Prosim o preventivni kontrolu logu

[worm11]

Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2010-09-18 12:48:09
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 3 GB (45%) free of 7 GB
Total RAM: 247 MB (10% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:49:13, on 18.9.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Plocha\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6709150156
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 7\Dfsdks.exe

--
End of file - 3038 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\iMeshNAG.job
C:\WINDOWS\tasks\MP Scheduled Scan.job

======Registry dump======

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
C:\Program Files\Google\Google Talk\googletalk.exe [2007-01-01 3739648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\system32\hkcmd.exe [2004-11-02 126976]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe [2004-11-02 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSSE]
C:\Program Files\Microsoft Security Essentials\msseces.exe [2010-06-01 1093208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2004-11-02 348160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Google\Google Talk\googletalk.exe"="C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-09-18 12:48:13 ----D---- C:\Program Files\trend micro
2010-09-18 12:48:09 ----D---- C:\rsit
2010-09-18 12:21:50 ----D---- C:\WINDOWS\system32\appmgmt
2010-09-15 23:43:24 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Opera
2010-09-15 23:42:09 ----D---- C:\Program Files\Opera
2010-09-15 10:53:49 ----A---- C:\WINDOWS\system32\DfSdkBt.exe
2010-09-15 07:29:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2259922$
2010-09-15 07:29:37 ----HDC---- C:\WINDOWS\$NtUninstallKB975558_WM8$
2010-09-15 07:29:26 ----HDC---- C:\WINDOWS\$NtUninstallKB2347290$
2010-09-15 07:29:10 ----HDC---- C:\WINDOWS\$NtUninstallKB2121546$
2010-09-15 07:28:56 ----HDC---- C:\WINDOWS\$NtUninstallKB982802$
2010-09-15 07:28:29 ----HDC---- C:\WINDOWS\$NtUninstallKB981322$
2010-09-15 07:24:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2141007$
2010-09-06 12:16:47 ----D---- C:\Program Files\The KMPlayer
2010-08-19 07:24:38 ----D---- C:\Program Files\Microsoft Security Essentials

======List of files/folders modified in the last 1 months======

2010-09-18 12:48:48 ----D---- C:\WINDOWS\Prefetch
2010-09-18 12:48:13 ----RD---- C:\Program Files
2010-09-18 12:48:09 ----D---- C:\WINDOWS\Temp
2010-09-18 12:23:42 ----D---- C:\Program Files\MyAshampoo
2010-09-18 12:21:50 ----D---- C:\WINDOWS\system32
2010-09-18 12:21:49 ----SHD---- C:\WINDOWS\Installer
2010-09-18 12:21:47 ----SD---- C:\WINDOWS\Tasks
2010-09-18 09:37:31 ----D---- C:\WINDOWS
2010-09-18 08:58:29 ----D---- C:\WINDOWS\system32\CatRoot2
2010-09-18 02:39:03 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-09-15 23:02:09 ----D---- C:\WINDOWS\Debug
2010-09-15 22:52:48 ----HD---- C:\WINDOWS\inf
2010-09-15 22:52:25 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-09-15 22:48:21 ----A---- C:\WINDOWS\system32\MRT.exe
2010-09-15 22:41:59 ----D---- C:\WINDOWS\system32\CatRoot
2010-09-15 10:38:41 ----D---- C:\WINDOWS\system32\config
2010-09-15 10:38:29 ----D---- C:\WINDOWS\system32\wbem
2010-09-15 10:38:28 ----D---- C:\WINDOWS\Registration
2010-09-15 10:11:18 ----D---- C:\WINDOWS\system32\Restore
2010-09-15 07:29:50 ----HD---- C:\WINDOWS\$hf_mig$
2010-09-06 12:06:20 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Media Player Classic
2010-08-27 10:35:42 ----SH---- C:\boot.ini
2010-08-27 10:35:42 ----A---- C:\WINDOWS\win.ini
2010-08-27 10:35:42 ----A---- C:\WINDOWS\system.ini
2010-08-19 07:52:35 ----D---- C:\WINDOWS\system32\drivers
2010-08-19 07:24:50 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-08-19 07:24:29 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-08-19 07:24:28 ----D---- C:\WINDOWS\WinSxS
2010-08-19 07:24:28 ----D---- C:\WINDOWS\pchealth
2010-08-19 07:11:35 ----SHD---- C:\System Volume Information
2010-08-19 07:11:35 ----D---- C:\Program Files\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-09-24 4122368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2004-11-02 773565]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-14 20992]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
S3 DfSdkS;Defragmentation-Service; C:\Program Files\Ashampoo\Ashampoo WinOptimizer 7\Dfsdks.exe [2009-08-24 406016]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny den preji

Log vypada v poradku a na havet cisty

Jsou s PC nejake problemy

[worm11]

Chtel jsem jen preventivni kontrolu.PC v poradku.Dekuji

[vyosek]

Z logu je patrno, ze nepouzivate firewall - doporucuji doinstalovat

• k cemu je dobry http://www.viry.cz/forum/viewtopic.php?f=41&t=20980
• prehled osobnich firewallu http://www.viry.cz/forum/viewtopic.php?f=41&t=6523

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis), pri instalaci dejte fajfku pryc u yahoo toolbaru
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

Jinak tedy v poradku

Nemate zac, rad jsem pomohl Zase nekdy