.0\Setup Files\Reader\reader_sl.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programy\MS Office\Office10\OSA.EXE
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\Programy\MSOFFI~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programy\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programy\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programy\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programy\Avast4\ashWebSv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 4144 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2009-10-14 1219584]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-11-24 953800]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\Programy\Avast4\ashDisp.exe [2009-11-25 81000]
"SpywareTerminator"=C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe [2009-10-25 2172416]
"QuickTime Task"=C:\Programy\QuickTime\QTTask.exe [2009-11-10 417792]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Documents and Settings\petr\Dokumenty\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"Advanced SystemCare 3"=C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe [2010-02-01 2342608]

C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
Adobe Reader Speed Launch.lnk - C:\Programy\Acrobat 7.0\Setup Files\Reader\reader_sl.exe
Akcelerátor spuštění AutoCADu.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
Microsoft Office.lnk - C:\Programy\MS Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveSearch"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - "C:\WINDOWS\system32\NOTEPAD.EXE" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-02-10 18:29:13 ----D---- C:\rsit
2010-02-10 18:29:13 ----D---- C:\Program Files\trend micro
2010-02-10 18:18:51 ----A---- C:\ComboFix.txt
2010-02-10 18:10:55 ----A---- C:\Boot.bak
2010-02-10 18:10:49 ----RASHD---- C:\cmdcons
2010-02-10 18:09:35 ----A---- C:\WINDOWS\PEV.exe
2010-02-10 18:09:35 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-10 18:09:35 ----A---- C:\WINDOWS\MBR.exe
2010-02-10 18:09:34 ----A---- C:\WINDOWS\zip.exe
2010-02-10 18:09:34 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-10 18:09:34 ----A---- C:\WINDOWS\SWSC.exe
2010-02-10 18:09:34 ----A---- C:\WINDOWS\SWREG.exe
2010-02-10 18:09:34 ----A---- C:\WINDOWS\sed.exe
2010-02-10 18:09:34 ----A---- C:\WINDOWS\grep.exe
2010-02-10 18:09:13 ----D---- C:\WINDOWS\ERDNT
2010-02-10 18:07:30 ----D---- C:\Qoobox
2010-02-09 23:36:35 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-02-09 21:47:57 ----D---- C:\Program Files\IObit
2010-02-09 19:37:27 ----D---- C:\WINDOWS\system32\PreInstall
2010-02-09 19:37:19 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2010-02-09 19:37:13 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2010-02-09 08:59:13 ----A---- C:\phyaddr.txt
2010-02-09 07:53:56 ----A---- C:\ipconfig.txt
2010-02-06 01:04:05 ----A---- C:\WINDOWS\Čestina do SimCity 4 Rush Hour a Delux BETA Uninstaller.exe
2010-01-19 20:39:42 ----D---- C:\Documents and Settings\petr\Data aplikací\Nero
2010-01-19 20:34:50 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Nero
2010-01-13 16:46:46 ----A---- C:\WINDOWS\iun6002.exe
2010-01-13 16:45:28 ----A---- C:\WINDOWS\Codec Pack - All In 1 Setup Log.txt

======List of files/folders modified in the last 1 months======

2010-02-10 18:29:13 ----RAD---- C:\Program Files
2010-02-10 18:23:25 ----D---- C:\Program Files\Mozilla Firefox
2010-02-10 18:19:00 ----D---- C:\WINDOWS\Temp
2010-02-10 18:18:53 ----D---- C:\WINDOWS\Prefetch
2010-02-10 18:17:15 ----D---- C:\WINDOWS
2010-02-10 18:17:15 ----A---- C:\WINDOWS\system.ini
2010-02-10 18:16:50 ----D---- C:\WINDOWS\system32
2010-02-10 18:15:40 ----D---- C:\WINDOWS\system32\drivers
2010-02-10 18:15:40 ----D---- C:\WINDOWS\AppPatch
2010-02-10 18:15:29 ----D---- C:\Program Files\Common Files
2010-02-10 18:13:31 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-10 18:10:55 ----RASH---- C:\boot.ini
2010-02-10 18:09:46 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-09 23:36:47 ----HD---- C:\WINDOWS\inf
2010-02-09 23:36:39 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-09 23:36:35 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-09 22:04:35 ----D---- C:\Documents and Settings\petr\Data aplikací\Spyware Terminator
2010-02-09 22:04:34 ----D---- C:\Program Files\Spyware Terminator
2010-02-09 21:38:27 ----D---- C:\hry
2010-02-09 17:14:39 ----D---- C:\WINDOWS\SoftwareDistribution
2010-02-09 17:14:36 ----D---- C:\WINDOWS\Help
2010-02-08 20:26:38 ----D---- C:\Programy
2010-02-08 19:22:23 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
2010-02-01 16:46:10 ----SD---- C:\WINDOWS\Tasks
2010-01-19 20:36:16 ----SHD---- C:\WINDOWS\Installer
2010-01-19 20:36:02 ----D---- C:\Program Files\Common Files\Nero
2010-01-19 20:34:28 ----D---- C:\WINDOWS\WinSxS
2010-01-19 20:34:28 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-01-13 16:46:38 ----D---- C:\Program Files\Codec Pack - All In 1

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2004-08-17 41216]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R3 ALCXWDM;Service for Avance AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2001-09-19 285533]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S3 catchme;catchme; \??\C:\DOCUME~1\petr\LOCALS~1\Temp\catchme.sys []
S3 mbr;mbr; \??\C:\DOCUME~1\petr\LOCALS~1\Temp\mbr.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
Avast mi pořád hlásí trojského koníčka.Nic s ním nejde udělat.
Díky za radu

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Programy\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Programy\Avast4\ashServ.exe [2009-11-25 138680]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Programy\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Programy\Avast4\ashWebSv.exe [2009-11-25 352920]
S2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2009-10-25 487936]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2007-03-26 77944]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]

-----------------EOF-----------------

[Diallix]

Zdravim.

Kde vir hlasi a o aky typ vira ide?

[zahry]

Občas mi z ničeho nic přestané hrát zvuk chíli jede a pak ticho, myslel jsem že to může být tím virem.Ale pokud je log OK tak nevím no.
Log je možná zkreslený před odesláním logu jsem PC projel ¨pomocí ComboFixu tak nevím jestli jsem náhodou neudělal chybu

[zahry]

Jmeno souboru:C:\WINDOWS\TEMP\clamav-02e9ad65fe2b7f85592254fb0070e5d0.0

Jméno vzorku:JS:ScriptSH-inf[Trj]

Typ malware: Trojský kůň

Verze VPS:1000129-1, 29.01.2010

[Diallix]

Combofix by ste mal nechat na skusenych a nie si ho svojvolne pouzivat. Potom vam nikto za nic neruci, ale to je uz Vasa vec.

Zmazat celu zlozku C:\WINDOWS\TEMP

Zvuk prestane pri akej akcii? Audio, video, games?

[zahry]

Zvuk nehrál přestal po chvilce hrát při zapnutí WMP ale už je to v pořádku. Složku TEMP pro jistotu smažu. Díky

[Diallix]

Zatial za nic.