Trojan.Vundo.H

[wosush]

Zdravim, po tom co som dnes zapol notebook na mna po startupe vybaflo okno o Potvrdeni spustenia suboru "divserv.exe". Google o nom nevie skoro nic, podla Virustotal.com je cisty (http://www.virustotal.com/file-scan/rep ... 1286120738), ale aj tak som ho pre istotu zakazal a spustil som rychlu kontrolu MBAM - ten nasiel 9 infikovanych objektov, ale kupodivu ani jeden z nich nebol uz spomenty "divserv.exe". Jeden z inkriminovanych objektov bola kniznica "pprotlie.dll", ta ma vsak podla http://www.runscanner.net/lib/pprotlie.dll.html patrit produktu CryptoPlus ProID, ktory pouzivam a podla Virustotal.com je cista (http://www.virustotal.com/file-scan/rep ... 1286121703). Neviem comu mam teraz verit. Dakujem za pomoc.

RSIT:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Peter.Osusky at 2010-10-03 18:06:02
Microsoft Windows 7 Enterprise
System drive C: has 165 GB (69%) free of 238 GB
Total RAM: 2996 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:06:08, on 3. 10. 2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\TpShocks.exe
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Integrated Camera Driver\RCIMGDIR.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Mobile Partner\Mobile Partner.exe
C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Windows\system32\taskhost.exe
C:\Users\Peter.Osusky.DM61798\Downloads\bot_setup.exe
C:\Windows\explorer.exe
C:\Users\Peter.Osusky.DM61798\Downloads\RSIT.exe
C:\Program Files\trend micro\Peter.Osusky.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 81.88.40.52:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Pomocník pri prihlasovaní v sieti Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Pass Pro Tools IE plugin (Browser Helper) - {A32F43DA-6EE0-4421-85FC-CAC345BD2997} - C:\Windows\system32\pprotlie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe" /startup
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [RotateImage] C:\Program Files\Integrated Camera Driver\RCIMGDIR.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IMSS] "C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [pptManager] C:\Program Files\CryptoPlus\CryptoPlus ProID v2.0\pptlsMan.exe /startup
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
O4 - HKCU\..\Run: [SoundDriver] C:\Users\Peter.Osusky.DM61798\AppData\Roaming\Microsoft\Windows\Templates\divserv.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nrsr.sk
O17 - HKLM\Software\..\Telephony: DomainName = nrsr.sk
O17 - HKLM\System\CCS\Services\Tcpip\..\{D3AE2187-4A77-488D-9078-BBE2E5AE9F67}: NameServer = 213.151.200.31 213.151.208.162
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = nrsr.sk
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = nrsr.sk
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo. - C:\Windows\system32\ibmpmsvc.exe
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Lenovo Auto Scroll (Lenovo.VIRTSCRLSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Power Manager DBC Service - Lenovo - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: CryptoPlus XME Engine Service (xmengine service) - Monet+, a.s. - C:\Windows\system32\xmesrv.exe

--
End of file - 9242 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1166092901-2131906445-1399616324-14538Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3625031304-3728238237-3407955535-1002Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3625031304-3728238237-3407955535-1002UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pri prihlasovaní v sieti Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A32F43DA-6EE0-4421-85FC-CAC345BD2997}]
Pass Pro Tools IE plugin (Browser Helper) - C:\Windows\system32\pprotlie.dll [2009-06-12 110657]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-28 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2009-11-16 307768]
"PSQLLauncher"=C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe [2010-04-02 55048]
""= []
"TpShocks"=C:\Windows\system32\TpShocks.exe [2009-12-11 337256]
"TPHOTKEY"=C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe [2010-07-27 69560]
"PWMTRV"=rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor []
"RotateImage"=C:\Program Files\Integrated Camera Driver\RCIMGDIR.exe [2008-10-30 31744]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-04-23 1725736]
"IMSS"=C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [2009-10-01 111640]
"pptManager"=C:\Program Files\CryptoPlus\CryptoPlus ProID v2.0\pptlsMan.exe [2007-09-12 180224]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-03-24 2145000]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-07-06 136216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-07-06 171032]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-07-06 170520]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2010-04-20 62312]
"TPKMAPHELPER"=C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe [2007-02-26 992816]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-04-29 437584]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TPKMAPMN"=C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe [2007-02-26 63024]
"SoundDriver"=C:\Users\Peter.Osusky.DM61798\AppData\Roaming\Microsoft\Windows\Templates\divserv.exe [2010-10-03 315016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Peter.Osusky.DM61798\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-10 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2010-06-22 228352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus]
C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll [2010-04-02 100104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableCAD"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=181

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-10-03 18:06:02 ----D---- C:\rsit
2010-10-03 18:06:02 ----D---- C:\Program Files\trend micro
2010-10-03 17:53:38 ----D---- C:\Users\Peter.Osusky.DM61798\AppData\Roaming\Malwarebytes
2010-10-03 17:53:31 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-10-03 17:53:30 ----D---- C:\ProgramData\Malwarebytes
2010-10-03 17:53:30 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-10-03 17:53:30 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-10-03 17:42:47 ----D---- C:\Users\Peter.Osusky.DM61798\AppData\Roaming\Subversion
2010-10-03 17:33:35 ----D---- C:\Program Files\TortoiseSVN
2010-10-03 17:33:35 ----D---- C:\Program Files\Common Files\TortoiseOverlays
2010-09-30 21:26:18 ----D---- C:\DRIVERS
2010-09-29 17:20:28 ----D---- C:\.jagex_cache_32
2010-09-29 16:52:11 ----A---- C:\Windows\system32\drivers\usbvideo.sys
2010-09-29 16:52:11 ----A---- C:\Windows\system32\drivers\ks.sys
2010-09-28 22:43:18 ----A---- C:\Windows\system32\tzres.dll
2010-09-24 16:17:13 ----D---- C:\Program Files\LogMeIn Hamachi
2010-09-24 16:08:39 ----D---- C:\Users\Peter.Osusky.DM61798\AppData\Roaming\Hamachi
2010-09-20 18:44:56 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-09-18 02:05:28 ----D---- C:\Program Files\Microsoft
2010-09-18 02:05:13 ----D---- C:\Program Files\Windows Live SkyDrive
2010-09-18 02:04:51 ----D---- C:\Program Files\Windows Live
2010-09-18 02:04:27 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-09-18 02:04:02 ----D---- C:\Program Files\Microsoft SQL Server Compact Edition
2010-09-18 02:01:35 ----D---- C:\Program Files\Common Files\Windows Live
2010-09-16 19:48:20 ----D---- C:\ProgramData\FLEXnet
2010-09-16 19:45:49 ----D---- C:\Program Files\Common Files\Macrovision Shared
2010-09-16 19:43:55 ----D---- C:\Program Files\Common Files\PX Storage Engine
2010-09-15 20:37:53 ----A---- C:\Windows\system32\drivers\IntcDAud.sys
2010-09-15 20:37:53 ----A---- C:\Windows\system32\drivers\Impcd.sys
2010-09-15 20:37:52 ----A---- C:\Windows\system32\IntcDAuC.dll
2010-09-15 20:37:51 ----A---- C:\Windows\system32\TVWSetup.exe
2010-09-15 20:37:51 ----A---- C:\Windows\system32\igfxCoIn_v2154.dll
2010-09-15 20:37:50 ----A---- C:\Windows\system32\igfxtray.exe
2010-09-15 20:37:50 ----A---- C:\Windows\system32\igfxTMM.dll
2010-09-15 20:37:50 ----A---- C:\Windows\system32\igfxsrvc.exe
2010-09-15 20:37:50 ----A---- C:\Windows\system32\igfxpers.exe
2010-09-15 20:37:50 ----A---- C:\Windows\system32\igfxext.exe
2010-09-15 20:37:50 ----A---- C:\Windows\system32\igfxdo.dll
2010-09-15 20:37:50 ----A---- C:\Windows\system32\IGFXDEVLib.dll
2010-09-15 20:37:49 ----A---- C:\Windows\system32\igdumdx32.dll
2010-09-15 20:37:49 ----A---- C:\Windows\system32\igdumd32.dll
2010-09-15 20:37:49 ----A---- C:\Windows\system32\drivers\igdkmd32.sys
2010-09-15 20:37:48 ----A---- C:\Windows\system32\ig4icd32.dll
2010-09-15 20:37:48 ----A---- C:\Windows\system32\hkcmd.exe
2010-09-15 20:37:47 ----A---- C:\Windows\system32\GfxUI.exe
2010-09-15 20:37:47 ----A---- C:\Windows\system32\gfxSrvc.dll
2010-09-15 20:25:32 ----A---- C:\Windows\system32\iertutil.dll
2010-09-15 15:48:29 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-14 15:10:42 ----A---- C:\Users\Peter.Osusky.DM61798\AppData\Roaming\myMPQ.ini
2010-09-12 18:18:21 ----D---- C:\ProgramData\Blizzard Entertainment
2010-09-12 18:18:21 ----D---- C:\Program Files\StarCraft II
2010-09-12 17:12:38 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2010-09-12 17:04:12 ----D---- C:\Program Files\DAEMON Tools Lite
2010-09-10 13:12:35 ----A---- C:\Windows\system32\drivers\sptd.sys
2010-09-10 13:11:53 ----D---- C:\Users\Peter.Osusky.DM61798\AppData\Roaming\DAEMON Tools Lite
2010-09-10 13:11:51 ----D---- C:\ProgramData\DAEMON Tools Lite
2010-09-04 01:33:25 ----D---- C:\Users\Peter.Osusky.DM61798\AppData\Roaming\vlc
2010-09-04 01:33:13 ----D---- C:\Program Files\VideoLAN
2010-09-04 01:09:29 ----D---- C:\Users\Peter.Osusky.DM61798\AppData\Roaming\PandoraRecovery
2010-09-04 01:09:27 ----D---- C:\Program Files\Pandora Recovery
2010-09-04 00:11:35 ----D---- C:\Program Files\7-Zip

======List of files/folders modified in the last 1 months======

2010-10-03 18:06:02 ----RD---- C:\Program Files
2010-10-03 18:06:02 ----D---- C:\Windows\Temp
2010-10-03 18:04:55 ----D---- C:\Windows
2010-10-03 17:53:31 ----D---- C:\Windows\system32\drivers
2010-10-03 17:53:30 ----HD---- C:\ProgramData
2010-10-03 17:53:24 ----D---- C:\Windows\Prefetch
2010-10-03 17:48:21 ----D---- C:\Windows\system32\config
2010-10-03 17:38:14 ----A---- C:\Windows\system32\log.txt
2010-10-03 17:37:11 ----D---- C:\Users\Peter.Osusky.DM61798\AppData\Roaming\uTorrent
2010-10-03 17:33:54 ----SHD---- C:\Windows\Installer
2010-10-03 17:33:52 ----D---- C:\Windows\winsxs
2010-10-03 17:33:35 ----D---- C:\Program Files\Common Files
2010-10-03 17:33:25 ----SHD---- C:\System Volume Information
2010-10-01 14:45:52 ----D---- C:\Windows\rescache
2010-10-01 13:13:54 ----D---- C:\Windows\system32\catroot2
2010-09-30 22:29:10 ----SD---- C:\Users\Peter.Osusky.DM61798\AppData\Roaming\Microsoft
2010-09-30 21:27:08 ----HD---- C:\Program Files\InstallShield Installation Information
2010-09-30 07:20:01 ----D---- C:\Program Files\Microsoft Silverlight
2010-09-30 00:25:34 ----D---- C:\Windows\system32\sk-SK
2010-09-30 00:25:34 ----D---- C:\Windows\system32\en-US
2010-09-30 00:25:34 ----D---- C:\Windows\system32\DriverStore
2010-09-30 00:25:34 ----D---- C:\Windows\System32
2010-09-29 16:52:14 ----D---- C:\Windows\system32\catroot
2010-09-29 16:52:07 ----D---- C:\Program Files\Internet Explorer
2010-09-28 19:47:46 ----D---- C:\Windows\system32\LogFiles
2010-09-24 18:03:54 ----D---- C:\Program Files\Cheat Engine
2010-09-20 18:45:55 ----RSD---- C:\Windows\Fonts
2010-09-18 02:05:18 ----D---- C:\Program Files\Common Files\microsoft shared
2010-09-18 02:04:03 ----RSD---- C:\Windows\assembly
2010-09-18 02:01:30 ----SD---- C:\ProgramData\Microsoft
2010-09-17 21:41:58 ----D---- C:\Windows\inf
2010-09-17 21:41:58 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-16 23:53:04 ----D---- C:\Program Files\Lenovo
2010-09-16 23:45:23 ----D---- C:\Windows\debug
2010-09-16 22:13:44 ----D---- C:\Users\Peter.Osusky.DM61798\AppData\Roaming\Adobe
2010-09-16 19:45:43 ----D---- C:\ProgramData\Adobe
2010-09-16 19:45:43 ----D---- C:\Program Files\Common Files\Adobe
2010-09-16 19:42:19 ----D---- C:\Program Files\Adobe
2010-09-15 20:37:57 ----D---- C:\Intel
2010-09-15 20:27:22 ----D---- C:\ProgramData\Microsoft Help
2010-09-15 20:25:41 ----A---- C:\Windows\system32\MRT.exe
2010-09-10 17:07:33 ----D---- C:\Program Files\Mozilla Firefox
2010-09-05 05:37:58 ----D---- C:\Windows\LiveKernelReports

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 DozeHDD;DozeHDD; C:\Windows\System32\DRIVERS\DozeHDD.sys [2010-05-12 24304]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2010-01-15 433176]
R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2008-06-16 44944]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 Shockprf;Shockprf; C:\Windows\System32\DRIVERS\Apsx86.sys [2009-10-09 120360]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-09-12 436792]
R0 TPDIGIMN;TPDIGIMN; C:\Windows\System32\DRIVERS\ApsHM86.sys [2009-10-09 20520]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-03-24 114984]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiif32.sys [2008-05-12 13480]
R1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr32v.sys [2010-05-12 11552]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-03-24 133512]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-03-24 96896]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 12672]
R2 rimspci;rimspci; C:\Windows\system32\DRIVERS\rimspe86.sys [2009-10-26 48640]
R2 smihlp;SMI Helper Driver (smihlp); \??\C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [2009-03-13 12560]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\XAudio32.sys [2009-04-29 8704]
R3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2009-12-14 127232]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT32.sys [2010-01-20 485944]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; C:\Windows\system32\DRIVERS\e1k6232.sys [2009-12-10 214696]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2010-02-03 26176]
R3 HECI;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECI.sys [2009-09-17 41088]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2009-06-30 981504]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2009-06-30 207360]
R3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-09-10 102912]
R3 hwusbdev;Huawei DataCard USB PNP Device; C:\Windows\system32\DRIVERS\ewusbdev.sys [2009-07-24 101248]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2009-11-18 26608]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2010-06-22 8760832]
R3 Impcd;Impcd; C:\Windows\system32\DRIVERS\Impcd.sys [2010-02-27 132480]
R3 IntcDAud;Intel(R) Zvuk pre obrazovky; C:\Windows\system32\DRIVERS\IntcDAud.sys [2010-02-03 232960]
R3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit; C:\Windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\Windows\system32\DRIVERS\psadd.sys [2007-02-19 21376]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-10-10 84992]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2010-04-23 244784]
R3 TPM;TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-14 30720]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2009-06-30 661504]
R3 WinUsb;WinUSB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2009-07-14 34944]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2009-12-02 86056]
S3 btwavdt;Bluetooth AVDT; C:\Windows\system32\drivers\btwavdt.sys [2009-12-02 108072]
S3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2009-12-02 29472]
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2009-12-02 18472]
S3 GemCCID;GemCCID; C:\Windows\System32\Drivers\GemCCID.sys [2009-08-10 89600]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 rixdpcie;rixdpcie; C:\Windows\system32\DRIVERS\rixdpe86.sys [2009-09-28 38912]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-14 207360]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-14 980992]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-14 661504]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8; C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-10-09 169312]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2009-10-02 595232]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-24 810120]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
R2 HsfXAudioService;HsfXAudioService; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 IBMPMSVC;ThinkPad PM Service; C:\Windows\system32\ibmpmsvc.exe [2009-11-18 38248]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2010-04-20 50536]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2010-04-07 45496]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2010-04-20 74088]
R2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [2010-04-07 93032]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2009-12-09 268824]
R2 SUService;System Update; C:\Program Files\Lenovo\System Update\SUService.exe [2009-10-19 28672]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2010-04-07 63928]
R2 UNS;Intel(R) Management & Security Application User Notification Service; C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-02-26 2320920]
R2 xmengine service;CryptoPlus XME Engine Service; C:\Windows\system32\xmesrv.exe [2007-01-18 28672]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 DozeSvc;Lenovo Doze Mode Service; C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE [2010-05-12 132456]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-03-24 33560]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-09-16 867080]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Power Manager DBC Service;Power Manager DBC Service; C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2010-05-12 75112]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 TPHDEXLGSVC;ThinkPad HDD APS Logging Service; C:\Windows\System32\TPHDEXLG.exe [2009-10-09 39976]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-17 1343400]

-----------------EOF-----------------


MBAM:

Malwarebytes' Anti-Malware 1.46
http://www.malwarebytes.org

Verzia databázy: 4736

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

3. 10. 2010 18:16:40
mbam-log-2010-10-03 (18-16-40).txt

Typ kontroly: Rýchla kontrola
Objektov kontrolovaných: 182673
Uplynulý čas: 3 min, 32 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 1
Infikované registračné kľúče: 6
Infikované registračné hodnoty: 1
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 1

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
C:\Windows\System32\pprotlie.dll (Trojan.Vundo.H) -> No action taken.

Infikované registračné kľúče:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a32f43da-6ee0-4421-85fc-cac345bd2997} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a32f43da-6ee0-4421-85fc-cac345bd2997} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{7bba09ab-3573-44e3-a7ae-27f3899ed337} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e8357959-b9b8-4095-8148-5619f163ab5c} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{a32f43da-6ee0-4421-85fc-cac345bd2997} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a32f43da-6ee0-4421-85fc-cac345bd2997} (Trojan.Vundo.H) -> No action taken.

Infikované registračné hodnoty:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\System32\pprotlie.dll (Trojan.Vundo.H) -> No action taken.

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
C:\Windows\System32\pprotlie.dll (Trojan.Vundo.H) -> No action taken.

P.S. Pokial je to mozne, rad by som sa vyhol pouzitiu ComboFixu, alebo podobnym "agresivnym" programom, pretoze tento notebook momentalne naozaj potrebujem mat funkcny.

[Rudy]

Vše, co MBAM nalezl, smažte.

[wosush]

Vratane "pprotlie.dll"?
http://www.virustotal.com/file-scan/rep ... 1286121703
http://www.runscanner.net/lib/pprotlie.dll.html

[Rudy]

Ten ne. Omlouvám se.

[wosush]

Dakujem za pomoc.

[Rudy]

Nemáte zač!