Prosim o kontrolu logu

[Neznalek]

Doneseny notebook, pry nejaky zpomaleny, mozna zavirovany...

HDD uz mozna neni v nejlepsi kondici, pri skenu se objevily nejake spatne sektory, nicmene nechal jsem to projet a zdefragmentovat. Zpomaleni podle vseho zpusobeno PIO modem, asi nejaky zadrhel v ovladacich pri instalaci O2 mobile inetu. Ted uz disk jede v Ultra DMA rezimu a zda se OK.

Jeste tedy log, jestli si tam panacek mezitim nenatahal nejaky hmyz:

Logfile of random's system information tool 1.08 (written by random/random)
Run by JAN at 2010-12-13 13:35:30
Microsoft Windows XP Home Edition Service Pack 1
System drive C: has 10 GB (66%) free of 15 GB
Total RAM: 238 MB (19% free)

HijackThis download failed

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 37808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467} - &Rádio - C:\WINDOWS\System32\msdxm.ocx [2003-04-16 844828]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"=LaunApp []
"IgfxTray"=C:\WINDOWS\System32\igfxtray.exe [2003-04-07 155648]
"HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2003-04-07 114688]
"SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2003-04-24 110592]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2003-04-24 610304]
"LaunchAp"=C:\Progra~1\Launch Manager\LaunchAp.exe [2003-05-12 32768]
"PowerKey"=C:\Progra~1\Launch Manager\PowerKey.exe [2002-08-30 94208]
"LManager"=C:\Progra~1\Launch Manager\HotkeyApp.exe [2003-05-19 45056]
"CtrlVol"=C:\Progra~1\Launch Manager\CtrlVol.exe [2003-05-12 167936]
"Wbutton"=C:\Progra~1\Launch Manager\Wbutton.exe [2003-05-28 53248]
"AcerNotebookManager"=C:\Program Files\Acer\Notebook Manager\almxptray.exe [2003-05-16 509952]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2003-02-14 88107]
"LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe [2002-11-25 172032]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"services"=C:\WINDOWS\services.exe []
"Internet Connection Wizard Setup Tool"=C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe []
"sysgif32"=C:\WINDOWS\Temp\wpv491254042811.exe []
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"EPSON Stylus DX3800 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE [2005-02-08 98304]
"O2CZ"=C:\Program Files\O2\O2CZ\EMMSN.exe [2009-11-30 4050632]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\System32\ctfmon.exe [2003-04-16 13312]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-11-15 1670144]
"FlashGet 3"=C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe -minimize []

C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2003-04-07 315392]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe"="C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 3 months======

2010-12-13 13:35:30 ----D---- C:\rsit
2010-12-13 13:35:30 ----D---- C:\Program Files\trend micro
2010-12-13 13:33:19 ----D---- C:\totalcmd
2010-12-13 13:33:19 ----A---- C:\WINDOWS\UC.PIF
2010-12-13 13:33:19 ----A---- C:\WINDOWS\RAR.PIF
2010-12-13 13:33:19 ----A---- C:\WINDOWS\PKZIP.PIF
2010-12-13 13:33:19 ----A---- C:\WINDOWS\PKUNZIP.PIF
2010-12-13 13:33:19 ----A---- C:\WINDOWS\NOCLOSE.PIF
2010-12-13 13:33:19 ----A---- C:\WINDOWS\LHA.PIF
2010-12-13 13:33:19 ----A---- C:\WINDOWS\ARJ.PIF
2010-12-12 14:29:28 ----SHD---- C:\FOUND.006
2010-11-29 13:54:09 ----A---- C:\WINDOWS\ModemLog_AnyDATA CDMA USB Modem (PID 6501).txt
2010-11-29 13:46:39 ----A---- C:\WINDOWS\red_dialer.ini
2010-11-29 13:42:10 ----D---- C:\Program Files\AnyDATA
2010-10-28 19:04:11 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem #5.txt
2010-10-26 19:31:28 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem #4.txt
2010-10-26 09:04:33 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem #3.txt
2010-10-13 20:17:12 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem #2.txt
2010-10-05 13:39:12 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem.txt
2010-10-05 13:32:15 ----A---- C:\WINDOWS\System32\drivers\ewusbnet.sys
2010-10-05 13:32:15 ----A---- C:\WINDOWS\System32\drivers\ewusbmdm.sys
2010-10-05 13:32:15 ----A---- C:\WINDOWS\System32\drivers\ewusbdev.sys
2010-10-05 13:32:15 ----A---- C:\WINDOWS\System32\drivers\ewdcsc.sys
2010-10-02 19:38:43 ----D---- C:\Documents and Settings\JAN\Data aplikací\Telefónica Móviles
2010-10-02 19:33:53 ----D---- C:\Program Files\O2

======List of files/folders modified in the last 3 months======

2010-12-13 13:35:14 ----A---- C:\WINDOWS\WINCMD.INI
2010-12-13 13:32:24 ----A---- C:\WINDOWS\ModemLog_Agere Systems AC'97 Modem.txt
2010-12-12 22:40:32 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-11-25 15:28:24 ----A---- C:\WINDOWS\winamp.ini
2010-11-13 13:56:52 ----A---- C:\WINDOWS\NeroDigital.ini
2010-10-05 13:34:14 ----A---- C:\WINDOWS\System32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2005-03-12 20640]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\System32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\System32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\System32\drivers\aswTdi.sys [2009-11-25 48560]
R1 fwdrv;Kerio Personal Firewall Driver; C:\WINDOWS\system32\Drivers\fwdrv.sys [2002-04-15 102912]
R1 Hotkey;Hotkey; C:\WINDOWS\System32\drivers\Hotkey.sys [2003-04-28 9867]
R1 tidnet;TID NDIS Protocol Driver; C:\WINDOWS\System32\DRIVERS\tidnet.sys [2009-09-15 19200]
R2 acernbm;acernbm; C:\WINDOWS\system32\drivers\acernbm.sys [2003-03-05 6570]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\System32\drivers\aswMon2.sys [2009-11-25 94160]
R2 irda;Protokol IrDA; C:\WINDOWS\System32\DRIVERS\irda.sys [2001-08-17 55296]
R3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-04-15 113504]
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-04-15 78752]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\System32\DRIVERS\AGRSM.sys [2003-02-14 1169792]
R3 cs429x;Cirrus Logic WDM Audio Codec Driver; C:\WINDOWS\system32\drivers\cwawdm.sys [2003-04-25 111104]
R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2003-04-15 90907]
R3 NTIDrvr;Upper Class Filter Driver; C:\WINDOWS\System32\DRIVERS\NTIDrvr.sys [2003-06-25 6912]
R3 POWERKEY;POWERKEY; \??\C:\Progra~1\Launch Manager\POWERKEY.sys []
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 rtl8139;Realtek RTL8139/810x Family Fast Ethernet NIC NT Driver; C:\WINDOWS\System32\DRIVERS\R8139n51.SYS [2002-10-04 46976]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\System32\DRIVERS\SynTP.sys [2003-04-24 270448]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2002-08-29 21760]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2002-08-29 19328]
S1 mailKmd;mailKmd; C:\WINDOWS\System32\drivers\mailKmd.sys []
S1 Wbutton;Wbutton; C:\WINDOWS\system32\drivers\Wbutton.sys []
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication; C:\WINDOWS\System32\DRIVERS\adusbser.sys [2006-10-23 93440]
S3 aswRdr;aswRdr; C:\WINDOWS\System32\drivers\aswRdr.sys [2009-11-25 23120]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader; C:\WINDOWS\System32\DRIVERS\ewdcsc.sys [2009-12-15 24448]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\System32\DRIVERS\ewusbmdm.sys [2009-12-15 102528]
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\WINDOWS\System32\DRIVERS\ewusbdev.sys [2009-12-15 100736]
S3 NSCIRDA;NSC Infrared Device Driver; C:\WINDOWS\System32\DRIVERS\nscirda.sys [2001-08-17 23552]
S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20040813.178\symidsco.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2002-08-29 28160]
S3 usbprint;Třída USB Printer; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2002-08-29 24960]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\System32\svchost.exe [2003-04-16 12800]
R2 PersFw;Kerio Personal Firewall; C:\Program Files\Kerio\Personal Firewall\persfw.exe [2002-04-15 393216]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2003-04-16 250880]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]

-----------------EOF-----------------

[Rudy]

Šmejdy tam vidím. Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[Neznalek]

Ajaj, tak ComboFix nejak zlobi. Po spusteni zacne skenovat soubory (alespon to hlasi) a harddisk lehce poblikava. Jenze ani po dlouhych minutach se nic nedeje, po stisku klavesy Windows zamrznou, totez pri manipulaci s kurzorem, respektive system ani ComboFix nejdou ukoncit a nezbyva nic jineho, nez reset. :/

[Neznalek]

Tak bohuzel, zadna zmena. I kdyz vypnu co se da (vlastne jenom Kerio firewall) ComboFix stejne pracuje jen chvili, pak zvolni (harddisk jen lehce poblikava) a tim to konci.

Tusi nekdo, proc to a co s tim?

[Rudy]

Zkuste to v nouz. režimu.

[Neznalek]

Bohuzel, ani nouzovy rezim nezabira. A prubeh je stejny, zacne skenovani, kurzor blika, vsechno chvili pracuje... a pak smytec. Doblikano, system kousnuty a musim resetovat.

[Rudy]

OK: Zkuste nejdřív sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

[Neznalek]

Tak tady uz neco mame:

Malwarebytes' Anti-Malware 1.50
http://www.malwarebytes.org

Verze databáze: 5214

Windows 5.1.2600 Service Pack 1
Internet Explorer 6.0.2800.1106

14.12.2010 22:57:20
mbam-log-2010-12-14 (22-57-03).txt

Typ kontroly: Úplný test (C:\|)
Testované objekty: 162220
Uplynulý čas: 10 minut, 0 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 1
Infikované hodnoty v registru: 6
Infikované datové položky v registru: 1
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DbgMgr (Malware.Trace) -> No action taken.

Infikované hodnoty v registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\id (Malware.Trace) -> Value: id -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\host (Malware.Trace) -> Value: host -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services (Worm.Spambot) -> Value: services -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet Connection Wizard Setup Tool (Trojan.Downloader) -> Value: Internet Connection Wizard Setup Tool -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysgif32 (Trojan.Agent) -> Value: sysgif32 -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Services\del (Malware.Trace) -> Value: del -> No action taken.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\documents and settings\JAN\data aplikací\wiaserva.log (Malware.Trace) -> No action taken.

[Rudy]

Vše, co MBAM nalezl, smažte. Pokuste se o log z CF.

[Neznalek]

OK, jenom se bojim, aby pak panackovi fungoval internet. Ma nejake mobilni pripojeni a sam nebyl schopen to zprovoznit. Nekoho si na to pozval a takhle to dopadlo. Disk zpomaleny, pocitac zableseny...

[Rudy]

Njn, s tím my moc neporadíme, to musí udělat podle podmínek vlastní sítě. Fakt je, že PC je zaneřáděn a nejprve musí být čistý. Pak lze řešit to ostatní.

[Neznalek]

Nuze MBAM infekce smazany, ted uz nic noveho nehlasi. ComboFix ale porad tuhne, prakticky hned po zacatku skenovani.

[Rudy]

Pokud CF tuhne i v nouzovém režimu, udělejte sken AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 a dejte log.

[Neznalek]

Takze AVP Tool nenasel nic, dle nej je cisto. A ComboFix stale beze zmen, tuhne v jakemkoliv modu.

[Rudy]

OK. Nastala nějaká změna v chování (chodu) PC?