Poprosím o kontrolu logu

[maxim-SK]

Zdravím poprosil by som Vás o kontrolu logu, podozrenie na možný vírus, ďakujem

Logfile of random's system information tool 1.08 (written by random/random)
Run by Owner at 2010-07-08 10:29:09
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 46 GB (90%) free of 51 GB
Total RAM: 447 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:29:18, on 8. 7. 2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\My Documents\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Owner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

--
End of file - 3282 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-06-28 344064]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-03-29 2145000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2006-02-28 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-06-29 46080]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-07-08 10:29:10 ----D---- C:\Program Files\trend micro
2010-07-08 10:29:09 ----D---- C:\rsit
2010-07-08 10:18:00 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-07-08 10:17:53 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$
2010-07-08 10:17:46 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-07-08 10:17:29 ----HDC---- C:\WINDOWS\$NtUninstallKB981793$
2010-07-08 10:17:23 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-07-08 10:17:14 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-07-08 10:17:07 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2010-07-08 10:17:03 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-07-08 10:16:46 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2010-07-08 10:09:14 ----D---- C:\Program Files\ESET
2010-07-08 10:09:14 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2010-07-08 10:05:31 ----D---- C:\WINDOWS\ie8updates
2010-07-08 10:04:47 ----D---- C:\WINDOWS\WBEM
2010-07-08 10:03:13 ----HDC---- C:\WINDOWS\ie8
2010-07-08 10:03:13 ----D---- C:\WINDOWS\system32\en-US
2010-07-08 10:01:58 ----A---- C:\WINDOWS\system32\MRT.exe

======List of files/folders modified in the last 1 months======

2010-07-08 10:29:10 ----RD---- C:\Program Files
2010-07-08 10:29:10 ----D---- C:\WINDOWS\Temp
2010-07-08 10:26:53 ----D---- C:\WINDOWS\system32
2010-07-08 10:26:53 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-07-08 10:25:49 ----D---- C:\WINDOWS
2010-07-08 10:25:30 ----D---- C:\WINDOWS\system32\drivers
2010-07-08 10:25:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-07-08 10:18:03 ----HD---- C:\WINDOWS\inf
2010-07-08 10:18:02 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-07-08 10:17:56 ----A---- C:\WINDOWS\imsins.BAK
2010-07-08 10:17:52 ----HD---- C:\WINDOWS\$hf_mig$
2010-07-08 10:09:54 ----SHD---- C:\WINDOWS\Installer
2010-07-08 10:09:38 ----D---- C:\WINDOWS\system32\CatRoot2
2010-07-08 10:07:26 ----D---- C:\WINDOWS\Help
2010-07-08 10:07:26 ----D---- C:\Program Files\Internet Explorer
2010-07-08 10:04:52 ----D---- C:\WINDOWS\system32\config
2010-07-08 10:04:39 ----D---- C:\WINDOWS\Media
2010-07-08 09:59:30 ----D---- C:\WINDOWS\WinSxS
2010-07-08 09:58:36 ----HD---- C:\Program Files\InstallShield Installation Information
2010-07-08 09:58:35 ----D---- C:\Program Files\Carambis
2010-07-08 09:50:54 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-07-08 09:50:42 ----D---- C:\WINDOWS\system32\wbem
2010-07-08 09:50:42 ----D---- C:\WINDOWS\AppPatch

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-03-29 114984]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-03-29 95872]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-02-28 36096]
R2 Angelnt;Angelnt; C:\WINDOWS\System32\Drivers\ANGELNT.SYS [2010-05-17 51072]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-03-29 140216]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-06-29 1241088]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2006-06-28 81920]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-06-29 376832]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-29 810120]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-03-29 33560]

-----------------EOF-----------------

[vyosek]

Zdravim a pekne dopoledne preji

Proc mate podezreni na nejakou havet Projevuje se nejak

Log vypada zcela OK...

[maxim-SK]

nefunguje aktualizácia Nod32, pred pár týždňami som bojoval s podobným problémom, vtedy to blokoval vírus, preto som teraz trochu paranoidný možno je len problém z aktualizačným serverom pretože neberiem aktualizácie priamo z domovského servra, ale istota je istota

[vyosek]

Odkud tedy prebirate aktualizace

Kontaktujte technickou podporu ESETu, jako platici zakaznik mate na ni samozrejme narok...

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

• Provedte aktualizaci - treti zalozka
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

[maxim-SK]

nod mame multilicenciu pre školu a aktualizácie sa ťahajú z jedného servra pre všetky školy.
MBAM nenašiel nič, takže to bude asi falošný poplach.
ďakujem za spoluprácu.

[vyosek]

Tak falesny poplach to byt nemusite - jakou mate prave verzi databaze Jak dlouho se NOD neaktualizoval Muzete mi prosim dat link na topic, kde jste tento problem resil...

[maxim-SK]

prepáčte, bol som na dovolenke je ešte možné problém riešiť?

[vyosek]

Zdravim po navratu z dovolenky

Samozrejme ze je mozne problem resit...

Tak falesny poplach to byt nemusite - jakou mate prave verzi databaze Jak dlouho se NOD neaktualizoval Muzete mi prosim dat link na topic, kde jste tento problem resil...