PRED SPUSTENIM WINDOWSU MI VYHADZUJE ,,TUREGOPT,, Trojan?

[Pravnik1]

Ahojte,

pred tym ako sa mi prihlasi windowsacka obrazovka vyhodi mi na modrej ploche napis TUREGOPT. Neviete co to moze byt???

Pre zmenu pripajam LOG na kontrolu.

Dakujem za odpoved

Logfile of random's system information tool 1.07 (written by random/random)
Run by Andread at 2010-05-15 23:35:06
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 2 GB (27%) free of 7 GB
Total RAM: 239 MB (17% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:35:26, on 15.5.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\LTSMMSG.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\khooker.exe
C:\WINDOWS\system32\sistray.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andread\My Documents\Downloads\RSIT.exe
C:\Program Files\trend micro\Andread.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\system32\khooker.exe
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\system32\sistray.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 3846491457
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3846614834
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 3433 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-790525478-1060284298-854245398-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-790525478-1060284298-854245398-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"LTSMMSG"=C:\WINDOWS\LTSMMSG.exe [2002-06-01 141880]
"SoundMan"=C:\WINDOWS\soundman.exe [2002-04-18 46592]
"SiSUSBRG"=C:\WINDOWS\sisUSBrg.exe [2002-04-25 32768]
"SiS KHooker"=C:\WINDOWS\system32\khooker.exe [2002-01-25 290816]
"SiS Tray"=C:\WINDOWS\system32\sistray.EXE [2002-05-09 303104]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-15 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoActiveDesktop"=0x00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-05-15 23:35:06 ----D---- C:\rsit
2010-05-15 21:20:43 ----D---- C:\Program Files\XP Codec Pack
2010-05-15 21:20:32 ----D---- C:\WINDOWS\system32\windows media
2010-05-15 21:20:01 ----HD---- C:\WINDOWS\msdownld.tmp
2010-05-15 21:13:50 ----D---- C:\DECCHECK
2010-05-15 20:53:47 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-05-15 20:53:26 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2010-05-15 20:52:32 ----D---- C:\Program Files\Windows Media Connect 2
2010-05-15 20:51:54 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2010-05-15 20:48:44 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2010-05-15 18:42:59 ----D---- C:\Documents and Settings\Andread\Application Data\TuneUp Software
2010-05-15 18:42:19 ----D---- C:\Program Files\TuneUp Utilities 2010
2010-05-15 18:41:26 ----D---- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2010-05-15 18:40:50 ----SHD---- C:\Documents and Settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-05-15 18:34:23 ----D---- C:\Documents and Settings\Andread\Application Data\dvdcss
2010-05-14 14:07:13 ----D---- C:\Program Files\VideoLAN
2010-05-14 14:03:03 ----A---- C:\Program Files\vlc-1.0.5-win32.exe
2010-05-11 17:29:06 ----A---- C:\WINDOWS\system32\wmpns.dll
2010-05-11 17:00:23 ----D---- C:\WINDOWS\Sun
2010-05-10 20:31:07 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2010-05-09 22:04:33 ----A---- C:\WINDOWS\khooker.INI
2010-05-09 22:01:24 ----D---- C:\Documents and Settings\All Users\Application Data\Sun
2010-05-09 21:59:11 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-05-09 21:55:07 ----D---- C:\Documents and Settings\Andread\Application Data\Sun
2010-05-06 19:49:07 ----D---- C:\Program Files\Mozilla Firefox
2010-05-06 09:53:32 ----D---- C:\WINDOWS\RegisteredPackages
2010-05-05 19:46:38 ----D---- C:\WINDOWS\pss
2010-05-05 19:37:19 ----D---- C:\Program Files\CCleaner
2010-05-05 17:01:53 ----D---- C:\Program Files\trend micro
2010-05-05 15:35:24 ----AH---- C:\aaw7boot.cmd
2010-05-05 14:35:58 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2010-05-05 13:13:42 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-04 16:00:41 ----D---- C:\WINDOWS\Minidump
2010-05-04 15:44:06 ----D---- C:\Documents and Settings\Andread\Application Data\WinRAR
2010-05-04 15:43:15 ----D---- C:\Program Files\WinRAR
2010-05-04 12:39:21 ----D---- C:\Documents and Settings\Andread\Application Data\Uniblue
2010-05-04 12:38:43 ----D---- C:\WINDOWS\SxsCaPendDel
2010-05-04 12:33:00 ----D---- C:\Documents and Settings\Andread\Application Data\BSplayer Pro
2010-05-04 12:32:35 ----D---- C:\Program Files\Webteh
2010-05-03 13:29:42 ----D---- C:\Program Files\QuickTime
2010-04-30 22:10:22 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2010-04-30 22:10:13 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2010-04-30 22:09:25 ----D---- C:\WINDOWS\Logs
2010-04-30 15:42:48 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-04-30 15:38:38 ----D---- C:\Documents and Settings\Andread\Application Data\Mozilla
2010-04-30 15:38:37 ----D---- C:\Documents and Settings\Andread\Application Data\Thunderbird

======List of files/folders modified in the last 1 months======

2010-05-15 23:19:54 ----D---- C:\WINDOWS\system32
2010-05-15 23:19:49 ----D---- C:\WINDOWS\Temp
2010-05-15 23:19:37 ----D---- C:\WINDOWS
2010-05-15 23:17:06 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-05-15 22:06:54 ----HD---- C:\WINDOWS\inf
2010-05-15 22:01:58 ----D---- C:\Program Files\Common Files\InstallShield
2010-05-15 21:24:40 ----SHD---- C:\WINDOWS\Installer
2010-05-15 21:24:27 ----RD---- C:\Program Files
2010-05-15 21:20:29 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-05-15 20:54:17 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-05-15 20:52:54 ----D---- C:\WINDOWS\Prefetch
2010-05-15 20:52:52 ----A---- C:\WINDOWS\win.ini
2010-05-15 20:52:31 ----D---- C:\Program Files\Windows Media Player
2010-05-15 20:52:16 ----D---- C:\WINDOWS\Help
2010-05-15 20:49:35 ----D---- C:\WINDOWS\system32\drivers
2010-05-15 20:46:40 ----D---- C:\WINDOWS\system32\CatRoot2
2010-05-15 20:30:25 ----SD---- C:\WINDOWS\Tasks
2010-05-15 20:29:11 ----D---- C:\WINDOWS\network diagnostic
2010-05-15 20:10:57 ----SH---- C:\boot.ini
2010-05-15 20:10:57 ----A---- C:\WINDOWS\system.ini
2010-05-15 20:00:19 ----D---- C:\Program Files\Messenger
2010-05-15 18:58:05 ----D---- C:\WINDOWS\Media
2010-05-15 18:58:00 ----D---- C:\Program Files\soundbase
2010-05-15 18:58:00 ----D---- C:\Program Files\NetMeeting
2010-05-15 18:43:40 ----D---- C:\WINDOWS\system32\config
2010-05-15 18:16:53 ----SD---- C:\Documents and Settings\Andread\Application Data\Microsoft
2010-05-14 17:50:35 ----D---- C:\Program Files\Common Files
2010-05-14 14:30:06 ----D---- C:\WINDOWS\Microsoft.NET
2010-05-14 14:29:55 ----RSD---- C:\WINDOWS\assembly
2010-05-13 14:49:43 ----D---- C:\WINDOWS\Debug
2010-05-12 20:21:25 ----D---- C:\WINDOWS\WinSxS
2010-05-12 20:13:12 ----D---- C:\Program Files\Outlook Express
2010-05-12 12:26:18 ----HD---- C:\WINDOWS\$hf_mig$
2010-05-12 12:12:36 ----D---- C:\WINDOWS\AppPatch
2010-05-12 12:12:35 ----D---- C:\Program Files\Microsoft Silverlight
2010-05-11 17:39:13 ----D---- C:\Program Files\Movie Maker
2010-05-11 17:37:04 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-05-11 17:26:29 ----D---- C:\WINDOWS\system32\CatRoot
2010-05-10 20:15:15 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-05-06 18:55:22 ----D---- C:\WINDOWS\security
2010-05-05 18:42:32 ----D---- C:\WINDOWS\system32\Restore
2010-05-05 18:25:59 ----SHD---- C:\System Volume Information
2010-05-05 18:11:17 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-05-05 14:25:18 ----D---- C:\WINDOWS\system32\inetsrv
2010-05-03 13:31:19 ----D---- C:\Program Files\Internet Explorer
2010-05-01 19:28:40 ----A---- C:\WINDOWS\WINCMD.INI
2010-05-01 19:27:43 ----D---- C:\WINDOWS\ie7updates
2010-05-01 19:26:12 ----D---- C:\WINDOWS\WBEM
2010-05-01 19:26:12 ----D---- C:\WINDOWS\system32\en-us
2010-04-30 22:10:44 ----D---- C:\WINDOWS\system32\DirectX
2010-04-30 20:51:06 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-30 12:38:44 ----D---- C:\Documents and Settings\Andread\Application Data\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 SiSkp;SiSkp; C:\WINDOWS\system32\drivers\srvkp.sys [2002-04-02 5760]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [1999-09-10 25244]
R2 STEC3;STEC3; \??\C:\WINDOWS\system32\STEC3.sys []
R3 ALCXWDM;Service for Avance AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2002-04-18 305100]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 LucentSoftModem;Lucent Technologies Soft Modem; C:\WINDOWS\system32\DRIVERS\LTSM.sys [2002-08-02 816043]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2009-03-25 130432]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2002-05-15 194176]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2003-06-20 322120]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ServiceLayer;ServiceLayer; C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[riffman]

zdravim

uz jste obdrzel druhy stupen varovani za neustaly spam a zcela ocividne je vam to jedno.

zde http://www.viry.cz/forum/viewtopic.php? ... 67#p857967 se vam venuje kolega, neobtezoval jste se s odpovedi a zalozil dnes dva naprosto zbytecne thready; pokracujte prosim v rozpracovanem threadu, naucte se prosim pouzivat tlacitko "odpovedet" a nepridelavejte nam prosim praci.

zde zamykam