VIRY.CZ

Zdravím poprosil by som Vás o kontrolu logu, podozrenie na možný vírus, ďakujem

Logfile of random's system information tool 1.08 (written by random/random)
Run by Owner at 2010-07-08 10:29:09
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 46 GB (90%) free of 51 GB
Total RAM: 447 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:29:18, on 8. 7. 2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\My Documents\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Owner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

--
End of file - 3282 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-06-28 344064]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-03-29 2145000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2006-02-28 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-06-29 46080]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-07-08 10:29:10 ----D---- C:\Program Files\trend micro
2010-07-08 10:29:09 ----D---- C:\rsit
2010-07-08 10:18:00 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-07-08 10:17:53 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$
2010-07-08 10:17:46 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-07-08 10:17:29 ----HDC---- C:\WINDOWS\$NtUninstallKB981793$
2010-07-08 10:17:23 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-07-08 10:17:14 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-07-08 10:17:07 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2010-07-08 10:17:03 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-07-08 10:16:46 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2010-07-08 10:09:14 ----D---- C:\Program Files\ESET
2010-07-08 10:09:14 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2010-07-08 10:05:31 ----D---- C:\WINDOWS\ie8updates
2010-07-08 10:04:47 ----D---- C:\WINDOWS\WBEM
2010-07-08 10:03:13 ----HDC---- C:\WINDOWS\ie8
2010-07-08 10:03:13 ----D---- C:\WINDOWS\system32\en-US
2010-07-08 10:01:58 ----A---- C:\WINDOWS\system32\MRT.exe

======List of files/folders modified in the last 1 months======

2010-07-08 10:29:10 ----RD---- C:\Program Files
2010-07-08 10:29:10 ----D---- C:\WINDOWS\Temp
2010-07-08 10:26:53 ----D---- C:\WINDOWS\system32
2010-07-08 10:26:53 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-07-08 10:25:49 ----D---- C:\WINDOWS
2010-07-08 10:25:30 ----D---- C:\WINDOWS\system32\drivers
2010-07-08 10:25:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-07-08 10:18:03 ----HD---- C:\WINDOWS\inf
2010-07-08 10:18:02 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-07-08 10:17:56 ----A---- C:\WINDOWS\imsins.BAK
2010-07-08 10:17:52 ----HD---- C:\WINDOWS\$hf_mig$
2010-07-08 10:09:54 ----SHD---- C:\WINDOWS\Installer
2010-07-08 10:09:38 ----D---- C:\WINDOWS\system32\CatRoot2
2010-07-08 10:07:26 ----D---- C:\WINDOWS\Help
2010-07-08 10:07:26 ----D---- C:\Program Files\Internet Explorer
2010-07-08 10:04:52 ----D---- C:\WINDOWS\system32\config
2010-07-08 10:04:39 ----D---- C:\WINDOWS\Media
2010-07-08 09:59:30 ----D---- C:\WINDOWS\WinSxS
2010-07-08 09:58:36 ----HD---- C:\Program Files\InstallShield Installation Information
2010-07-08 09:58:35 ----D---- C:\Program Files\Carambis
2010-07-08 09:50:54 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-07-08 09:50:42 ----D---- C:\WINDOWS\system32\wbem
2010-07-08 09:50:42 ----D---- C:\WINDOWS\AppPatch

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-03-29 114984]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-03-29 95872]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-02-28 36096]
R2 Angelnt;Angelnt; C:\WINDOWS\System32\Drivers\ANGELNT.SYS [2010-05-17 51072]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-03-29 140216]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-06-29 1241088]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2006-06-28 81920]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-06-29 376832]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-29 810120]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-03-29 33560]

-----------------EOF-----------------

Zdravim a pekne dopoledne preji

Proc mate podezreni na nejakou havet Projevuje se nejak

Log vypada zcela OK...

nefunguje aktualizácia Nod32, pred pár týždňami som bojoval s podobným problémom, vtedy to blokoval vírus, preto som teraz trochu paranoidný možno je len problém z aktualizačným serverom pretože neberiem aktualizácie priamo z domovského servra, ale istota je istota

Odkud tedy prebirate aktualizace

Kontaktujte technickou podporu ESETu, jako platici zakaznik mate na ni samozrejme narok...

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

• Provedte aktualizaci - treti zalozka
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

nod mame multilicenciu pre školu a aktualizácie sa ťahajú z jedného servra pre všetky školy.
MBAM nenašiel nič, takže to bude asi falošný poplach.
ďakujem za spoluprácu.

Tak falesny poplach to byt nemusite - jakou mate prave verzi databaze Jak dlouho se NOD neaktualizoval Muzete mi prosim dat link na topic, kde jste tento problem resil...

prepáčte, bol som na dovolenke je ešte možné problém riešiť?

Zdravim po navratu z dovolenky

Samozrejme ze je mozne problem resit...

vyosek píše:Tak falesny poplach to byt nemusite - jakou mate prave verzi databaze Jak dlouho se NOD neaktualizoval Muzete mi prosim dat link na topic, kde jste tento problem resil...